Status as of October 2026 · 9 sourced guides
Which AI rules apply to your business?
There is no single AI law in the United States. A business that builds, buys, or uses AI answers to five layers of rules at once. They are cross-border laws like the EU AI Act, federal agencies applying old rules to new tools, a growing set of state AI laws, the rules of its own sector, and voluntary frameworks that regulators point to.
- 9 sourced guides
- 5 layers of rules mapped
- Sources linked in every guide
- No ads, cookies, or forms
Rule finder
What does your AI decide?
Start with the decision, not the technology. Pick the decision the AI touches and go straight to the guides that cover it.
Start here The AI-specific laws are new. The duties they sit on top of are not. Map the five layers first, then the sector.
Key date Colorado’s SB 26-189 covers financial and lending decisions from January 1, 2027.
Key date Illinois HB 3773 took effect January 1, 2026.
Key date Colorado private passenger auto and health benefit plan insurers owed full compliance and their first annual report by July 1, 2026.
Key date In traditional Medicare, CMS’s WISeR model began January 1, 2026 in New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington.
Key date California’s AB 325 on common pricing algorithms took effect January 1, 2026.
Key date Stand-alone high-risk duties moved from August 2, 2026 to December 2, 2027.
The stack
Five layers apply at once
Open a layer to see where it is covered.
01 Cross-border laws EU AI Act
The EU AI Act reaches non-EU companies whose AI or its output is used in the EU. EU AI Act compliance
02 Federal agencies Old rules, new tools
Federal agencies apply existing rules to AI. Each sector guide covers the regulators for that sector; insurance is regulated mainly by the states. The overview
03 State AI laws Colorado, Texas, California
State laws differ most in who they reach. Colorado’s law and California’s privacy rules cover consequential or significant decisions across many sectors. Texas relies mainly on intent-based prohibitions. Other state laws target frontier developers, generative AI disclosures, or employers. No federal statute preempts them, so each remains enforceable unless a court rules otherwise. US state AI laws
04 Sector rules Your industry’s own law
Guides for financial services, health care, hiring and HR, insurance, and pricing. Every guide is listed in the library.
05 Voluntary frameworks NIST AI RMF, ISO/IEC 42001
Frameworks such as the NIST AI RMF and ISO/IEC 42001 are voluntary. They give a program a structure and a schedule for the inventory, testing, and records that the laws ask for, but they do not make a company compliant by themselves. They can also earn legal credit. In Texas, a company that finds a violation through an internal review process while substantially complying with the NIST Generative AI Profile or another recognized framework is not liable for it. AI governance frameworks
Key dates
What applies now, and what is next
Dates that moved in 2026 are shown as amended. Each line links to the guide with the source.
- Feb 2, 2025 In force EU EU AI Act prohibited practices apply
- Aug 2, 2025 In force EU General-purpose AI model duties apply
- Jan 1, 2026 In force US states Texas HB 149 and California SB 53 take effect
- Aug 2, 2026 In force EU Article 50 transparency duties apply
- Oct 14, 2026 Enforcement EU Commission confirms AI Office requests for information to OpenAI and Anthropic (not a finding of breach; no fine announced)
- Dec 2, 2026 Next deadline EU New prohibitions on non-consensual intimate imagery and child sexual abuse material; Article 50(2) marking grace period ends
- Jan 1, 2027 Upcoming US states Colorado SB 26-189 regulates automated decision-making technology in consequential decisions
- Dec 2, 2027 Upcoming EU Stand-alone high-risk system duties apply (moved from Aug 2, 2026)
- Aug 2, 2028 Upcoming EU High-risk duties for AI in regulated products apply (moved from Aug 2, 2027)
Library
Guides by sector
Each guide covers which rules apply, what they require in practice, the key dates, and links to the primary text. Status is stated as of the date at the top of each guide.
AI compliance, layer by layer
How the five layers of AI regulation fit together, and what to do in the first 90 days.
EU AI Act compliance
Who the EU AI Act reaches, what each risk tier requires, and the dates after the 2026 Omnibus.
US state AI laws
Colorado, Texas, California, Utah, Illinois, and NYC AI laws, with dates and a comparison table.
AI in financial services
Model risk guidance after SR 11-7, adverse action notices, fair lending, FINRA, SEC, and NYDFS.
AI in health care
FDA device status, HIPAA vendor rules, Section 1557, health IT transparency, Medicare Advantage, and state laws.
AI in hiring and HR
NYC bias audits, Illinois and California rules, Colorado, Title VII after the EEOC pullback, and the FCRA.
AI in insurance
The NAIC model bulletin, Colorado’s SB21-169 rules, NYDFS Circular Letter No. 7, and unfair discrimination testing.
AI pricing and antitrust
When pricing software becomes an antitrust problem, new state laws, surveillance pricing, and FTC AI cases.
AI governance frameworks
How NIST AI RMF, the Generative AI Profile, and ISO/IEC 42001 map to legal duties, plus a policy and inventory template.
What changed in 2026?
In 2026 the EU delayed most high-risk duties under the AI Act, Colorado repealed its 2024 AI Act before it took effect and passed a narrower replacement, and federal bank regulators replaced the model risk guidance that had stood since 2011. Plans built on the old dates need rework. The overview and each sector guide give the current dates with sources.
What this site is and is not
It is a free, sourced reference. Where the primary text is available, each guide links to the statute, regulation, agency text, or court record behind the rules it describes. Where a guide relies on a law firm or press report, its source list names the firm or publication. It is not legal advice, it does not sell compliance services, and it is not written by a law firm. Confirm anything you act on against the primary text and a qualified lawyer.