AI Compliance: The Five Layers and the First 90 Days

What does “AI compliance” actually mean?

AI compliance mostly means applying the laws that already govern a decision, such as credit, hiring, coverage, or care, to the AI that now makes or shapes it, with a newer and thinner layer of AI-specific notice and documentation rules on top.

So the useful first step is to list the decisions your AI touches and the laws that already govern them, before looking for an AI statute. A lender that uses a model to deny credit is still bound by the Equal Credit Opportunity Act. An employer that screens resumes with software is still bound by Title VII. A health plan that uses an algorithm in prior authorization is still bound by its coverage rules.

Two recent state laws say so directly. Utah’s 2025 amendments state that it is not a defense that generative AI made the violative statement or took the violative act. Colorado’s 2026 replacement law says the use of automated decision-making technology does not excuse any obligation under state or federal law.

What are the five layers?

The five layers are cross-border AI laws such as the EU AI Act, federal agency rules applied to AI, state AI laws, sector rules, and voluntary frameworks.

Each layer has its own regulator, its own dates, and its own idea of what a record is. A company can be compliant in one layer and exposed in another.

Which layer usually causes the problem?

For most US businesses, it is the second and fourth layers: existing federal law and sector rules.

The enforcement record shows this. The SEC’s March 2024 “AI washing” cases were ordinary misstatement cases, brought against two advisers that described AI capabilities they did not have. The FTC’s Rite Aid order in December 2023 was an unfairness case about a facial recognition system deployed without reasonable safeguards. Neither depended on an AI statute.

The state AI laws matter more each year. Their main effect so far is procedural: notices, explanations after adverse decisions, appeal or human review, and documentation from vendors.

What changed in 2025 and 2026?

The main changes were delays and withdrawals: the EU pushed back most high-risk duties, Colorado replaced its AI Act before it took effect, and federal regulators withdrew or replaced guidance that applied to AI. A program built on 2024 dates is likely out of date.

• EU: The Digital Omnibus on AI entered into force on July 27, 2026. Stand-alone high-risk systems moved from August 2, 2026 to December 2, 2027. High-risk AI in regulated products moved to August 2, 2028.
• Colorado: The 2024 AI Act was delayed to June 30, 2026, then repealed and replaced by SB 26-189, signed May 14, 2026. The new duties apply from January 1, 2027.
• Federal preemption push: Executive Order 14365 (December 11, 2025) directed an AI Litigation Task Force at the Justice Department to challenge state AI laws. Congress has not passed a preemption statute.
• Banking: The Federal Reserve, OCC and FDIC replaced the 2011 model risk guidance (SR 11-7) with SR 26-2 on April 17, 2026.
• Consumer credit: The CFPB withdrew its AI adverse action circulars in May 2025 and finalized a Regulation B rule in April 2026 that removes disparate impact from its reading of ECOA. That rule is being challenged in court.

The direction at the federal level in 2025 and 2026 was fewer AI-specific rules. The direction in the states and the EU was more, but later.

What should a company do in its first 90 days?

In the first 90 days, find every AI system, then tier the risk and fix vendor contracts, then put notices, human review, and record retention in place. The order matters more than the speed: you cannot tier what you have not inventoried, and you cannot write notices for decisions you have not mapped.

Days 1 to 30: find the AI

• List every AI system in use, including features inside software you already license
• Record who owns each system, who the vendor is, and what data goes in
• Mark each system that makes, ranks, scores, or recommends a decision about a person
• Note every jurisdiction where those people live, not only where your company sits
• Collect the marketing and investor statements you have made about AI

Days 31 to 60: tier the risk and fix contracts

• Assign each system a tier using the table below
• Request vendor documentation on intended use, training data categories, known limits, and testing
• Add contract terms for audit rights, change notice, data use limits, incident reporting, and cooperation with regulators
• Put a business associate agreement in place for any vendor that handles protected health information
• Check each AI claim in your marketing against what the system actually does

Days 61 to 90: notices, human review, records

• Draft pre-use notices where a law requires them (NYC, Illinois, California, Colorado, the EU)
• Write the adverse decision explanation you will send, and test it on a real case
• Define who can override the system, what they see, and how often they do it
• Set retention periods: Colorado requires 3 years of compliance records; California’s employment rules require 4 years of automated-decision data
• Schedule the first bias or performance test and name who reviews the result

How should risk be tiered?

Tier each system by two questions: does it affect a consequential decision about a person, and does a human meaningfully review its output? The laws do not share one definition of high risk, but they share that pattern, and risk rises as the first answer becomes yes and the second becomes no.

One detail changes many tiering decisions. Colorado’s new law excludes tools an individual uses solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing. It also does not treat summarizing or presenting information for human review as a consequential decision if the tool produces no score, ranking, recommendation, classification, or other inference that materially influences the outcome. A summary that an underwriter reads, with no score or recommendation attached, may fall outside the law. A model that scores the applicant does not.

What belongs in a vendor contract?

A vendor contract should get you the documentation, change notice, test access, data limits, and regulator cooperation you need to meet duties that stay with you. Regulators have said plainly that buying a tool does not transfer the duty. New York’s insurance regulator wrote that responsibility for anti-discrimination compliance stays with the insurer at all times. California’s employment rules treat a vendor acting on an employer’s behalf as an agent of the employer.

• Documentation of intended use, limits, and the categories of training data
• Notice before material model changes, with time to retest
• Access to test results, or the data needed to run your own
• Limits on the vendor’s use of your data for training other customers’ models
• Security and incident notice terms that match your sector rules
• Cooperation with regulator inquiries and audits
• No clause that blocks you from explaining a decision to the person it affects

Where do the sector guides pick up?

Each guide below covers the rules, dates, and primary sources for one sector or one layer. Start with the inventory above; every guide assumes you have it.

• EU AI Act compliance: risk tiers, provider and deployer duties, and the amended dates
• US state AI laws: Colorado, Texas, California, Utah, Illinois, NYC, and the federal preemption push
• Financial services: model risk, adverse action notices, fair lending, FINRA, SEC, NYDFS
• Health care: FDA, HIPAA, Section 1557, health IT transparency, Medicare Advantage, state laws
• Employment and HR: bias audits, notices, California and Illinois rules, Title VII, FCRA
• Insurance: the NAIC bulletin, Colorado, New York, and unfair discrimination testing
• Pricing and competition: algorithmic pricing, RealPage, new state laws, FTC Section 5
• Governance frameworks: NIST AI RMF, ISO/IEC 42001, and how they map to legal duties

This guide is general information as of October 2026, not legal advice. Laws and dates in this area changed often in 2025 and 2026; confirm current text with the primary source or with counsel before acting.