Stay in the know
We’ll send you the latest insights and briefings tailored to your needs
Subscribe now
1 4月 2026
Insight
The United States does not have comprehensive federal AI legislation. Instead, a patchwork of state laws addresses AI development and deployment, while existing regulations on privacy, data protection, intellectual property, employment, human rights, consumer protection, financial services and healthcare continue to apply to AI systems.
AI Strategy
The appointment of President Donald Trump in January 2025 marked a significant shift in federal AI policy toward prioritizing innovation and global competitiveness over regulatory oversight. President Trump's Executive Order "Removing Barriers to American Leadership in Artificial Intelligence" replaced Former President Biden's approach, stating "it is the policy of the United States to sustain and enhance America's global AI dominance in order to promote human flourishing, economic competitiveness, and national security."
America’s AI Action Plan
In July 2025, the White House released "Winning the Race: America's AI Action Plan," outlining 30 initiatives across three pillars: (1) Accelerate AI Innovation, (2) Build American AI Infrastructure, and (3) Lead in International AI Diplomacy and Security. Key initiatives include removing regulation, encouraging open-source AI models, building data center infrastructure, and promoting US AI exports.
President Trump signed three executive orders implementing the Action Plan: "Preventing Woke AI in the Federal Government" (directing agencies to procure ideologically neutral AI models), "Accelerating Federal Permitting of Data Center Infrastructure" (streamlining data center construction), and "Promoting the Export of the American AI Technology Stack" (supporting global deployment of US AI products).
Additional AI-related Executive Orders:
|
Federal AI Legislation
President Trump signed the TAKE IT DOWN Act in May 2025, criminalizing non-consensual intimate images (NCII) and mandating removal procedures for social media platforms. Covered platforms, as defined by the Act, must implement robust takedown processes, clear user notifications, appeals procedures and trained staff by May 2026.
In December 2025, President Trump issued the Executive Order (EO) on Ensuring a National Policy Framework for Artificial Intelligence, outlining the United States' policy to sustain and enhance global dominance in AI with a minimally burdensome framework. The EO establishes an AI Litigation Taskforce to challenge state AI laws inconsistent with the policy and if found to be in conflict, grants departments and agencies the right to restrict state funding. The EO also directs the FTC to issue a policy statement on the applicability of the FTC Act's prohibition on unfair and deceptive acts or practices to AI models and the FCC to determine whether to adopt a Federal reporting and disclosure standard for AI models that pre-empts conflicting state laws.
In March 2026, the Administration released its National Policy Framework for Artificial Intelligence, prompting Congress to work with the federal government to create federal legislation that addresses issues including on protecting minors, strengthening American communities, IP rights and creators, enabling innovation, developing an AI-ready workforce and establishing a federal framework to pre-empt state AI laws.
State AI Legislation
In the previous absence of federal law, some states have moved ahead with their own AI legislation. These state laws can be divided into two categories: (1) those focused on broadly regulating AI and (2) those focused on specific AI uses. Some municipalities have also introduced AI legislation.
State AI Legislation – Broad regulation
- Colorado: Colorado's AI Act regulates high-risk AI systems that make "consequential decisions" with "material legal or similarly significant effects" on education, employment, financial services, government services, healthcare, housing, insurance or legal services. Developers and deployers must conduct impact assessments, implement risk management policies, and provide consumer notifications about AI use.
- California: California has passed a number of laws broadly regulating AI developers and deployers.
- The AI Transparency Act (SB 942) requires large providers (over 1 million monthly users) of generative AI producing images, video or audio to provide free AI detection tools and insert disclosures into AI-generated content.
- The Generative-AI Training Data Transparency Act (AB 2013) requires generative AI developers to post high-level summaries of training data, including sources, data types, intellectual property rights, personal information and data modifications. This applies retroactively to systems released from 1 January 2022.
- AB 2885 establishes a standard AI definition as "an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments."
- The Transparency on Frontier Artificial Intelligence Act (TFIA) signed into law September 2025 establishes safety regulations for developers of large foundation models, the first frontier model safety law in the country.
- New York State: The New York Responsible AI Safety and Education (RAISE) Act, which takes effect in March 2026, imposes transparency and incident‑reporting obligations on frontier AI developers. Large developers must disclose their safety protocols and notify the State of any critical harm incidents within 72 hours of occurrence.
- Utah: Utah's Artificial Intelligence Policy Act requires regulated professionals to disclose AI use during "high-risk" interactions involving sensitive personal information or personalized advice on significant personal decisions. Other commercial uses require disclosure only upon consumer request.
- Texas: The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) prohibits AI systems from encouraging self-harm or criminal activity, infringing constitutional rights, engaging in social scoring (for government entities), using biometric identification without consent (for government entities), unlawfully discriminating against protected classes, or producing child pornography or unlawful deepfakes.
State AI Legislation – Specific AI uses
- Tennessee: Tennessee's Ensuring Likeness, Voice and Image Security (ELVIS) Act protects against AI-generated deepfakes of a person's likeness and voice, expanding individual property rights to include voice (actual or simulated) and creating a private right of action against unauthorized publication of deepfakes.
- Arkansas: Arkansas amended its name, image and likeness law to include AI-generated reproductions and simulations, providing legal recourse through injunction or damages for unauthorized commercial use.
- Multiple states, including California, Florida, and Maine, have passed laws related to AI-generated sexually explicit images or deepfakes, which are further discussed in the “Human Rights” section of this page.
Municipal AI Legislation
- New York City's AI Bias Law requires employers to conduct bias audits before using AI tools in hiring or promotion decisions, publish audit results, and provide advance notice to applicants and employees.
San Francisco, CA and Oakland, CA have placed restrictions on using AI tools with surveillance footage, such as policy bodycam videos and facial recognition software.
From consumer protection law to online safety, AI continues to stretch existing legal frameworks. See the latest updates below.
Financial Services
As AI becomes embedded in financial services infrastructure, regulators have clarified that existing financial laws apply to AI systems.
AI in Lending
- AI-driven lending platforms must comply with the Equal Credit Opportunity Act (ECOA), which prohibits credit discrimination based on protected categories. Courts recognize disparate impact claims under ECOA, meaning facially neutral AI models can be unlawful if they produce discriminatory outcomes.
- The Consumer Financial Protection Bureau clarified that creditors cannot rely on AI complexity to avoid adverse action notice requirements.
- Massachusetts Attorney General alleged that Earnest, Inc. used AI models resulting in disparate impact on minority borrowers, settling for $2.5 million with mandated algorithmic governance requirements.
- AI scoring providers must comply with Fair Credit Reporting Act (FCRA) requirements for data accuracy, adverse action notice and permissible purpose.
AI in Investment Management
- AI-powered investment tools are subject to fiduciary obligations under the Investment Advisers Act of 1940. The Supreme Court held in SEC v. Capital Gains Research Bureau that the Act imposes fiduciary duties on investment advisers, including those overseeing AI models.
- The SEC's 2017 Guidance Update on Robo-Advisers requires automated advisers to disclose algorithm roles, explain material limitations and establish compliance programs.
- In Wealthfront Advisers LLC, the SEC found violations for misleading statements about automated tax-loss harvesting and inadequate compliance programs.
- In Betterment LLC, the SEC imposed a $9 million penalty for inadequate disclosures regarding automated rebalancing algorithm changes.
AI in Trading
- Firms deploying AI for trading must adhere to Securities Exchange Act and Commodity Exchange Act market integrity provisions, including SEC Rule 10b-5 (anti-fraud), SEC Market Access Rule (automated trading controls), and CFTC Rule 180.1 (prohibition on manipulative conduct).
- In SEC v. John Thomas Capital Management Group, the SEC charged a fund manager with fraud for misrepresenting that trades were based on proprietary AI systems.
Healthcare
Healthcare AI applications are subject to existing healthcare regulations and increasing litigation, primarily involving health insurance and AI algorithms.
State-Specific Laws and Regulations
- Utah: Utah's AI Policy Act requires regulated healthcare professionals to disclose AI use during high-risk interactions involving health data or medical advice. HB 452 imposes regulations on AI-supported mental health chatbots, banning advertising during interactions and prohibiting personal information sharing.
- Arizona: Arizona HB 2175 mandates that medical directors personally review all denials of claims and prior authorizations based on medical necessity, exercising independent medical judgment.
- Georgia: Georgia HB 203 permits optometrists and ophthalmologists to use AI for eye exams provided AI data is not the sole basis for prescriptions, AI is not used for initial prescriptions or first renewals, and patients have had traditional exams within the past two years.
- Illinois: Wellness and Oversight for Psychological Resources Act (HB 1806) prohibits anyone from using AI to provide mental health and therapeutic decision-making, while allowing the use of AI for administrative and supplementary support services for licensed behavioral health professionals.
Healthcare Litigation over AI Use
- In Minnesota, plaintiffs alleged in February 2025 that UnitedHealthcare used an AI program to deny claims despite knowing 90% of coverage denials were faulty.
- In Kentucky, plaintiffs accused in August 2025 Humana of halting payments based on AI model predictions that were "highly inaccurate."
In California, plaintiffs alleged in January 2025 that Cigna developed an algorithm allowing doctors to automatically deny payments in batches without individual review.
Key contacts
Austin Manes
Special Counsel, Privacy Counsel, Silicon Valley
S. Burr Eckstut
Partner, Head of Technology Transactions, US, New York
Featured insights
Legal Notice
The contents of this publication are for reference purposes only and may not be current as at the date of accessing this publication. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action based on this publication.
© Herbert Smith Freehills Kramer 2026