North America - AI Regulation Overview

Overview

As of September 19, 2026, the regulatory landscape for artificial intelligence across North America exhibits a dynamic, multi-layered environment characterized by high legislative velocity at the state level in the United States alongside targeted federal and provincial statutory oversight, standardization, and public sector frameworks in Canada. Rather than relying on a single, uniform federal framework across the continent, North American AI governance is defined by sector-specific statutory mandates, executive decrees, digital trust standards, and localized compliance rules.

In the United States, federal baseline policy is steered primarily through executive action, notably Executive Order 14409 — Promoting Advanced Artificial Intelligence Innovation and Security enacted in 2026 and the National Security Presidential Memorandum/NSPM-11 — Artificial Intelligence in the National Security Enterprise, which became effective on June 5, 2026. However, state legislatures have taken the lead in imposing binding, statutory rules on private actors. State laws passed throughout 2026 cover a wide spectrum of issues, including consumer transparency, healthcare algorithm accountability, mental health services, synthetic media disclosures, conversational AI operations, and frontier model development.

Canada has established an institutional approach emphasizing public sector trust, workplace transparency, personal data privacy, and international alignment. Key legislative acts such as the Enhancing Digital Security and Trust Act, 2024 and the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 underpin public sector modernization, while provincial frameworks like An Act to modernize legislative provisions as regards the protection of personal information (Law 25) govern privacy. Canadian regulatory oversight is reinforced by dedicated technical and safety guidance from the Canadian Artificial Intelligence Safety Institute (CAISI) (effective November 12, 2024) and national standards like the CAN-ASC-6.2 Accessible and Equitable Artificial Intelligence Standard (effective December 3, 2025).

Key Trends and Focus Areas

Across North America, regulatory activity is concentrated around several distinct thematic pillars, combining binding statutory prohibitions with technical guidance and sector-specific guardrails.

• Healthcare, Psychotherapy, and Clinical AI Transparency: One of the strongest statutory trends across US jurisdictions is the regulation of AI in health care delivery, medical transcription, and prior authorization. Enacted laws such as Concerning the use of artificial intelligence in health care. (2026), Concerning restrictions on the use of artificial intelligence relating to psychotherapy services. (2026), and An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services (2026) establish stringent limits on autonomous clinical decision-making. Furthermore, mandates like Requires a healthcare professional to disclose to a patient the use of a recording device, software, or service to transcribe using artificial intelligence during an appointment or treatment. (effective August 1, 2026) and Making improvements to transparency and accountability in the prior authorization determination process. (effective June 11, 2026) enforce explicit patient disclosure and administrative oversight.
• Frontier Model Governance and Generative AI Safety: Regulators are focusing heavily on developers of advanced foundation models and generative systems. Statutes such as An Act to amend the general business law, in relation to transparency and safety requirements for developers of artificial intelligence frontier models (2026) and the Connecticut Artificial Intelligence Responsibility and Transparency Act (2026) impose requirements regarding risk mitigations and algorithmic transparency. At the executive level, California has enacted targeted mandates including California Executive Order N-5-26 — Responsible Procurement and Deployment of Generative Artificial Intelligence (effective March 30, 2026) and As Trump rolls back protections, Governor Newsom signs first-of-its-kind executive order to strengthen AI protections and responsible use (effective March 30, 2026).
• Conversational AI, Disclosure, and Consumer Protection: Legislative bodies are active in preventing consumer deception by conversational agents and chatbots. Requirements are governed through laws like Concerning requirements for an operator of a conversational artificial intelligence service. (2026), Artificial Intelligence Disclosure and Safety Act (effective July 14, 2026), and A bill for an act establishing requirements and guidelines for conversational AI services, and providing civil penalties, and including applicability provisions. (effective July 1, 2026). In addition, broader identity and cognitive protections are emerging through instruments like An Act Relating to Neurological Rights and the Use of Artificial Intelligence Technology in Health and Human Services (effective July 1, 2026) and Identity Protection Modifications (effective May 6, 2026).
• Workplace Monitoring, Hiring Disclosures, and Education: Regulating AI in employment and classroom settings represents a core priority in both countries. In Canada, workplace rules are established under the Working for Workers Four Act, 2024 (effective March 21, 2024), with further rules pending under the Ontario Working for Workers Act - AI Hiring Disclosure. In the US, state legislatures have enacted educational integration laws including Adds to existing law to establish provisions regarding generative artificial intelligence in public education. (2026), Classroom Technology Amendments (2026), and S.B. 267 Software in Education Amendments (2026).
• Deepfakes, Elections, and Synthetic Media: The misuse of synthetic media is addressed through campaign finance and criminal statutes. Examples include AN ACT to amend Tennessee Code Annotated, Title 2, Chapter 19, relative to the Transparency for Deepfakes in Political Advertising Act. (2026), Provides relative to unlawful conduct involving images of another person created by artificial intelligence (effective August 1, 2026), and targeted disclosures under AN ACT To amend and reenact R.S. 18:1463.1(D) and (E)... (effective August 1, 2026).

Regulatory Status

The regulatory status of AI across North America as of September 19, 2026, reflects a dual structure combining in-force legislation and executive decrees with active soft law guidelines, technical standards, and pending regulatory frameworks.

In the United States, binding laws dominate the state level, while federal oversight relies on executive mandates. In force federally are decrees such as Executive Order 14409 — Promoting Advanced Artificial Intelligence Innovation and Security (2026) and National Security Presidential Memorandum/NSPM-11 — Artificial Intelligence in the National Security Enterprise (effective June 5, 2026). In state jurisdictions, a wave of 2026 statutory enactments is currently in force, including the Connecticut Artificial Intelligence Responsibility and Transparency Act, the Office of Artificial Intelligence Policy Amendments, H.B. 218 Digital Skills Amendments, and state health laws like AN ACT TO AMEND TITLE 24 OF THE DELAWARE CODE RELATING TO MEDICAL PROFESSIONALS, TITLES, AND NONHUMAN ENTITIES. and RELATING TO ARTIFICIAL INTELLIGENCE. (effective July 14, 2026).

In Canada, binding public sector and privacy acts are fully in force, including the Enhancing Digital Security and Trust Act, 2024, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, Access to Information Act (Alberta Bill 34) (2024), and Quebec's An Act to modernize legislative provisions as regards the protection of personal information (Law 25). These are augmented by operational guidelines and standards that are currently in force, such as the Implementation Guide for Managers of Artificial Intelligence Systems (Innovation, Science and Economic Development Canada) (effective March 6, 2025), the CAN-ASC-6.2 Accessible and Equitable Artificial Intelligence Standard (effective December 3, 2025), the federal government's Guide on the use of generative artificial intelligence (effective February 12, 2024), and Quebec's Statement of Principles for the Responsible Use of Artificial Intelligence by Public Organizations (effective June 27, 2024).

Instruments awaiting entry or future enforcement dates include:

• Ontario Working for Workers Act - AI Hiring Disclosure (statute passed in 2024, awaiting entry into force for employment disclosure requirements).
• Guideline E-23 — Model Risk Management (Office of the Superintendent of Financial Institutions) (final) (guideline issued for financial institutions, with a formal effective date of May 1, 2027).

Notable Differences

While both North American nations share concerns regarding transparency, consumer safety, and algorithmic bias, their regulatory governance structures differ significantly in architecture, scope, and enforcement mechanisms.

The United States exhibits a decentralized, fragmented legislative approach. Due to the absence of a single horizontal federal AI statute, individual states serve as primary regulatory centers. This has produced explicit statutory mandates across distinct topics—such as rental price coordination under An Act to amend the Illinois Antitrust Act regarding residential rental price coordination (2026), legal personhood limitations under AN ACT to amend Tennessee Code Annotated, Title 1, relative to certain conditions of personhood. (2026), and defining foundational AI terms under AN ACT TO DEFINE THE TERM "ARTIFICIAL INTELLIGENCE"; AND FOR RELATED PURPOSES. (effective July 1, 2026). State executive branches also demonstrate explicit policy polarization, as highlighted by state-level executive orders acting independently of federal directives (e.g., As Trump rolls back protections, Governor Newsom signs first-of-its-kind executive order to strengthen AI protections and responsible use).

Conversely, Canada prioritizes administrative alignment, public trust, accessibility, and institutional risk management. Governance is established through centralized standard-setting bodies and cross-border agreements, such as the Canada-EU Memorandum of Understanding on Artificial Intelligence (effective December 8, 2025) and specialized technical bodies like the Canadian Artificial Intelligence Safety Institute (CAISI). Rather than introducing criminal or civil liability across dozens of individual state statutes, Canada embeds AI compliance into existing privacy laws (Law 25), public administrative trust frameworks (Enhancing Digital Security and Trust Act, 2024), and financial prudential guidelines like Guideline E-23 — Model Risk Management (Office of the Superintendent of Financial Institutions) (final).

Regional Outlook

Looking ahead from late 2026, North America is progressing toward tighter enforcement of enacted state statutes and the gradual implementation of sector-specific risk models. Organizations operating across the region face a complex compliance environment where cross-border operations must reconcile state-level statutory prohibitions in the US with standards-based risk management systems in Canada.

Key regulatory milestones include the upcoming implementation of financial risk frameworks, specifically Guideline E-23 — Model Risk Management (Office of the Superintendent of Financial Institutions) (final) effective May 1, 2027, alongside the formal rollout of pending employment rules like the Ontario Working for Workers Act - AI Hiring Disclosure. In the United States, state-level legislative momentum around frontier model safety, conversational AI disclosures, and healthcare integration will continue to drive compliance programs, compelling organizations to maintain flexible, highly modular AI governance frameworks across all North American operations.