United States AI Regulation Overview

Overview

The United States approaches artificial intelligence regulation through a decentralized, sector-specific, and innovation-focused strategy. Rather than enacting a single comprehensive horizontal AI statute akin to the European Union AI Act, the federal regulatory framework relies on executive directives, policy frameworks, agency-specific rules, and voluntary technical standards. Following the revocation of Executive Order 14110, federal policy reoriented under Executive Order 14179 ("Removing Barriers to American Leadership in Artificial Intelligence"), Executive Order 14365, and "Winning the Race: America's AI Action Plan." This posture prioritizes accelerating AI innovation, expanding domestic computing and energy infrastructure, cutting regulatory barriers, and securing American dominance in frontier technology while embedding targeted national security and consumer protection safeguards.

Key executive directives establish binding governance across federal departments and agencies. Office of Management and Budget (OMB) Memorandum M-25-21 ("Accelerating Federal Use of AI through Innovation, Governance, and Public Trust") and OMB Memorandum M-25-22 regulate federal agency AI adoption, procurement, and risk management. In national security and defense, National Security Presidential Memorandum/NSPM-11 and Department of Defense Directive 3000.09 govern the ethical integration of autonomous systems and commercial frontier models into military operations. Simultaneously, Executive Order 14409 ("Promoting Advanced Artificial Intelligence Innovation and Security") and Executive Order 14319 ("Preventing Woke AI in the Federal Government") establish policies to secure national security information systems, create an AI cybersecurity clearinghouse, and mandate truth-seeking and ideological neutrality in federal model procurement.

Regulatory Approach

The U.S. regulatory approach balances soft-law guidelines and voluntary standards for private developers with mandatory compliance requirements for federal procurement, national security, export controls, and criminal misuse. Central to voluntary technical guidance is the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF 1.0), complemented by the Generative AI Profile (NIST AI 600-1), the Cyber AI Profile (NISTIR 8596), and Special Publication 1353. These frameworks define functions—Govern, Map, Measure, and Manage—to evaluate trustworthiness characteristics including safety, security, transparency, explainability, privacy, and fairness.

Where binding obligations exist for non-governmental actors, they are enforced through existing statutory authorities and targeted federal legislation. The Federal Trade Commission (FTC) utilizes Section 5 of the FTC Act to police deceptive AI marketing, "AI washing," and the intentional suppression or manipulation of model accuracy. The Bureau of Industry and Security (BIS) within the Department of Commerce enforces export controls under the Export Administration Regulations (EAR) to restrict foreign adversary access to advanced computing integrated circuits and dual-use AI technologies. In addition, federal legislation addresses specific high-harm applications, such as the TAKE IT DOWN Act (Public Law 119-12), which criminalizes non-consensual intimate deepfakes and imposes mandatory 48-hour notice-and-takedown obligations on interactive online platforms.

Key AI Legislation

Federal AI governance in the United States is anchored by a combination of enacted statutes, executive orders, administrative regulations, and sector-specific guidance:

• National Artificial Intelligence Initiative Act of 2020 (Public Law 116-283): Establishes the National AI Initiative, codifying interagency coordination through the National AI Initiative Office (NAIIO), NSTC Interagency Committee, and National AI Advisory Committee, while funding R&D across NIST, NSF, and DOE.
• CHIPS and Science Act of 2022 (Public Law 117-167): Authorizes federal subsidies for domestic semiconductor manufacturing and funds agency measurement science, standards, and AI testbeds.
• AI in Government Act of 2019 (Public Law 116-260): Establishes the GSA AI Center of Excellence, mandates OMB federal AI guidance, and directs OPM workforce planning.
• TAKE IT DOWN Act (Public Law 119-12): Criminalizes knowing publication or threats of non-consensual intimate AI deepfakes and mandates 48-hour platform notice-and-removal mechanisms enforced by the FTC.
• Executive Orders 14179, 14318, 14319, 14363, 14365, and 14409: Presidential directives streamlining data center permitting, mandating unbiased AI in federal procurement, launching the Genesis Mission for AI-driven scientific discovery, and enhancing cybersecurity for frontier models.
• OMB Memoranda M-25-21 and M-25-22: Binding policies for federal executive agencies governing AI adoption, Chief AI Officer (CAIO) appointments, high-impact AI assessments, and lifecycle procurement terms.
• Export Administration Regulations (EAR) - AI Diffusion Controls: Administered by BIS to enforce global licensing requirements and Foreign Direct Product rules for advanced computing chips and dual-use model infrastructure.

Governance & Enforcement Bodies

Federal AI oversight is distributed across multiple executive agencies and independent regulatory commissions rather than a single central AI authority. Within the executive branch, the White House Office of Science and Technology Policy (OSTP), the Office of Management and Budget (OMB), and the Assistant to the President for Science and Technology coordinate government-wide strategy. OMB sets binding acquisition and risk management rules for federal agencies, while NIST functions as the lead scientific body for AI measurement, voluntary standards, and technical risk management frameworks.

Independent and sector-specific regulatory bodies exercise enforcement and supervisory jurisdiction within their domains. The Federal Trade Commission (FTC) investigates deceptive AI practices, enforcement of endorsement guides, and online platform takedown compliance. The Bureau of Industry and Security (BIS) enforces export controls on advanced AI chips and computing infrastructure. Financial regulators—including the Securities and Exchange Commission (SEC), Federal Reserve Board, OCC, FDIC, CFPB, NCUA, and FHFA—supervise AI risk management, model risk governance (SR 11-7), automated valuation models (AVMs), and market disclosures. Sectoral agencies such as the FCC (telecommunications and TCPA AI voice prohibitions), FDA (AI/ML in drug development), FERC (energy infrastructure for AI data centers), and the Department of Defense (CDAO and military autonomy under DoD Directive 3000.09) enforce specialized rules within their respective fields.

Penalties & Enforcement

Penalties for AI-related violations in the United States depend on the governing statutory or regulatory framework. Under the TAKE IT DOWN Act (Public Law 119-12), criminal violations for knowingly publishing or threatening to publish non-consensual intimate deepfakes carry federal criminal fines and imprisonment. Non-compliant online platforms failing to maintain mandatory notice-and-takedown mechanisms within 48 hours face civil enforcement actions and monetary penalties administered by the FTC under the Federal Trade Commission Act.

In commercial markets, the FTC enforces Section 5 prohibitions against unfair or deceptive acts or practices, seeking remedies such as civil monetary penalties, permanent injunctions, corrective advertising, and algorithmic disgorgement (mandating the deletion of models trained on deceptively acquired data or deceptive practices). For federal contractors and vendors, executive directives (NSPM-11, EO 14319, OMB M-25-22) enforce compliance through administrative remedies, including contract termination for default, exclusion from federal procurement, and charging model decommissioning costs to non-compliant vendors. Under banking and financial regulations (FIRREA, Dodd-Frank, BSA), failure to adhere to model risk management standards or AVM quality control rules subjects institutions to cease-and-desist orders, formal administrative actions, and civil money penalties.

Data Protection Framework

The United States does not possess a single, comprehensive federal data protection statute comparable to the European Union GDPR; instead, privacy and data protection are governed through a combination of sector-specific federal privacy laws, administrative regulations, and state-level enactments. In the financial sector, the SEC's amended Regulation S-P mandates that registered financial entities maintain written incident response programs to detect, respond to, and notify affected individuals within 30 days of unauthorized access to customer financial records. Financial institutions using AI models are also bound by the Right to Financial Privacy Act and Bank Secrecy Act requirements.

In healthcare, the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules govern the use of Protected Health Information (PHI) in AI model training and clinical decision support. CMS guidance clarifies that Medicare Advantage organizations deploying predictive algorithms must ensure full HIPAA compliance, including data anonymization, strict access controls, and prohibitions against using unapproved PHI for model training. Furthermore, federal AI governance frameworks—such as OMB Memorandum M-25-21 and the NIST AI RMF—require agencies and deployers to implement privacy-enhancing technologies (PETs), data minimization, and safeguards against model data leakage or re-identification risks.

Sector-Specific Rules

Sectoral regulators have established detailed rules to govern AI integration within their jurisdictions. In healthcare and pharmaceuticals, the Food and Drug Administration (FDA) issued draft guidance titled "Considerations for the Use of AI To Support Regulatory Decision-Making for Drug and Biological Products," establishing a risk-based credibility assessment framework across the drug product lifecycle. Concurrently, CMS regulations and guidance for Medicare Advantage plans mandate that AI tools and predictive algorithms cannot serve as the sole basis for coverage denials, requiring individualized clinical assessments based on patient medical history.

In banking and financial services, the Federal Reserve, OCC, FDIC, NCUA, CFPB, and FHFA jointly issued the Final Rule on Quality Control Standards for Automated Valuation Models (AVMs), requiring mortgage originators and secondary market issuers to implement quality controls that prevent data manipulation, avoid conflicts of interest, require random sample testing, and ensure compliance with non-discrimination laws. The Federal Reserve's Supervisory Guidance on Model Risk Management (SR 11-7) extends rigorous model development, independent validation, and governance expectations to AI/ML systems. In telecommunications, the Federal Communications Commission (FCC 24-17) ruled that Telephone Consumer Protection Act (TCPA) restrictions on artificial or prerecorded voices apply directly to AI voice cloning, requiring prior express consent from call recipients. In defense, DoD Directive 3000.09 mandates human judgment over the use of force in autonomous weapon systems, complemented by the CDAO Responsible AI Strategy and Implementation Pathway.

International Alignment

The United States pursues an international alignment strategy centered on market-driven innovation, voluntary consensus technical standards, and allied cooperation, presenting an alternative to prescriptive regulatory regimes such as the European Union AI Act. As articulated in NIST AI 100-5e2025 ("A Plan for Global Engagement on AI Standards") and "Winning the Race: America's AI Action Plan," federal policy prioritizes accelerating international consensus standards through standards development organizations (SDOs), promoting technical interoperability, and exporting the American AI technology stack to international allies.

International engagement emphasizes OECD principles for trustworthy AI, technical alignment on AI safety testing, and joint risk management. Concurrently, the U.S. enforces extraterritorial export controls via the Bureau of Industry and Security under the Export Administration Regulations (EAR). The Framework for Artificial Intelligence Diffusion establishes global licensing requirements and Foreign Direct Product rules to restrict the transfer of advanced computing integrated circuits, semiconductor manufacturing equipment, and dual-use model infrastructure to foreign adversaries, ensuring that international diffusion aligns with national security interests.

Future Developments

The legislative and regulatory landscape in the United States features numerous pending bills and active administrative initiatives. Major legislative proposals introduced in the 119th Congress include the Great American AI Act (GAAIA), which proposes a unified federal framework, preemption of conflicting state AI laws, and an Independent Verification Organization (IVO) licensing regime under CAISI. Other prominent bills under congressional review include the TRUMP AMERICA AI Act (S. 5765 / TAAIAX), the AI Kill Switch Act (H.R. 9917) authorizing CISA emergency shutdown orders for high-compute models, the Secure AI Development Act (S. 5061), the AI Data Center Moratorium Act (S. 4214), the American AI Sovereign Wealth Fund Act (S. 4825), the NO FAKES Act (S. 1367), the DEFIANCE Act (S. 1837), and the Preventing Algorithmic Collusion Act (S. 232).

On the administrative front, executive agencies are executing phased implementation milestones under OMB Memoranda M-25-21 and M-25-22, NSPM-11, and Executive Order 14409. Key upcoming developments include NIST's ongoing refinement of the Cyber AI Profile (NISTIR 8596) and Special Publication 1353, the Department of Energy's rollout of the American Science and Security Platform under the Genesis Mission (EO 14363), and the National Science Foundation's transition of the NAIRR pilot into a permanent Operations Center (NSF 25-546).

Enforcement Bodies