As checked on 29 October 2026, the United States has no federal AI statute and no general federal AI regulator. Federal regulation is sector based, through agencies that apply existing law to AI uses within their remits, together with voluntary frameworks such as the NIST AI Risk Management Framework 1.0, and executive action that directs federal policy and agency work. That position changes through executive orders, agency guidance, legislation and court decisions, and it must be checked on official federal sources, including the Federal Register, agency sites and NIST, before it is relied on. A US company with Union activities must meet US federal and state law and the AI Act separately.
Why is there no federal AI statute?
The United States has not enacted a comprehensive federal AI statute comparable to the EU AI Act. Federal AI policy has instead developed through executive orders, agency guidance, sector regulation and voluntary frameworks, with Congress considering but not enacting general AI legislation as checked on 29 October 2026. An executive order on AI issued in 2023 was later revoked, and later executive action in 2025 directed a national policy framework and agency work on AI, including a White House AI Action Plan. The details of executive action, including the orders in force, the agencies directed and the deadlines set, must be checked on the Federal Register and on White House and agency sites, because executive action can be revoked, replaced or challenged, and secondary reporting on executive orders quickly becomes out of date. The absence of a federal statute does not mean that AI is unregulated at federal level. Sector statutes and agency powers apply to AI uses in the same way as they apply to other technologies, and a company that assumes that the absence of an AI statute means the absence of federal duties will miss the duties that apply through its sector.
How does sector regulation work at federal level?
Federal sector regulation applies existing statutes to AI uses within each agency remit. The Federal Trade Commission applies consumer protection and competition law to AI claims, to deceptive practices and to unfair methods of competition, including claims about AI capabilities and the use of AI to deceive consumers. The Food and Drug Administration applies medical device law to AI and machine learning software that meets the device definition, including premarket and post market duties. The Securities and Exchange Commission, the Consumer Financial Protection Bureau, the Equal Employment Opportunity Commission and other agencies apply their sector statutes to AI uses in securities, consumer finance, employment and other areas. The Department of Health and Human Services, through the Office of the National Coordinator for Health Information Technology, applies transparency duties for predictive decision support in certified health IT. Each agency has its own guidance, enforcement priorities and procedures, and each must be checked on its own site. A company should map its activity to the federal agencies that oversee it, in the same way as it maps its UK activity to sector regulators, and should record the agency guidance checked, with dates.
For the broader regulatory framework, see non-EU and international overview.
What is the NIST AI Risk Management Framework?
The NIST AI Risk Management Framework 1.0, published on 26 January 2023 as NIST AI 100-1, is a voluntary framework intended for voluntary use to improve the ability to incorporate trustworthiness considerations into the design, development, use and evaluation of AI products, services and systems. It is organised around four functions, Govern, Map, Measure and Manage, with categories and subcategories that describe outcomes, and it is supported by a Playbook, a Generative AI Profile published in July 2024 as NIST AI 600-1, and other profiles and crosswalks. The Framework is voluntary guidance, not a law, and it carries no certification, no penalties and no expiry date. Its importance lies in its use as a common language for AI risk management, in its reference in contracts, sector guidance and some state laws, and in its crosswalks to other frameworks including ISO/IEC 42001. NIST has stated that AI RMF 1.0 is being revised, so the version must be checked on the NIST site on the date of use. A company should not present NIST AI RMF alignment as compliance with the AI Act, or as compliance with a federal statute, because the Framework is voluntary and the AI Act duties are legal duties with their own evidence requirements. The Framework can support the risk management work, but it cannot replace it.
What executive action should be checked?
Executive action on AI includes executive orders, the AI Action Plan, agency directives and funding conditions, and it must be checked on official sources because it changes and because its legal effect varies. An executive order can direct agencies to act, to issue guidance, to prioritise enforcement or to review regulations, but it does not by itself create a general AI statute, and it can be revoked by a later order. Reporting checked for this guide described a December 2025 executive order on a national AI policy framework, with an AI Litigation Task Force and funding conditions relating to state AI laws, and described preemption as not enacted. Those details are given here only as a prompt to check the official sources, not as a statement of current law, because executive action and litigation on state laws develop quickly. A company should check the Federal Register for the orders in force, the White House site for the Action Plan, and the agency sites for the implementing guidance, and should obtain US legal advice where executive action affects its state law position. A guide that stated the executive position without a checking instruction would be unreliable within weeks.
How should a US company handle EU duties alongside federal duties?
A US company with Union market or output use activities should keep a US record and an EU record, as described for UK companies in this cluster. The US record should map the federal sector agencies, the state laws, the voluntary frameworks used, and the executive action checked, with dates and sources. The EU record should map the AI Act scope, classification, role, authorised representative and conformity position. The two records should be kept distinct, even where the same risk management work supports both, because the legal bases and the authorities differ. The company should check whether its US risk management framework, such as NIST AI RMF, maps to the AI Act requirements, and should record the mapping with gaps, rather than assuming that a voluntary framework satisfies legal duties. It should also check its contracts with Union customers, its authorised representative arrangements and its documentation language, because a US company that documents only in US terms will struggle to show AI Act compliance to a Union authority. Local advice in each jurisdiction should be sought for borderline questions.
Continue with US state AI laws.
What does this guide not decide?
This guide does not decide the current federal executive position, does not reproduce any federal statute or agency guidance, and does not give legal advice for any US activity. The federal position described here is the position as checked on 29 October 2026 from the official NIST material and secondary reporting summarised in the sources note, and it must be rechecked on the Federal Register, on agency sites and on NIST before it is relied on. Federal AI policy, agency guidance and court decisions develop, and a position stated without a checking instruction would quickly become out of date. A company with a specific US activity should obtain US legal advice on the current federal and state law for that activity, and should confirm the AI Act position separately.
Frequently asked questions
Is there a US federal AI Act?
No, as checked on 29 October 2026. The United States has no federal AI statute and no general federal AI regulator. Federal regulation is sector based, with voluntary frameworks such as NIST AI RMF 1.0 and executive action that must be checked on official sources. State law adds a separate layer that varies by state.
Is the NIST AI Risk Management Framework mandatory?
No. NIST AI RMF 1.0 is a voluntary framework, published on 26 January 2023, intended for voluntary use. It has no certification and no penalties. It can support risk management work and is referenced in contracts and sector guidance, but it does not satisfy AI Act duties by itself and should not be presented as a legal compliance certificate.
Does an executive order create AI law?
An executive order directs federal policy and agency work, but it does not create a general AI statute, and it can be revoked or replaced. Orders, the AI Action Plan and agency implementing guidance must be checked on the Federal Register and agency sites, with US legal advice where the position affects state law or a specific activity.
Which federal agencies matter for AI?
It depends on the activity. The FTC for consumer protection and competition, the FDA for medical devices, the SEC, CFPB and EEOC for securities, consumer finance and employment, and HHS ONC for health IT transparency are among the agencies whose remits can cover AI uses. Each agency guidance must be checked on its own site.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗NIST AI Risk Management Framework ↗AI Act Service Desk timeline ↗