US AI Policy in 2026: Federal Regulation and What's Changed

The United States has taken a different path on AI regulation than the European Union, and the gap between the two approaches is now clearly visible. Rather than a comprehensive AI-specific law, the US has pursued a patchwork of executive actions, sector-specific rules, and export controls. Understanding where that leaves businesses in 2026 requires looking at several policy threads simultaneously.

The Executive Order Legacy

The Biden administration's 2023 executive order on AI established the template: mandatory safety reporting for frontier AI systems with significant compute thresholds, sector-specific guidance across healthcare, finance, and critical infrastructure, and a coordination role for NIST in developing AI standards.

Most of those mechanisms remained in place through the 2024 transition, though enforcement priorities have shifted. The current administration has emphasized AI for economic competitiveness and national security more than consumer protection frameworks—a shift visible in which agencies have been most active and which guidance documents have been updated versus left dormant.

NIST's AI Risk Management Framework, published in 2023 and updated in 2025, remains the closest thing the US has to a general compliance standard. It's voluntary, but it's increasingly referenced in federal procurement requirements and cited by regulators in sector-specific enforcement actions. For companies selling AI to the federal government, meeting the NIST AI RMF is effectively a market requirement. The framework is maintained at nist.gov/artificial-intelligence.

National Security and Export Controls

The area where US AI policy has been most aggressive is national security—specifically, controlling the flow of advanced AI technology to adversary nations.

The Commerce Department has expanded export controls on advanced semiconductors and AI model weights. The latest rules restrict export of models above certain capability thresholds to a broad list of countries, with carve-outs for close allies under licensing arrangements.

For AI companies, this creates real operational complexity. Hosting infrastructure, data processing agreements, and even cloud access need to be reviewed against export control requirements. Companies that have built international AI services without dedicated compliance programs are finding this is no longer optional.

The controls also affect academic and research institutions, which have historically operated outside export control regimes. Researchers working on frontier AI with international collaborators now face more scrutiny on what can be shared and how.

Sector-Specific Regulation: Where the Real Action Is

In the absence of comprehensive federal AI legislation, the most consequential AI regulation in the US is happening at the sector level:

Financial services: Banking regulators—the OCC, Fed, and FDIC—have issued joint guidance on model risk management for AI systems. The guidance extends existing model risk management frameworks (SR 11-7) to cover AI-specific risks including explainability, bias, and data drift. Banks using AI in credit decisions, fraud detection, and customer service face examination questions that didn't exist three years ago.

Healthcare: The FDA has cleared over 700 AI-based medical devices, and the approval framework has matured significantly. Devices that learn continuously after deployment—adaptive algorithms—now require pre-specified performance monitoring protocols as a condition of clearance. Healthcare systems deploying AI for clinical decision support face both FDA requirements and increasing scrutiny from CMS under Medicare and Medicaid programs.

Insurance: State insurance regulators have moved unevenly on AI. California, Colorado, and New York have the most developed frameworks, restricting the use of AI in underwriting decisions without documented fairness assessments. Nationally, the NAIC has published model bulletin guidance that many states are implementing.

Employment: The EEOC has issued guidance clarifying that existing employment discrimination law applies to AI-assisted hiring tools. Employers using AI in screening, assessment, or hiring decisions bear the same legal obligations as if a human made those decisions. Several high-profile enforcement actions in 2025 and 2026 have made this concrete.

State-Level AI Laws: A Growing Compliance Burden

In the absence of federal preemption, states have filled the vacuum. As of mid-2026, more than twenty states have enacted or are actively advancing AI-specific legislation.

The most significant state laws:

• Colorado AI Act: Requires developers and deployers of "high-risk" AI to conduct impact assessments and disclose AI use to affected individuals
• California's multiple AI bills: Cover automated decision-making rights, AI disclosure requirements, and training data transparency
• Illinois: Extended its existing Artificial Intelligence Video Interview Act and added provisions for employment AI more broadly
• Texas: Focused on AI use in critical infrastructure and government services

For companies operating nationally, this creates a genuine compliance complexity problem. Meeting the strictest state standards (currently a mix of Colorado and California requirements) provides reasonable coverage, but the landscape continues to change as more states enact laws.

What US Businesses Need to Do Now

The lack of a comprehensive federal AI law doesn't mean the regulatory landscape is light. The combination of sector rules, state laws, and export controls creates meaningful obligations for most companies using AI at scale:

Document AI use: Know what AI systems you're running, in what decisions, and with what data. This is the baseline for any compliance program and a prerequisite for responding to regulatory inquiries.

Assess for bias in consequential decisions: Any AI system affecting employment, credit, housing, or healthcare access faces fairness scrutiny. Documenting bias testing and remediation is now expected, not optional.

Map export control exposure: If you're distributing AI models or hosting AI services internationally, get legal review of export control obligations. The rules in this area change faster than most legal teams track.

Follow sector-specific guidance: If your industry has a regulator with published AI guidance, treat that as a floor. The OCC, FDA, EEOC, and state insurance regulators have made clear they will use existing enforcement tools on AI-related violations.

Monitor state legislation: The state legislative calendar for AI is unusually active. Bills in California, Texas, and several smaller states could significantly change your obligations by year-end.

The EU Comparison Question

Businesses operating in both US and EU markets inevitably face the question of whether to build one compliance program to the higher EU standard or maintain separate tracks.

The EU AI Act is more prescriptive, more comprehensive, and carries higher penalties. For most large organizations, building to EU standards and adapting for US requirements is more efficient than the reverse. The documentation, bias assessment, and oversight mechanisms required by the EU AI Act satisfy most US sector requirements as well.

The EU AI Act compliance guide for 2026 covers the specific requirements in detail. The key point for US businesses: the compliance infrastructure built for EU purposes doesn't go to waste in the US regulatory environment.

What Federal Legislation Would Change

Congress has debated comprehensive AI legislation for three years without passing a bill. The main divides: how to handle state preemption, which agency would lead enforcement, and whether to require pre-deployment safety reviews or rely on post-harm liability.

If federal legislation passes before the end of 2026—which several legislative calendars indicate is possible—the most likely framework is a risk-based approach similar to the EU's, with lighter obligations than Europe's and significant carve-outs for national security applications.

For businesses, the practical implication of potential legislation is the same as the current state law patchwork: building documentation and governance infrastructure now is less expensive than retrofitting it in response to a compliance deadline.

The Competitive Position Question

US AI companies argue that heavy-handed regulation risks ceding competitive ground to less-regulated competitors, particularly Chinese AI companies. US policymakers have been responsive to this argument, which explains the relative lightness of the US framework compared to Europe's.

The counterargument—that clear regulatory frameworks build trust and enable broader enterprise adoption—is also visible in the market. European enterprises that have gone through EU AI Act compliance have documented AI governance systems that their US peers often lack. In B2B AI markets, that governance documentation is increasingly a procurement requirement.

The US will likely end up somewhere between the current light-touch approach and the EU's comprehensive framework. Where exactly depends on legislative developments, court decisions on agency authority, and the outcome of ongoing pilot enforcement actions that are establishing what regulators expect in practice.