Editorial Team
Governome Editorial Team
The Governome Editorial Team publishes the analysis on this site, working from primary sources: statutes, official regulator guidance, and enforcement records. We use AI tools in research and drafting, and every legal claim is checked against its primary source before publication; where we could not verify something, the page says so. Each article shows a last-reviewed date, and substantive errors are logged publicly on our corrections page. We are a small, early-stage team and do not yet publish individually named bylines. When outside counsel or a credentialed practitioner reviews an article, that person is credited on it.
Published by Governome Editorial Team
US employers using AI in hiring face existing federal civil rights law plus city and state rules: NYC Local Law 144's bias audits, Illinois HB 3773's notice duty, California's automated-decision regulations, and Colorado's new automated decision-making law. This checklist maps what each requires and what to do first.
Governome Editorial Team · 4 min read
Article 26 sets the obligations of deployers of high-risk AI systems: use the system per the provider's instructions, assign competent human oversight, monitor and report incidents, keep logs for at least six months, and tell workers and affected people. Here is what each paragraph requires and when it applies.
Governome Editorial Team · 4 min read
Article 27 requires certain deployers of high-risk AI systems, including public bodies, private entities providing public services, and deployers of some credit and insurance systems, to assess the impact on fundamental rights before first use. Here is who must do it, the six required elements, and how it relates to a GDPR DPIA.
Governome Editorial Team · 4 min read
ISO/IEC 42001 certification runs through an accredited certification body: a Stage 1 documentation review, a Stage 2 audit of whether the management system actually operates, then surveillance audits and recertification over a three-year cycle. Here is the sequence and how to prepare for each stage.
Governome Editorial Team · 3 min read
regulations us
Massachusetts AI Regulatory Guidance: What Exists Today
There's no Massachusetts AI Act to check against, and there may not be one for a while. What there is: an Attorney General's advisory applying consumer protection, anti-discrimination, and data security law directly to AI systems, a state policy governing how executive branch agencies use generative AI internally, and a frontier-AI safety bill reconciling between the House and Senate. Here's what's actually binding today, what isn't, and what to watch.
Governome Editorial Team · 8 min read
regulations us
Washington State AI Regulations: Current Status
There's no single 'Washington AI law' to check compliance against. The My Health My Data Act, a 2020 government facial-recognition statute, and two new 2026 laws on companion chatbots and AI content provenance each reach AI products through a different trigger. A fifth, on AI in health-insurance prior authorization, is already in force. Here's what each one actually requires.
Governome Editorial Team · 8 min read
SB 2, the duty-of-care bill compliance teams have tracked since 2024, failed twice and was shelved. What's actually in force is SB 5 (Public Act 26-15), a four-track statute with obligations phasing in from October 2026 through January 2028. Here's what each track requires and when.
Governome Editorial Team · 8 min read
regulations us
New York AI Regulations Beyond NYC Local Law 144
NYC Local Law 144 only reaches automated hiring and promotion tools used inside New York City. Separately, New York State has enacted the RAISE Act, the AI Companion Models Law, the Algorithmic Pricing Disclosure Act, and NYDFS Circular Letter No. 7 — four instruments covering frontier AI safety, companion chatbots, personalized pricing, and insurance underwriting. Here's what each one actually requires.
Governome Editorial Team · 8 min read
regulations us
Utah AI Policy Act: A Practical Breakdown
Utah regulates AI through disclosure, not a duty of care. SB 149 set the baseline in 2024; SB 226 narrowed and added a safe harbor in 2025; a separate law, HB 452, covers mental health chatbots on its own terms. Here's what each actually requires.
Governome Editorial Team · 9 min read
BIPA (2008) regulates biometric data regardless of AI, and HB 3773 (2024) regulates AI in employment decisions regardless of biometrics. Here's what each actually requires, where HB 3773's implementing rules currently stand, and the one place the two statutes overlap.
Governome Editorial Team · 7 min read
regulations us
Texas AI Regulations (TRAIGA): What's Actually Required
TRAIGA (HB 149) took effect January 1, 2026, with a prohibited-practices list and an intent-based liability standard that's deliberately harder to trigger than the reasonable-care duty in Colorado's original AI Act. Here's who it covers, what it bans, and how enforcement actually works.
Governome Editorial Team · 9 min read
There's no single federal AI procurement law. OMB Memorandum M-25-22 governs most federal AI contracts today, a separate executive order adds ideological-neutrality terms for LLM vendors specifically, and a GSA contract clause meant to tie it together is still only a draft.
Governome Editorial Team · 8 min read
Teams look for 'the AI regulator' and don't find one, then assume nothing applies. Jurisdiction follows the underlying function — hiring, lending, marketing claims, investment advice, medical use, calling — and a single product can trigger more than one agency at once.
Governome Editorial Team · 7 min read
An executive order can't preempt state law by itself. Real preemption needs an act of Congress, a court ruling, or funding leverage coercive enough to force repeal — and the federal government's most advanced attempt at any of the three just got mooted by the state rewriting the law it was suing over.
Governome Editorial Team · 8 min read
Congress has introduced nearly 400 AI bills and passed none. The reason isn't simple gridlock — it's fragmented committee jurisdiction, a task force that recommended against one big law, and an unresolved fight over federal preemption that's now spilled into the courts.
Governome Editorial Team · 9 min read
regulations us
A History of US Federal AI Executive Orders
US federal AI policy has never come from a statute. It's come from a sequence of executive orders running from 2019 to 2025 — American AI leadership, then trustworthy government use, then a comprehensive safety order, then that order's rescission and replacement. Here's the full timeline, what each order actually required, and why none of it can outlast a change in administration the way a law would.
Governome Editorial Team · 9 min read
regulations us
FCC Rules on AI-Generated Robocalls and Voice Cloning
The FCC's February 2024 declaratory ruling confirmed that an AI-generated voice counts as an 'artificial voice' under the TCPA, closing an argument a political operative tried to use against a wave of AI-cloned robocalls. A separate rule requiring calls to disclose AI use is still pending, not in force.
Governome Editorial Team · 7 min read
regulations us
FDA's Regulatory Pathway for AI/ML-Based Medical Devices
AI-enabled medical software doesn't get its own FDA lane. It goes through the same device pathways as a stethoscope or an infusion pump, with one addition built for software that keeps learning after it ships — and a real threshold question of whether it's regulated as a device at all.
Governome Editorial Team · 9 min read
regulations us
SEC AI-Washing Enforcement: What Counts as a Violation
Four SEC cases so far — two investment advisers, a trading-fraud scheme, and a public company's SEC filings — show the agency doesn't need new legislation to charge AI-washing. It just applies the antifraud and disclosure rules that already existed to a specific, checkable capability claim that turned out to be false.
Governome Editorial Team · 8 min read
A machine-learning underwriting model that can't explain why it declined an application isn't a legal gray area. ECOA has required a specific, accurate reason since 1974, and the CFPB spent 2022 and 2023 explaining exactly how that applies to AI — before withdrawing the explanation, not the rule, in 2025.
Governome Editorial Team · 9 min read
regulations us
EEOC Guidance on AI in Employment Decisions, Explained
The EEOC's AI hiring guidance no longer exists on eeoc.gov. That doesn't mean algorithmic hiring discrimination became legal — it means the agency's own explanation of the law disappeared while the law itself stayed exactly as it was. Here's what the withdrawn guidance said, and what actually still applies.
Governome Editorial Team · 8 min read
There's no federal AI enforcement statute, yet the FTC has extracted settlements — including forced deletion of the AI models themselves — from companies making AI claims. Here's the legal theory behind 'algorithmic deception,' the real case record, and what actually crosses the line.
Governome Editorial Team · 9 min read
Article 2(7) of the EU AI Act states plainly that the Act applies without prejudice to the GDPR. The two regimes overlap on automated decision-making and impact assessments, but diverge on scope triggers, risk classification, and enforcement — and meeting one doesn't discharge the other.
Governome Editorial Team · 7 min read
The EU AI Act's General-Purpose AI Code of Practice gets covered as a headline — 'OpenAI and Anthropic signed a pledge' — when it's actually three chapters of specific, auditable commitments tied to Article 53 and 55 obligations. Here's what a signatory agrees to do, chapter by chapter, and what happens to a provider that skips it or signs only part.
Governome Editorial Team · 7 min read
The EU AI Act doesn't ask where your company is incorporated. Article 2 sets two independent triggers — placing an AI system on the EU market, and having its output used in the Union — and the second one catches non-EU companies with no EU office, no EU sale, and no EU contract at all. Here's how both triggers actually work, what genuinely takes a company out of scope, and what happens next once you're in it.
Governome Editorial Team · 8 min read
The EU AI Act's original phased schedule got rewritten mid-2026: the Digital Omnibus on AI pushed the high-risk-system deadline from August 2026 to December 2027, and the product-embedded high-risk deadline from August 2027 to August 2028. Article 5 prohibited practices, GPAI obligations, and the governance framework weren't touched. Here's what's actually in force right now, what moved, what didn't, and why.
Governome Editorial Team · 8 min read
regulations eu
EU AI Act Penalties: The Full Tiered Structure
EU AI Act fines aren't a single €35 million number. Article 99 defines three separate tiers by violation type, Article 101 sets a fourth track for general-purpose AI model providers enforced directly by the Commission, and Article 100 even reaches EU institutions themselves. Here's the full structure, including the SME inversion rule that changes real exposure by orders of magnitude.
Governome Editorial Team · 7 min read
regulations eu
The EU AI Office: What It Does and Why It Matters to You
The EU AI Office is a European Commission body with real fining power — but only over one specific category of company: providers of general-purpose AI models. Everyone else's high-risk obligations are enforced by their national market surveillance authority instead. Here's the actual jurisdiction map, the fine amounts, and how the Office differs from the AI Board, the Advisory Forum, and the Scientific Panel.
Governome Editorial Team · 7 min read
CE marking under Article 48 of the EU AI Act is the provider's own compliance signal, applied after conformity assessment — for most high-risk systems, with no external body involved at all. Here's what has to be visible, legible, and indelible, how digital marking works for software-delivered AI, and what importers have to verify before a marked system reaches the EU market.
Governome Editorial Team · 8 min read
Article 43 conformity assessment has two routes: internal control, which covers most high-risk systems and involves no external reviewer at all, and notified-body assessment, reserved for a narrow slice of biometric systems. Here's how each one actually works, what gets produced, and what forces a redo.
Governome Editorial Team · 7 min read
Articles 51 through 56 of the EU AI Act put a separate, model-level obligations track on any provider of a general-purpose AI model — documentation, copyright, and training-data transparency for everyone, with a further layer of testing and incident-reporting duties for the models classified as posing systemic risk. Here's exactly what applies to whom, and what open source does and doesn't exempt.
Governome Editorial Team · 9 min read
ai governance
Building Your First AI Systems Inventory
You can't govern, risk-tier, or classify a system you don't know exists. Here's a practical process for building a first AI systems inventory, including the part most guides skip: how to find the AI nobody officially procured.
Governome Editorial Team · 5 min read
Article 10 requires documented data governance practices for training, validation, and testing data — provenance, bias examination, gap identification, and relevance to intended purpose — a materially different and broader standard than generic data cleaning. Here's what it actually covers.
Governome Editorial Team · 5 min read
Article 11 requires a technical documentation file, built before market placement and kept current, that lets regulators verify a high-risk system's compliance. Annex IV's scope is real, but the more expensive mistake is assembling it retroactively instead of incrementally — here's what's actually required.
Governome Editorial Team · 5 min read
Article 12 requires high-risk AI systems to automatically log events built for three specific purposes — risk identification, post-market monitoring, and deployer oversight — plus an extra minimum spec for remote biometric identification systems. Generic application logs rarely satisfy all three by accident.
Governome Editorial Team · 5 min read
Article 13 requires high-risk AI providers to produce instructions for use that let deployers interpret and correctly apply the system's output. It's routinely confused with end-user AI disclosure rules elsewhere in the Act — here's what it actually requires and why the distinction matters.
Governome Editorial Team · 6 min read
Article 14 requires human oversight measures that give a person real capability to understand, monitor, interpret, and override a high-risk AI system — not a procedural approval step. Here's the five specific capabilities the Act requires, including the automation-bias problem most teams never design for.
Governome Editorial Team · 5 min read
Article 15 requires high-risk AI systems to meet defined, maintained levels of accuracy, robustness, and cybersecurity — including AI-specific threats like data and model poisoning that a standard application security review typically doesn't test for. Here's what's actually required, and who tends to miss it.
Governome Editorial Team · 5 min read
Article 5 of the EU AI Act originally prohibited eight specific AI practices (two more have since been added) — social scoring, manipulative and exploitative AI, untargeted facial-recognition scraping, workplace emotion inference, and more — with no compliance path around them. It's also been in force since February 2025, earlier than almost everything else in the Act.
Governome Editorial Team · 8 min read
Article 9 requires high-risk AI providers to run a continuous risk management process across the system's entire lifecycle, not produce a one-time document. Here's what the process actually has to include, and the gap auditors flag most.
Governome Editorial Team · 7 min read
A gap assessment is the diagnostic step before committing budget to ISO/IEC 42001 certification — a structured comparison against both the clause 4-10 management-system requirements and the Annex A AI-specific controls. Here's how to actually run one, and why an existing ISO 27001 program changes the math significantly.
Governome Editorial Team · 5 min read
NIST's own framework describes Govern as cross-cutting, not sequential — it's the organizational accountability and culture layer that makes Map, Measure, and Manage meaningful. Here's what implementing it actually requires, and how to tell a real governance program from a policy document that only looks like one.
Governome Editorial Team · 6 min read
regulations
Conformity Assessment
The formal process a high-risk AI system goes through to demonstrate it meets the EU AI Act's requirements — internal self-assessment for most Annex III systems, or third-party assessment where a notified body is involved — before the system can be placed on the market or put into service.
Governome Editorial Team
regulations
GPAI (General-Purpose AI Model)
An AI model trained on broad data at scale that can competently perform a wide range of distinct tasks and be integrated into many different downstream systems — the EU AI Act's term for foundation-model-scale AI, subject to its own separate obligations track rather than the risk-tier system that governs most AI systems.
Governome Editorial Team
regulations us colorado
Colorado Rewrote Its AI Act: What SB 26-189 Changes Before 2027
Colorado's SB 24-205 was repealed and reenacted by SB 26-189 in May 2026. The new law drops the duty-of-care and impact-assessment framework in favor of notice, post-decision disclosure, human review, and record-keeping, with duties starting January 1, 2027.
Governome Editorial Team · 2 min read
regulations
High-Risk AI System
An AI system subject to heightened legal obligations because of what it's used for — not because of the underlying technology — typically because it materially affects access to employment, credit, healthcare, housing, or legal standing.
Governome Editorial Team
ai governance
AI Governance
The structure of accountability, review, and decision rights a company puts in place to control how it builds, buys, and deploys AI systems.
Governome Editorial Team
risk management
Algorithmic Bias
A systematic pattern in a model's outputs that disadvantages a particular group, arising from training data, feature selection, or optimization choices rather than random error.
Governome Editorial Team
regulatory checklists
EU AI Act High-Risk Classification Checklist
Step through this checklist before concluding an AI system falls outside the EU AI Act's high-risk category. It mirrors the actual two-track Article 6 test, not a simplified summary of it.
Governome Editorial Team · 2 min read
policy templates
AI Acceptable Use Policy Template
A practical AI acceptable use policy template covering approved tools, data handling rules, prohibited uses, and disclosure requirements. Adapt the bracketed sections before adopting it.
Governome Editorial Team · 3 min read
Board-level AI oversight usually fails in one of two directions: no oversight at all, or oversight so generic it doesn't change what management does. Here's what directors should actually be asking.
Governome Editorial Team · 3 min read
Most AI governance committees fail for the same reason most committees fail: no real decision authority, no clear charter, and no named accountability when something goes wrong. Here's what a working one actually looks like.
Governome Editorial Team · 3 min read
regulations australia
Australia AI Regulation
The National AI Plan (December 2025) dropped the proposed mandatory guardrails for high-risk AI and committed to relying on existing technology-neutral law. The most concrete new duty is the Privacy Act's automated decision-making transparency rule, in force from December 10, 2026.
Governome Editorial Team · 3 min read
regulations canada
Canada AI Regulation
Canada's proposed Artificial Intelligence and Data Act did not survive the federal legislative process. Here's what actually governs AI in Canada right now.
Governome Editorial Team · 2 min read
regulations uk
UK AI Regulation
The UK's pro-innovation approach empowers existing regulators like the FCA and ICO to apply shared AI principles within their own sectors, rather than passing a single comprehensive AI law.
Governome Editorial Team · 3 min read
frameworks
OECD AI Principles
The OECD AI Principles are the highest-level, most widely adopted AI governance principles internationally — the shared foundation most national AI policies, including the EU AI Act, build on.
Governome Editorial Team · 1 min read
regulations us california
California AI Regulations
California regulates AI through several parallel tracks rather than one comprehensive law: CPPA rulemaking on automated decision-making technology, generative AI disclosure statutes, and employment law amendments.
Governome Editorial Team · 4 min read
frameworks
ISO/IEC 23894
ISO/IEC 23894 adapts ISO 31000 risk management principles specifically for AI systems. It's guidance, not a certifiable standard — but it's the practical reference for the risk-assessment work ISO 42001 requires.
Governome Editorial Team · 2 min read
regulations us colorado
Colorado AI Act (SB 24-205 and SB 26-189)
SB 24-205 was repealed and reenacted by SB 26-189, signed May 14, 2026. The new law centers on notice, post-decision disclosure, human review, and record-keeping for automated decisions that affect consumers, with developer and deployer duties starting January 1, 2027.
Governome Editorial Team · 3 min read
frameworks
ISO/IEC 42001
ISO/IEC 42001 is a certifiable AI management system standard. Unlike the NIST AI RMF, an accredited body can actually audit you against it and issue a certificate.
Governome Editorial Team · 2 min read
regulations us
US Federal AI Regulation: What Actually Exists Today
There's no single federal AI law in the US. Here's what federal agencies have actually said about AI, and why existing law already covers more AI use cases than most companies assume.
Governome Editorial Team · 5 min read
The NIST AI RMF is a voluntary, four-function framework for managing AI risk. It carries real legal weight in the US: Colorado's original AI Act tied an affirmative defense to it, and regulators treat it as a benchmark for reasonable AI risk management.
Governome Editorial Team · 2 min read
regulations eu
The EU AI Act
The EU AI Act classifies AI systems into risk tiers and phases its obligations in on a multi-year schedule. Here's what's actually in force today, what's still phasing in, and how the risk tiers work.
Governome Editorial Team · 4 min read
Article 6 of the EU AI Act classifies a system as high-risk through a combination of Annex I product-safety overlap and Annex III use-case categories. Here's how the two-step test actually applies, with the exemption most teams get wrong.
Governome Editorial Team · 3 min read
Most AI governance frameworks fail for the same reason: they're written to look complete in a slide deck, not to survive contact with a real model deployment. Here's what to build first, in what order, and why the sequence matters more than the paperwork.
Governome Editorial Team · 4 min read