US Federal AI Regulation: What Actually Exists Today

Congress has not passed a comprehensive federal AI statute comparable to the EU AI Act, and no enacted bill is close enough to a floor vote to treat as imminent. That doesn't mean AI is unregulated at the federal level — it means federal AI regulation runs through existing law and agency guidance rather than a purpose-built statute.

What federal agencies have actually done

Several agencies have issued guidance applying their existing authority to AI systems, without needing new legislation — and figuring out which one actually has jurisdiction over a specific product usually comes down to what the product does rather than the fact that it's AI, which is why we built a decision guide for mapping an AI use case to the right federal agency:

• The FTC has repeatedly stated that using a biased or opaque algorithm to make consequential decisions can itself violate the FTC Act's prohibition on unfair or deceptive practices — the agency's position is that existing consumer protection law already reaches most AI harms. See our deeper breakdown of the legal theory behind the FTC's AI enforcement record for what that actually looks like case by case.
• The EEOC has addressed how existing employment discrimination law (Title VII and the ADA) applies when an employer uses algorithmic tools — including software, not just AI narrowly defined — for hiring, promotion, or other employment decisions; see our breakdown of what the EEOC's now-withdrawn AI guidance actually said, and why the withdrawal didn't change the underlying law for the vendor-liability point and the real enforcement record behind it.
• The CFPB has confirmed that existing fair lending law (ECOA) applies fully to AI-driven credit decisions, including the requirement to provide specific, accurate adverse-action reasons — a requirement that "the algorithm decided" does not satisfy.
• The SEC has charged investment advisers and, in one case, a public company with securities fraud and disclosure violations for overstating what their AI actually does — no new "AI-washing" rule, just Advisers Act and Exchange Act provisions that already governed false claims to investors.
• The FDA doesn't have a separate approval track for AI at all — AI/ML-based medical software goes through the same 510(k), De Novo, and PMA device pathways as any other medical device, with one AI-specific addition (the Predetermined Change Control Plan) layered on top for models that keep changing after clearance.
• The FCC confirmed in February 2024 that an AI-generated or cloned voice is still an "artificial voice" under the TCPA's decades-old robocall consent rules — see our breakdown of the ruling, the New Hampshire case that triggered it, and the disclosure rule that's still only proposed — for what that means for anyone using AI voice technology in outbound calling.

Layered on top of all of this is a separate, faster-moving track: a sequence of presidential executive orders, running from 2019 through 2025, that has directed how agencies prioritize and govern AI even though none of it required Congress — including the one order, since rescinded, that triggered several of the guidance withdrawals mentioned above. See our full history of US federal AI executive orders for the complete timeline and why that layer of policy is the least durable one to build a compliance program around.

Why "no federal AI law" doesn't mean "no federal exposure"

The practical mistake we see most often: a company checks whether a federal AI-specific statute applies, finds none, and treats federal compliance as a non-issue. But existing federal law — anti-discrimination law, consumer protection law, sector-specific banking and lending regulation — already applies fully to AI-driven decisions. The absence of AI-specific federal legislation doesn't create a gap; it means the applicable law is older and less obviously AI-related, which makes it easier to miss.

Where the real action is

For US companies, the state statutes are where AI-specific obligations are actually being created right now. Colorado rewrote its AI Act in 2026 (SB 26-189, with duties starting January 1, 2027); California is regulating through several parallel tracks. See our state-by-state coverage for current status.

Selling to the government is governed differently than being regulated by it

Everything above covers federal agencies regulating AI companies from the outside. A separate question applies to any company selling AI to a federal agency directly: what rules govern that contract itself. That runs through OMB acquisition memoranda and a still-evolving GSA contract clause rather than any of the statutes above — see our breakdown of the current federal AI procurement rules for what actually binds a federal AI contract today.

Federal legislative activity to watch

Nearly 400 bills mentioning AI have been introduced across recent congressional sessions, covering topics from AI transparency to sector-specific rules, and none has advanced to enactment as of this writing. That's not simple inaction — our breakdown of why the US doesn't have a federal AI law covers the fragmented committee jurisdiction behind it, the House AI Task Force's own recommendation against one comprehensive bill, and the ongoing fight over federal preemption of state AI laws that's now spilled into an executive order and DOJ litigation — and our closer look at that preemption fight covers the specific legal theories involved and how far they've actually gotten against a real state statute. We track this page's status field for material movement rather than covering every bill introduction as news.

Not sure which of these applies to you? Use our Which AI laws apply to me? checker.