The United States does not have a single federal AI statute comparable to the EU AI Act. Instead, enterprises face a layered landscape: executive-branch policy, agency enforcement, sector rules, procurement requirements, and a rapidly growing set of state laws. Governance programs must be flexible enough to map one internal workflow to multiple external obligations.

Federal direction

White House and agency guidance has emphasized safe, secure, and trustworthy AI development — with NIST's AI Risk Management Framework as the voluntary baseline most large enterprises adopt. Federal contractors increasingly face AI-related contract clauses. Agencies including the FTC, CFPB, EEOC, and HHS apply existing consumer protection, fair lending, employment, and health authorities to AI systems — meaning "no AI law" does not mean "no liability."

NIST AI RMF as the US lingua franca

Govern, Map, Measure, Manage translates into operational controls: deploy gates (Govern/Manage), structured intake (Map), compliance tests (Measure), and runtime enforcement (Manage). Organizations selling to federal customers or operating in regulated sectors should treat NIST alignment as de facto mandatory.

The state patchwork

Colorado's AI Act imposes duties on deployers of high-risk AI systems — impact assessments, notice, and appeal rights. California has passed transparency and frontier-model safety measures affecting developers and deployers. Utah, Texas, and other states have enacted narrower AI disclosure or government-use rules. Multistate operators cannot assume one compliance template fits all.

Practical enterprise response

  • Maintain an AI system inventory with jurisdiction tags per deploy
  • Use governance intake to capture use case, data, and affected decisions — inputs for both federal and state assessments
  • Automate risk tiering and control mapping (Regal AI) to speed review without skipping GRC accountability
  • Enforce approved policy at runtime with auditable logs — evidence for any agency inquiry

openRegal's deploy-to-runtime workflow gives US enterprises a single governance spine they can map to NIST, state acts, and sector regulators — without rebuilding process per jurisdiction.