The US AI Rules,Industry by Industry

The United States has no single AI law. Instead, industry regulators and state legislatures are each writing their own rules, while the federal government tries to override some of the state laws. For a company using AI, that means the question is not "Are we covered?" but "Which rules cover which of our AI uses?"

This guide answers that question by industry, as of October 2026.

The baseline that applies to almost everyone

One more moving part: a December 11, 2025 executive order created a Department of Justice task force to challenge state AI laws. Some state rules may change or be blocked, which is one reason to build on a framework like the NIST AI RMF that holds up whatever happens to individual laws.

Financial services

On April 17, 2026, the Federal Reserve, OCC and FDIC replaced the long-standing SR 11-7 model risk guidance (OCC Bulletin 2026-13, SR 26-2). The new guidance covers traditional models and non-generative AI. It explicitly leaves generative and agentic AI out of scope, while telling banks to apply their own risk management to those systems. In practice, that means banks need their own controls for chatbots, copilots and AI agents, on top of model inventories, validation and fair lending reviews. More on the generative AI gap.

Insurance

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers has been adopted by 25 states and the District of Columbia. It expects a written AI systems program, senior management accountable to the board, and due diligence on AI vendors, including the right to audit or receive audit reports.

Healthcare

Under the Section 1557 rule, covered providers have had to comply since May 2025: make reasonable efforts to identify patient care decision support tools that use race, color, national origin, sex, age or disability as inputs, and reduce the risk of discrimination from their use. That requires an inventory of clinical algorithms and AI, which many providers still lack. HIPAA continues to govern patient data that flows into AI tools.

Employers in every industry

Hiring and HR are where AI rules overlap most. Illinois has prohibited discriminatory use of AI in employment decisions, and required notice, since January 1, 2026. New York City requires bias audits for automated hiring tools. California and Colorado add notice, explanation and review rights from January 1, 2027. See the hiring AI checklist.

Government contractors

From November 10, 2026, DoD contracts begin to require CMMC Level 2 certification by a third-party assessor. Any AI tool that stores or processes Controlled Unclassified Information falls inside that scope, and DFARS 252.204-7012 requires such cloud services to meet the FedRAMP Moderate baseline or equivalent. Companies selling AI to federal agencies also face the OMB M-25-22 acquisition requirements for solicitations issued from October 1, 2025.

Technology and AI vendors

For software companies, the pressure comes mostly from customers. Enterprise security reviews now ask how vendors govern AI, and ISO/IEC 42001, a certifiable AI management system standard, gives buyers a common yardstick. California's training-data transparency law (AB 2013) took effect January 1, 2026.

Where to start

1. Inventory every AI use, including AI features switched on inside software you already buy.
2. Tier each use by risk. Decisions about people and sensitive data come first.
3. Map each high-impact use to the rules above and close the gaps, starting with notices, human review and vendor contracts.