U.S. AI Law and AI Governance

U.S. AI law is a layered governance problem

There is no single legal question called “AI compliance.” A company should identify the use case, affected people, data sources, model provider, output, downstream decision and sector before selecting the relevant legal controls. Existing consumer-protection, privacy, employment, intellectual-property, contract, cybersecurity and sector-specific rules can apply to AI systems even where a rule does not use the term “artificial intelligence.”

NIST’s AI Risk Management Framework is voluntary, but it provides a useful governance vocabulary for mapping, measuring, managing and governing AI risk. NIST also released a Generative AI Profile addressing risks that are particularly relevant to generative systems. In 2026 NIST stated that AI RMF 1.0 is being revised, which is a reminder that governance programs should be designed to absorb change rather than freeze around one version of guidance.

AI claims require evidence before they become sales language

The FTC’s advertising framework is directly relevant to AI product claims because objective claims should have a reasonable basis before dissemination. Statements such as “eliminates hallucinations,” “fully compliant,” “bias free,” “secure,” “private,” or “more accurate than humans” can create risk if their scope and evidentiary basis are unclear.

AI evaluation should therefore be connected to the specific deployment context. A benchmark result obtained on one dataset does not automatically substantiate a claim about another customer population, workflow or model version. Legal review should ask what the claim means to a reasonable customer, what evidence supports that meaning, what limitations are material and how frequently the evidence should be refreshed.

High-impact AI uses need stronger evidence and escalation

Not every AI use justifies the same control burden. A risk-based approach should increase the level of evidence when an AI system influences employment, credit, healthcare, safety, access to important services, legal rights or other consequential outcomes. In those settings, the organization should document the intended use, excluded uses, validation context, known limitations, human-review authority, override procedure, monitoring and incident escalation. The evidence should be specific enough to show why the system is suitable for the actual deployment rather than for AI in the abstract.

Vendor documentation is useful but not sufficient when the customer configures the workflow or supplies material data. The deployer should understand which parts of the system were tested by the vendor and which arise from its own prompts, retrieval layer, business rules, integrations or user population. This distinction helps prevent a common failure mode: relying on a general model card or benchmark to support a much narrower real-world decision.

Where the legal environment is uncertain, governance can still be concrete. The company can limit use, require approval, preserve logs, add human review, restrict sensitive data, test claims and define triggers for renewed legal analysis. Those controls do not answer every legal question, but they reduce the risk of making unsupported assumptions while the use case evolves.

AI governance should produce an updateable decision record

A mature program should be able to answer: what AI is being used, for what purpose, under whose authority, with what data, against what risks, with what evidence, and with what monitoring. That record should be proportionate to the importance of the use case. High-impact or regulated uses warrant stronger evidence, clearer escalation and tighter change control than low-risk internal experimentation.

The objective is not to accumulate policies. It is to connect policy to deployment. A policy that forbids sensitive data in public models is useful only if access controls, approved-tool lists, training and monitoring make the rule operational. The same principle applies to model evaluations, human review, vendor diligence, incident response and record keeping.

These sources provide current federal starting points. State, sector and fact-specific rules may add or change obligations.

Focused AI governance and contracting research

These newly researched pages extend the current cluster with distinct U.S. legal and compliance intents. Each page uses the same evidence, passage and canonical standards as the governing SOP.

AI-career research: Review AI attorney and AI counsel careers for current role families, skills and employer patterns.