US AI rules: federal agencies, executive orders and the states

Why there's no single law

The EU wrote one AI Act. The US has, so far, done three other things:

1. Told its own agencies how to use and buy AI, through executive orders and memos from the Office of Management and Budget (OMB).
2. Applied laws it already had (consumer protection, civil rights, credit) to AI.
3. Left the rest to the states, which have been filling the gap, and are now being pushed back on.

Enlarge (opens the diagram full size)

Close

The executive orders, in order

An executive order is the President directing the executive branch: agencies, their staff, their spending and their contracts. It can't change a statute, and it doesn't, by itself, put duties on private companies. What it does is set what agencies do next.

Layer 1: rules for federal agencies

M-25-21: using AI

OMB memo M-25-21 (April 3, 2025) replaced the 2024 memo M-24-10. Its tone is "accelerate", but it keeps a core of governance. Each agency must:

• name a Chief AI Officer and set up an AI governance board;
• publish an AI strategy and keep a public inventory of AI use cases, updated every year;
• apply minimum practices to high-impact AI: AI whose output is a principal basis for decisions with a legal, material, binding or significant effect on people's rights or safety. The memo presumes some uses are high-impact, including federal benefits, federal employment, healthcare, biometrics, immigration and asylum, crime forecasting and critical infrastructure.

The seven minimum practices:

1. Test before deployment, in conditions like real use.
2. Complete an AI impact assessment: purpose, data, expected benefits, risks and how they're handled.
3. Monitor performance and adverse impacts on an ongoing basis.
4. Train and assess the people who operate it.
5. Provide human oversight, intervention and accountability for decisions.
6. Offer consistent remedies or appeals to people affected.
7. Consult end users and the public, and use what they say.

If a high-impact use can't meet them, the agency must safely stop using it, unless the Chief AI Officer grants a written, tracked, public waiver. The memo gave agencies 365 days to document the practices (April 2026). Some trackers report a later reporting date of September 22, 2026; I couldn't confirm an official extension, so check the agency's own compliance plan.

M-25-22: buying AI

M-25-22 applies to contracts from solicitations issued from October 1, 2025. It asks agencies to prefer AI made in the US, to bring together contracting, IT, security, privacy and legal staff before buying, and to put into contracts: testing rights before and after award, who owns the data, limits on using agency data to train the vendor's models, and terms that avoid vendor lock-in.

M-26-04: buying language models

M-26-04 (December 11, 2025) implements the "Preventing Woke AI" order. Agencies buying large language models must require two Unbiased AI Principles: truth-seeking (accurate, acknowledges uncertainty) and ideological neutrality (no deliberately encoded partisan judgments unless the user asks). At minimum, vendors supply an acceptable use policy, model or system cards, end-user resources, and a way to report outputs that break the principles. Agencies may ask for more, such as bias evaluations. Agencies had to update their procurement policies by March 11, 2026; the memo expires in December 2027 unless renewed. Critics point out it sets no test for "neutral": compliance rests on what vendors report.

Why this matters outside government: the federal government is a huge buyer. Testing rights, model cards, data terms and incident reporting written into federal contracts tend to become what every large customer asks for.

Layer 2: laws that already apply

None of these was written for AI. All of them apply to it.

• The FTC Act, Section 5, bans unfair or deceptive practices. Overstating what an AI product does, or hiding what it does with people's data, is a deception case. In 2026 the FTC sent investigative demands to large AI companies, and proposed a policy statement on AI accuracy (below).
• Civil rights and employment law. An employer that screens out applicants with a biased tool is responsible for the result, whoever built the tool.
• Credit and consumer reports. Lenders must give specific reasons for a denial, and consumer reports must be accurate. A model making the call doesn't change either.
• Privacy, product liability and sector rules (health, finance, insurance) apply in their own areas.

Layer 3: state AI laws

There are many more narrow laws: election deepfakes (about 30 states), chatbots and minors, AI disclosure in health care, and California's training-data transparency law (AB 2013). Two patterns stand out. Frontier model laws (California, New York) target a handful of large developers. Decision laws (Colorado, Illinois, New York City) target anyone using AI to decide about jobs, credit, housing and the like, which is where most engineers will meet them.

Colorado is the cautionary tale: its 2024 law, the first broad one in the US, was delayed twice and then repealed and replaced in May 2026 with narrower duties, before a single obligation took effect.

The federal push against state laws

Executive Order 14365 (December 11, 2025) aims for one national standard by pressing on state laws it calls "onerous". It directed:

• a Justice Department AI Litigation Task Force to challenge state AI laws in court;
• the Commerce Department to identify onerous state laws (I haven't found a published list);
• funding conditions: states with such laws lose eligibility for some broadband (BEAD) money not used for deployment;
• the FCC to consider a federal AI disclosure standard that would override state ones;
• the FTC to say when state laws requiring AI to "alter truthful outputs" conflict with the FTC Act. It proposed a policy statement in July 2026;
• a legislative proposal for Congress, with carve-outs such as child safety.

What's happened since:

• Courts. The task force joined xAI's lawsuit against Colorado in April 2026. Colorado agreed not to enforce until a ruling on an injunction. There's been no merits ruling, and no court has struck down a state AI law on preemption grounds.
• Congress. The Senate removed a 10-year state moratorium from a bill 99 to 1 in July 2025. A House discussion draft in June 2026 would pause state rules on model development for three years; it hasn't been introduced as a bill.
• States. The laws above stay in force until a court, Congress or the state itself changes them.

The legal limit is simple: only Congress can preempt state law by statute, and an agency can preempt only with authority Congress gave it. An executive order can start lawsuits and attach conditions to federal money; it can't erase a state law on its own.

Which of this touches CivicGrid?

Work through it the same way as Lesson 4. (Still not legal advice.)

1. Federal agency rules? Only if a federal agency buys from CivicGrid. Then M-25-22's contract terms would apply to the contract. M-26-04 covers language models sold to agencies; CivicGrid sells data, not a model, though an agency could still ask how the data was produced.
2. Existing laws? The FTC Act applies to what CivicGrid says about its data. "Every mayor verified" would need to be true. The site's accurate claim (a model proposes, a person approves) is the safe one.
3. State AI laws? The mayor check makes no decision about a person, so Colorado's, Illinois's and New York City's decision rules don't apply. It's not a frontier model, so SB 53 and RAISE don't. Texas TRAIGA's bans are about intent to harm, manipulate or discriminate, which it has none of.
4. The Texas pilot. TRAIGA puts extra duties on government agencies in Texas, such as telling people when they're interacting with AI. If a Texas city ever used CivicGrid data in an AI system that talks to residents, that duty would be the city's, and the city would ask CivicGrid how the data was made. The run logs and review trail answer that.

So: no new legal duties today. The work is keeping claims honest and records ready, because customers, especially government ones, will ask.

Spot the problem

Work out what's wrong before you read the explanation.

"The executive order cancels it." A startup sells an AI tool that screens tenant applications, and has customers in Colorado. In December 2025, after Executive Order 14365, its founder tells the team to drop the work on notices, explanations and appeals for Colorado: "The President has preempted state AI laws." The team stops. What's wrong? An executive order doesn't preempt a state law. It directs federal agencies: to sue, to set funding conditions, to issue statements. Until a court strikes the law down, Congress passes a preemption statute, or the state changes it, the law stands. Colorado did change its law, in May 2026, but the replacement still requires notice, explanation of adverse outcomes, data correction and human review for consequential decisions like housing, from January 1, 2027. The team lost a year. Three fixes: read what an order actually directs, and to whom; track the state law itself, including rewrites; and build the common controls (notice, explanation, correction, review) that most frameworks ask for anyway.

Where you are now

You can map the three layers of US AI rules, say what the federal memos require and how they reach companies, name the main state laws and when they apply, explain what Executive Order 14365 can and can't do, and work out which rules touch a real system. The next lesson starts the practical half of the track: building an AI inventory, the first thing every framework and law in Lessons 2 to 5 asks for.

Check yourself

Key terms

• Executive order: a President's directive to the executive branch. It binds agencies, not private companies or states directly.
• OMB memo: guidance from the Office of Management and Budget telling agencies how to carry out policy.
• Chief AI Officer (CAIO): the official each agency names to lead its AI use and governance.
• High-impact AI: under M-25-21, AI whose output is a principal basis for decisions with significant effects on rights or safety.
• AI use case inventory: an agency's public list of how it uses AI.
• Preemption: federal law overriding state law, by an act of Congress or an agency acting under authority Congress gave it.
• Frontier model: a very large, highly capable model, the target of laws like California SB 53.
• Consequential decision: a decision with a significant effect on someone's access to jobs, credit, housing, insurance, education or similar, the target of laws like Colorado's.

Go deeper

• OMB M-25-21 (opens in a new tab), Accelerating Federal Use of AI, and M-26-04 (opens in a new tab), Unbiased AI Principles.
• The White House: Ensuring a National Policy Framework for AI (opens in a new tab) (EO 14365).
• Ropes & Gray: the limits of the federal push to override state AI law (opens in a new tab).
• Arnold & Porter: the FTC's proposed policy statement on AI accuracy and preemption (opens in a new tab).
• Try: find one federal agency's AI use case inventory and pick a use marked high-impact. Which of the seven minimum practices would be hardest for it?
• Try: list the states your work touches. For each, is there a decision law, a frontier law, or neither?