Field guide / Updated 2026-05-10

AI laws in 2026. Find the rule that applies to you.

There is no broad federal AI law in the United States. Rules live at the state level (Colorado, Texas, California, New York, Illinois), in the EU AI Act if your AI touches EU users, and in the voluntary standards Fortune 500 procurement teams now require (ISO/IEC 42001 and NIST AI RMF). This page is the field guide. Pick the entry point that fits.

By Northbeams editorial · reviewed quarterly

Pick the entry point that fits.

If you want a fast answer, start with one of these. Each card opens the right field-guide page.

Hiring, lending, housing, insurance "My AI tools touch consequential decisions about Colorado consumers." EU users in scope "My product is used by people in the EU." Procurement requirement "A Fortune 500 prospect asked for AI-management certification." US-only voluntary baseline "I want a free, voluntary US framework to start with." Texas in scope "We have customers or operations in Texas." California in scope "We're a frontier developer, healthcare AI vendor, or chatbot operator in California." AI in hiring interviews "We use AI to analyze recorded job-interview videos." Compliance audit incoming "My auditor asked: how do you govern employee AI use?"

At a glance.

Every law and standard covered on this site, in one table. Click a row to open the field guide.

Law / Framework Effective Who's covered Key requirement Enforcer
Colorado AI Act (SB 24-205) 2026-02-01 Deployers and developers of high-risk AI affecting Colorado consumers Risk program, annual impact assessments, consumer notice and explanation, 90-day discrimination report Colorado AG
Texas TRAIGA 2026-01-01 Companies developing, distributing, or deploying AI in Texas Prohibitions on discriminatory and manipulative AI uses Texas AG
California (SB 53, AB 2013, SB 942, AB 489, SB 243) 2026 staggered Frontier developers, generative AI providers, healthcare AI vendors, companion chatbot operators Risk frameworks, training-data disclosure, watermarks, healthcare disclosure, chatbot safety California AG, CPPA
New York RAISE Act 2025-12 / amended 2026-03 Companies deploying AI in New York Transparency and incident reporting New York AG
Illinois AI in interviews In effect Employers using AI to analyze recorded job-interview video Consent before use, retention limits, data destruction on request Illinois Dept of Labor
EU AI Act 2026-02 / 2026-08-02 Providers and deployers whose AI affects EU users Risk-tier obligations, Article 4 AI literacy, documentation, incident reporting National competent authorities, EU AI Office
US federal (Trump EO + AI LEAD Act) 2025-12 / pending Federal agencies primarily; AI LEAD Act would create product liability framework Preempt-state task force; pending product liability rules US AG, federal courts
ISO/IEC 42001 Voluntary Any organization that develops or uses AI Plan-Do-Check-Act AI management system, certifiable Accredited certification bodies
NIST AI RMF Voluntary Any US organization that develops or uses AI Govern, Map, Measure, Manage Self-attest; recognized as safe harbor by Colorado and others
ISO 27001 to 42001 stack Voluntary Existing ISO 27001-certified organizations adding AI governance Reuse 27001 management system to certify 42001 about 40% faster Accredited certification bodies
ISO 42001 vs NIST AI RMF Comparison Anyone choosing between the two Side-by-side and "which to pick" n/a

Field guide pages.

Each page is a self-contained brief. TLDR at the top, structured body, FAQ. Cite us, link us, share us.

US state laws

Colorado · Effective 2026-02-01 Colorado AI Act The first US state consumer-protection AI law. Covers high-risk AI in hiring, lending, insurance, housing, healthcare, education, and government services. Read brief → Texas · Effective 2026-01-01 Texas TRAIGA The Texas Responsible AI Governance Act prohibits discriminatory and manipulative AI uses. Read brief → California · 2026 staggered California AI laws Five laws in one stack: SB 53 (frontier AI), AB 2013 (training data), SB 942 (watermarks), AB 489 (healthcare), SB 243 (companion chatbots). Read brief → New York · Signed 2025-12 New York RAISE Act The Responsible AI Safety and Education Act covers transparency and incident reporting. Read brief → Illinois · In effect Illinois AI in interviews Consent rules for using AI to analyze job-interview videos. Niche but high-intent for employers. Read brief → US federal Federal AI policy The Trump executive order, the March 2026 White House framework, and the AI LEAD Act, in plain English. Read brief →

International law

European Union · 2026-02 / 2026-08-02 EU AI Act The most aggressive AI law globally. Risk-tier obligations, Article 4 AI literacy, penalties up to 7% of global revenue. Applies to non-EU companies whose AI touches EU users. Read brief → Lead magnet · 7-page PDF EU AI Act readiness PDF Free printable checklist: which articles apply to non-EU SMBs, what evidence auditors expect, the page auditors ask for. Email me the PDF →

Standards and frameworks

Standard · ISO/IEC 42001:2023 ISO/IEC 42001 The world's first AI management system standard. Plan-Do-Check-Act methodology. Now appearing in Fortune 500 vendor security questionnaires. Read brief → Framework · NIST NIST AI Risk Management Framework Govern, Map, Measure, Manage. Voluntary, free, and recognized as a safe harbor by Colorado and others. Read brief → Stacking guide ISO 27001 to ISO 42001 If you have ISO 27001, here's what 42001 adds. Certified shops report stacking 42001 about 40% faster than greenfield. Read brief → Comparison ISO 42001 vs NIST AI RMF Side-by-side comparison and a clear "which to pick" recommendation by company profile. Read brief →

Inventory first. Everything else flows from there.

Most of these laws assume you already know which AI tools your team uses, what data they process, and who reviewed each consequential decision. Most companies don't know.

That gap is what Northbeams catches. One platform, three install surfaces (browser, desktop, CLI). The classifier runs on-device so original prompt content never leaves the user's machine. You get the inventory. The audit-ready evidence pack writes itself.

  • 27 tools active in a typical 50-person company. Most companies count fewer than 5.
  • $670K breach cost premium when shadow AI is involved (IBM 2024).
  • 92% Northbeams catalogue coverage of the top-100 browser AI tools.
  • 4 desktop AI apps and 2 CLI agents watched on Mac and PC (Claude Desktop, ChatGPT Desktop, Cursor, Granola, Claude Code, Aider).

One install. One dashboard. The evidence pack auditors expect.

Free to discover. Pay to control. The fastest path from "we don't know what AI we use" to a defensible answer for any of these laws.

Start free → See the evidence pack Run the calculator