AI Laws Are Here: What U.S. Businesses Need to Know Now

Artificial intelligence is no longer a futuristic buzzword or a side project for tech giants. From hiring and healthcare to marketing and customer service, AI is embedded in the operations of businesses across the country. What many companies still overlook, however, is that AI is already regulated — not just in theory, but in binding laws and enforceable policies.

If your business uses, builds, or buys AI tools, some of these laws may already apply to you. Others are right around the corner. Here's a primer on some of the key rules that may be impacting your business now.

Federal Laws and Regulations

National Artificial Intelligence Initiative Act (2020)

Part of the National Defense Authorization Act for FY 2021, this law established the National AI Initiative Office to coordinate federal R&D (42 U.S.C. § 9401 et seq.). While not a direct source of business regulation, it shapes the national agenda on AI development and federal funding.

Executive Orders

• EO 14110 (Oct 2023) on “Safe, Secure, and Trustworthy AI” has been rescinded.
• EO 14179 (Jan 23 2025) now directs agencies to “remove regulatory barriers” to AI innovation and to file an inter-agency AI Action Plan by July 2025. Until that review is complete, earlier OMB guidance (Mar 2024) is best treated as background rather than operative rulemaking.

Federal Aviation Administration Reauthorization Act (Pub. L. 118-63, § 1024, 2024)

Tasks the FAA with reviewing and, where necessary, regulating AI and machine-learning systems used in aviation safety, traffic management, and airport operations.

National Defense Authorization Act for FY 2019

Directed the Department of Defense to develop ethical frameworks and oversight structures for military AI (10 U.S.C. § 4061 note). Relevant if your company contracts with the federal government or works in defense tech.

Cross-Cutting Federal Laws Used to Regulate AI

Several longstanding laws are now being used to challenge or regulate AI-based systems:

•  Federal Trade Commission Act(15 U.S.C. § 45). Section 5 unfair-practice actions now target deceptive or biased AI.
•  Equal Credit Opportunity Act(15 U.S.C. § 1691 et seq.). Credit and lending algorithms must explain adverse actions.
•  Title VII of the Civil Rights Act(42 U.S.C. § 2000e et seq.). Applies to AI-based employment decisions around hiring and promotion.
•  Americans with Disabilities Act(42 U.S.C. § 12101 et seq.). AI interfaces must remain accessible to people with disabilities.

State AI Laws and Regulations

California Consumer Privacy Act (CCPA), as amended

The CCPA (Cal. Civ. Code § 1798.100 et seq.) regulates personal data used in automated decision-making. AB 2013(signed 2024; effective Jan 1, 2026) adds a requirement that generative-AI developers disclose high-level training-data details and give consumers a right to opt out of AI-driven profiling.

Colorado AI Act (SB 24-205, signed May 17 2024; effective Feb 1 2026)

Targets high-risk AI systems making consequential decisions (employment, housing, credit, healthcare). Developers and deployers must perform impact assessments, provide notices, and exercise “reasonable care” to prevent algorithmic discrimination.

Utah Artificial Intelligence Policy Act (SB 149, effective May 1 2024)

Requires disclosure whenever generative-AI tools interact with the public in regulated contexts (e.g., healthcare, financial advice). Non-compliance can trigger fines up to $2,500 per violation (Utah Code § 13-2-9).

Illinois Artificial Intelligence Video Interview Act (AIVIA, 820 ILCS 42/1 et seq., effective 2020)

Employers using AI to analyze video interviews must notify applicants, obtain written consent, and delete videos within 30 days of a request.

Illinois Human Rights Act (amended by HB 3773, effective Jan 1 2026)

Adds a prohibition on discriminatory use of AI in employment, including algorithmic proxies such as ZIP codes (775 ILCS 5/2-103(B-5)).

Tennessee ELVIS Act (HB 2091, effective July 1 2024)

Extends the state’s right-of-publicity statute to voice likenesses, targeting unauthorized AI deep-fake vocals used in advertising or entertainment (Tenn. Code § 47-25-1104).

California AI Transparency Act (SB 942, effective Jan 1 2026)

Requires generative-AI developers with ≥1 million monthly active users to embed manifest and latent watermarks in AI-generated media and to provide free public detection tools (Cal. Bus. & Prof. Code § 22765 et seq.).

Minnesota AI Legislation

Minnesota has been particularly active in regulating AI, with several enacted laws and notable proposals:

•  Deepfake Election Law (Minn. Stat. § 609.771; 2023): Criminalizes distribution of AI-generated content intended to deceive voters within 90 days of an election.
  • On April 23, 2025, X Corp. (formerly known as Twitter), filed a lawsuit challenging this statute on First Amendment grounds. See X Corp. v. Ellison, (D. Minn., case no. 25-cv-01649-LMP-DLM); see also Moody v. NetChoice, LLC, 603 U.S. 707, 744 (2024) (discussing curation of social media content as protected speech).
•  Non-Consensual Explicit Deepfakes (Minn. Stat. § 604.32): Creates civil and criminal penalties for disseminating fake explicit content created with AI.
•  Minnesota Consumer Data Privacy Act (effective July 31 2025): Gives consumers rights to know and opt out of profiling that produces “legal or similarly significant effects.”
•  Proposed Business Communication Disclosure (SF 1886): Would require businesses using AI in consumer interactions to disclose the use of AI and offer a human alternative.
•  Proposed Nudification-App Ban (SF 1119): Would impose civil penalties on developers of AI tools used to create non-consensual explicit content.
•  Proposed Neurodata Rights Bill (SF 1240): Aims to protect individuals from unauthorized use of brain-activity data.

Businesses operating in Minnesota should monitor these proposals as they advance and review existing policies to comply with the Minnesota Consumer Data Privacy Act before July 31, 2025.

Other Relevant Laws Being Applied to AI

Illinois Biometric Information Privacy Act (BIPA)

Not specific to AI, but used extensively in facial-recognition and voiceprint litigation. Requires informed written consent and restricts retention and disclosure of biometric data (740 ILCS 14/1 et seq.).

State Privacy Laws (e.g., Virginia CDPA, Connecticut DPA, Texas TDPSA, Oregon OPA)

Each regulates automated decision-making and profiling, often granting consumers rights to opt out or demand an explanation.

Intellectual Property Law

Federal courts continue to hold that purely AI-generated works are not protected by copyright (e.g., Thaler v. Perlmutter, 2023). Ongoing litigation is testing whether training AI on copyrighted data infringes existing rights.

What This Means for Your Business

•  If you use AI in hiring, credit scoring, medical advice, customer service, or content creation, some of these laws may already apply.
•  If you are developing or customizing AI systems, expect transparency, fairness, and disclosure obligations in California, Colorado, and Illinois by 2026.
•  If you operate across states, prepare for a fragmented compliance map and keep abreast of federal agency rule changes driven by EO 14179.

If you are wondering whether your AI use is on solid legal footing, we can help.

Get in touch to schedule an AI compliance check-in. Your business may already be subject to AI laws. Be ready.