AI regulation in the U.S.: what Congress and agencies can do

AI regulation in the United States comes from several places: laws passed by Congress and state legislatures, agency rules and enforcement, executive orders, and court decisions. Voluntary standards also shape how organizations use AI, but they are not the same as legal requirements.

This guide focuses on federal decisions and how to follow them. The examples below were checked on September 10, 2026.

What counts as AI regulation?

Before treating an announcement as a new rule, check what was actually issued:

• A law: Congress has enacted requirements that apply to the people, organizations, or activities it covers.
• A bill: A proposal before Congress. Introduction or passage by one chamber does not make it law.
• Agency action: A proposed rule, final rule, or enforcement case. Check which one it is and the authority the agency cites.
• An executive order: Instructions from the president to the executive branch, subject to applicable law.
• A voluntary framework: Guidance organizations can choose to use. A separate legal or contractual requirement may make particular practices binding.

The Congressional Research Service's June 2025 report on AI regulation describes the federal mix of existing agency authority, targeted legislation, and voluntary approaches. Its account of what Congress had enacted is dated to that report; it is not a current list of every AI law.

What can Congress change?

Congress can pass AI legislation that creates new duties, changes an agency's authority, funds research, or sets rules for federal use of AI. It can also decide how a federal law interacts with state requirements. These choices can be combined; funding AI development and regulating particular harms are separate legislative decisions.

When comparing proposals for federal AI regulation, look for who is covered, what they must do, who enforces it, and when it takes effect. A title alone will not answer those questions.

Has Congress already passed AI legislation?

Yes. The TAKE IT DOWN Act, Public Law 119-12, was enacted on May 19, 2025. It addresses certain nonconsensual intimate images, including digital forgeries. It does not regulate every use of AI or every kind of deepfake.

Section 3 requires covered platforms to establish a notice-and-removal process. It sets a deadline of 48 hours after a valid removal request to remove the depiction and requires reasonable efforts to find and remove known identical copies. The law defines which platforms and requests are covered.

This is an example of targeted AI legislation: identify a harm, define the duty, and specify who must comply. Other bills may address different problems or use different enforcement mechanisms.

Can existing laws apply when someone uses AI?

Yes. Using AI does not remove duties under laws that already apply to the activity.

For example, the Justice Department announced a February 2026 settlement over AI-generated job advertisements. The department alleged that an employer's advertisements imposed citizenship-status restrictions not authorized by law. It used the Immigration and Nationality Act to address the alleged conduct.

That was a specific enforcement settlement under an existing law. It was not a new law governing all AI-generated advertising.

Do White House AI announcements change the law?

Check whether the announcement describes an executive order or asks Congress to pass legislation.

Executive Order 14365, issued in December 2025, directed federal work on state AI laws, litigation, funding conditions, and a proposed national framework. The order says it must be implemented consistently with applicable law. It does not, by itself, establish that every state AI law is invalid.

The White House's March 2026 legislative recommendations ask Congress to act on issues including child protection, intellectual property, infrastructure, and the relationship between federal and state rules. That document is a set of recommendations, not an enacted statute.

Is the NIST AI framework mandatory?

The NIST AI Risk Management Framework is intended for voluntary use. It helps organizations assess and manage risks from AI systems. NIST says version 1.0 is being revised.

Using the framework does not, by itself, establish compliance with every applicable law. Check separately whether a law, contract, or procurement requirement makes a particular practice mandatory.

How can I follow AI policy and contact Congress?

Start with the issue you care about. Modern Action has pages for AI discrimination and algorithmic accountability and AI deepfake election ads. These are different policy questions, even though both involve AI.

Use the Congress bill tracker to find relevant legislation, read its current status, and follow updates. Check the latest action before deciding what to ask an office to do.

To contact Congress about a bill, choose your position and the reasons behind it. Modern Action drafts a message for the relevant offices. Review the request and recipients, make any edits, and send when it reflects your view.