United States:Federal Direction Meets State Enforcement
Federal instruments issued from December 2025 onwards are reshaping the landscape, California’s transparency law became operative in August 2026, and Illinois’s first-in-nation AI safety-audit law lands January 2027. The companies that thrive will be those with governance infrastructure that satisfies every track.
The Dual-Track Reality
Federal AI Policy: Three Coordinated Instruments
Between December 2025 and March 2026, the federal government issued three instruments that collectively reshape AI governance. The Administration’s unified national approach creates new dynamics for businesses operating across jurisdictions.
DOJ AI Litigation Task Force
Established to pursue a unified national framework by addressing state laws that may create barriers to interstate commerce. Signals federal intent to shape — not just observe — the AI regulatory landscape.
Commerce Dept. Evaluation
Comprehensive review of state AI laws, identifying approaches that align with or diverge from federal policy objectives. Creates a roadmap for potential federal preemption or harmonization.
FTC Proposed Policy Statement
A proposed FTC policy statement dated 30 June 2026 addresses the suppression of accuracy in AI systems. It is a proposal and is not final. Separately, Section 5 of the FTC Act already applies to deceptive or unfair AI-related conduct, with civil penalties of up to $50,120 per violation per day.
NIST AI Risk Management Framework: The Federal Standard
The Administration’s preferred voluntary standard provides a roadmap that aligns with federal objectives
Colorado’s AI Act explicitly recognizes NIST AI RMF compliance as an affirmative defense. Companies that align their governance infrastructure with this framework are better positioned for both federal reviews and state enforcement actions.
Existing Federal Law Already Reaches AI Conduct
Section 5 of the FTC Act applies to deceptive and unfair conduct today, including conduct involving AI systems. Governance infrastructure matters not only because states mandate it, but because federal consumer-protection law already reaches how AI systems are described and how they behave.
Where Section 5 Exposure Arises in AI Systems
What This Means for Businesses
AI accountability is reachable under existing federal law, not only under state mandates. Section 5 applies to AI-related claims and conduct today.
Companies with documented AI governance records are better positioned for FTC reviews, state enforcement actions, and EU conformity assessments.
The NIST AI Risk Management Framework — the Administration’s preferred voluntary standard — provides a roadmap that aligns with federal objectives.
Jurisdiction-neutral governance records serve as business insurance that holds up under any regulatory framework — federal, state, or international.
Illinois: The First-in-Nation AI Safety-Audit Law
Illinois SB 315 — the Artificial Intelligence Safety Measures Act — is the first US statute to mandate annual, independent, third-party safety audits of frontier AI developers. It moves audit-based accountability from voluntary practice to enforceable law.
What SB 315 Requires
- Independent Third-Party Audits: Annual audits by conflict-free auditors with frontier-model safety expertise — the first such US mandate
- Frontier AI Frameworks: Published, annually updated plans to identify, disclose and mitigate “catastrophic risks”
- Incident Reporting: Critical safety incidents reported to the state within 72 hours (24 hours if imminent risk of death or serious injury)
- Whistleblower Protections: Confidential internal channels and legal protection for employees raising safety concerns
Who Is Covered & When
- Frontier Developers: Companies with more than $500M annual gross revenue that train models above defined compute thresholds
- “Catastrophic Risk” Defined: Foreseeable harm contributing to death or serious injury of 50+ people, or over $1B in property damage
- Effective Jan 1, 2027: Core obligations begin, with independent third-party audit requirements phasing in through 2028
- Federal Interoperability: Illinois may recognize future federal standards deemed “substantially equivalent”
Why SB 315 Validates Regitech’s Approach
SB 315 turns independent audit and continuous evidence into a legal baseline — exactly the assurance layer Regitech was built to provide. Annual audits are only credible when the underlying monitoring and evidence exist year-round, not reconstructed after the fact.
Continuous monitoring and tamper-evident, provenance-backed trails give auditors verifiable evidence of safety controls operating.
A neutral, conflict-free assurance layer aligns with the statute’s demand for structurally independent audits.
As other states and regulators follow Illinois, one SB 315-aligned methodology extends across the wider compliance map.
State Enforcement: Active Regardless of Federal Developments
While the federal government pursues a unified national approach, California’s transparency law is on schedule and Colorado has reset its framework. Companies need governance infrastructure that satisfies every track.
Colorado: SB 24-205 → SB 26-189
- Original Act Repealed: SB 24-205 was repealed before taking effect and replaced by SB 26-189, signed May 14, 2026
- New Model: Shifts from “high-risk” impact assessments to transparency and consumer-rights rules for automated decision-making technology
- Consumer Rights: Developer documentation, consumer notice, and a right to human review of consequential decisions
- Effective Jan 1, 2027: Enforced by the Colorado AG under the Consumer Protection Act, with a 60-day right to cure
California CAITA (SB 942)
- Content Provenance: AI-generated content must carry machine-readable provenance metadata
- Watermarking: Covered providers must embed persistent, tamper-resistant watermarks in AI outputs
- Detection Tools: Must provide free tools enabling users to determine if content is AI-generated
- 18+ Covered Providers: OpenAI, Google, Meta, Microsoft, Anthropic, Adobe, and growing
Colorado Reset Its AI Law. Healthcare Leaders Still Need to Prepare
“Colorado has not abandoned AI accountability. It has changed the framework.” HIPAA-covered entities and their business associates are largely exempt from the statute’s core provisions — but a covered entity must still provide patients with a general notice of its use of advanced technologies, financial-assistance decisions trigger specific disclosures, and employment decisions remain in scope.
By Dr Ranse Howell and Laura Glennie, MBA, BSN · October 2026
California SB 1000: The Recast of the AI Transparency Act
SB 1000 (authored by Senator Josh Becker) substantially amends and recasts the California AI Transparency Act — the same law shown above as SB 942, as amended by AB 853. It passed both chambers in late August 2026, was presented to Governor Newsom on September 2, 2026, and was signed on September 30, 2026. As an urgency statute it took effect immediately upon signature.
Scope Expansion — No More User Threshold
SB 1000 removes the one-million monthly-user threshold from the “covered provider” definition. Smaller generative-AI developers previously outside CAITA are brought directly within scope — a material widening of who must comply.
“Disclosure Verification Tool”
The free public “AI detection tool” is renamed the “disclosure verification tool” and must be made available to users at no cost — reframing the mechanism around verifying provenance disclosures rather than detecting AI.
Latent Disclosure: Created vs Altered
Latent disclosures must now specify whether the GenAI system created or altered the content, alongside the provider name, version, date/time and a unique identifier — all machine-readable. The requirement to offer users an optional manifest disclosure is removed.
Assistive-Technology Exemption
CAITA’s operation is delayed until January 1, 2029 for GenAI designed primarily as assistive technology. Falsely representing a system as assistive technology to evade compliance carries a $50,000 civil penalty per violation.
SB 1000 widens the population of covered providers and tightens the technical content of disclosures. Organisations that scoped compliance to the former one-million-user threshold should reassess their position against the amended Act. The bill also revises third-party licensee noncompliance procedures and privacy protections.
California’s AI Audit Infrastructure: SB 813 & AB 1405
On September 9, 2026, Governor Newsom signed two complementary — but legally distinct — laws creating the first statutory framework in the United States for independent, third-party evaluation of AI systems. Together they regulate the assurance layer around California’s expanding AI obligations, replacing self-assessment with state-supervised independent review.
SB 813: Independent Verification Organizations
- Independence: no operational or management dependence on an assessed party or its affiliates
- Conflict management & methodology: disclosed benchmarks; outcome-independent, market-rate compensation
- Cybersecurity & integrity: suspension or termination for lapses, misrepresentation, or compromised independence
AB 1405: The AI Auditor Registry
- Public registration: unique registration numbers, service descriptions, and a misconduct-reporting mechanism
- Independence rules: no auditing one’s own work, no objectivity-impairing relationships, no concurrent employment negotiations
- Standardized reporting: scope, objectives, results, deficiencies, and a signed compliance statement
Why This Validates Regitech’s Approach
California is building the professional assurance market Regitech was designed to serve. The near-term opportunity is organizational readiness, not an assumption of automatic eligibility — building auditable independence, conflict management, documented methodology, evidence retention, and cybersecurity before designation and registration requirements are finalized.
A neutral, conflict-free assurance layer with outcome-independent engagement terms maps directly onto the IVO and AB 1405 independence standards.
Continuous monitoring and tamper-evident, provenance-backed trails produce the documented methodology and evidence standards designation requires.
Inventory, gap analysis, and separation of consulting from assurance let organizations prepare now — before the 2028 and 2029 milestones.
The Updated Enforcement Timeline: Phased, Not Delayed
Federal direction, state enforcement, and EU obligations are now operating on parallel tracks. Every quarter from now through 2028 brings a new enforcement milestone.
Federal Direction
State Enforcement
EU (For US Companies)
Key Sectors: Where Federal and State Requirements Converge
Each sector faces overlapping compliance obligations from federal enforcement, state mandates, and international requirements. Effective governance infrastructure addresses all simultaneously.
Employment & HR Tech
Colorado ADMT + FTC fairness + EEOC oversight
- • Colorado: Notice & human-review rights for AI hiring/promotion decisions (SB 26-189)
- • FTC: Algorithmic discrimination enforcement under Section 5
- • EEOC: AI guidance on Title VII compliance for employment decisions
- • EU: Annex III high-risk classification for employment AI (Dec 2027)
Financial Services & Insurance
Colorado Act + FTC + OCC/Fed/FDIC + fair lending
- • Colorado: Consequential decisions in credit, insurance, investment
- • FTC: Consumer protection enforcement for AI lending decisions
- • Federal regulators: OCC, Fed, FDIC issuing AI model risk guidance
- • Fair lending: ECOA/FCRA intersect with state AI requirements
Healthcare & Life Sciences
Colorado Act + FDA + HHS + state regulations
- • Colorado: AI affecting healthcare access and coverage decisions
- • FDA: AI/ML medical device guidance and pre-market requirements
- • HHS: AI in Medicaid/Medicare decision-making oversight
- • Telemedicine: AI triage, diagnostic support, and clinical decision tools
Legal & Government
Federal procurement + state requirements + transparency
- • Federal contractors: NIST AI RMF creates procurement advantage
- • Colorado DORA: 10 regulatory divisions using AI for licensing
- • California: Government agency AI transparency requirements
- • Legal tech: 180% AI adoption increase creating compliance need
Cross-Jurisdictional Penalty Exposure
For companies operating across multiple jurisdictions, penalty exposure is cumulative. A single AI governance failure can trigger enforcement actions under federal, state, and international frameworks simultaneously.
The Business Certainty Argument
AI governance isn’t a regulatory burden — it’s business insurance. Whether regulation comes from federal enforcement, state mandates, or international requirements, companies with defensible AI governance records are better positioned. Jurisdiction-neutral governance infrastructure produces defensible evidence of responsible AI practice regardless of which regulatory framework prevails.
Every State, in One Place: the NCSL AI Legislation Database
AI legislation is moving in every state at once, and the picture on this page is a snapshot of the most consequential measures. The National Conference of State Legislatures (NCSL) maintains a continuously updated, non-partisan database of AI-related bills and enacted laws across all fifty states — the authoritative starting point for tracking what is proposed, pending, and in force.
Open the NCSL AI Legislation DatabaseExternal resource maintained by the National Conference of State Legislatures. Opens in a new tab.
Federal Direction + State Enforcement = Governance Now
Existing federal law already reaches AI conduct, and the state enforcement dates are now fixed. Companies that build governance infrastructure today — aligned with NIST AI RMF, defensible under FTC Section 5, and compliant with the state mandates that apply to them — will be ready when scope widens.