The AI Regulatory Picture
AI regulation is moving fast. In the past two years, we've gone from virtually no AI-specific laws to a patchwork of federal, state, and international regulations that affect how businesses can use AI tools. If you're waiting for the dust to settle before paying attention, you're already behind.
This guide covers the regulations that matter most to small and mid-size US businesses, with a look at what's coming next. We keep this updated as things change.
We've gone from virtually no AI-specific laws to a patchwork of federal, state, and international regulations in under two years. If you're waiting for the dust to settle, you're already behind.
Key Regulations
Colorado AI Act (SB 24-205)
Colorado's Senate Bill 24-205 is the first comprehensive state-level AI regulation in the US, and other states are watching closely.
Feb 2026
Effective date
1st
Comprehensive state-level AI law in the US
- Who it applies to: Any business that uses AI to make or substantially support "consequential decisions," meaning decisions with a material legal or financial impact on consumers. This includes decisions about employment, financial services, healthcare, housing, insurance, and education.
- What it requires:
- Transparency: You must notify consumers when AI is used in consequential decisions about them
- Risk management: Businesses must implement a risk management program for high-risk AI systems
- Bias prevention: You must take reasonable steps to prevent algorithmic discrimination
- Impact assessments: Regular assessments of AI systems that make consequential decisions
- Documentation: Maintain records of AI systems, their purposes, and their outcomes
- Enforcement: The Colorado Attorney General has enforcement authority. There's a cure period for first violations, but penalties increase for subsequent non-compliance.
WARNING
If you operate in Colorado (or have Colorado-based customers or employees) and use AI for hiring, lending, insurance underwriting, or any other consequential decision, you should be preparing now. Even using AI to screen resumes or prioritize customer service tickets could put you in scope.
EU AI Act
The EU AI Act is the most comprehensive AI regulation in the world. It's an EU law, but it affects US companies that:
- Have customers in the EU
- Have employees in the EU
- Process data of EU residents
- Offer AI-powered services accessible from the EU
The EU AI Act uses a risk-based classification system:
| Risk Level | Examples | Requirements |
|---|---|---|
| Unacceptable | Social scoring, real-time biometric surveillance | Banned |
| High | HR/recruitment, credit scoring, healthcare diagnostics | Conformity assessment, risk management, human oversight, transparency |
| Limited | Chatbots, deepfakes, emotion recognition | Transparency (must disclose AI interaction) |
| Minimal | AI-enabled video games, spam filters | None (voluntary codes of conduct) |
Most small businesses using AI for productivity (writing, research, data analysis) fall into the "minimal" or "limited" categories. The high-risk category applies when AI influences decisions about people: hiring, lending, medical diagnosis.
HIPAA
HIPAA isn't new, but its application to AI is. Any AI tool that processes Protected Health Information (PHI) must be covered by a Business Associate Agreement. That means Enterprise-tier tools only, with specific compliance configurations.
We've written an entire guide on this topic: HIPAA-Compliant AI Tools.
GDPR (General Data Protection Regulation)
GDPR applies to any processing of EU residents' personal data, regardless of where your business is located. The key provisions for AI:
- Right to explanation: If you use AI to make automated decisions about people, those people have the right to understand how the decision was made. Applies to hiring, credit, and similar consequential outcomes.
- Data minimization: Only process personal data that's necessary for the specific purpose. Don't dump an entire customer database into an AI tool when you only need aggregated trends.
- Lawful basis: You need a lawful basis (consent, legitimate interest, etc.) for processing personal data through AI, same as any other processing.
- Data Processing Agreements: Required with any AI vendor that processes EU personal data on your behalf. Available at Team tier and above from most providers.
State Privacy Laws
Beyond Colorado's AI-specific law, several states have privacy laws that touch AI use:
- California (CCPA/CPRA): Right to opt out of automated decision-making. Right to access information about how personal data is used in profiling.
- Virginia (VCDPA): Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
- Connecticut, Utah, Montana, Oregon, Texas: All have consumer privacy laws with provisions that touch AI-driven profiling and automated decision-making.
NOTE
If you serve customers across multiple states, your AI policy and practices need to account for the strictest applicable law. In practice, this usually means treating CCPA/CPRA and the Colorado AI Act as your baseline.
What This Means for Your Business
To be direct: if you're a 15-person company using ChatGPT Team for email drafting and meeting summaries, you're probably not in the crosshairs of the EU AI Act's high-risk requirements. Compliance obligations scale with the risk level of your AI use.
Compliance obligations scale with the risk level of your AI use. Most SMBs using AI for productivity have straightforward requirements, but you still need the basics in place.
Low-Risk (Most SMBs)
AI for general productivity
- ✓ Use business-tier AI tools (Team or Enterprise)
- ✓ Have an AI acceptable use policy
- ✓ Train employees on appropriate use
- ✓ Don't use AI for automated decisions about people without human oversight
Medium-Risk
Customer-facing AI or EU data
- ✓ Everything in low-risk, plus:
- ✓ Data Processing Agreements with AI vendors
- ✓ Documented data classification procedures
- ✓ Transparency about AI use in customer interactions
- ✓ Regular review of vendor compliance certs
High-risk businesses
If you're in healthcare, financial services, insurance, or use AI for employment decisions, credit decisions, or other consequential outcomes:
- Everything above, plus:
- Formal risk assessments for each AI use case
- Impact assessments under applicable regulations (Colorado AI Act, EU AI Act)
- BAAs and specialized compliance configurations (see HIPAA-Compliant AI)
- Human oversight requirements documented and enforced
- Bias testing and monitoring for AI-driven decisions
- Incident response plan specific to AI failures
AI Compliance Checklist
Regardless of risk level, here's the minimum every business should have in place:
Inventory all AI tools in use
You can't comply with what you can't see. Audit your organization for shadow AI and document every tool, who uses it, and what data it processes.
Classify data being processed by AI
Use the green/yellow/red framework to categorize the data your organization puts into AI tools.
Ensure appropriate tier for data sensitivity
Match each data classification level to the minimum AI tier required. See the Provider Privacy Matrix for tier-by-tier comparisons.
Maintain records of AI-assisted decisions
If AI influences any decision about customers, employees, or business operations, document what AI was used, what data it processed, and the outcome.
Create an acceptable use policy
Document the rules and make sure every employee has read and acknowledged them.
Train employees and document it
Repeat at least annually. Keep records of who completed training and when.
Review quarterly
Regulations, vendor policies, and your own usage patterns all shift. A policy that was compliant six months ago may not be today.
Looking Ahead
This is only going to get more complex. Multiple US states have AI legislation in various stages of development. Federal legislation has been proposed (though progress is slow). Industry-specific regulations in banking, insurance, and healthcare are adding AI-specific requirements.
BOTTOM LINE
Businesses that start building compliance infrastructure now, even if their current requirements are minimal, will be better positioned when new regulations take effect. The foundation is the same regardless of which specific regulation applies: know what AI you're using, control what data goes into it, document your decisions, and keep a human in the loop.
Need help assessing your compliance posture? Take our AI Readiness Assessment for a baseline evaluation, or schedule a discovery call and we'll review your AI usage and regulatory obligations. You can also explore our compliance services for ongoing support.