Regulations and standards that touch AI work

An SBOM is a machine-readable list of a software product's components, versions, producers and dependencies. CISA's 2026 Minimum Elements, issued with NSA, FBI and 15 international partners, replaced NTIA's 2021 baseline and expanded it to 17 data fields covering all software, including AI software and SaaS.

SP 800-161 Rev. 1 tells organizations how to identify, assess and reduce cybersecurity risks across their supply chains, from counterfeit or tampered products to weak supplier development practices. It builds on the SR control family in SP 800-53 and applies to AI models, data and services bought from third parties.

Since Mata v. Avianca in 2023, courts have sanctioned lawyers for filing briefs with fake or misdescribed authority produced by AI tools, under Rule 11, state equivalents and inherent power. Sanctions have escalated from small fines to public reprimands, disqualification, fee-shifting and bar referrals, so any AI-assisted drafting needs a human verification step before filing.

Remote and AI proctoring raises three main legal issues: constitutional privacy at public institutions, disability discrimination when software flags disability-related behavior, and consent rules for biometric data. In Ogletree, a federal court found a public university's webcam room scan of a student's bedroom an unreasonable search, but that judgment was vacated in 2023 after the student died and the appeal was dismissed as moot, so it is persuasive reasoning, not binding precedent.

The AI Act is the EU's risk-tiered AI law: it bans certain practices, sets strict duties for high-risk systems, imposes transparency duties on chatbots and generated content, and regulates general-purpose AI models. The Digital Omnibus, in force 27 July 2026, pushed high-risk obligations to December 2027 and August 2028 and left Article 50 transparency on 2 August 2026.

The Code is a voluntary tool, drafted by independent experts and assessed as adequate by the Commission and the AI Board, that GPAI model providers can follow to meet AI Act Articles 53 and 55. Signatories include most major model developers; non-signatories must show compliance by other adequate means.

The first international management-system standard for AI: it sets requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). It uses the same clause structure as ISO 27001 and ISO 9001, so organizations can certify AI governance alongside existing management systems.

SLSA, an OpenSSF specification, defines levels of assurance that a software artifact was built as claimed, centered on signed build provenance. v1.0 (April 2023) introduced the Build track; it is now marked retired, replaced by v1.1 (April 2025) and v1.2 (November 2025), which added a Source track and remain backward compatible.

SCITT defines how signed statements about supply chain artifacts are registered on an append-only transparency service that returns a signed receipt proving registration. RFC 9943, published as an IETF Proposed Standard in June 2026, gives independently checkable records of claims such as SBOMs, test results or provenance.

Annex A lists 38 reference controls grouped under 9 control objectives (A.2 to A.10), from AI policy through data, lifecycle and third-party relationships. It is the auditable control surface of a 42001 certification: organizations pick the controls their AI risk treatment needs and record the choices in a Statement of Applicability.

Ten guiding principles issued by the FDA, Health Canada and the UK MHRA in October 2021 for developing safe, effective machine-learning medical devices across the total product lifecycle. IMDRF finalized a near-identical international version in January 2025, and FDA people reviewing it use the same concepts when assessing AI-enabled device submissions.

The UK has no general AI statute: existing regulators interpret five cross-sector principles within their own remits, backed by central coordination and the AI Security Institute. The government has said it will legislate for the most powerful models when ready, but as of October 2026 no AI bill has been introduced.

Issued by the Cyberspace Administration of China with MIIT, the Ministry of Public Security and the NRTA, the Measures require a visible label on certain AI-generated content and a metadata label on all of it, with duties running along the whole distribution chain. GB 45438-2025 fixes the technical labelling method, including the metadata format.

India amended its intermediary rules rather than passing an AI act: synthetically generated audio, visual and audio-visual content must carry a prominent label and embedded provenance, and takedown windows were shortened to as little as two hours. There is no fine; an intermediary that fails the rules loses its safe-harbour immunity for user content.

Korea's comprehensive AI statute imposes transparency duties on generative and high-impact AI, risk-management duties on high-impact AI, and a domestic-representative duty on large foreign operators. The duties have been binding since 22 January 2026, but the Ministry of Science and ICT has deferred investigations and fines for at least a year except in serious cases.

NIST's voluntary framework for managing AI risks, organized into four functions (GOVERN, MAP, MEASURE, MANAGE) with 19 categories and 72 subcategories, plus seven characteristics of trustworthy AI. It is the most widely referenced US AI risk vocabulary and is being revised under the 2025 AI Action Plan.

Issued together on April 3, 2025, the pair replaced M-24-10 and M-24-18: M-25-21 governs how agencies use and govern AI, and M-25-22 governs how they buy it. M-25-22 requires contracts to ensure compliance with M-25-21's high-impact practices, so the two work as one regime from purchase to operation.

The June 2022 Pathway turns DoD's five AI Ethical Principles into 64 lines of effort organized under six tenets: governance, warfighter trust, product and acquisition lifecycle, requirements validation, ecosystem, and workforce. It is the basis for the CDAO's Responsible AI Toolkit and for how DoD programs are expected to document trust in fielded AI.

EO 14179 sets the current federal AI policy of sustaining US 'global AI dominance' and orders agencies to review and undo actions taken under the already-revoked EO 14110. It led to the July 2025 AI Action Plan and to OMB memos M-25-21 and M-25-22, which hold the operative agency duties.

FIPS 140-3 sets security requirements for cryptographic modules at four increasing levels, by reference to ISO/IEC 19790 and 24759; modules are tested by accredited labs and validated by the Cryptographic Module Validation Program. Since September 2026 all FIPS 140-2 certificates are historical, so new federal purchases look to FIPS 140-3 validations.

FIPS 180-4 specifies the approved secure hash algorithms, including SHA-256, which turns any input into a fixed 256-bit digest so that any change to the input produces a different value. It underpins digital signatures, file integrity checks, content addressing and Merkle trees used in software and AI provenance.

SP 800-53 Rev. 5 is the federal catalog of security and privacy controls, organized in 20 families, that agencies select and tailor under the Risk Management Framework. It is the control set behind FISMA authorizations and FedRAMP, so AI systems in federal use are assessed against it.

CMMC verifies that defense contractors meet existing safeguarding requirements for FCI (FAR 52.204-21) and CUI (NIST SP 800-171), with three levels and either self-assessment or third-party or government assessment. Phase 1 (self-assessments as a condition of award) took effect November 10, 2025; on July 13, 2026 the Department of War suspended Phase 2, which would have required C3PAO certification from November 10, 2026, pending a CMMC Reform Task Force review.

The SSDF is a set of secure software development practices in four groups: Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW) and Respond to Vulnerabilities (RV). Version 1.1 is final; version 1.2 was released as a draft in December 2025 under Executive Order 14306, and NIST's generative AI profile (SP 800-218A) applies the framework to AI model development.

An ATO is the official decision by a senior federal official to authorize operation of an information system and explicitly accept its risk, made after security and privacy controls are assessed under the NIST RMF. Any AI system or AI service an agency runs or connects to its data needs to sit inside an authorized boundary, which makes the ATO the gate for federal AI deployments.

The SRG defines Impact Levels for DoD data in commercial cloud: IL2 covers publicly releasable and non-critical mission information, and IL4 covers Controlled Unclassified Information. IL2 rests on a FedRAMP Moderate (or High) authorization, while IL4 adds DoD-specific (FedRAMP+) controls, DISA parameters and connection through a DoD Cloud Access Point.

The clause requires 'adequate security' for covered defense information, meaning NIST SP 800-171 on contractor systems, and rapid reporting of cyber incidents to DoD. It is the baseline that CMMC assesses and it stayed in force when CMMC Phase 2 was suspended in July 2026.

The Privacy Rule limits how covered entities and business associates may use and disclose protected health information (PHI) and gives patients rights over it. It has no AI-specific provisions, but it governs any AI tool that ingests, is trained on, or outputs PHI on behalf of a covered entity.

Section 92.210 bars covered entities from discriminating on the basis of race, color, national origin, sex, age or disability through patient care decision support tools, a term that covers any automated or manual tool supporting clinical decisions, including AI. Since May 1, 2025, covered entities must make reasonable efforts to find tools that use those characteristics as inputs and to reduce the discrimination risk.

For SaMD, a standalone software product with a medical purpose, a PCCP lets the maker pre-authorize planned model updates such as retraining on new data or tuning performance, so frequent software releases do not each need a new FDA submission. It matters because SaMD models change faster than hardware devices, and without a PCCP many model changes would require a new 510(k) or PMA supplement.

Rule 702 lets a qualified expert testify only if the proponent shows the court it is more likely than not that the testimony is helpful, based on sufficient facts or data, the product of reliable methods, and a reliable application of those methods. The 2023 amendment made the preponderance standard explicit and tightened the 'reliable application' prong. That matters wherever an expert's opinion rests on AI or model output.

FERPA bars schools from disclosing personally identifiable information from education records without parent or eligible-student consent unless an exception applies. Most school AI tools that touch student records depend on the 'school official' exception, which carries strict control and use limits for vendors.

Title VI bars discrimination based on race, color or national origin in federally funded programs. Since July 24, 2026, ED's regulations reach only intentional discrimination: disparate-impact liability has been removed, so AI tools draw scrutiny mainly when they treat students differently by race or national origin, or when schools ignore race-based harassment.

GOVERN is the cross-cutting function of the AI RMF, with 6 categories and 19 subcategories that set the policies, accountability, culture, stakeholder engagement and third-party controls under which AI risk is mapped, measured and managed. NIST describes it as informing and infused throughout the other three functions.

MAP establishes the context needed to frame an AI system's risks, through 5 categories and 18 subcategories covering intended purpose, categorization, capabilities, benefits and costs, component risks and impacts. Its outputs feed MEASURE and MANAGE and support a go or no-go decision on whether to design, develop or deploy.

MEASURE uses quantitative, qualitative or mixed methods to analyze, benchmark and monitor AI risks, through 4 categories and 22 subcategories. It is where documented test sets, metrics, deployment-like performance testing, production monitoring and evaluation of the measurement process itself are expected.

MANAGE allocates resources to the risks mapped and measured, through 4 categories and 13 subcategories covering prioritization, risk response, third-party risk, and post-deployment monitoring, incident response and recovery. It includes the decision whether an AI system should proceed at all and how to disengage one that misbehaves.

A cross-sector profile of the AI RMF for generative AI that defines 12 risks unique to or worsened by generative AI and lists about 200 suggested actions mapped to AI RMF subcategories. It gives teams a concrete checklist vocabulary for issues like confabulation, information integrity, and value-chain risk from third-party models.

M-25-21 is OMB's governing policy for how federal agencies adopt, govern and manage the risk of AI; it rescinded and replaced M-24-10. It sets up Chief AI Officers and governance boards, an annual use case inventory, and minimum risk practices that every high-impact AI use must meet or be shut off.

M-25-22 sets how agencies buy AI and rescinds M-24-18. It requires contract terms on government data, vendor lock-in, compliance with M-25-21's high-impact practices, and agency rights to test and monitor the delivered AI.

High-impact AI is M-25-21's single risk tier for federal AI: AI whose output is a principal basis for decisions with a legal, material, binding or significant effect on rights or safety, with 15 listed categories presumed high-impact. Each such use must meet seven minimum practices, have a CAIO waiver, or be discontinued.

PS is one of the SSDF's four practice groups; it says organizations should protect all components of their software from tampering and unauthorized access. For AI work, NIST's generative AI profile (SP 800-218A) extends PS to training data, model weights and model provenance.

The AU family has 16 controls (AU-1 to AU-16, AU-15 withdrawn) covering which events a system logs, what each record contains, how logs are reviewed, protected, retained and made non-repudiable. For AI systems inside a federal boundary it is the baseline for logging model use, administrative actions and outputs so incidents can be investigated later.

The CA family has 9 controls (CA-1 to CA-9, CA-4 withdrawn) covering control assessments, plans of action, authorization to operate, continuous monitoring and penetration testing. For AI systems in federal use it is how an authorizing official accepts risk before deployment and keeps checking controls after go-live.

FedRAMP is the government-wide program for security assessment and authorization of cloud services; by statute a FedRAMP authorization package is presumed adequate for an agency's own ATO. FedRAMP 20x, now in Phase 3, replaces document-heavy Rev5 reviews with automated, machine-readable validation and Class A to D certifications, and FedRAMP prioritized several generative AI services in 2025-2026.

IL5 covers higher-sensitivity CUI and unclassified National Security Systems data whose disclosure could seriously harm operations; IL6 covers classified information up to SECRET. Both build on the FedRAMP High baseline with DoD FedRAMP+ controls, and IL6 adds the CNSSI 1253 Classified Information Overlay and dedicated classified infrastructure.

SP 800-37 Rev. 2 sets out the seven-step RMF: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor, ending in a risk-based authorization decision. It is the process behind federal ATOs and DoD and classified system authorizations, so AI systems in government settings are usually authorized through it.

The ITAR, administered by the State Department's Directorate of Defense Trade Controls (DDTC), control exports, temporary imports and brokering of items on the US Munitions List, including technical data and defense services. For AI work, putting ITAR technical data into prompts, training sets, models or cloud tools that foreign persons or foreign servers can reach can be an unlicensed export.

The EAR, administered by Commerce's Bureau of Industry and Security (BIS), control dual-use and less-sensitive military items through the Commerce Control List, country rules, end-use and end-user restrictions. For AI, they control advanced computing chips and related items, and a January 2025 rule added a control on certain closed AI model weights (ECCN 4E091) that BIS announced it would rescind and has not enforced since May 2025.

ICD 705 sets the requirement that SCI be handled only in accredited SCIFs built and operated to Intelligence Community physical and technical security standards. Classified information systems, typically air-gapped from unclassified networks, must be authorized before use, under ICD 503 for the IC and 32 CFR 117.18 (applying the NIST RMF) for cleared contractors, so any AI system used on classified data must be accredited inside that boundary.

CMS-4201-F requires Medicare Advantage plans to base medical necessity decisions on the individual enrollee's medical history, physician recommendations and clinical notes, follow Traditional Medicare coverage rules, and have a qualified clinician review any adverse decision. CMS's February 2024 FAQ applies this to AI: plans may use algorithms to assist, but not as the sole basis for denying or ending care.

HTI-1 updated the ONC certification program: it replaced the old clinical decision support criterion with the decision support interventions criterion, added algorithm transparency and risk management duties for predictive models, moved the baseline to USCDI v3, and revised information blocking rules. It was the first US federal rule to require transparency about AI and other predictive models embedded in EHRs.

Certified EHRs must let users see plain-language source attributes for the decision support tools they supply: 13 for evidence-based tools and 31 for predictive (AI or other model-based) tools, covering purpose, training data, fairness, external validation, performance and ongoing monitoring. It is the main US federal rule that forces disclosure of how a clinical prediction model was built and tested, though a pending proposal would remove it.

FDA's final guidance explains what to put in a predetermined change control plan so that pre-specified changes to an AI-enabled device, such as retraining, can be made after authorization without a new marketing submission for each change. It is the main route for updating a cleared or approved AI model while staying within the law.

AI software that diagnoses, treats or predicts disease is usually a medical device and needs FDA marketing authorization: 510(k) clearance if substantially equivalent to a predicate, De Novo for novel low-to-moderate-risk devices, or PMA for high-risk Class III devices. FDA's January 2025 draft guidance sets out what an AI device submission should contain across the total product lifecycle.

The Security Rule requires administrative, physical and technical safeguards for ePHI, built on a documented risk analysis. A January 2025 proposed overhaul would make most safeguards mandatory and expects AI software that touches ePHI to appear in a required technology asset inventory, but HHS now lists it as a long-term action with final action estimated for July 2027.

Proposed Rule 707 would make AI or machine-generated evidence offered without an expert meet the Rule 702 reliability requirements. It was published for comment in August 2025, drew mixed comments, and in May 2026 the Advisory Committee chose to revise and keep studying it rather than send it forward, so it has no effective date.

Section 504 bars disability discrimination by recipients of federal funds, and ED's rules require free appropriate public education, fair evaluation, and academic adjustments for students with disabilities. AI ed-tech is covered when a school uses it, so inaccessible tools, unreviewed AI-written 504 plans, and AI flags that penalize disability-related behavior can all violate the law.

IDEA guarantees eligible children with disabilities a free appropriate public education through an individualized education program (IEP) developed by a team that includes parents. AI tools used to evaluate students, draft IEPs or deliver services must fit inside its evaluation, individualization and confidentiality rules.

COPPA requires notice and verifiable parental consent before collecting, using or disclosing personal information from children under 13. The 2025 amendments, enforced from April 22, 2026, add separate parental consent for disclosures to third parties, including disclosures to train AI, plus written retention and security programs.

OCR's November 2024 resource gave 21 examples of how school AI use could lead to investigations under Title VI, Title IX and Section 504, such as biased facial recognition, AI proctoring that flagged a disability, and unreviewed AI-written 504 plans. ED has since marked it formally rescinded, but the underlying statutes still apply, though Title VI enforcement now covers intentional discrimination only.

The Model Rules are the template for state lawyer ethics codes, and their duties of competence, communication, confidentiality, candor and supervision apply to any AI a lawyer uses. ABA Formal Opinion 512 (2024) maps these rules onto generative AI, and courts have sanctioned lawyers who filed AI-fabricated citations.

Opinion 512 is the ABA's first formal ethics opinion on generative AI, applying existing Model Rules on competence, confidentiality, communication, candor, supervision and fees to lawyers' AI use. It is advisory, but state bars and courts widely cite it as the baseline for how lawyers may use AI.

The FSMB's House of Delegates adopted policy in April 2024 saying physicians stay accountable for care delivered with AI and setting expectations on understanding tools, documentation, informed consent, privacy and bias. Boards cannot regulate AI products directly, but they discipline licensees, so this policy signals how boards are likely to judge AI-related complaints.

Bar ethics committees agree that lawyers may use generative AI if they meet existing duties of competence, confidentiality, supervision, candor and reasonable fees. California replaced its 2023 guidance in 2026 with a version that also covers agentic AI.

SOPIPA bars K-12 ed-tech operators from targeted advertising, building profiles of students for non-school purposes, selling student information, and most disclosures. It also requires reasonable security and deletion on request, and it governs how AI tutoring and learning tools can use student data.

Local Law 144 bars using an automated employment decision tool (AEDT) unless it had an independent bias audit within the past year, the results summary is public, and candidates get advance notice. It is one of the few laws that mandates a third-party bias audit of AI hiring tools.

Colorado's 2024 AI Act, the first comprehensive US state AI statute, was delayed twice and then repealed and reenacted in May 2026 as a narrower notice-and-transparency law for automated decision-making technology (ADMT). The original risk-management programs and annual impact assessments are gone; the new duties apply from 1 January 2027, with Attorney General rules still in draft.

TRAIGA bans developing or deploying AI with intent to cause specific harms, such as inciting self-harm or unlawful discrimination, rather than imposing audits or impact assessments. It also requires government agencies and health care providers to disclose AI use, creates an AI regulatory sandbox and a Texas AI Council, and gives the Attorney General exclusive enforcement.

Utah's Act requires businesses to disclose generative AI use when a person clearly asks, and requires licensed professionals to disclose it up front in high-risk interactions. It also bars blaming AI as a defence to consumer-protection violations and created an Office of AI Policy with a regulatory learning lab.

HB 3773 makes it a civil rights violation for an employer to use AI that has the effect of discriminating against employees or applicants on protected grounds, to use ZIP codes as a proxy for protected classes, or to fail to tell employees it uses AI in employment decisions. The notice duty has been in force since 1 January 2026, but the Department of Human Rights' implementing rules were withdrawn in June 2026.

SB 942 requires large generative AI providers to embed hidden provenance disclosures in content their systems create, offer users a visible disclosure option, and run a free public detection tool. AB 853 moved the operative date to 2 August 2026, the same day EU AI Act Article 50 begins to apply.