An AI policy sets the rules for how people in your organization use AI tools: which tools, for what, with which information, and who checks the results. Here's what it should cover in the US, and how AI is regulated there.
The US has no general federal AI law. A growing number of states regulate specific uses: Texas's Responsible AI Governance Act has applied since January 1, 2026, and Colorado's automated decision-making law and California's rules on automated decisionmaking technology apply from January 1, 2027.
A federal executive order (December 2025) seeks to override state AI laws, but no federal law doing so has passed, so state laws remain in force.
A general summary, checked on 27 October 2026 against the sources in the regulations tracker. It isn't legal advice.
Which decisions about people, such as hiring, lending or housing, AI tools influence, and how people are told.
Which AI tools may receive customer or employee data, and what must never be entered.
A list of approved tools with an owner each, and how staff request a new one.
A short induction before first use, and a signed acknowledgment that staff have read the policy.
Why the policy exists and who it applies to: staff, contractors, any device used for work.
Which AI tools are approved, what each may be used for, and who owns each one.
What information may go into each tool, what never may, and what must be removed first.
Uses that are off limits, with examples from your own work.
Who checks AI output before it's used, and how much, scaled to the risk.
When customers, staff or others are told that AI was used.
How to report a mistake or misuse, to whom, and how quickly.
Training before first use, a signed acknowledgment, and when the policy is reviewed.
Answer a few questions and get a short AI use policy for your organization, free to copy or download as a Word document. No account needed.
The AI Policy & Risk Pack is written from your answers about how your organization uses AI, for the US. Preview every section free before you pay. It's a starting point to review and adopt, not legal advice.
Launch price for the first 20 packs sold: 13 of 20 left. Then US$199.
Prices in US dollars.
SB 26-189, signed on 14 May 2026, repeals and replaces the Colorado AI Act before it took effect. Deployers will have to tell people before automated decision-making technology materially influences a consequential decision, explain adverse outcomes on request, allow data correction and offer human review. Enforcement depends on the Attorney General's rulemaking.
The California Privacy Protection Agency's regulations took effect on 1 January 2026. Businesses that use automated decisionmaking technology to make significant decisions about consumers must meet the ADMT requirements from 1 January 2027. Risk assessment requirements began on 1 January 2026.
TRAIGA bans certain uses of AI by anyone, such as AI intended to encourage self-harm or crime, or to unlawfully discriminate. Government agencies must tell people when they interact with AI, and health care providers must disclose AI use in treatment. The Texas Attorney General enforces it; there's no private right of action.
Executive Order 14365 directs federal agencies to challenge state AI laws and to prepare a federal framework that would override them. No federal law overriding state AI laws has been passed, so state laws remain in force unless a court, Congress or the state changes them.
No federal law requires a document called an AI policy. Some state laws set duties for specific uses, such as decisions about employment, lending or housing, and a written policy is a common way to set the rules staff follow.
Colorado and California both have rules on automated decision-making that apply from January 1, 2027, and Texas's AI law has applied since January 1, 2026. The regulations tracker lists them with sources.
Yes. Packs for US organizations use American spelling and date formats, and prices are in US dollars.
