What AI Laws, Disclosure Requirements, and Industry Regulations Apply to Your Business in 2026

The Short Answer

For most U.S. small and mid-size businesses in 2026, the regulatory obligations around AI come from three sources:

1. Existing laws that apply to your industry and activities — now being applied to AI use. If you handle health data, you already have HIPAA obligations — those apply whether you process data with AI or not. If you make employment decisions, you're subject to anti-discrimination laws — those apply whether you use AI screening tools or not. If you collect consumer data, privacy laws apply regardless of whether AI touches it.

1. New AI-specific transparency and disclosure requirements. A growing number of jurisdictions require disclosure when AI is used in specific contexts: automated decision-making that affects consumers, AI-generated content in political advertising, AI use in employment screening, and deepfake or synthetic media disclosure. These requirements are expanding but currently apply to specific use cases, not all AI use.

1. Emerging AI regulatory frameworks (mostly for high-risk uses). The EU AI Act (effective in stages through 2026-2027) is the most comprehensive, but it primarily regulates 'high-risk' AI systems and imposes transparency requirements. In the U.S., federal AI regulation is developing through executive orders and agency guidance rather than a single comprehensive law. State-level AI laws are proliferating and vary significantly.

If your business uses AI for routine productivity tasks (drafting, summarizing, analyzing, ideating) with human review before any consequential output, you likely have few or no AI-specific regulatory obligations beyond what your existing industry compliance already requires. If you use AI for automated decisions about people (hiring, lending, housing, benefits), for generating content that reaches consumers without human review, or in regulated industries, your obligations are more significant and you should consult qualified counsel.

Existing Laws That Apply to AI Use (By Business Activity)

These aren't AI laws — they're existing laws that regulate your activities regardless of whether AI is involved. AI doesn't exempt you from them.

Employment and hiring: Federal anti-discrimination laws (Title VII, ADA, ADEA) prohibit discrimination in employment decisions. If you use AI to screen resumes, evaluate candidates, or make hiring recommendations, you are responsible for ensuring the AI tool doesn't produce discriminatory outcomes — even if the discrimination is unintentional and results from biased training data or proxy variables. The EEOC has issued specific guidance on AI in employment. State and local laws may impose additional requirements (e.g., NYC's law requiring bias audits for automated employment decision tools).

Consumer protection: The FTC Act prohibits unfair and deceptive trade practices. The FTC has made clear that this applies to AI: making false claims about AI capabilities, using AI in ways that harm consumers without adequate safeguards, and failing to disclose AI use when it would affect consumer decisions can all constitute FTC violations. The CFPB similarly applies consumer financial protection laws to AI use in lending, credit, and financial services.

Data privacy and security: If you collect, store, or process personal data — of customers, employees, donors, or beneficiaries — you are subject to applicable privacy laws. These laws apply to data you share with AI tools. Key U.S. frameworks: state comprehensive privacy laws (California CPRA, Colorado CPA, Connecticut CTDPA, Virginia VCDPA, and others), sector-specific laws (HIPAA for health data, FERPA for student data, GLBA for financial data), and the FTC's cybersecurity expectations under Section 5.

Intellectual property: Copyright, trademark, and trade secret law apply to AI-generated content and AI tools. See the companion article on AI copyright and IP ownership for detailed guidance.

Nonprofit-specific: Nonprofits using AI should review: grant agreements (many funders are adding AI-specific terms about data privacy, content ownership, and disclosure), IRS regulations (AI use doesn't change tax-exempt compliance obligations), state charitable registration requirements, and donor privacy commitments (if your donor privacy policy promises specific data handling practices, AI tool use must comply with those promises).

New AI-Specific Disclosure Requirements

AI-generated content disclosure: As of 2026, several states require disclosure when AI-generated content is used in specific contexts — notably political advertising (multiple states), certain commercial communications, and government interactions. The FTC has indicated that failure to disclose AI use in contexts where consumers would reasonably want to know is potentially deceptive. Best practice: disclose AI use when a reasonable consumer, client, or stakeholder would consider it material to their decision or assessment.

Automated decision-making disclosure: Several state comprehensive privacy laws (California, Colorado, Connecticut) grant consumers rights related to automated decision-making, including the right to know when automated decisions are being made about them and, in some cases, the right to opt out. These provisions are expanding.

Employment AI disclosure: A growing number of states and cities require employers to disclose when AI is used in hiring, promotion, or other employment decisions — and some require bias audits of AI employment tools. Illinois and New York City have specific requirements; other jurisdictions are following.

Deepfake and synthetic media laws: Multiple states have laws specifically addressing deepfakes and synthetic media, particularly in the contexts of election interference, non-consensual intimate imagery, and fraud. These laws typically don't affect legitimate business use of AI media tools but establish liability for malicious uses.

The EU AI Act (Why It Might Matter to U.S. Businesses)

If your business has customers, users, or employees in the EU, or if your AI-generated outputs reach people in the EU, the EU AI Act may apply to you. It's the world's most comprehensive AI regulation and is being implemented in stages through 2027.

Key provisions: Risk-based framework — 'unacceptable risk' AI uses are prohibited, 'high-risk' uses (in employment, education, critical infrastructure, law enforcement, etc.) face extensive requirements, 'limited risk' uses have transparency obligations, and 'minimal risk' uses (most routine business AI applications) are largely unregulated.

Transparency requirements: AI systems that interact directly with people must disclose that the user is interacting with an AI system (with some exceptions). AI-generated content must be labeled as such in certain contexts.

What this means for a typical U.S. small business: If you don't operate in the EU and don't target EU customers, the EU AI Act likely doesn't directly apply to you. If you do have EU exposure, the requirements scale with the risk level of your AI use. Routine business AI applications (drafting, summarizing, analyzing) are minimal risk. Consult qualified counsel if you have meaningful EU operations or customer base.

U.S. State AI Law Patchwork (Current as of Mid-2026)

The U.S. does not have a comprehensive federal AI law. Instead, states are passing their own — creating a patchwork. Key areas of state activity:

• AI in employment: Multiple states regulate AI use in hiring and employment decisions
• AI and consumer privacy: State comprehensive privacy laws include AI-related provisions
• Deepfake and synthetic media: Most states have laws addressing malicious uses
• AI safety and bias: Several states have proposed or passed AI safety legislation
• AI in insurance: States regulate insurer use of AI in underwriting and claims

The practical implication for small businesses: If you operate in multiple states, you may be subject to multiple, potentially inconsistent requirements. The trend is toward more regulation, not less. Monitor requirements in states where you have significant operations or customers.

What You Should Do Right Now (The Practical Checklist)

Level 1 — Everyone should do these (1-2 hours):
- [ ] Identify which existing regulations already apply to your industry (HIPAA, FERPA, GLBA, employment laws, consumer protection) — these apply to your AI use too
- [ ] Review your AI tools' terms of service for data handling and compliance provisions
- [ ] Create a simple internal policy documenting which AI tools are approved for which types of data and tasks
- [ ] Ensure human review of all AI outputs before they reach customers, stakeholders, or the public

Level 2 — Do these if you use AI for customer-facing or employment decisions (3-5 hours):
- [ ] Document your AI use cases and the human oversight in place for each
- [ ] Check whether your state or city has AI-in-employment requirements
- [ ] Review your privacy policy — does it accurately describe your AI data practices?
- [ ] Implement AI disclosure where a reasonable person would consider it material

Level 3 — Do these if you're in a regulated industry or use AI for consequential decisions (consult qualified counsel):
- [ ] Conduct a legal review of AI use cases with counsel familiar with your industry's regulatory framework
- [ ] Assess whether EU AI Act or other international AI regulations apply to your operations
- [ ] Implement formal AI governance: documented risk assessments, bias testing where applicable, and compliance monitoring
- [ ] Review and update contracts with AI vendors to address compliance, data handling, and liability

Key Principle: The Human Is Always Responsible

Across all emerging AI regulations, one principle is consistent: the human or organization using AI is responsible for the outcomes. You can't delegate legal responsibility to an AI tool. If AI-assisted hiring discriminates, you're liable under employment law. If AI-generated marketing material deceives consumers, you're liable under consumer protection law. If AI-processed data is breached, you're liable under privacy law — even if the breach occurred at the AI provider.

This doesn't mean don't use AI. It means use AI with the same legal diligence you apply to any other tool or service your business depends on — understand the obligations, implement appropriate safeguards, and never assume the AI provider's compliance covers your own.