Skip to content

US and Canadian laws for AI-built apps

No US or Canadian law regulates building apps with AI as such. The laws that apply attach to what an app does: the data it holds, the decisions it helps make about people, what it tells customers, and what happens when it leaks. Most of these duties map to controls you already have, such as the registry, the six tier questions, access controls, vendor contracts and incident response. As of October 2026; not legal advice.

Who this is for

Legal, privacy and compliance leads, and the execs and IT managers at US and Canadian businesses who answer for worker-built apps. About 18 minutes.

Not legal advice

Not legal advice. This page summarizes laws as of October 2026 for a general audience. It was written with an AI legal-research persona and hasn't been reviewed by a lawyer for your situation. Ask your counsel.

Stop and call counsel before you build if any of these apply

These are the items that turn on the laws on this page. The full stop-and-call-counsel list, which applies to every app, also covers the jurisdiction flag, decisions about people (Q5 (c), SB 947, NYC LL 144) and credit screening (FCRA, ECOA).

  • The consent gate: it collects biometric identifiers (fingerprints, face or voice prints), data about anyone under 18, or consumers' health information or other sensitive-category data outside HIPAA (for example, consumer health data under Washington's My Health My Data Act). Route to counsel before collecting. See which state laws apply.
  • The jurisdiction flag, for Quebec: it handles information about people in Quebec. If you don't know, answer yes (Law 25 s. 3.3 and s. 17, below).
  • Q4 (d1): its output is posted to the general ledger or financial statements, or is itself the evidence for an account reconciliation or a control your auditors test, without being independently recomputed. Route it to your compliance owner too.
  • Audit scope: it's in your audit scope. Route it to your compliance owner before go-live (a gate, not a tier). The compliance owner's change-management and evidence requirements apply at whatever tier the app is, Team included; an audit-scope app gets no minimum tier (the audit-scope flag).
  • HIPAA or card data: it holds patient or health-plan-member health information for a HIPAA covered entity or business associate, or full card numbers (Q1 (d)).

How to read this page

Each law is labelled a legal requirement (statute or regulation), a regulator expectation (non-binding guidance that signals enforcement) or good practice, with who it covers and from when. A law's own thresholds (revenue, headcount, residents' records) decide whether it applies to you. Secondary-sourced statuses are labelled. Every worker-built app sits in one of four risk tiers (Sandbox, Team, Important or Critical), set by the highest answer to six questions about its data, users, internet reach, dependence, decisions about people and actions, and two floors apply at every tier. You screen for these laws through those six tier questions, by an app's effects, not by whether it uses AI.

Which law applies to which kind of app?

Fast-moving

As of October 2026. Check the review date.

App situation (intake answer) US federal US state Canada Control that helps Framework clause it supports
Holds personal data (Q1(b), Q1(c)) FTC Act §5 (data security) CCPA/CPRA and 20+ state privacy laws PIPEDA; Quebec Law 25 (PIA to build, s. 3.3) Data classes; deny-by-default access; the jurisdiction flag SOC 2 P-series; ISO/IEC 27001 5.34; NIST CSF 2.0 GV.OC-03
Sensitive categories or Restricted data (Q1(c), Q1(d)) HIPAA; GLBA Safeguards; COPPA BIPA, Texas and Washington biometric laws; Washington My Health My Data Act and Nevada's equivalent; sensitive-data consent; risk assessments PIPEDA safeguards Data-owner sign-off; the consent gate (biometrics, data about anyone under 18, consumers' health or other sensitive data outside HIPAA); standard downgrade 2 for PHI NIST CSF 2.0 PR.DS-01/02; SOC 2 CC6.1, C1.1
Decides about people (Q5) FCRA; ECOA/Reg B; Title VII, ADA CCPA ADMT; Colorado SB 26-189; NYC LL 144; Illinois HB 3773; California FEHA, SB 947 Quebec s. 12.1; Ontario job postings Meaningful human review; reasons per outcome; bias testing AI RMF GOVERN 3.2, MEASURE 2.9, 2.11; ISO/IEC 42001 A.5.4, A.8.2
Outside users or customer-facing AI (Q2(c), M2) FTC Act §5 (claims); ADA; Section 508 Chatbot disclosure laws (California, Maine, Utah, Colorado) Ontario AODA (public websites) Claims register; AI-disclosure and accessibility check at Important SOC 2 CC2.3; ISO/IEC 42001 A.8.2; WCAG 2.2 AA
Output posted to the ledger or financial statements, or itself the evidence for a reconciliation or tested control, without independent recomputation (Q4(d1)). Output a person re-performs or checks against the system of record is Q4(c), Important SOX §404 / ICFR (SEC registrants) — — Critical tier for (d1); change log; second reviewer; graduation SOC 2 CC8.1, PI1.x; ISO/IEC 27001 8.32
Produces control evidence or sits in audit scope (audit-scope flag) SOX (registrants) — — Route to the compliance owner before go-live (a gate, not a tier); their requirements apply at any tier, with no tier floor SOC 2 CC6.1, CC8.1, CC9.2
Sends data to an AI service (M1 approval gate) GLBA §314.4(f); FTC Act; trade secrets (DTSA); DOJ bulk sensitive-data rule (28 CFR Part 202) CCPA service-provider terms (§7051); other states' processor contracts PIPEDA accountability; Law 25 s. 17 Approved tools and contract terms ISO/IEC 27001 5.19–5.23; SOC 2 CC9.2; NIST CSF 2.0 GV.SC-05
Reachable from the internet (Q3(b)) GLBA FTC notice; HIPAA breach rule; SEC Regulation S-P and Form 8-K Item 1.05 All state breach laws PIPEDA and Alberta PIPA breach reporting; Quebec incident duties Floor 2; exposure scan; incident runbook with legal escalation (breach and incident duties) NIST CSF 2.0 RS.CO; SOC 2 CC7.3–CC7.5

The control column is what to reuse. Mapping a control to a law doesn't make anyone compliant; it shows which existing evidence answers which duty.

Don't: tell anyone this framework makes you compliant (AP16)

No framework, crosswalk or checklist makes a business compliant with a law; only meeting the law's duties does, and that's for your counsel to judge. Overstated claims are their own risk: regulators have acted against unsupported AI claims.1 Say "we map our controls to", and keep the evidence.

Which US federal laws apply?

For laws on decisions about people (FCRA, ECOA, the CCPA automated-decision rules), start with apps that make decisions about people; this section summarizes them and covers the rest.

FTC Act Section 5 (legal requirement). It bans unfair or deceptive practices, applied to AI as deceptive claims about what a feature does, unfair data practices, and deploying automated systems without reasonable safeguards. It covers most for-profit businesses; banks and common carriers fall under their own regulators.1 The FTC's 2024 "Operation AI Comply" targeted deceptive AI claims, and the Rite Aid order (2024) banned a facial-recognition program. In December 2025 the FTC set aside its Rytr order, so expect fewer unfairness cases and continued deception cases.2 For worker-built apps: a customer-facing claim about an AI feature ("accurate", "automated") needs evidence behind it.

FCRA and ECOA/Regulation B (legal requirement). These cover apps that score or screen people for credit, insurance, housing or employment. Under ECOA and Regulation B, a credit adverse-action notice must give specific principal reasons. The FCRA requires an adverse-action notice when a consumer report is used (the agency's details, and free-report and dispute rights, plus key factors when a credit score is used), and, for employers, a copy of the report before adverse action (§1681b(b)(3)); it doesn't require a statement of reasons.26 The CFPB withdrew Circular 2022-03 on complex algorithms effective 12 May 2025, though the circular's own page shows no withdrawal notice,4 and a Regulation B rule effective 21 July 2026 removed the disparate-impact "effects test" (reported by law-firm summaries; Federal Register text not read). The regulation still requires the reasons.3 Details are on apps that make decisions about people.

Title VII, the ADA and the ADEA (legal requirement). Disparate impact is in the statute, so private suits continue even though the EEOC removed its AI guidance and Executive Order 14281 deprioritizes disparate-impact enforcement.5 The DOJ's ADA guidance on AI in hiring is still posted (regulator expectation).6

HIPAA (legal requirement) applies to health plans, clearinghouses, providers who bill electronically, and their business associates; employee health data in HR records usually isn't PHI. A vendor that handles PHI for you needs a business associate agreement, and the app belongs in your risk analysis. The breach rule has its own clock (breach and incident duties). The proposed Security Rule update (January 2025) isn't final.7

GLBA Safeguards Rule (legal requirement) applies to non-bank financial institutions, a broad group that includes lenders, brokers and tax preparers. It requires a written security program with service-provider oversight, and since 13 May 2024 notice to the FTC within 30 days of a notification event affecting 500 or more consumers.8

DOJ bulk sensitive-data rule (28 CFR Part 202; legal requirement since 8 April 2025). It prohibits some data transactions with "countries of concern" (China, Cuba, Iran, North Korea, Russia and Venezuela) and the people and companies linked to them, and restricts others, including vendor agreements, unless set security requirements are met. It applies to US persons, any business size, once data passes bulk thresholds measured over 12 months: for example, personal health or financial data on more than 10,000 US persons, biometric identifiers or precise geolocation on more than 1,000, and covered personal identifiers on more than 100,000. It can reach an AI vendor or sub-processor owned by, or based in, a country of concern. Check ownership in the data-location contract term before sending bulk sensitive data.29

COPPA (legal requirement) applies to services directed at children under 13 or with actual knowledge. The 2025 amendments require a written children's information security program, with compliance by 22 April 2026.9 Rare for internal apps.

SOX §404 and ICFR (legal requirement for SEC registrants; for private companies, an audit or lender expectation). A spreadsheet or app is in scope when it performs or supports a key control or produces journal entries, reconciliations or disclosures. If its output is posted to the ledger or financial statements, or is itself the evidence for a reconciliation or tested control, without being independently recomputed, that's Q4(d1): Critical, no downgrade. Output a person re-performs or checks against the system of record before use is Q4(c), Important. Either way, an app in audit scope goes to your compliance owner.10

Accessibility (legal requirement where it applies). Private businesses open to the public have no ADA web regulation, but lawsuits are common, so WCAG 2.2 AA is the good-practice target, and internal tools fall under the ADA's reasonable-accommodation duty. Circumstance C2: federal agencies follow Section 508; state and local governments (ADA Title II) and HHS-funded recipients such as hospitals (Section 504) must meet WCAG 2.1 AA, with deadlines from April 2027 to May 2028.1112

OMB M-25-21 and M-25-22 (circumstance C2: federal agencies and their contractors). M-25-21 replaced M-24-10 and sets minimum practices for "high-impact AI"; M-25-22 covers AI acquisition.13

Copyright. Material an AI generates without enough human authorship isn't protected by US copyright. See IP and licensing for AI-built apps.

Which US state laws apply?

Fast-moving

As of October 2026. Check the review date.

Law What it requires Who it applies to When Type
CCPA/CPRA and CPPA regulations Privacy rights; ADMT notice, opt-out and access; risk assessments before high-risk processing; cybersecurity audits14 For-profit businesses in California above a threshold: annual gross revenue over $26,625,000 (the figure since 1 Jan 2025; next adjustment due January 2027), 100,000 or more consumers' or households' data bought, sold or shared, or half of revenue from selling or sharing. Employee data is covered Regulations effective 1 Jan 2026; ADMT from 1 Jan 2027; risk assessments for existing processing by 31 Dec 2027; first audit certifications 2028–2030 Legal requirement
Other comprehensive privacy laws Access, deletion, correction; opt-outs including profiling for significant decisions; sensitive-data consent; data protection assessments; processor contracts15 More than 20 states, each with resident-count thresholds; most exempt employee and B2B data Varies; Oklahoma 1 Jan 2027, Alabama 1 May 2027, Vermont 1 Jan 2028 (secondary sources) Legal requirement
Colorado SB 26-189 Notice, an explanation after an adverse outcome, correction, and, on the person's request, human review or reconsideration, for tools that materially influence consequential decisions16 Developers and deployers 1 Jan 2027 (replaced SB 24-205, which never took effect); AG rules due Legal requirement
NYC Local Law 144 A bias audit by an independent auditor within one year before use, a published summary, and candidate notice at least 10 business days before use, for automated employment decision tools22 Employers hiring or promoting for NYC roles Since 5 Jul 2023 Legal requirement
Illinois BIPA Written notice and a signed release before collecting biometrics; a retention and destruction policy; private right of action23 Any private entity collecting Illinois residents' biometrics, employees included In force (2024 amendment limits damages to one violation per person) Legal requirement
Washington My Health My Data Act (RCW 19.373) Consent before collecting consumer health data, and separate consent before sharing it (RCW 19.373.030); a consumer health data privacy policy; a ban on geofencing near health-care facilities; enforced through the Consumer Protection Act, including a private right of action24 Any entity that does business in Washington or targets Washington consumers and collects consumer health data, with no revenue threshold; it covers consumers, not people acting as employees Since 31 Mar 2024 (30 Jun 2024 for small businesses) Legal requirement
Illinois HB 3773 No AI use with a discriminatory effect in employment; notice of AI use27 Employers Since 1 Jan 2026; notice rules not issued Legal requirement
Texas TRAIGA Bans developing or deploying AI with intent to discriminate unlawfully, manipulate toward harm, and similar; disclosure duties only for government and health-care providers30 Developers and deployers; AG enforcement, 60-day cure Since 1 Jan 2026 Legal requirement
California employment AI FEHA ADS rules (since 1 Oct 2025, 4-year records); SB 947 corroboration for discipline and termination (from 1 Jul 2027; secondary sources)31 California employers As stated Legal requirement
California AI Transparency Act (SB 942, AB 853, SB 1000) Latent disclosures in AI-generated image, video and audio content, and a disclosure verification tool; SB 1000 removed the 1,000,000-user threshold32 "Covered providers" of generative AI systems Operative 2 Aug 2026; SB 1000 effective on signing (30 Sep 2026) Legal requirement
State breach-notification laws Notify affected residents, often the AG, after unauthorized acquisition of defined personal data; most have encryption safe harbors (breach and incident duties)33 Every state, DC and the territories In force Legal requirement
Electronic-monitoring notice Prior written notice to employees of monitoring of their email, phone or internet use, for example New York Civil Rights Law §52-c (acknowledged at hiring and posted); Connecticut and Delaware have similar laws21 Employers in those states. A fleet-wide laptop search for AI tool or MCP configurations can count New York since 7 May 2022 Legal requirement

Other consent-before-collection laws feed the same consent gate: Nevada has a consumer health data law similar to Washington's (SB 370, 2023; not re-verified for this page), and Texas and Washington have their own biometric-identifier laws, enforced by their attorneys general.25 Not being a HIPAA covered entity doesn't end the health-data question.

Whether a business that wraps a third-party model in a public image or audio generator is a "covered provider" under SB 1000 isn't settled; ask counsel.

For worker-built apps, the duties that bite most often are the profiling opt-outs and assessments (Q5), sensitive-data consent (Q1(c)), and breach notice when an internet-reachable app leaks (Q3(b)), the pattern behind AP1: public-by-default data.

Which laws require telling people they're talking to a bot?

As of October 2026. Disclosing plainly ("you're chatting with an AI assistant") meets the safe harbor or core duty in each; Colorado adds much more.

Law What it requires Who it applies to When Type
California B.O.T. Act (Bus. & Prof. Code §§17940–17943, SB 1001) It's unlawful to use a bot online to interact with a person in California with intent to mislead about its artificial identity, to incentivize a sale or influence a vote. No liability if the bot is disclosed in a way that's "clear, conspicuous, and reasonably designed to inform" (§17941(b))18 Any person using a bot on a public-facing website or app; platform service providers are excluded (the 10,000,000-visitor figure defines platforms only) Since 1 Jul 2019; AB 410's expansion not enacted as of Oct 2026 Legal requirement
Maine (10 M.R.S. §1500-DD, P.L. 2025, ch. 294) No AI chatbot or other technology in trade or commerce with a consumer in a way that may lead a reasonable consumer to believe they're engaging with a human, unless they're told clearly and conspicuously; no intent element. A violation is a violation of the Maine Unfair Trade Practices Act19 Any person dealing with Maine consumers Since September 2025 (sources give 16 or 24 Sep) Legal requirement
Utah AI Policy Act (Utah Code §13-75-103, as amended by SB 226, 2025) Disclose generative AI use to a consumer who clearly asks; licensed professions disclose up front in high-risk interactions28 Businesses using generative AI with consumers In force; sunset 1 Jul 2027 (secondary sources) Legal requirement
Colorado HB 26-1263 (conversational AI services) Disclose that the service is AI; estimate users' age by commercially reasonable methods; for known minors, no engagement rewards, safeguards against sexual content and simulated emotional dependence, and privacy tools; a protocol for suicidal ideation and self-harm, with annual reports to the AG; no claims that output comes from a licensed professional17 Operators of an AI system "accessible to the general public" that primarily simulates human conversation. The bill states no exemption for customer-service bots 1 Jan 2027; AG rules (4 CCR 904-6) in draft, may narrow the scope Legal requirement
California SB 243 (companion chatbots) Disclosure, suicide and self-harm protocols, extra safeguards for known minors, annual reporting20 Operators of "companion chatbots". Bots used only for customer service, business operations, productivity or technical help are excluded, so most worker-built bots aren't covered Since 1 Jan 2026 (secondary sources) Legal requirement

The EU AI Act's Article 50(1) disclosure duty is on the EU AI Act page.

Which Canadian laws apply?

PIPEDA (legal requirement) covers private-sector organizations handling personal information in commercial activity, in provinces without substantially similar laws. It covers employee data only at federally regulated businesses; Alberta, BC and Quebec have their own private-sector laws. Breaches posing a real risk of significant harm must be reported to the Privacy Commissioner and to individuals, and records of all breaches kept for 24 months.40 Alberta's PIPA has its own mandatory notice to the Alberta Commissioner, and Quebec its own incident duties (breach and incident duties). The Commissioner's principles for generative AI (December 2023) are a regulator expectation.41

Bill C-36, tabled 15 June 2026, would replace PIPEDA's privacy part. As reported by secondary sources (primary text not verified), it adds automated-decision transparency, a privacy impact assessment before transferring personal information outside Canada, and a new commission with administrative penalties up to the greater of $10M or 3% of global revenue. It's still awaiting second reading: a bill, not law.42 AIDA, the earlier AI bill, died on prorogation on 6 January 2025, and C-36 has no AI-system successor.

Don't: treat a bill as law

Bill C-36 may change or die, as C-27 and AIDA did.42 Build the explanation and assessment capability it would need, because US and Quebec rules already ask for it, but don't tell staff or customers it's in force.

Quebec Law 25 (legal requirement, private-sector Act). Three rules matter for worker-built apps:43

  • s. 3.3: a privacy impact assessment for any project to acquire, develop or overhaul a system that handles personal information, with the privacy officer consulted from the outset. This is the one North American rule where building the app triggers a duty.
  • s. 12.1: notice and an explanation for decisions based exclusively on automated processing (see decisions about people).
  • s. 17: a privacy impact assessment and a written agreement before personal information leaves Quebec, including to a US-hosted AI service.

That's why the jurisdiction flag routes any app with Quebec people's data to counsel before building.

Federal Directive on Automated Decision-Making (circumstance C2; federal institutions only). It requires an algorithmic impact assessment, bias testing, notice, explanation and recourse, scaled by impact level.44

Ontario (legal requirement). Since 1 January 2026, an employer that publicly advertises a job and uses AI to screen, assess or select applicants must say so in the posting; employers below the 25-employee threshold are excluded.45 Under the Employment Standards Act, Part XI.1, an employer with 25 or more employees in Ontario on 1 January must have a written policy on electronic monitoring of employees, saying whether, how and why it monitors.48 A fleet-wide search of staff laptops for AI tool or MCP configurations is monitoring the policy should cover.

Accessibility. The amended Accessible Canada Regulations (SOR/2025-255) require new or updated web pages and web apps, including employee-facing ones, to meet CAN/ASC-EN 301 549:2024. Federal public-sector bodies are covered at any size, from 5 December 2027. Federally regulated private-sector businesses (banks, telecoms, airlines, interprovincial transport) are covered if they averaged 100 or more employees, from 5 December 2028; 99 or fewer are exempt. Content in an employee "collaborative digital environment" is exempt; whether a worker-built app counts is for counsel.46 This is the first rule to reach private-sector employers' internal web apps directly (Section 508 already covers federal agencies' internal ICT). Ontario's AODA requires WCAG 2.0 AA for public websites of organizations with 50 or more employees (internal websites aren't covered). Its employment standard on accessible formats for employees on request (O. Reg. 191/11, s. 26) applies to every Ontario employer; employers with fewer than 50 employees have been covered since 1 January 2017 (secondary sources; verify on e-Laws).47

What breach and incident duties apply?

Fast-moving

As of October 2026. Check the review date.

When a worker-built app exposes data, several clocks can run at once, and whether a notice is owed often turns on whether anyone accessed the data, which only the logs show. Your counsel decides; the first-hour steps are on if your data was exposed.

Duty Who it applies to What and when Type
State breach-notification laws Anyone holding defined personal data of a state's residents Notice to affected residents, often the AG; California within 30 calendar days from 1 Jan 2026, and a copy to the AG when more than 500 Californians are notified (Civ. Code §1798.82)33 Legal requirement
HIPAA Breach Notification Rule (45 CFR §§164.400–414) HIPAA covered entities and their business associates Individuals without unreasonable delay and within 60 days of discovery; HHS (at the same time if 500 or more people, otherwise within 60 days after the year ends) and the media for 500 or more in a state; a business associate tells the covered entity34 Legal requirement
GLBA Safeguards Rule (16 CFR §314.4(j)) Non-bank financial institutions The FTC within 30 days of discovering a notification event affecting 500 or more consumers8 Legal requirement
SEC Regulation S-P (as amended 2024) Broker-dealers, investment companies, registered investment advisers, funding portals and transfer agents An incident response program, service-provider oversight, and notice to affected individuals within 30 days of becoming aware of unauthorized access to sensitive customer information; compliance from 3 Dec 2025 (larger entities) and 3 Jun 2026 (smaller)35 Legal requirement
SEC Form 8-K Item 1.05 SEC registrants (listed companies) Disclose a material cybersecurity incident within four business days of determining it's material36 Legal requirement
PIPEDA Organizations under PIPEDA (see above) Report to the Privacy Commissioner and notify individuals where there's a real risk of significant harm; keep a record of every breach for 24 months40 Legal requirement
Alberta PIPA (s. 34.1) Private-sector organizations in Alberta, employee data included Notify the Alberta Commissioner without unreasonable delay where a reasonable person would see a real risk of significant harm; the Commissioner can require notice to individuals37 Legal requirement
Quebec Law 25 (ss. 3.5–3.8) Businesses holding personal information about people in Quebec For a confidentiality incident that risks serious injury, notify the Commission d'accès à l'information and the people affected; keep a register of every incident43 Legal requirement
GDPR (Arts. 33, 34) Only where the GDPR applies (Art. 3, below) The supervisory authority within 72 hours, unless the breach is unlikely to be a risk; individuals without undue delay if the risk is high38 Legal requirement
CIRCIA Critical-infrastructure entities 72-hour reports, not yet required: CISA's final rule hasn't been issued51 Pending

When does EU or UK law reach you?

GDPR applies to a North American business that has an EU establishment (a branch or subsidiary), or that offers goods or services to people in the EU or monitors their behavior there (Art. 3). Article 22 limits solely automated decisions with significant effects. The EU AI Act reaches you when your AI system's output is used in the EU; see the EU AI Act page.

EU-US data transfers

If the GDPR applies, a US vendor can receive EU personal data under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), but only if its listing on the DPF List covers your data type (HR or non-HR). The General Court dismissed the Latombe challenge (T-553/23) on 3 September 2025; an appeal, C-703/25 P, is reported as pending at the Court of Justice (secondary sources; the docket wasn't read). Keep standard contractual clauses as a fallback. For UK data, use the UK Extension to the DPF, the IDTA or the UK Addendum.39 Contract checks are on approve tools.

The UK's Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A–22D from 5 February 2026. Solely automated significant decisions are permitted with safeguards. The jurisdiction flag covers EU and UK people, staff who work in the EU or UK, and AI output used in the EU.49

What's pending or uncertain?

  • Federal preemption of state AI laws. Executive Order 14365 (11 December 2025) set up a DOJ AI Litigation Task Force and called for preemptive legislation, but no federal statute preempts state AI laws. State laws apply until a court or Congress says otherwise. Whether Commerce has published its list of "onerous" state laws isn't verified.50
  • The FTC's proposed policy statement on "suppression of accuracy" in AI, which suggests some state laws may be preempted, is proposed, not final.
  • CCPA ADMT duties start 1 January 2027; watch for CPPA enforcement advisories.
  • Colorado AG rules (4 CCR 904-6, implementing SB 26-189 and the chatbot law HB 26-1263) were released as interim drafts, with comments due 26 October 2026; they may narrow HB 26-1263's scope. Re-check before the January 2027 review (law-firm tracker, secondary).17
  • Illinois HB 3773 notice rules were proposed and withdrawn in 2026; employers have the duty without a rule defining its form.
  • HIPAA Security Rule update: proposed January 2025, not final.
  • CIRCIA: CISA's final rule hasn't been issued, so its 72-hour incident reports aren't required yet.
  • Bill C-36: second reading pending; contents from secondary sources.

Questions to ask your counsel

  1. In which states, provinces and countries do the people our apps touch live or work, and which privacy laws apply to us there, including employee data in California and Quebec?
  2. Do we meet the CCPA and other state privacy-law thresholds, and do any entity-level exemptions (GLBA, HIPAA) apply?
  3. Does any app make or materially influence a significant or consequential decision about a person under the CCPA ADMT rules, Colorado SB 26-189, NYC LL 144, Illinois HB 3773 or California's FEHA and SB 947 rules?
  4. Are we a HIPAA covered entity or business associate, a GLBA financial institution, or an SEC registrant or Regulation S-P institution? Which AI vendors need a BAA or service-provider terms, and which breach clocks in the breach table would run for us?
  5. Which worker-built apps support SOX key controls or sit in our SOC 2 or ISO audit scope, and what evidence will our auditors expect?
  6. Do we have Quebec operations, so that Law 25 requires a PIA when we build a system handling personal information or send it outside Quebec?
  7. Which of our customer-facing claims about AI features need substantiation under the FTC Act and state consumer-protection laws, and does any public chatbot fall under the California, Maine, Utah or Colorado chatbot laws?
  8. Which accessibility standard should our customer-facing and internal apps meet, and do the Title II, HHS Section 504 or Accessible Canada deadlines apply to us?
  9. Do any apps collect biometric identifiers, data about anyone under 18, or consumers' health or other sensitive data outside HIPAA, and which consent laws (BIPA, the Texas and Washington biometric laws, Washington's My Health My Data Act, Nevada's equivalent, state sensitive-data opt-in rules) apply before we collect it?
  10. Is any AI vendor or sub-processor linked to a country of concern under the DOJ bulk sensitive-data rule, and which pending items above should we watch most closely?

Assumptions and evidence

  • A-019 (Medium): We expect regulators to favor enabled, inventoried, risk-tiered use over bans. That's well supported for the public sector (OMB M-25-21); for private businesses it's a hypothesis by analogy. Test it by checking each new enforcement action and guidance document at the quarterly review for a regulator that mandates prohibition by default.
  • Evidence: statutes, regulations and regulator pages, read or located on 2026-10-21; rows resting on secondary sources are labelled. Several bill and regulation texts (Bill C-36, Ontario regulations) couldn't be read directly.
  • Facts on this page are as of October 2026.

  1. 15 U.S.C. §45, https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section45&num=0&edition=prelim [statute]; FTC, Operation AI Comply, 25 Sep 2024, https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes; FTC v. Rite Aid, https://www.ftc.gov/legal-library/browse/cases-proceedings/2023190-rite-aid-corporation-ftc-v [regulator], accessed 2026-10-21. ↩↩

  2. FTC, FTC reopens and sets aside Rytr final order, Dec 2025, https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-reopens-sets-aside-rytr-final-order-response-trump-administrations-ai-action-plan [regulator], accessed 2026-10-21. ↩

  3. 12 C.F.R. §1002.9, https://www.consumerfinance.gov/rules-policy/regulations/1002/9/ [statute], accessed 2026-10-21. ↩

  4. CFPB, withdrawal of 67 guidance documents, 90 FR 20084, 12 May 2025, https://www.govinfo.gov/content/pkg/FR-2025-05-12/html/2025-08286.htm [regulator]; the circular's page, https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/, shows no withdrawal banner (last modified 28 Aug 2024) [regulator], accessed 2026-10-21. ↩

  5. 42 U.S.C. §2000e-2, https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section2000e-2&num=0&edition=prelim [statute]; Executive Order 14281, https://www.whitehouse.gov/presidential-actions/2025/04/restoring-equality-of-opportunity-and-meritocracy/ [primary], accessed 2026-10-21. ↩

  6. US Department of Justice, Algorithms, Artificial Intelligence, and Disability Discrimination in Hiring, https://www.ada.gov/resources/ai-guidance/ [regulator], accessed 2026-10-21. ↩

  7. 45 C.F.R. §164.308, https://www.law.cornell.edu/cfr/text/45/164.308 [statute]; HIPAA Security Rule NPRM, 6 Jan 2025, https://www.govinfo.gov/content/pkg/FR-2025-01-06/html/2024-30983.htm [regulator], accessed 2026-10-21. ↩

  8. 16 C.F.R. §314.4, https://www.law.cornell.edu/cfr/text/16/314.4 [statute]; FTC Safeguards Rule amendment, 13 Nov 2023, https://www.govinfo.gov/content/pkg/FR-2023-11-13/html/2023-24412.htm [regulator], accessed 2026-10-21. ↩↩

  9. FTC, COPPA Rule amendments, 22 Apr 2025, https://www.govinfo.gov/content/pkg/FR-2025-04-22/html/2025-05904.htm [regulator], accessed 2026-10-21. ↩

  10. 15 U.S.C. §7262, https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7262&num=0&edition=prelim [statute], accessed 2026-10-21. ↩

  11. US Department of Justice, ADA Title II web and mobile accessibility rule, https://www.ada.gov/resources/2024-03-08-web-rule/ [regulator]; US Access Board, ICT standards, https://www.access-board.gov/ict/ [regulator], accessed 2026-10-21. ↩

  12. HHS, interim final rule extending Section 504 web accessibility compliance dates, FR Doc. 2026-09266, https://public-inspection.federalregister.gov/2026-09266.pdf [regulator], accessed 2026-10-21. ↩

  13. OMB, Memorandum M-25-21, https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf; memoranda index, https://www.whitehouse.gov/omb/information-resources/memoranda/ [primary], accessed 2026-10-21. ↩

  14. California Privacy Protection Agency, CCPA regulations, https://cppa.ca.gov/regulations/ccpa_updates.html; threshold adjustment, https://cppa.ca.gov/regulations/cpi_adjustment.html [regulator], accessed 2026-10-21. ↩

  15. IAPP, US State Privacy Legislation Tracker (updated 8 Sep 2026), https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ [secondary tracker], accessed 2026-10-21. ↩

  16. Colorado General Assembly, SB 26-189, https://leg.colorado.gov/bills/sb26-189 [statute], accessed 2026-10-21. ↩

  17. Colorado General Assembly, HB 26-1263, signed 29 May 2026, effective 1 Jan 2027, https://leg.colorado.gov/bills/hb26-1263 [statute; the duties and the "accessible to the general public" definition were read from the bill page's summary and text on 2026-10-21, not from the session laws]; Colorado Attorney General, AI laws, https://coag.gov/ai/ [regulator]; Akin Gump, Colorado AG interim draft rules (4 CCR 904-6), Oct 2026, https://www.akingump.com/en/insights/ai-law-and-regulation-tracker/colorado-attorney-general-releases-interim-draft-rules-implementing-admt-and-chatbot-safety-acts [law firm, secondary; source for the draft-rule status and comment date], accessed 2026-10-21. ↩↩

  18. Cal. Bus. & Prof. Code §§17940–17943 (SB 1001, 2018), https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=7.&title=&part=3.&chapter=6.&article= [statute; leginfo refused our fetcher, so the text was read on the mirror https://california.public.law/codes/business_and_professions_code_section_17941], accessed 2026-10-21. ↩

  19. 10 M.R.S. §1500-DD (P.L. 2025, ch. 294, LD 1727), https://legislature.maine.gov/statutes/10/title10sec1500-DD.html [statute; the page returned an error to our fetcher, so the text was confirmed through search results showing the codified section]; Office of Policy and Legal Analysis enacted-law summary, https://lldc.mainelegislature.org/Open/Sums/132/sum132-LD-1727.pdf [legislative summary], accessed 2026-10-21. ↩

  20. California SB 243 (2025), companion chatbots, https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 [statute; not read by our tools]; Skadden, New California "companion chatbot" law, Oct 2025, https://skadden.com/insights/publications/2025/10/new-california-companion-chatbot-law [law firm, secondary; source for the scope and the customer-service exclusion], accessed 2026-10-21. ↩

  21. New York Civil Rights Law §52-c, https://www.nysenate.gov/legislation/laws/CVR/52-C [statute; Connecticut (Conn. Gen. Stat. §31-48d) and Delaware (19 Del. C. §705) cited from memory, not re-read], accessed 2026-10-21. ↩

  22. NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools, https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page [regulator], accessed 2026-10-21. ↩

  23. Biometric Information Privacy Act, 740 ILCS 14, https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57 [statute], accessed 2026-10-21. ↩

  24. Washington My Health My Data Act, RCW 19.373 (consent, RCW 19.373.030), https://app.leg.wa.gov/RCW/default.aspx?cite=19.373 [statute; the effective dates and the Consumer Protection Act enforcement route (RCW 19.373.090) weren't re-read for this page; verify before relying on them], accessed 2026-10-21. ↩

  25. Washington biometric identifiers law, RCW 19.375, https://app.leg.wa.gov/RCW/default.aspx?cite=19.375; Texas Business and Commerce Code §503.001, https://statutes.capitol.texas.gov/Docs/BC/htm/BC.503.htm [statute], accessed 2026-10-21. ↩

  26. 15 U.S.C. §1681m (adverse action), https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section1681m&num=0&edition=prelim; §1681b(b)(3) (employment), https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section1681b&num=0&edition=prelim [statute], accessed 2026-10-21. ↩

  27. Illinois Public Act 103-0804, https://www.ilga.gov/legislation/publicacts/fulltext.asp?Name=103-0804 [statute], accessed 2026-10-21. ↩

  28. Utah Code §13-75-103, as amended by SB 226 (2025), https://le.utah.gov/~2025/bills/static/SB0226.html [statute; the bill page didn't render the text for our tools; scope and the 1 Jul 2027 sunset (SB 332) are from secondary summaries], accessed 2026-10-21. ↩

  29. US Department of Justice, Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, 28 CFR Part 202 (90 FR 1636, 8 Jan 2025; effective 8 Apr 2025), https://www.law.cornell.edu/cfr/text/28/part-202; bulk thresholds §202.205, https://www.law.cornell.edu/cfr/text/28/202.205; countries of concern §202.601, https://www.law.cornell.edu/cfr/text/28/202.601 [statute], accessed 2026-10-21. ↩

  30. Texas Legislature Online, HB 149 (89R) history, https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149 [statute], accessed 2026-10-21. ↩

  31. California SB 947 (reported as Stats. 2026, ch. 859), https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947 [statute; the page refused our tools, so its scope and dates come from law-firm summaries only, secondary]; Civil Rights Department, FEHA ADS regulations, https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/ [regulator], accessed 2026-10-21. ↩

  32. California SB 1000 (Stats. 2026, ch. 861), https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000 [statute], accessed 2026-10-21. ↩

  33. Cal. Civ. Code §1798.82 (AG copy where more than 500 residents are notified, subd. (f)), https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 [statute; the page refused our tools, so the 30-day wording is confirmed only through the index that follows]; NCSL, Security Breach Notification Laws, https://www.ncsl.org/technology-and-communication/security-breach-notification-laws [secondary index of statutes], accessed 2026-10-21. ↩↩

  34. 45 C.F.R. §§164.400–414 (Breach Notification Rule), notice to individuals §164.404, https://www.law.cornell.edu/cfr/text/45/164.404, and to the Secretary §164.408, https://www.law.cornell.edu/cfr/text/45/164.408 [statute]; HHS, Breach Notification Rule, https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html [regulator], accessed 2026-10-21. ↩

  35. SEC, Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Release No. 34-100155, 16 May 2024, https://www.sec.gov/files/rules/final/2024/34-100155.pdf [regulator; the PDF was located but its text not extracted by our tools; scope and dates confirmed through IAPP and law-firm summaries, secondary], accessed 2026-10-21. ↩

  36. SEC, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release No. 33-11216, 26 Jul 2023 (Form 8-K Item 1.05), https://www.sec.gov/files/rules/final/2023/33-11216.pdf [regulator], accessed 2026-10-21. ↩

  37. Alberta Personal Information Protection Act, SA 2003, c. P-6.5, ss. 34.1 and 37.1, https://kings-printer.alberta.ca/1266.cfm?page=P06P5.cfm&leg_type=Acts&isbncln=9780779855148 [statute; the text didn't render for our tools, so the wording is confirmed through the Alberta OIPC, https://oipc.ab.ca/resources/notifying-affected-individuals-practice-note.aspx, regulator], accessed 2026-10-21. ↩

  38. Regulation (EU) 2016/679 (GDPR), Arts. 3, 33 and 34, https://eur-lex.europa.eu/eli/reg/2016/679/oj [statute], accessed 2026-10-21. ↩

  39. European Commission, Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework), https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj [primary]; US Department of Commerce, DPF List, https://www.dataprivacyframework.gov/list [primary]; Court of Justice, case C-703/25 P, https://curia.europa.eu/juris/liste.jsf?num=C-703/25 [court; appeal status from secondary sources, docket not read]; UK Government, UK-US data bridge, https://www.gov.uk/government/publications/uk-us-data-bridge-supporting-documents [regulator], accessed 2026-10-21. ↩

  40. PIPEDA, https://laws-lois.justice.gc.ca/eng/acts/P-8.6/; Breach of Security Safeguards Regulations, SOR/2018-64, https://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/page-1.html [statute], accessed 2026-10-21. ↩↩

  41. Office of the Privacy Commissioner of Canada, Principles for responsible, trustworthy and privacy-protective generative AI technologies, https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/ [regulator], accessed 2026-10-21. ↩

  42. Bill C-36 (45th Parliament, 1st session), https://openparliament.ca/bills/45-1/C-36/ [secondary]; official page https://www.parl.ca/legisinfo/en/bill/45-1/c-36 couldn't be read by our tools [primary], accessed 2026-10-21. ↩↩

  43. Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 [statute], accessed 2026-10-21. ↩↩

  44. Treasury Board of Canada Secretariat, Directive on Automated Decision-Making, https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592 [primary], accessed 2026-10-21. ↩

  45. Ontario Regulation 476/24, https://www.ontario.ca/laws/regulation/240476 [statute; page not machine-readable, details from Ontario's employer guidance], accessed 2026-10-21. ↩

  46. Regulations Amending the Accessible Canada Regulations, SOR/2025-255, Canada Gazette Part II, 17 Dec 2025, https://gazette.gc.ca/rp-pr/p2/2025/2025-12-17/html/sor-dors255-eng.html [statute], accessed 2026-10-21. ↩

  47. Government of Ontario, How to make websites accessible, https://www.ontario.ca/page/how-make-websites-accessible [regulator]; O. Reg. 191/11, s. 26, https://www.ontario.ca/laws/regulation/110191 [statute; e-Laws didn't render, so the small-employer scope and the 1 Jan 2017 date come from secondary summaries: Mondaq, https://mondaq.com/canada/discrimination-disability-sexual-harassment/559368/times-up-new-aoda-requirements-became-effective-january-1-2017, and the University of Waterloo AODA toolkit, https://uwaterloo.ca/library/aoda-toolkit/node/15], accessed 2026-10-21. ↩

  48. Employment Standards Act, 2000, S.O. 2000, c. 41, Part XI.1 (written policy on electronic monitoring), https://www.ontario.ca/laws/statute/00e41 [statute; e-Laws didn't render for our tools; the 25-employee rule and content requirements are confirmed through Littler's summary of the ministry guide, https://www.littler.com/publication-press/publication/ontario-canada-esa-guidance-now-contains-chapter-electronic-monitoring, secondary], accessed 2026-10-21. ↩

  49. Data (Use and Access) Act 2025, s. 80, https://www.legislation.gov.uk/ukpga/2025/18/section/80 [statute], accessed 2026-10-21. ↩

  50. Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence, 90 FR, 16 Dec 2025, https://www.govinfo.gov/content/pkg/FR-2025-12-16/html/2025-23092.htm [primary], accessed 2026-10-21. ↩

  51. CISA, Cyber Incident Reporting for Critical Infrastructure Act of 2022, https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia [regulator], accessed 2026-10-21. ↩