US AI compliance for regulated SMBs.

Executive summary

• The US AI compliance picture in May 2026 is not "we are waiting for federal law." It is a stack of state attorney-general statutes, federal sector regulators, and contract obligations that already bind any regulated SMB doing business in California, Colorado, Texas, New York, Utah, or under HHS, SEC, FINRA, CFPB, OCC, FDIC, NYDFS, PCI SSC, or DoD authority.
• The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) and its Generative AI Profile (NIST-AI-600-1, July 2024) are the de-facto national template. They are referenced or mirrored in every meaningful state AI law and in OMB procurement guidance.^[1]
• The Colorado AI Act (SB 24-205) was the country's first comprehensive state AI statute. Its substantive obligations were delayed from February 1, 2026 to June 30, 2026, and on April 27, 2026 a federal court paused enforcement while the legislature reconsiders the scope. The fact that it can be paused does not undo the underlying obligation; planning for it is still planning for what every other state is now copying.^[2]
• Texas TRAIGA (HB 149) is in force January 1, 2026 with civil penalties of $10,000 to $200,000 per violation, plus $2,000 to $40,000 per day for continuing violations.^[3] California AB 2013 took effect January 1, 2026; SB 942 (watermarking) is operative August 2, 2026.^[4] Connecticut's AI Responsibility and Transparency Act passed both chambers May 1, 2026, with employment-AI obligations effective October 1, 2026.^[5]
• Sector federal exposure is already binding. FINRA Notice 24-09 (June 27, 2024) confirms every existing securities rule applies to generative AI.^[6] The SEC charged Delphia and Global Predictions $400,000 combined for AI-washing in March 2024.^[7] The FTC banned Rite Aid from facial recognition for five years and required model deletion in December 2023, then opened Operation AI Comply in September 2024.^[8] NYDFS issued AI-specific cybersecurity guidance under 23 NYCRR Part 500 in October 2024 and AI-specific third-party guidance in October 2025.^[9]
• The cyber-insurance market is where the cost shows up first. Carriers added AI-specific renewal questionnaires in early 2026, started writing AI-specific exclusions, and expect documentation. Non-disclosure of AI use is already triggering renewal pressure or denial.^[10]
• The audit pack the regulators, examiners, and insurers actually want is the same artifact in every case: AI inventory, vendor risk register, NIST AI RMF self-assessment, impact assessments per high-risk use case, training-data provenance, consumer notices, retention policies, AI-aware incident response. AiTLLM Private and Sovereign tiers ship that pack pre-built.

The map of US AI obligations as of May 2026

Each row below is a binding source of obligation today, tomorrow, or this calendar year. Effective dates and penalty figures are confirmed against the primary source linked in the footnotes; "paused" means the obligation exists in statute but enforcement is currently stayed.

Two things stand out reading the table together. First, the obligations are cumulative, not exclusive. A 75-person Connecticut RIA selling into Texas using a HIPAA-relevant medical-billing back office and a CMMC-Level-2 government subcontract is sitting in five jurisdictions and four sector regimes at once. Second, the obligations are operationally similar. Every regime, with minor framing differences, asks for the same artifacts: an inventory of AI use, a risk classification, a documented control set, a vendor pipeline, and an audit log. That convergence is why the NIST AI RMF is the right place to start.

Why this hits SMBs harder than enterprises

An enterprise with a privacy office, an in-house AI committee, a full-time GRC team, and a panel of outside counsel can absorb a new state law every quarter. A 50-to-300-person regulated SMB cannot. The regulatory load that hyperscalers and Fortune 500s budget for in millions lands on the same one to three people who are also running endpoints, email security, and the help desk.

The mismatch is not theoretical. The same SMB that spent 2024 and 2025 catching up on basic identity hygiene (MFA on every account, conditional access, baseline DLP) is now expected, in 2026, to produce an AI inventory, a NIST AI RMF self-assessment, vendor attestations from every AI subprocessor, training-data documentation under California AB 2013, and a bias-audit posting under NYC Local Law 144 if they touch any candidate in New York City. The gap between what is required and what an in-house team can produce is widening.

The regulators know this, which is why state AGs and the FTC are using existing consumer-protection authority rather than waiting for AI-specific statutes. The FTC's Rite Aid order is the cleanest example: no AI-specific statute was needed. Section 5 of the FTC Act covered it, and the remedy included algorithmic disgorgement. Insurers know it too, which is why the loudest near-term cost shows up at renewal.

Colorado AI Act: what the canary tells us

Colorado SB 24-205 was the country's first comprehensive AI statute, signed May 17, 2024 by Governor Polis. Its substantive obligations were originally set to take effect on February 1, 2026, were postponed in August 2025 to June 30, 2026 by a special-session bill, and on April 27, 2026 a federal district court approved a joint motion to stay enforcement and litigation deadlines while the legislature reconsiders the scope.^[2] The pause is real. The text is also still on the books, and every other state currently drafting AI legislation is treating it as a reference.

Reading the statute is therefore the cheapest forecast of what Texas, Connecticut, California, and the dozen other state bills on dockets right now will actually require.

What is a "high-risk artificial intelligence system"?

Colorado defines high-risk as any AI system that, when deployed, makes or is a substantial factor in making a "consequential decision" about a consumer. Consequential decision means a decision that has a material legal or similarly significant effect on the provision or denial, cost, or terms of education enrollment, employment, financial or lending services, healthcare services, housing, insurance, legal services, or essential government services.

A regulated SMB will encounter the high-risk threshold in workflows it already runs: AI-assisted resume screening, AI-driven loan or credit decisioning, AI features inside an EHR or practice-management platform, AI inside a tenant-screening or insurance-quote tool. The bar is whether AI is "a substantial factor" in the decision, not whether it is the only factor. Vendors saying "we just suggest, the human decides" do not necessarily clear the threshold.

Developer vs deployer

A developer designs, codes, or substantially modifies a high-risk AI system. A deployer is the entity actually using it to make a consequential decision. The SMB is almost always the deployer. Developer obligations live mostly with the vendor; deployer obligations live with you. They include implementing a risk management program, conducting an annual impact assessment per high-risk system, providing consumer notice of the use of AI in a consequential decision, providing an appeal-and-correction mechanism, and reporting algorithmic discrimination to the AG within 90 days of discovery.^[2b]

Safe harbor and penalties

The statute provides an affirmative defense for entities that follow a recognized risk management framework "such as the latest version of the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework." Mapping your controls to NIST AI RMF is the explicit safe-harbor path. Penalties are up to $20,000 per violation under the Colorado Consumer Protection Act, $50,000 per violation involving consumers age 60 or older, with no private right of action.

NIST AI RMF as the spine

The NIST AI Risk Management Framework 1.0 was published January 26, 2023, and the Generative AI Profile (NIST-AI-600-1) on July 26, 2024.^[1] The framework is voluntary, but it is now the closest thing the United States has to a national AI standard. Colorado's safe-harbor language names it. Texas TRAIGA mirrors its risk-tiering vocabulary. NYDFS guidance points at it. OMB M-25-21 imports its function set into federal AI use, and OMB M-25-22 imports it into AI procurement.

The framework has four core functions, each implementable as a small set of SMB controls.

Govern

The cross-cutting function. For an SMB this is: a one-page AI policy, a named owner (often the CISO or head of IT), an AI inventory that lists every AI use case in the business, a vendor risk register that maps each AI feature to its provider, a training plan, and an incident-response playbook with AI-specific triggers (model exfiltration, prompt-injection breach, hallucination causing customer harm, vendor outage). The artifact is short. The discipline of producing it once and updating it quarterly is what counts.

Map

For each AI use case in the inventory, describe its context: who it affects, what data it touches, what decision it influences, what the failure modes look like, who would be harmed by failure, what regulatory regime it sits inside, and what the deployment surface is (M365 tenant, customer-facing chatbot, in-EHR copilot). This is the input that drives risk classification.

Measure

For high-risk use cases, measure performance against the failure modes identified in Map. Bias testing, hallucination rate, security testing of the prompt boundary, data-leakage testing, model drift over time. For SMBs, "measure" does not mean "build a benchmarking pipeline." It means: pick three test cases per high-risk use, run them quarterly, write down the result.

Manage

Put the controls in place that the Map and Measure work indicated were needed: DLP at the prompt boundary, RAG retrieval with identity scoping, human-in-the-loop checkpoints on consequential decisions, model-version pinning, retention policies, vendor BAAs and DPAs, and the consumer notices the relevant statute requires.

That is the entire spine. Every state law and sector regulator we mapped above is asking for some subset of those four. The reason to anchor your program to NIST AI RMF is not because NIST is the regulator. It is because every other regulator has chosen to point at NIST instead of building their own framework from scratch.

Sector layers

Healthcare (HIPAA)

HHS Office for Civil Rights proposed the first major update to the HIPAA Security Rule in 20 years on January 6, 2025, with a final rule expected in summer 2026. The proposal eliminates the addressable/required distinction and explicitly brings AI tools that touch PHI into the risk analysis. The implication for a covered entity or business associate is that "we use ChatGPT for charting" is a risk-analysis failure unless it is documented, scoped, and contractually controlled.

The BAA expectations follow. A covered entity using AI on PHI must have a Business Associate Agreement with the AI vendor that explicitly prohibits using PHI to train or refine the model unless authorized in writing, requires audit-trail retention, and adds AI-aware breach notification. Most consumer LLM products do not offer a HIPAA BAA. Vendors that do (Microsoft Azure OpenAI, AWS Bedrock under HIPAA-eligible services, Google Vertex AI under HIPAA-eligible services, Together AI for specific configurations) require explicit account-level configuration before the BAA attaches.

Financial services (SEC + FINRA + GLBA + NYDFS)

The SEC has been the most aggressive AI enforcer in financial services. The first AI-washing actions, against Delphia and Global Predictions in March 2024, settled for a combined $400,000 in civil penalties.^[7] The 2025 SEC Marketing Rule risk alert (issued December 2025) flagged AI claims as an exam priority and called out testimonial, endorsement, and substantiation gaps tied to AI marketing.

FINRA Notice 24-09 (June 27, 2024) is short and direct. Existing rules apply. Rule 3110 (Supervision) requires firms using GenAI in supervisory functions to address technology governance, model risk, data privacy, and accuracy. Rule 2210 (Communications with the Public) applies the same content standards to AI-generated content. Rule 4511 (Books and Records) and SEC Rule 17a-4 retention obligations apply to AI prompts and outputs that constitute business records.^[6] The 2026 FINRA Annual Regulatory Oversight Report (published December 9, 2025) substantially expanded the GenAI section and added explicit expectations for autonomous AI agents.

For NYDFS-licensed entities, the October 16, 2024 industry letter named four AI-specific cybersecurity risks (AI-enabled social engineering, AI-enhanced attacks, AI-driven NPI exposure, AI supply chain) and pointed every Covered Entity back to the existing 23 NYCRR Part 500 controls. The October 21, 2025 follow-up specifically recommends contract language for third-party AI service providers covering training limitations, location and transfer restrictions, subcontractor disclosure, and acceptable-use clauses.^[9]

GLBA's Safeguards Rule (16 CFR Part 314) treats AI vendors as service providers and inherits its standard third-party-provider language: written contracts, periodic assessment, access controls, encryption.

Retail and consumer (PCI DSS, FTC)

PCI DSS v4.0.1 brought 51 future-dated requirements into mandatory force on March 31, 2025. The PCI Security Standards Council subsequently issued AI assessment guidance for QSAs covering AI involvement in artifact review, work paper creation, and remote interviews. For a merchant, the operational impact is that any AI tool deployed in or adjacent to the cardholder data environment is in PCI scope, including AI-assisted customer-service tools that handle payment information.

The FTC has been the most assertive federal regulator on consumer-protection grounds. The Rite Aid consent order in December 2023 banned the company from facial-recognition surveillance for five years and required model deletion ("algorithmic disgorgement") plus deletion of derived models held by third parties.^[8] Operation AI Comply followed in September 2024 with five enforcement actions against companies making deceptive AI claims, including DoNotPay's "AI lawyer," Rytr's review-generator, and three e-commerce "AI business opportunity" schemes. Algorithmic disgorgement is the FTC's most consequential remedy: it can erase the asset, not just fine the use of it.

Government contracting (NIST 800-171 + CMMC 2.0)

The DoD CMMC 2.0 Final Rule was finalized September 10, 2025 and became effective November 10, 2025, with phased implementation through November 10, 2028. Phase 1 introduces Level 1 and Level 2 self-assessment requirements for any contractor handling Federal Contract Information or Controlled Unclassified Information. NIST SP 800-171 Revision 3 was finalized by NIST but is not yet authorized by DoD for CMMC scoring; Level 2 self-assessments and C3PAO audits remain on Revision 2. AI use inside a CUI environment must be scoped against the same control set as any other technology touching CUI.

Cyber insurance is where this hurts first

Statutes are slow. Renewal cycles are not. Cyber-insurance carriers were the first commercial actors to make AI use a documented requirement, because the next loss they pay out is theirs to underwrite. Three changes have hit the market in 2025 and 2026.

First, AI-specific renewal questionnaires. Major cyber and EPLI carriers (Beazley among them) added explicit AI questions to renewal applications in early 2026: do you use AI in employment decisions, do you have a written AI use policy, do you conduct bias testing, do you use AI in customer-facing contexts, do you have BAA or DPA coverage with each AI vendor, do you have human-in-the-loop checkpoints on consequential decisions. Insurers verify some of these answers against external data (DMARC records, Shodan exposure, dark-web credential monitoring); AI questions are increasingly verified against vendor-side attestations.^[10]

Second, AI-specific exclusions. Starting in early 2026, multiple carriers began applying generative-AI exclusions to standard CGL and some cyber forms, covering defamation, privacy violations, copyright infringement, and bodily injury or property damage arising from AI outputs. "Unauthorized AI tool" exclusions remove coverage for losses arising from employee use of AI tools not on the organization's approved list. The era of "silent AI" coverage, the period when AI risk slipped into a policy because nothing excluded it, is closing.

Third, non-disclosure consequences. Carriers treat AI use materially the same way they treat ransomware exposure: a misstatement on the application can void coverage at claim time. The single most common SMB mistake in 2026 renewals is answering "no" to the AI question because nobody at the company has run the inventory. The AI is in the M365 Copilot license, the help desk's ChatGPT use, the marketing team's HeyGen subscription, the vendor's "AI mode" toggle. The misanswer is not strategic; it is administrative. The cost is real.

The audit pack: what regulators, examiners, and insurers actually want

Across every regime mapped above, the underlying request converges on the same set of artifacts. The vocabulary differs by audience (the SEC says "policies and procedures," the cyber underwriter says "controls evidence," the Colorado AG says "risk management program," the HHS auditor says "risk analysis"), but the documents are the same.

1. AI inventory. One row per AI use case in the business. Owner, vendor, data classification, decision impact, regulatory regime, status (production / pilot / shadow). Living document, refreshed quarterly.
2. Vendor risk register for AI subprocessors. Per AI vendor: contract type (BAA / DPA / standard MSA), training-data clause, data-residency clause, subprocessor disclosure, retention and deletion clause, security-attestation evidence (SOC 2 Type II report, ISO 27001 certificate, HIPAA attestation).
3. NIST AI RMF self-assessment. The four functions, mapped to your controls, with gaps documented.
4. Impact assessment per high-risk use case. Following the NIST GAI Profile and the Colorado / Texas / Connecticut content requirements: purpose, affected populations, data inputs, failure modes, mitigations, residual risk, sign-off.
5. Training-data provenance and consumer notice templates. AB 2013-style training-data summary if you build, plus consumer-facing notice templates for high-risk AI use (Colorado / Texas / Connecticut).
6. Data flow diagrams. One per AI use case. Source, transit, processing location, retention, egress controls.
7. Retention and deletion policies. Specifically: retention of prompts, outputs, model versions; alignment with SEC 17a-4 (financial services) and HIPAA (healthcare); user-driven deletion for CCPA, GDPR.
8. Incident response plan with AI-specific triggers. Prompt-injection compromise, model-output harm, training-data exfiltration, vendor outage, agentic-AI scope creep.
9. Third-party AI service provider contracts. Aligned with NYDFS October 2025 guidance for FS, with HHS BAA expectations for healthcare, with CMMC flow-down for govcon.
10. Audit log retention. Per use case: prompt, response, model version, identity, timestamp, retention period. Aligned to the longest applicable statute.

An SMB that produces this stack, even at minimum-viable depth, is in better shape than 90% of the market. A regulator or insurer asking for "your AI program" gets handed a single binder (or a single shared folder) and the conversation gets shorter.

What an SMB can ship in 30, 60, and 90 days

The audit pack above looks long. In practice it is two-to-three weeks of focused work for an SMB that is willing to start with the lightest acceptable artifact and iterate. The following is a concrete 90-day plan that produces every document in the audit pack.

How AiTLLM ships you the audit pack on day one

Most of the work above is not the controls themselves. It is the documentation that proves the controls exist. AiTLLM, Intelligent iT's private LLM tier, ships the audit pack pre-built so that the SMB's day-one posture matches what a regulator, examiner, or underwriter expects on day ninety.

AiTLLM Sovereign and Private tiers ship with: a populated NIST AI RMF self-assessment template scoped to the deployment; the AI inventory pre-populated with every gateway-routed use case; the vendor risk register populated with the partner-infrastructure attestations (SOC 2 Type II, HIPAA, ISO 27001) at the underlying provider; gateway-side audit logging (every prompt, every output, every model version, every identity, every retention class) wired into the AiT Trust Portal; consumer notice templates for Colorado, Texas, Connecticut, California, and the EU AI Act Article 50 transparency obligations; and a quarterly impact-assessment review with an Intelligent iT engineer.

AiTLLM Connect tier includes a quarterly checkpoint review covering the same artifacts at lower depth, with the customer keeping the controlled vendor relationship (Anthropic, OpenAI, Google) directly. Connect customers get the inventory template, vendor-register starter, and consumer-notice templates without the gateway-side audit logging.

The point is not the product. The point is that the audit pack is an artifact of running the system, not a separate compliance project. If you have to build it from scratch every renewal cycle, every state law, and every examiner visit, you will lose. If it falls out of your AI substrate by default, the regulatory load stops growing faster than your team.

Conclusion

The US AI compliance picture in May 2026 is loud, fragmented, and binding. The fragmentation is not a reason to wait; it is the reason to start. Every regime points at the same handful of controls. Every regulator, examiner, and underwriter wants the same handful of documents. The first SMB in a sector to ship the audit pack is the one that gets a clean renewal, a short examination, and a contract with a customer who needs evidence on day one. The last one is the one explaining to its insurer at claim time why the questionnaire was answered "no."

The 90-day plan above is achievable for any regulated SMB with a single named owner and an MSP partner. We built AiTLLM so that owner does not start from a blank page. Book a 30-minute call or read the AiTLLM page for the deployment options.