The United States AI rules that apply to a small business in 2026
There is no single federal AI law. What applies to a small business using AI is a set of existing laws, a growing list of state rules, and a federal effort to override the states that has not yet become law. Here is the map, in plain language.
If you run a small business and you are thinking about putting AI to work, the regulatory picture looks confusing from the outside. Headlines say Washington is deregulating. Other headlines say states are passing new laws. Both are true, and neither tells you what applies to you. This article does, as of October 18, 2026. It is a summary, not legal advice, and the rules are moving.
There is no federal AI statute
Congress has not passed a law that governs AI in general. What exists at the federal level is direction from the executive branch. In December 2025 an executive order directed the Justice Department to challenge state AI laws in court, and in March 2026 the White House published a legislative framework asking Congress to preempt most state AI regulation. Congress has not enacted it. Until it does, or a court rules, state laws remain in effect, and a business has to follow them.
The federal laws that already apply
Three federal laws reach almost every AI system a small business would deploy, because they govern the activity, not the technology.
The FTC Act. Section 5 prohibits unfair or deceptive practices. If a system makes a claim to a customer that is not true, or a vendor makes a claim about a system that it cannot back up, that is the same violation it would be without AI. The Federal Trade Commission has brought cases over exaggerated AI capability claims and is considering a policy statement on AI accuracy.
The Telephone Consumer Protection Act. In February 2024 the Federal Communications Commission ruled that AI generated voices count as artificial voices under the Act. That means an automated call to a customer using an AI voice needs the customer's prior express consent, with narrow exceptions. Rules on how customers can revoke consent took effect in April 2025: a revocation by any reasonable means must be honored within ten business days. Text messages carry similar consent duties.
The CAN-SPAM Act. Commercial email, including email a system sends on your behalf, must have accurate headers, a truthful subject line, your physical postal address, and a working opt out that is honored within ten business days.
The state laws that shape how systems are built
States have moved faster than Congress, and three developments matter most for a small business.
State AI governance acts. The first general AI governance act took effect on January 1, 2026. It prohibits AI built to manipulate people toward harm, to discriminate unlawfully, or to produce abusive sexual content, and it recognizes alignment with the NIST AI Risk Management Framework as an affirmative defense. For a small business, the practical effect is that building to that framework is now worth doing for legal reasons as well as good ones.
Colorado's replacement law. Colorado passed a broad AI law in 2024, then repealed and replaced it in May 2026 after the law was challenged in federal court. The replacement, effective January 1, 2027, applies where automated decision technology is used in a consequential decision about a person, such as employment, lending, or housing. It requires notice at the point of interaction, a plain language explanation after an adverse outcome, a right to correct data, and human review.
California's automated decision making rules. Under the California Consumer Privacy Act, regulations effective January 1, 2027 require businesses that use automated decision making for significant decisions to give notice before use, offer an opt out, and provide access to the logic behind the decision.
Several other states have narrower rules, most of which require that people be told when they are dealing with AI rather than a person. If your systems disclose that by default, the common thread of state law is already handled.
What this means for a receptionist or a follow up system
For the kind of system most small businesses actually deploy, the rules sort into a short list. If it calls or texts customers, consent has to be designed in before launch, not added later. If it talks to customers, it should say it is AI. If it makes or supports a decision about a person's job, loan, home, or similar, the state rules above add notice and review duties. If it handles payment card numbers, it should not; payments belong on your processor's hosted page. And whatever it does, the FTC Act means it cannot deceive the people it talks to.
Where this is going
The preemption fight will shape the next two years. If Congress enacts a federal framework, some state rules on transparency and algorithmic accountability could be overridden; others, such as consumer protection and child safety laws, would stay. The European Union's AI Act, which does not apply to a business whose systems and outputs stay in the United States, is nonetheless becoming the reference design that vendors build to, and its transparency rules have been in force since August 2026.
The safest position for a small business is the one that does not depend on which way the fight goes: build to the NIST framework, disclose AI to the people it talks to, get consent before automated outreach, keep records of what the system did, and have counsel check the design of anything a regulation touches. That is how Millwright builds, and the full list is on the security page.