The US still has no federal AI law, and unlike the EU it isn’t heading towards one. What governs a US adviser’s AI use instead is supervision through existing securities law, an active enforcement line on AI claims, and a voluntary framework that functions as the de facto standard.

US state AI laws in force in 2026

Four states have AI obligations in force today, and federal moves to override them have not yet changed that. Firms that built plans around a hardening US state patchwork should re-check those assumptions, but so should firms assuming it evaporated. Colorado’s pioneering AI Act was delayed, enjoined after a legal challenge the Department of Justice joined, and then repealed and replaced in May 2026 by a narrower notice-based regime (SB 26-189) taking effect January 2027; no Colorado AI Act obligations are in force today. Meanwhile the federal government moved against state AI laws directly: Executive Order 14365 (December 2025) created a DOJ AI Litigation Task Force to challenge state statutes, and the White House published preemption-framework recommendations in March 2026, but Congress has enacted no preemption statute, so state laws in force still bind.

What is in force in 2026 is a shorter list:

  • Texas (TRAIGA, from 1 January 2026): an intent-based regime of prohibited uses, enforced by the Attorney General with a cure period.
  • Utah (AI Policy Act, as amended 2025): disclosure duties at the start of “high-risk interactions”, which expressly include providing financial advice and collecting financial data, the state rule most directly relevant to advisers.
  • California: the frontier-AI transparency law (SB 53) since January 2026; the AI Transparency Act’s watermarking and detection duties operative since 2 August 2026; and privacy-regulator rules on automated decision-making in areas like hiring, with full compliance for existing uses required by 1 January 2027.
  • Illinois (from January 2026): AI-in-employment discrimination and notice rules under the Human Rights Act.

The practical posture: comply with the laws in force where your clients are, and watch the preemption litigation rather than assuming its outcome.

What the SEC expects: exam priorities and AI-washing

The SEC supervises adviser AI through examinations and enforces against overstated AI claims. Its examination priorities for fiscal 2026 put adviser use of AI firmly in scope: examiners will look at whether firms have policies and procedures to monitor and supervise their AI use, whether staff are trained, and, pointedly, whether representations about AI capabilities are accurate [1].

That last item reflects the SEC’s continuing “AI washing” enforcement line, which began in March 2024 with charges against two investment advisers for false and misleading statements about their use of AI [2]. The practical rule: every AI claim in your marketing (including claims your vendors made and you repeated) needs substantiation you can produce.

FINRA: generative-AI expectations for broker-dealers

FINRA expects broker-dealers to govern generative AI before deploying it. For broker-dealers, FINRA’s 2026 Regulatory Oversight Report devotes a section to generative AI: assess compliance obligations before deployment, establish governance over usage, address hallucination and bias, and keep humans monitoring outputs, with early attention to autonomous AI agents [3].

NIST AI RMF: voluntary, but what examiners recognise

The NIST framework is not law, but it is the standard a US examiner measures good practice against. The NIST AI Risk Management Framework remains voluntary but is the de facto US reference for AI governance [4]; in February 2026 the US Treasury, with the Cyber Risk Institute, released a Financial Services AI Risk Management Framework mapping NIST’s structure into sector-specific control objectives. Neither is law; both are what a US examiner will recognise as good practice.

What a US adviser should do now

Build the standard controls and make sure every AI claim in your marketing can be substantiated. The US regime rewards the same core set of controls in the overview (inventory, named owner, human review, vendor due diligence, records), with one US-specific emphasis: substantiation of AI claims. If your firm serves US clients from elsewhere, note that promotion rules attach where material is received: one AI-drafted commentary sent to a mailing list spanning the EU, UK and US can engage the SEC’s AI-washing line alongside European transparency obligations. The cross-border mechanics are covered in AI governance for cross-border financial advisers.

This article is for informational purposes only and does not constitute regulated financial advice, legal advice, or a compliance opinion. Consult a qualified compliance professional for advice specific to your firm.

Sources

[1] US Securities and Exchange Commission, ‘SEC Division of Examinations Announces 2026 Priorities’, November 2025. Available at: https://www.sec.gov/newsroom/press-releases/2025-132-sec-division-examinations-announces-2026-priorities

[2] US Securities and Exchange Commission, ‘SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence’, March 2024. Available at: https://www.sec.gov/newsroom/press-releases/2024-36

[3] FINRA, ‘2026 FINRA Annual Regulatory Oversight Report — GenAI: Continuing and Emerging Trends’, December 2025. Available at: https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai

[4] NIST, ‘AI Risk Management Framework’, accessed July 2026. Available at: https://www.nist.gov/itl/ai-risk-management-framework