Start by checking which law, supervisory expectation, proposal, or guidance applies to your organization. The table identifies each instrument, its status, and who it addresses. The contribution section then explains what AAES Govern records can help a reviewer examine.
These pages describe the product and cite public instruments. They are not legal advice, not a certification, and not a statement that any instrument applies to your organization. The official source is authoritative; applicability questions belong to your advisers.
Instruments, by status
| Instrument | Status | What it addresses |
|---|---|---|
| Executive Order 14365 and the DOJ AI Litigation Task Force · Federal | Executive action, not legislation. EO 14365 (11 December 2025) seeks a national policy framework and directs challenges to state AI laws; the DOJ task force was announced 9 January 2026; a nonbinding National Policy Framework followed on 20 March 2026. An executive order does not itself invalidate a state law. Outcomes depend on litigation and courts; treat preemption claims as unsettled. | The balance between federal and state AI regulation. No federal compliance duty for enterprises results from these instruments by themselves; existing federal civil-rights, consumer-protection, credit and privacy laws continue to apply to AI use. |
| Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) | Binding state law, effective 1 January 2026. Exclusive Attorney General enforcement, a 60-day cure period, and an affirmative defense linked to risk-management practices aligned with NIST AI RMF, subject to the statute's conditions. | Persons doing business in Texas who develop or deploy AI systems. Intent-based prohibitions (manipulation toward self-harm or crime, intentional unlawful discrimination, certain biometric and synthetic-content uses) and disclosure duties for government AI interactions. |
| California SB 53 (Transparency in Frontier AI Act) and AB 2013 | Binding state law. SB 53 signed 29 September 2025, effective 1 January 2026; AB 2013 training-data transparency effective 1 January 2026. | SB 53 addresses frontier-model developers above defined compute thresholds (safety frameworks, incident reporting), mostly upstream of enterprise deployers. AB 2013 requires training-data disclosures from developers. |
| Utah Code, Title 13 Chapter 77: Generative Artificial Intelligence — Consumer Disclosures and Enforcement · Illinois HB 3773 / Public Act 103-0804 | Binding state laws. Utah's current disclosure duties were enacted by SB 226 (2025), effective 7 May 2025, replacing the original SB 149 disclosure section; the compiled Chapter 77 records later amendments. Illinois: AI employment amendments to the Human Rights Act, effective 1 January 2026. | Utah Section 13-77-103 has two disclosure triggers: a supplier using generative AI in a consumer transaction must disclose AI use when the individual clearly asks whether AI is being used; an individual providing regulated professional services must proactively disclose AI use for a defined high-risk interaction, verbally at the start of a verbal interaction or in writing before a written one. Illinois addresses AI-related employment discrimination and notice duties. Neither duty is satisfied merely by producing AAES action records. |
| NYC Local Law 144 | Binding municipal law; enforcement began 5 July 2023. | Automated employment decision tools as defined by the law, not every hiring tool: annual independent bias audits and candidate notices. |
| New York RAISE Act (2026 chapter amendment) · Colorado automated decision-making transparency law | Future-effective and unsettled. New York's RAISE Act (frontier-model safety) was signed 19 December 2025, amended by a chapter amendment signed 27 March 2026, and takes effect 1 January 2027. It brings Department of Financial Services oversight and 72-hour incident reporting for large frontier developers above a $500 million revenue threshold. Colorado replaced its original 2024 AI Act with SB 26-189 (signed 14 May 2026), effective 1 January 2027. The replacement covers disclosure after adverse consequential decisions, personal-data access and correction, and meaningful human review; Attorney General implementing rules are due by then. The enacted text controls; this note does not determine the outcome of related litigation. | Frontier-model safety duties (NY) and automated decision-making transparency duties (CO), respectively. |
| NIST AI Risk Management Framework 1.0 | Voluntary technical guidance. Not a law, but TRAIGA references NIST AI RMF–aligned practices in its affirmative defense. See the NIST AI RMF framework note. | Enterprise AI risk management structure; the action-layer records a reviewer can inspect are described in the framework note. |
What AAES Govern records may contribute
| Expectation | AAES contribution | Capability status |
|---|---|---|
| Named accountability for AI-driven work (state disclosure and oversight duties; internal governance) | Each registered agent has an accountable manager whose chain of managers ends at a person. AAES Govern records the approver for human approval decisions; those assignments do not establish statutory appointments. | Implemented. |
| Human control over consequential actions (internal governance; state and municipal oversight scrutiny) | Capabilities registered as irreversible require human approval bound to the exact request, with expiry. The operator classifies the action and must ensure reviewers have the information and authority to decide. | Implemented. |
| Documented risk management (records potentially relevant to a NIST AI RMF review; TRAIGA's NIST-linked affirmative defense) | Decision records are linked by cryptographic fingerprints to help detect changes. The client's own reviewer can check an export offline. | Implemented. An independently controlled witness can be configured separately; that is not an external assessment, and the default deployment has none. |
AAES Govern decision records may support review of access and approval controls. They do not establish lawful processing, model fairness, suitability, or compliance with any instrument as a whole, and no AAES feature satisfies a state bias-audit or impact-assessment requirement by itself.
Export checks do not establish complete capture, downstream success, or meaningful human oversight. Enforcement requires a credential path the agent cannot bypass. See the verification checks and their limits.
Your responsibilities
- The client remains the regulated entity. Ask your advisers which state laws reach your organization and whether federal preemption changes that.
- Activity outside AAES Govern is visible only where telemetry is supplied. Decision records cover routed requests; reported telemetry may describe other activity without establishing complete coverage.
- AAES has no independent certification or assessment. No SOC 2 report exists, and no penetration test has been performed yet; an independent test is planned for Q4 2026.
- Status changes. State legislation and federal–state litigation were both moving when this note was reviewed. Re-check the primary source before relying on the status shown here.
Bring the instruments your risk team cites to a scoped evaluation.