Audience: AI providers, deployers, and compliance teams operating in the United States, Canada, Brazil, Colombia, Peru, or other American jurisdictions. Especially relevant for organizations navigating the US state law patchwork or dual US-EU compliance obligations.
Contents
1. Americas AI Regulatory Landscape 2. Active Frameworks 2a. US Federal 2b. US State Laws 2c. Latin America & Canada 3. Cross-Border Considerations 4. Obligation-to-Evidence Mapping 5. Quick Start 6. Detailed Guides for This Region 7. Other Regional Guides1. Americas AI Regulatory Landscape
The Americas present the most fragmented AI regulatory landscape in the world. The United States has no comprehensive federal AI law. Instead, obligations emerge from a patchwork of executive orders, agency guidance (NIST, FTC, Treasury), and an accelerating wave of state legislation. Over 16 US states have enacted or proposed AI-specific laws as of mid-2026, each with different scopes, definitions, and enforcement mechanisms.
At the federal level, the NIST AI Risk Management Framework provides voluntary but widely adopted structure. The FTC has proposed rules on AI accuracy claims. Executive orders set procurement and safety requirements for federal agencies. Sector-specific regulators (Treasury, Federal Reserve, OCC) impose model risk management obligations on financial institutions.
Latin America is developing its own frameworks, with Brazil, Colombia, and Peru leading through risk-based approaches influenced by both the EU AI Act and regional data protection traditions such as LGPD and Habeas Data. Brazil's AI Bill introduces risk tiers that mirror the EU approach while reflecting local enforcement realities. Colombia's CONPES 4144 lays out 106 actions through 2030. Peru's Law 31814 became the first binding AI law in Latin America.
Canada continues to refine its AI governance framework, balancing innovation incentives with accountability requirements. The 2026 framework builds on the Directive on Automated Decision-Making and the proposed Artificial Intelligence and Data Act (AIDA).
Key challenge: Organizations operating across multiple US states face overlapping, sometimes conflicting obligations with no federal preemption in sight. Adding Latin American or Canadian operations compounds this complexity. A consistent evidence protocol is essential for managing compliance at scale.
2. Active Frameworks
2a. US Federal
| Framework | Scope | Status | Guide |
|---|---|---|---|
| NIST AI RMF (AI 100-1) | Voluntary risk management framework for AI systems. Widely adopted across sectors. | Published, voluntary | Guide |
| NIST 800-53 | Federal information system security controls. Applicable to AI systems within federal environments. | Rev 5 active | Guide |
| NIST Agentic AI Standards | NCCoE initiative for autonomous AI systems, multi-agent orchestration, and delegation. | In development | Guide |
| FTC AI Accuracy | Proposed rule on AI accuracy claims and substantiation requirements. | Comment period closed July 31, 2026 | Guide |
| EO-14028 / June 2026 EO | Federal AI procurement, safety requirements, and agency adoption mandates. | Active | Guide |
| CMMC v2.0 | DoD contractor cybersecurity maturity. Includes controls applicable to AI systems in defense environments. | Rulemaking complete | Guide |
| SR 11-7 | Federal Reserve model risk management for financial institutions using AI/ML models. | Active | Guide |
| Treasury AI RMF | Financial sector AI risk management guidance. Complements SR 11-7 with AI-specific controls. | Published | Guide |
2b. US State Laws
US states are legislating AI governance at an unprecedented pace. The table below covers enacted and significant proposed laws as of mid-2026. Obligations vary widely in scope, from narrow bias audit requirements to broad algorithmic accountability mandates.
| State | Law | Key Obligations | Status | Guide |
|---|---|---|---|---|
| New York | NYC LL144 | Bias audits for automated employment decision tools (AEDTs). Annual audit, public summary. | Enacted, enforced | Guide |
| New York | RAISE Act | AI transparency, disclosure, and accountability for state agencies and contractors. | Signed Dec 2025, eff Jan 2027 | Guide |
| New York | 2026 AI Package (6 bills) | Comprehensive package covering deepfakes, AI in hiring, healthcare AI, and consumer disclosures. | Proposed / in committee | Guide |
| California | SB 53 | Frontier AI safety evaluations and risk assessments for large-scale models. | Enacted | Guide |
| California | SB 942 | AI transparency and disclosure requirements for generative AI systems. | Enacted | Guide |
| California | AB 2013 | Training data transparency for generative AI developers. | Enacted | Guide |
| Colorado | AI Act | Algorithmic discrimination prevention. Impact assessments, notification requirements. | Enacted | Guide |
| Connecticut | SB 2 (AI Accountability) | Impact assessments, transparency, and consumer rights for high-risk AI systems. | Enacted | Guide |
| Connecticut | SB 5 Omnibus | Broad AI governance including procurement, education, and workforce applications. | Enacted | Guide |
| Connecticut | CART Act | Consumer AI rights and transparency for automated decision-making. | Enacted | Guide |
| Illinois | AI Safety Act / HB 3773 | AI system impact assessments, bias testing, and consumer notification. | Enacted | Guide |
| Texas | TRAIGA | AI governance and accountability for state agencies and high-risk applications. | Enacted | Guide |
| Tennessee | SB 1580 | AI disclosure and transparency for consumer-facing systems. | Enacted | Guide |
| Idaho | SB 1297 | AI governance framework for state agencies. | Enacted | Guide |
| Maryland | HB 895 | AI use in employment decisions, bias prevention, and applicant notification. | Enacted | Guide |
| Rhode Island | 3 AI Laws | AI therapy chatbot restrictions, self-harm prevention, and clinical AI disclosure requirements. | Enacted | Guide |
| Multi-state | AI Companion Ban Tracker | Emerging restrictions on AI companion applications, particularly for minors. | Various | Guide |
2c. Latin America & Canada
| Jurisdiction | Framework | Key Features | Status | Guide |
|---|---|---|---|---|
| Brazil | AI Bill (PL 2338/2023) | Risk tiers modeled on EU AI Act. LGPD intersection. Impact assessments for high-risk systems. EU-Brazil Digital Partnership alignment. | In legislative process | Guide |
| Colombia | CONPES 4144 | 106 actions through 2030 covering AI ethics, governance, sectoral adoption, and international alignment. | Active policy | Guide |
| Peru | Law 31814 | First binding AI law in Latin America. Risk-based approach with transparency, accountability, and human oversight requirements. | Enacted | Guide |
| Canada | AI Governance 2026 | Builds on Directive on Automated Decision-Making and proposed AIDA. Impact assessments, transparency, and algorithmic accountability. | Framework published | Guide |
3. Cross-Border Considerations
Organizations operating across the Americas face several cross-border compliance challenges that compound the domestic complexity.
- US state law patchwork: Operating in multiple US states means multiple overlapping obligations with no uniform definitions. What qualifies as "high-risk AI" differs between Colorado, Connecticut, and Illinois. Organizations need a consistent evidence baseline that satisfies the strictest applicable standard.
- EU AI Act extraterritorial reach: Any US or Latin American provider whose AI system produces outputs consumed by EU residents falls under EU AI Act jurisdiction. This affects a significant portion of SaaS providers, cloud platforms, and API-based AI services.
- Brazil-EU Digital Partnership: The 2026 digital partnership creates alignment pressure between LGPD and GDPR, and between Brazil's AI Bill risk tiers and the EU AI Act classification system. Organizations serving both markets benefit from harmonized evidence.
- CMMC and federal procurement: Defense contractors face a separate compliance track where CMMC maturity levels interact with AI system security controls. AI systems processing CUI (Controlled Unclassified Information) must satisfy both AI governance and cybersecurity requirements.
- No US-wide preemption expected: Despite federal activity (NIST, FTC, executive orders), comprehensive federal AI legislation remains unlikely in the near term. The state-level patchwork will continue to expand, making jurisdiction-aware evidence production a long-term operational requirement.
- Latin American data localization: Some Latin American jurisdictions impose data residency requirements that affect AI model training data governance and inference logging, creating additional evidence requirements for cross-border deployments.
4. Obligation-to-Evidence Mapping
The table below maps cross-cutting Americas obligations to SWT3 witness procedures. Each obligation appears in multiple frameworks across the region, making these procedures high-value evidence producers.
| Obligation | Source Frameworks | SWT3 Procedures |
|---|---|---|
| Bias auditing | NYC LL144, Colorado AI Act, Illinois HB 3773, Connecticut SB 2 | AI-FAIR.1 |
| Transparency / disclosure | CA SB 942, FTC AI Accuracy, NY RAISE Act, multiple state laws | AI-TRANS.1, AI-EXPL.1 |
| Risk management | NIST AI RMF, Treasury AI RMF, SR 11-7, Brazil AI Bill | AI-SAFE.1, AI-ROBUST.1 |
| Model documentation | NIST AI RMF, CMMC, CA AB 2013, Peru Law 31814 | AI-MDL.5, AI-INF.1 |
| Human oversight | Colorado AI Act, Connecticut SB 2, Brazil AI Bill, Canada AIDA | AI-HITL.1 |
| Data governance | LGPD, state privacy laws, CA AB 2013, Colombia CONPES 4144 | AI-DATA.1, AI-CONSENT.1 |
| Incident response | Executive order requirements, NIS-2 (for EU-facing operations), NIST CSF | AI-INCIDENT.1 |
| Supply chain | CMMC, federal procurement, EO-14028 | AI-SBOM.1, AI-SUPPLY.1 |
| Audit trail | All frameworks (universal requirement across Americas jurisdictions) | AI-LOG.1, AI-AUDIT.1 |
Cross-framework leverage: A single AI-FAIR.1 witness anchor can serve as evidence for NYC LL144 bias audit documentation, Colorado AI Act impact assessment, Illinois HB 3773 bias testing, and Connecticut SB 2 fairness evaluation. The crosswalk engine resolves which procedures satisfy which frameworks automatically.
5. Quick Start
Install the SWT3 AI Witness SDK and begin producing compliance evidence that maps to Americas frameworks.
pip install swt3-aifrom swt3_ai import Witness# Initialize with jurisdiction contextwitness = Witness( agent_id="loan-scoring-v3", jurisdiction="US", purpose_class="financial_risk_assessment")# Witness a model inference (produces AI-INF.1 anchor)result = witness.wrap( model="credit-risk-ensemble", input_data={"applicant_id": "A-4421"}, output={"decision": "approved", "score": 0.87})# Witness fairness evaluation (produces AI-FAIR.1 anchor)# Satisfies NYC LL144, Colorado AI Act, Illinois HB 3773witness.witness_fairness( model="credit-risk-ensemble", evaluation_type="bias_audit", protected_classes=["race", "gender", "age"], metrics={"demographic_parity": 0.94, "equalized_odds": 0.91})# Flush to ledgerwitness.flush()
TypeScript, Rust, C#, Ruby, and Swift SDKs are also available. See the SDK documentation for language-specific examples.
6. Detailed Guides for This Region
US Federal
- NIST AI RMF for Critical Infrastructure
- NIST SP 800-53 Crosswalk
- NIST Agentic AI Standards Crosswalk
- NIST Cybersecurity AI Profile Crosswalk
- NIST Cyber AI Profile Crosswalk
- FTC AI Accuracy Crosswalk
- June 2026 AI Executive Order Crosswalk
- CMMC Overlay
- SR 11-7 Overlay
- Treasury Financial Services AI RMF Crosswalk
- Treasury AI RMF Crosswalk
- MITRE ATLAS Crosswalk
US State Laws
- NYC Local Law 144 (AEDT Bias Audits)
- New York RAISE Act
- New York 2026 AI Package (6 Bills)
- California SB 53 (Frontier AI Safety)
- California SB 942 (AI Transparency)
- California AB 2013 (Training Data)
- Colorado AI Act
- Connecticut SB 2 (AI Accountability)
- Connecticut SB 5 Omnibus AI
- Connecticut CART Act
- Illinois HB 3773 / AI Safety Act
- Illinois AI Safety Act Crosswalk
- Texas TRAIGA
- Tennessee SB 1580
- Idaho SB 1297
- Maryland HB 895
- Rhode Island AI Laws (3 Laws)
- Multi-State AI Companion Ban Tracker
Latin America & Canada
- Brazil AI Bill Crosswalk
- Colombia CONPES 4144 Crosswalk
- Peru AI Law Crosswalk
- Canada AI Governance 2026 Crosswalk
7. Other Regional Guides
This guide is one of four regional compliance references. Each follows the same structure for consistent cross-regional navigation.