US and Canada AI Rules in 2027: Which Ones Actually Bind You

Six rules bind a company that sells AI-assisted services into the US and Canada in 2027, and ten other items are orders, drafts, consultations or voluntary guides. Two of the six apply from 1 January 2027: California's rules on automated decisions and Colorado's AI law. This is for the CEO and general counsel of a Singapore or Malaysia firm selling in North America. Not legal advice. Financial regulators: see our map.

We read every source on 28 October 2026 and checked the Canadian bills again before publishing.

Is there one US AI law, or fifty?

Neither. We found no single federal AI statute. Older law already covers AI, a few states have AI laws, and a federal push to override them is not law yet. The FTC made the first point in its September 2024 announcement: "there is no AI exemption from the laws on the books."

We sorted 16 instruments into four groups. Binding is a statute or regulation in force or with a start date. Federal action is an order or filing that binds no private company. Proposed is a draft, bill or consultation. Voluntary is guidance.

The federal effort works through agencies and Congress. Executive Order 14365, signed on 11 December 2025, directs the Attorney General to set up an AI Litigation Task Force "whose sole responsibility shall be to challenge State AI laws inconsistent with the policy". A memo of 9 January 2026 created it.

The order also asks for a bill. The White House's recommendations, dated March 2026, state the aim:

Congress should preempt state AI laws that impose undue burdens to ensure a minimally burdensome national standard consistent with these recommendations, not fifty discordant ones.

The White House, A National Policy Framework for Artificial Intelligence: Legislative Recommendations, March 2026.

The same document says a national standard should not preempt state laws of general applicability, "including particular laws to protect children, prevent fraud, and protect consumers". A request is not a statute. Until Congress or a court acts, plan for the state rules that have dates.

The map below shows the layers.

Which US rules bind, and from when?

Four US rules bind a company with the right facts: the FTC Act, Texas, California and Colorado. Two of them apply from 1 January 2027.

The FTC Act applies today. It bans deceptive practices, including AI claims. A July 2026 proposed policy statement says an AI company that alters its system's outputs to pursue undisclosed ideological goals could be deceiving consumers and breaking Section 5. Comments closed on 31 July 2026. It is a draft, a signal and not a rule.

Texas has applied since 1 January 2026. The Texas Responsible Artificial Intelligence Governance Act, HB 149, covers a person who promotes, advertises or conducts business in Texas, or whose product Texas residents use. It is narrow for private companies. It bans AI used "in a manner that intentionally aims to incite or encourage" self-harm, harm to others or crime, and AI used "with the intent to unlawfully discriminate against a protected class". "A disparate impact is not sufficient by itself to demonstrate an intent to discriminate." Only the attorney general enforces it, after a 60-day cure window.

California's automated decision rules apply from 1 January 2027. The Office of Administrative Law approved the regulations on 22 September 2025. Under section 7200, a business that uses automated decisionmaking technology (ADMT) for a significant decision must meet the deadline the rule sets, "no later than January 1, 2027". A significant decision concerns lending, housing, education, employment or compensation, or health care. The business must give a plain-language pre-use notice, and consumers can opt out or appeal and can access information about the ADMT.

Two limits matter. The rules reach only businesses the CCPA covers. The California Attorney General lists three tests: a revenue threshold, 100,000 or more California residents or households, or 50% or more of revenue from selling personal information. And the regulation defines ADMT as technology that processes personal information and uses computation "to replace human decisionmaking or substantially replace human decisionmaking" (section 7001(e)). In our reading, technology will "substantially replace human decisionmaking" when a business uses the output to make a decision without human involvement, and human involvement means a reviewer who knows how to interpret and use the output, reviews and analyses it, and has authority to make or change the decision (the confirm step).

Colorado's AI law applies to decisions made from 1 January 2027. SB 26-189, signed on 14 May 2026, covers developers and deployers that are a "person doing business in Colorado". A deployer must give notice before using a covered ADMT and, within 30 days after an adverse outcome, describe the decision and the tool's role. Consumers can ask for correction and human review. Developers owe deployers documentation. The Attorney General must adopt rules on post-decision disclosures by 1 January 2027. See our Colorado guide.

Enforcement is the open question. A Legislative Council fiscal note of 8 September 2026 says a US District Court ordered the Attorney General on 27 April 2026 "to not initiate enforcement" until rulemaking is complete and the court rules in X.AI LLC v. Weiser. The Justice Department moved to intervene on 24 April 2026. Prepare; do not wait.

The next rule may give less warning.

What binds in Canada?

In Canada, privacy law does the work, because there is no AI-specific federal statute. The Artificial Intelligence and Data Act was part of Bill C-27, which LEGISinfo shows in a prior session that ran to 6 January 2025. No statute has replaced it. Two June 2026 bills are related. Bill C-36 amends PIPEDA. Bill C-34, the Safe Social Media Act, introduced on 10 June 2026, would put a Duty to Act Responsibly on AI chatbot services, says the Government of Canada. LEGISinfo shows C-36 at second reading in the House of Commons. C-34 passed second reading on 29 October 2026 and went to the House Canadian Heritage committee. Neither is law.

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to "every organization" for personal information it handles in commercial activities, including AI tools that process customer, lead or staff data. On 6 May 2026 the privacy commissioners found "a real and substantial connection to Canada" for OpenAI, and that it lacked implied consent to train and missed accuracy requirements. Assume the test can reach a Singapore firm with Canadian customers.

Ontario has an AI-specific duty in force for ordinary employers. Section 8.4 of the Employment Standards Act, 2000 requires a publicly advertised job posting to include "a statement disclosing the use of the artificial intelligence" if AI is used to "screen, assess or select applicants". It has applied since 1 January 2026.

The government's AI transparency consultation ran from 23 July to 23 September 2026 and closed without a bill. LEGISinfo's progress fields for C-36 are inconsistent (first reading 15 June 2026), so re-read the page. This post does not cover Quebec's privacy law.

All 16 instruments, with status, date and what could change

Six of the 16 instruments bind a company. First actions, then all 16 with status and date.

Four things can move the map: a ruling in X.AI LLC v. Weiser, a final FTC statement, Colorado rules, or a preemption bill. None had removed a state duty in the sources we checked on 28 October 2026. Re-read the official pages first.

Does it apply to my AI use?

Start with the person the AI affects, not the tool. Answer up to four questions per AI use.

Illustrative example: a Singapore firm sells a tool that ranks job applicants with little human review. One US customer hires in Colorado, one Canadian customer in Ontario. From 1 January 2027 the tool is a covered ADMT for the Colorado customer, so the firm is a developer and the customer a deployer. The Ontario posting must disclose AI screening.

Which gaps should you check by 1 January 2027?

Tick what is true today. It covers the six binding rules and a watch item. The result lists gaps to check. It is not a compliance determination.

Where Origin Pi stands

Most of this is a records problem. Origin Pi's AI governance work designs AI agents with bounded scope, named owners and logs, which gives you the list of uses and the evidence of human review these rules ask about. See what to log for AI work. Have a lawyer confirm scope.

Your first step this week: list every AI use that touches a person in the US or Canada, mark those that help decide a job, loan, housing, school, insurance or health care, and note where each person lives.

Take the data with you

Every figure in the charts and at-a-glance card is in one table, with its source and dates. If you reuse either file, please cite this post.

• Data table (CSV, 3 KB)
• At-a-glance card (PNG, 62 KB)