United States: the instruments named

ISO/IEC FDIS 27091ReferenceNo new requirement

A US organization that develops or uses AI systems with personal data meets a sector patchwork, not one federal privacy statute. This page names the instruments; it does not state their requirements.

What this page covers

• The Federal Trade Commission Act, section 5, on unfair or deceptive practices, including a privacy promise the system does not keep.
• Sector statutes where they apply, such as HIPAA for protected health information and GLBA for financial data.
• State comprehensive privacy laws, which now cover a large share of the population and carry assessment and notice duties.
• State AI and profiling rules, including notice and opt-out for certain automated decisions, which differ by state.
• The NIST AI Risk Management Framework, a voluntary framework that maps to the control set used here.

How to use it

Record the federal and state instruments that apply to each AI system and each population in the legal register, and check the state rules for profiling and automated decisions.

What it does not add

This page does not state a statute and is not legal advice. State law changes often; verify the current text before relying on it.

Read across

• Control A.5.2, AI system impact assessment process
• Control A.9.4, Intended use of the AI system