What Laws Actually Govern AI Usage for Small Businesses Right Now

Clients ask me this more than almost anything else: "is there a law about using AI in my business?" The honest answer is there's no single AI law to check yourself against. What exists is a patchwork of new state rules, plus a bunch of old law that already applied and just didn't need an "AI" label to reach you.

There's no comprehensive federal AI law

Congress has introduced a lot of AI bills and passed almost none of them into general law. What's actually enforcing anything right now is the FTC, using authority it's had for decades — Section 5 of the FTC Act, which bans unfair or deceptive business practices. The agency has been explicit that a chatbot, deepfake, or "AI-powered" tool doesn't get special treatment just because it's AI: if it's built or used in a way designed to deceive people, that's the same violation it would be without the AI label.

States are moving faster, and inconsistently. Texas's TRAIGA law, in effect since January 2026, is a useful example of where this tends to land for a small business: it doesn't license or regulate ordinary AI use. It bans intentional misuse — AI built or deployed specifically to discriminate, manipulate someone's behavior in harmful ways, or generate unlawful deepfakes — enforced by the state attorney general. California and Colorado have passed their own AI-specific laws too, but most of the real weight there falls on the companies building and selling the models, not the five-person shop using one of their tools.

The laws that already covered you

This is the part worth actually sitting with: nearly everything that matters to a small business was already law before AI entered the picture.

Anti-discrimination law applies to what a hiring tool or pricing algorithm does, the same as it applies to a person making that call. "The AI did it" isn't a defense.
Consumer protection law applies to what your chatbot tells a customer, same as what an employee says on the phone.
Whatever privacy law already covers your state or industry applies to customer data the moment you paste it into an AI tool, same as it did before.

What that means day to day

You don't need a new legal category in your head called "AI compliance." You need the same habits that were always good practice, pointed at a new tool: know what happens to data you put into it, don't take a vendor's compliance claims at face value, and keep a person accountable for anything touching money, hiring, or health information.

If a vendor tells you their AI tool is "legally compliant," that's not really an answer — ask what specifically they mean, and whether that claim would hold up if a regulator asked the same question.

Sources: