No single federal AI law governs agents in the United States. Instead, the agency that supervises your business applies its existing rules: the OCC, Federal Reserve and FDIC for banks, the CFPB for consumer finance, the SEC and FINRA for securities, and state regulators for insurance. Sector laws such as ECOA, GLBA and HIPAA, and state laws, add duties.
What does each layer require, in plain words?
Bank supervisors. The OCC, Federal Reserve and FDIC expect banks to manage model risk under the interagency guidance SR 11-7: inventory, development standards, independent validation, ongoing monitoring and governance with effective challenge. They also expect sound management of third-party relationships, information security and operational resilience.
The CFPB. Consumer financial products must be offered without unfair, deceptive or abusive practices. ECOA and Regulation B prohibit discrimination in credit and require creditors to give specific reasons when credit is denied, including when a model is used. A general statement that the applicant did not meet internal standards is not enough.
The SEC and FINRA. Broker-dealers and advisers must supervise their business, meet standards for communications with the public, act in clients' interests and keep required records, including of communications.
State insurance regulators. Coordinated through the NAIC, they apply unfair discrimination, claims handling and market conduct rules, and several have issued expectations on insurers' use of AI. NYDFS and other state regulators supervise financial firms licensed in their states.
Sector privacy laws. GLBA governs financial privacy and safeguards; HIPAA governs health information.
State laws. California's CCPA, as amended by the CPRA, gives consumers rights over personal information. Colorado has passed an AI act aimed at high-risk systems that make consequential decisions. Other states have their own privacy and AI-related laws.
Who does it apply to?
Each law follows the business. A national bank answers to the OCC, the CFPB if large enough, and state laws where it operates. A fintech lender may answer to the CFPB and several state licensing regulators. An insurer answers to every state it writes business in. One agent used across a group can fall under many regimes at once.
What does this mean when the system is an agent that acts?
The agent is a model. Under SR 11-7, anything that turns inputs into estimates that drive decisions is a model. An agent that triages alerts, prices risk or drafts credit decisions qualifies, and its instructions, retrieval and actions are part of what must be validated.
Adverse action reasons must be real. If an agent contributes to a credit denial, the reasons given must reflect the factors that actually drove the outcome. An agent's narrative explanation cannot be assumed to do that; the reasons must come from the decision logic you can verify.
Communications are regulated content. An agent talking to brokerage clients is producing communications with the public, and those must be supervised and retained.
State laws vary. A consequential decision in Colorado, a California consumer's privacy request and a New York insurer's underwriting use each bring different duties. Agents need configuration by state, not one national setting.
The payments view is in AI agents for compliance teams in payments in the United States and AI agents for operations leaders in payments in the United States.
How do you meet the rules?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| SR 11-7: inventory and validation | Each agent capability in the model inventory, tiered and validated | Inventory; validation reports |
| SR 11-7: monitoring and challenge | Outcome monitoring with thresholds; independent review | Monitoring reports; challenge records |
| Third-party risk | Platform due diligence, contract and ongoing monitoring | Due diligence file; reviews |
| ECOA and Regulation B | Denial reasons drawn from verifiable decision factors; fair lending testing | Reason codes; testing results |
| Unfair, deceptive or abusive practices | Agent content approved; customer interactions tested | Content library; test results |
| SEC and FINRA communications | Agent communications supervised and retained | Supervision records; archives |
| Insurance unfair discrimination | Agent use in underwriting and claims tested for unfair outcomes | Testing records |
| GLBA and HIPAA | Scoped access, service provider contracts, safeguards | Access maps; contracts |
| State laws | Agent configuration and notices by state | State rules register |
What will US supervisors ask?
- Is each agent in your model inventory, and who validated it?
- If an agent contributes to a credit decision, how are adverse action reasons produced?
- How do you supervise and retain what agents tell clients?
- How do you test agents for unfair outcomes across groups?
- Which state laws apply to each agent, and how is it configured for them?
- Who in senior management is accountable for agent risk?
What do these rules not cover?
There is no federal AI statute, no federal registration of AI systems and no national list of prohibited AI uses. Federal agency guidance can change with policy direction, so check the current position of your supervisor. For comparison with regulator-led approaches elsewhere, see how AI agents are regulated in the United Kingdom and how AI agents are regulated in South Africa. For architecture that meets several regimes at once, see how to design an AI agent architecture for a regulated business; for the full map, AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, authority is granted per capability, per customer, and enforced at the moment of action through the minimum chain, where your own limits are one of five bounds. That lets a firm set state-specific limits on one agent. Each verdict names the bound that decided and is filed in an append-only record, which supports both model validation and examination.
Questions people ask
Does the absence of a federal AI law mean agents are lightly regulated?
No. Financial services are heavily regulated, and those rules apply in full to agents. The lack of an AI law means there is no single rulebook, not that there are fewer rules.
Is a chatbot answering FAQs subject to SR 11-7?
If it only retrieves approved answers and drives no decisions, it may fall outside the model definition. Once it assesses, prioritises or recommends, it is likely within scope. Record the reasoning either way.
Does the Colorado AI act apply to firms outside Colorado?
It is aimed at developers and deployers of high-risk systems making consequential decisions about Colorado consumers. Firms elsewhere serving Colorado residents should assess whether it reaches them.