The laws that govern the activity the agent performs. There is no single federal AI law, so the question is what the agent does. Deciding credit brings in ECOA and Regulation B. Financial data brings in GLBA; health data, HIPAA; California consumers' data, the CCPA. Bank agents face SR 11-7. Colorado's AI act adds duties for consequential decisions.
How do you work out which laws apply?
Start from the agent's capabilities and ask what each one touches:
| If the agent... | Laws and regulators likely in play |
|---|---|
| Assesses or decides credit | ECOA and Regulation B (specific reasons for denial, including when a model is used); CFPB; fair lending |
| Runs in a bank and informs decisions | SR 11-7 model risk guidance; OCC, Federal Reserve, FDIC supervision |
| Handles customer financial data | GLBA privacy and safeguards duties |
| Handles health information | HIPAA, for covered entities and their business associates |
| Processes California consumers' data | CCPA as amended by the CPRA |
| Makes or shapes consequential decisions about Colorado consumers | Colorado's AI act aimed at high-risk systems |
| Works in securities | SEC and FINRA conduct and supervision rules |
| Works in insurance | State insurance regulators, coordinated by the NAIC |
| Works for a New York regulated financial firm | NYDFS requirements |
Federal and state consumer protection law against unfair or deceptive practices applies across all of these. The NIST AI Risk Management Framework is voluntary but widely used to organise the work. How model risk and the NIST framework combine in banks is covered in NIST AI RMF and SR 11-7: model risk for AI agents in US banks.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Why does the line fall where it does?
US law tends to regulate outcomes and relationships rather than technology. That produces a consistent line for agents even across different laws.
Reasons must be real. Under ECOA and Regulation B, a lender must give specific principal reasons when it denies credit. An agent that declines an applicant without a record of the factors it relied on leaves the lender unable to comply. This, more than any AI rule, is why credit agents must record their reasoning.
Data duties travel with the data. GLBA, HIPAA and state privacy laws attach to the information, not to whoever handles it. An agent reading customer records is covered the moment it reads them, and so is the vendor behind it.
Supervisors judge the firm. Bank and insurance regulators hold the regulated firm accountable for every tool it uses. An agent built by a vendor is still the bank's model risk.
What may the agent do, and what stays with a person?
- Agent may: answer customer questions, gather application documents, prepare credit memos, monitor transactions, draft adverse action notices with the reasons it recorded.
- Agent may, within limits: approve routine requests and small, favourable decisions within tested policy.
- Stays with a person: credit denials and their reasons, decisions to close accounts or deny claims, any disclosure of customer data outside approved channels, suspicious activity decisions, and appeals of consequential decisions under Colorado's act.
An illustrative example
Take a fintech lender based in New York that serves customers in California and Colorado through a partner bank. Its underwriting agent touches almost every row of the table. The partner bank applies SR 11-7 to the agent through its third-party oversight. ECOA and Regulation B require specific reasons for every denial. GLBA governs the customer data. California applicants have CCPA rights. Colorado applicants are covered by the state's AI act, which brings an impact assessment and an appeal route. And NYDFS has its own expectations for the lender itself.
The lender builds one design to satisfy all of them: every factor the agent uses is recorded, denials are made by a credit officer with those factors in front of them, customer data is accessed only for the application, and outcomes are tested across groups.
Which controls cover the most ground?
- A decision record per action, listing factors and sources.
- Holds on adverse decisions for a named person.
- Data access limited to purpose, with vendor oversight.
- Outcome testing for unfair or discriminatory patterns.
- Model risk treatment for agents in or serving banks.
- A state-by-state check for consumer privacy and AI laws as you expand.
For a market comparison, see which Indian rules apply to AI agents in banking. The full map is in AI agent regulation, mapped to controls.
Questions people ask
Is there a federal law that regulates AI agents directly?
No single federal AI law applies across sectors. Federal sector laws, state laws and supervisory guidance apply to agents through the activities they perform.
Do state AI laws apply to companies elsewhere?
They can, where they protect that state's residents. A company outside Colorado making consequential decisions about Colorado consumers should check the act.
Does using a vendor's agent shift legal responsibility?
No. The firm using the agent remains responsible to its customers and regulators. Contracts can allocate costs between the firm and the vendor, but not the firm's duties.