Home / Solutions / Regions / United States
In the US, AI accountability is now personal.
Examiners keep finding inventory gaps. The CFPB rejects any advanced-technology exception. The SEC prosecutes AI claims you can't substantiate. State AI laws are live or imminent. And the precedents say individual officers can carry the consequences. Five questions US institutions must be able to answer.
What US regulators will actually ask
The examiner wants the model inventory and the reconstruction, and our LLMs were never registered.
OCC / Fed · SR 11-7 model riskThe most common 2024–2025 examination finding: inadequate model inventory, LLMs in customer service, document processing, and compliance excluded as "tools." Notably, the April 2026 revised interagency MRM guidance excludes generative and agentic AI from its scope as novel and rapidly evolving, leaving them under general risk-management and governance expectations. That gap is precisely where correlated app + OS security lives.
→ Map closes the inventory gap from real endpoint activity; Measure provides the session-level reconstruction examiners increasingly request.
Our lending AI can't produce specific adverse-action reasons.
CFPB · ECOA / Regulation BSpecific, accurate adverse-action reasons are mandatory, and the CFPB is explicit that there is no advanced-technology exception to federal consumer financial law. Supervisory findings have criticized credit models with 1,000+ variables as difficult to monitor for proxy discrimination.
→ Action-level decision evidence gives every adverse action a reconstructable, specific basis.
We made AI claims in filings and marketing that we can't fully substantiate.
SEC · AI-washing enforcementFrom Delphia and Global Predictions (2024) to Presto Automation, the first public-company AI-washing action, and the ~$42M Nate Inc. fraud case (SEC + DOJ). AI governance is a stated examinations priority.
→ A documented, operating record of what your AI actually did, evidenced at the endpoint.
We operate across states with conflicting AI laws.
Colorado · Texas · CaliforniaColorado AI Act (June 30, 2026): impact-based, reasonable-care duty, impact assessments, up to $20,000/violation. Texas TRAIGA (Jan 1, 2026): intent-based, NIST AI RMF safe harbor, up to $200,000/violation. California SB 53 frontier-AI rules. Federal preemption is unsettled after the Dec 2025 executive order, prudent enterprises build to the strictest applicable standard.
→ One control layer, mapped to the strictest standard, with NIST AI RMF alignment that doubles as a Texas safe-harbor posture.
My exposure for an AI failure is no longer just corporate. It's personal.
Officer & board accountabilityThe SEC charged SolarWinds' CISO personally; Uber's CSO was criminally convicted. 40% of Fortune 100 boards now assign AI oversight to a board-level committee, up from 11% a year earlier. The accountability chain now ends at named individuals.
→ Evidence that controls exist and operate, the strongest position an institution, and its officers, can hold.
United States: a moving front, state by state
There is no single US AI law, there is a layering of examination practice, consumer-protection enforcement, securities enforcement, and state statutes. The prudent build target is the strictest applicable standard.
Jan 1, 2026
Texas TRAIGA in force
Intent-based liability with a NIST AI RMF safe harbor; penalties to $200,000 per violation.
Apr 2026
Interagency MRM revision
Generative and agentic AI excluded from MRM scope as "novel and rapidly evolving", left under general governance expectations, with an agentic-AI RFI signaled.
Jun 30, 2026
Colorado AI Act effective
Impact-based duty of reasonable care for high-risk systems; impact assessments; penalties to $20,000 per violation.
Ongoing
SEC AI-washing enforcement
From Delphia and Global Predictions through Presto Automation and Nate Inc., AI governance is a stated examinations priority.
Federal preemption remains unsettled after the December 2025 executive order, multistate enterprises should assume the strictest standard applies.
Examination-ready, before the examination.
We're engaging with US enterprises in banking, SaaS, and insurance. A demo maps your AI estate against SR 11-7 expectations, CFPB requirements, and your state-law exposure.