Executive action, existing regulators, and state law, not one federal statute
Where the EU built one comprehensive AI-specific law, the US approach as of the time of writing has been noticeably more fragmented. There is no single federal statute that plays the role the AI Act plays in the EU. Instead, AI governance in the US has come from three different directions at once, and a builder operating across the country has to track all three rather than one.
The first is executive branch action: presidential executive orders and agency guidance that direct how federal agencies approach AI, without themselves being statutes passed by Congress. Executive orders can be substantial in scope, but they're also more easily reversed by a subsequent administration than legislation would be, which makes the federal executive-branch posture on AI a genuinely less stable target to build against than a passed law. The second is sector-specific regulators applying their existing authority to AI rather than waiting for AI-specific legislation. The FTC has signaled it will treat deceptive or unfair AI-related claims and practices under its existing unfair-and-deceptive-practices authority, the same authority it's used for decades against other kinds of consumer harm. The FDA regulates AI-enabled medical devices under its existing medical device framework. Financial regulators apply existing lending and disclosure law to AI-driven credit decisions. None of this required Congress to pass a new AI law, it's existing statutory authority being pointed at a new kind of technology.