What must a US company document when it deploys an AI system?

• Federal level

  There is no general federal AI statute. The framework is voluntary and organises the work in four functions: govern, map, measure and manage.

  NIST AI 100-1

• Enforcement

  Claims about what an AI system does, and unfair uses of it, are treated as deception or unfairness under the general consumer protection rule.

  15 U.S.C. § 45

• State level

  Colorado requires developers and deployers of high risk systems to use reasonable care against algorithmic discrimination, with documentation and impact assessments.

  Colorado SB24-205, Consumer Protections for Artificial Intelligence

• European comparison

  The European regulation is binding and classifies systems by risk, with documentation, logging and human oversight duties for high risk systems.

  Regulation (EU) 2024/1689, the AI Act

• The NIST framework describes govern, map, measure and manage, and is explicitly voluntary.
• Section 5 of the FTC Act prohibits unfair or deceptive acts or practices, which covers unsubstantiated claims about model performance.
• Colorado SB24-205 imposes a duty of reasonable care on developers and deployers of high risk artificial intelligence systems.

A buyer or regulator asks for the same four artefacts: what the system decides, what data it uses, how it was tested, and who can override it. Producing them later is far more expensive than recording them at deployment.

Where a system decides on employment, credit, housing or insurance, state law increasingly gives the individual notice and a route to contest the decision.

Write one system card per deployed model that names the decision, the data, the test results and the named human who can override it.

All US questions