Skip to content
Back to Destinations

United States (Federal): compliance overview

7 regulations, 37 mapped obligations and 1 data-transfer routes, organised by when they start to bind you and what you have to do.

Filter the obligations that bind usContact an advisor

Regulatory timeline: what comes next

  1. 2025-01-02

    Final rule takes effect

    U.S. Outbound Investment Security Program

  2. 2025-01-07

    Lifecycle management draft guidance published (90 FR 1154, still draft)

    FDA Predetermined Change Control Plans (PCCP) for AI-enabled devices

  3. 2025-01-08

    Final rule published in the Federal Register

    U.S. DOJ Bulk Sensitive Personal Data Rule (Data Security Program)

  4. 2025-01-13

    Framework for Artificial Intelligence Diffusion takes effect

    U.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List)

  5. 2025-04-08

    Rule takes effect at 12:01 a.m. ET

    U.S. DOJ Bulk Sensitive Personal Data Rule (Data Security Program)

  6. 2025-07-08

    End of the DOJ 90-day implementation and enforcement policy

    U.S. DOJ Bulk Sensitive Personal Data Rule (Data Security Program)

  7. 2025-09-29

    The 50 percent affiliates interim final rule takes effect

    U.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List)

  8. 2025-10-06

    Data compliance program, audit and reporting duties begin to apply

    U.S. DOJ Bulk Sensitive Personal Data Rule (Data Security Program)

  9. 2025-11-10

    The 50 percent affiliates rule is stayed

    U.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List)

  10. 2026-01-15

    Revised license review policy for advanced computing commodities takes effect

    U.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List)

  11. 2026-01-15

    Revision to the licence review policy for advanced computing commodities takes effect: from presumption of denial to case-by-case for China and Macau

    U.S. export controls on advanced computing and AI model weights — sector application points for AI hardware

  12. 2026-06-03

    SEC publishes a proposal to rescind the rules

    SEC climate-related disclosure rules (stalled and proposed for rescission)

  13. 2026-08-03

    Comment period on the rescission proposal closes

    SEC climate-related disclosure rules (stalled and proposed for rescission)

  14. 2026-09-01

    Reference date of the eCFR version verified

    U.S. export controls on advanced computing and AI model weights — sector application points for AI hardware

  15. 2026-11-09not final

    The stay on the 50 percent affiliates rule lapses, absent extension

    U.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List)

Applicable regulations (7)

In forceCross-border dataRelevance Critical

U.S. DOJ Bulk Sensitive Personal Data Rule (Data Security Program)

A Chinese AI company is caught by concrete operational acts: (1) its U.S. subsidiary routes U.S. users location, health, financial, biometric or identifier data back to teams in China for model training or operational analytics; (2) R&D, outsourcing or data-labelling teams in China reach production systems or warehouses holding U.S. user data through accounts or VPN; (3) bulk precise geolocation data collected by U.S. autonomous-driving fleets, robots, wearables or apps is sold or licensed to the Chinese parent; (4) U.S. user datasets are sold or licensed to Chinese affiliates or third parties, or SDKs and tracking pixels in an app pass data to a covered person; (5) it accepts non-passive Chinese investment that could confer access to U.S. user data; (6) it engages in cross-border research or commercial collaboration on U.S. persons genomic or proteomic data. The test does not turn on encryption, de-identification or whether money changes hands, but on whether a covered person can access the data.

10 obligations · reviewed 2026-09-12

Phased applicationExport controlsRelevance Critical

U.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List)

At the level of concrete business acts, a Chinese AI company is pulled into the EAR when it: (1) buys GPUs, accelerator cards, servers or HBM in or from the United States and ships them abroad; (2) builds or rents compute clusters in a third country in Southeast Asia, the Middle East or Europe using chips within 3A090, 4A090 or their .z entries; (3) uses offshore contract manufacturing where the plant or its major components are a direct product of U.S. technology or software; (4) delivers controlled model weights to overseas customers, migrates them to offshore inference clusters, or gives China-national employees inside the United States access to controlled technology or weights (deemed export); (5) is itself or through an affiliate placed on the Entity List, forcing global suppliers to license each order; or (6) obtains controlled compute indirectly through a distributor, integrator or cloud provider, since intermediation does not change the jurisdictional result.

9 obligations · reviewed 2026-09-12

In forceExport controlsRelevance High

U.S. Outbound Investment Security Program

The duties bind U.S. persons, but Chinese AI companies are affected through three concrete acts: (1) taking investment from U.S.-person individuals, U.S. funds or U.S. entities, where a company engaged in a covered activity may see the investment prohibited or made notifiable, causing the deal to be restructured or abandoned; (2) having U.S.-person directors or officers, including investor-designated board members, whose participation in approvals, document signature or negotiations can amount to knowingly directing; and (3) forming a joint venture with a U.S. person, wherever located, to engage in a covered activity, or a U.S. person acquiring, leasing or developing operations and assets in China that establish a covered foreign person. U.S. investors will additionally require the Chinese target to give representations and warranties about training compute, training data composition and product end uses.

5 obligations · reviewed 2026-09-12

In forceAI regulationRelevance High

FTC Act Section 5 enforcement posture on artificial intelligence

A Chinese AI company is directly exposed under section 5 when it: (1) claims model accuracy, recognition rates, automation substitution rates or return on investment on its website, app store listing, white papers, ad creative or sales scripts without substantiation held in advance; (2) offers under an AI banner services that would normally require a licensed professional, such as legal, medical, tax or mental health services, without adequate qualification; (3) deploys face recognition, behaviour recognition or risk scoring in the United States to flag consumers without pre-deployment risk assessment, false-positive handling and human review; (4) supplies a product used to mass-produce fake reviews, fake identities or misleading marketing content where the company knows or should know of that use; or (5) makes statements in its privacy policy or security commitments that do not match reality. Section 5 has no revenue or user thresholds and applies to start-ups equally.

3 obligations · reviewed 2026-09-12

Enacted, not yet in forceESG disclosureRelevance Low

SEC climate-related disclosure rules (stalled and proposed for rescission)

The relevance to Chinese AI companies runs through two concrete acts: (1) when preparing registration statements and annual reports for a U.S. IPO or an existing U.S. listing, the climate disclosure section should not be built on these rules, although general materiality-based disclosure duties and requirements in other jurisdictions such as the EU and California state climate legislation still need assessment; and (2) when completing ESG questionnaires for U.S. enterprise customers or diligence materials for investors, the rules must not be described as a current U.S. mandate, which would misstate the position to customers and investors. The purpose of this entry in the corpus is to stop an incorrect conclusion from spreading, not to impose a new duty.

2 obligations · reviewed 2026-09-12

In forceSector-specificRelevance High

FDA Predetermined Change Control Plans (PCCP) for AI-enabled devices

A Chinese medical AI company is in scope when it files a 510(k), De Novo or PMA to market AI-enabled imaging, pathology, ECG, fundus or ultrasound software in the United States; when it plans post-market retraining on new data, expansion of the indicated population or supported device models, threshold adjustments or changes to input imaging protocols; when U.S. hospitals or distributors require an explanation of how model updates stay compliant; and when it supplies AI modules as an OEM to a U.S. submission holder, which will write the PCCP boundary into supply and change notification terms. Modifications outside an authorised PCCP still require a new marketing submission, which is a hard constraint on product roadmap scheduling.

4 obligations · reviewed 2026-09-12

In forceExport controlsRelevance Critical

U.S. export controls on advanced computing and AI model weights — sector application points for AI hardware

A Chinese AI company is caught when it buys GPUs, accelerators, HBM or related software and technology with U.S. content and deploys training clusters in China or a third country; when it builds or leases compute capacity abroad, including outside D:5, while the end user or its ultimate parent is headquartered in China, which drives the end-user analysis for model weights and advanced computing items; when it supplies or receives controlled AI model weights, since ECCN 4E091 carries a worldwide licence requirement rather than a country-specific one; when it ships AI appliances, edge inference boxes or robot compute modules containing controlled chips to overseas customers; and when it supplies equipment, parts, software or technical support to advanced-node IC lines. The reverse also holds: as a link in the supply chain delivering to U.S. or third-country customers, it will be asked for end-user and end-use statements written to the §744.23 knowledge standard.

4 obligations · reviewed 2026-09-12

Data transfer routes

  • US DOJ bulk sensitive personal data rule (28 CFR Part 202): prohibited and restricted transactions

    The bulk thresholds are in 28 CFR 202.205: any amount of sensitive personal data meeting or exceeding the following at any point in the preceding 12 months, whether in a single covered data transaction or aggregated across transactions involving the same US person and the same foreign person or covered person - (a) human omic data on more than 1,000 US persons, or, for human genomic data, more than 100 US persons; (b) biometric identifiers on more than 1,000 US persons; (c) precise geolocation data on more than 1,000 US devices; (d) personal health data on more than 10,000 US persons; (e) personal financial data on more than 10,000 US persons; (f) covered personal identifiers on more than 100,000 US persons; (g) combined data, meaning any set containing more than one of the categories in (a) to (f), or any listed identifier linked to categories in (a) to (e), where any individual data type meets the threshold for the lowest number of US persons or devices in that category. The direct consequence for a Chinese AI company: even where it never touches the data, once a US vendor, customer or portfolio company classifies the deal as a restricted transaction, that party’s compliance cost and security requirements are pushed down into your technical and contractual terms - no access from personnel in China, key escrow, data segregation - and may simply cause the US side to decline the deal.

    Lead time: Estimate: 2-4 weeks to classify the transaction and the data; 3-6 months to implement the security requirements and stand up the data compliance program for restricted transactions (access control rework, data segregation, logging and audit capability). The timeline for a specific licence is set case by case by DOJ and was not verified in this pass, so assess it per project. · Cost band Very High

What you can use right now

Playbooks

Bringing AI SaaS to US enterprise buyers: SOC 2, state privacy and AI laws, and the DOJ bulk-data ruleAI hardware and compute going global: two-way export controls, end users and model-weight transfers

Templates

Model CardData Card — datasheet for a training, validation or test datasetGreenhouse gas inventory workpaper (GHG Protocol Scope 1 / 2 / 3)Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)SOC 2 Type II readiness checklist (Trust Services Criteria)ISO/IEC 42001 AI management system implementation and certification readiness checklistSupplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)Investor ESG due diligence pack (for fundraising and pre-IPO)

Relevant standards

  • SEC climate-related disclosure rules (stayed and never effective; the SEC has proposed to rescind them in their entirety) · Final Rules, Release Nos. 33-11275 / 34-99678 (adopted 6 March 2024, 89 FR 21668); proposed rescission, Release Nos. 33-11421 / 34-105572 (File No. S7-2026-19, published 3 June 2026)
  • NIST Artificial Intelligence Risk Management Framework 1.0 (NIST AI 100-1) · AI RMF 1.0 (NIST AI 100-1, released 2023-01-26; being revised under the White House AI Action Plan)
  • NIST AI 600-1 Generative Artificial Intelligence Profile · NIST AI 600-1 (released July 2024; approved by the NIST Editorial Review Board on 2024-07-25)
  • SOC 2 (System and Organization Controls) and the AICPA Trust Services Criteria · 2017 Trust Services Criteria (with the 2022 revised points of focus)
  • CSA STAR and STAR for AI (including CCM, CAIQ, AICM and AI-CAIQ) · STAR program (combined CCM/CAIQ v4.1); AI Controls Matrix AICM v1 (released 2025-07-09, updated 2025-10-30; v1.1 also published)

What has actually happened here

Sources (22)

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.

GDPR · PIPL · CCPA control mapping
Traceable AI · cited when sourced
ISO 27001 alignment in progress
WCAG 2.1 AA accessibility target
United States (Federal): compliance overview | HaiWen HQ