Guidelines by field
AI guidelines in business, hiring and finance what the field's own bodies ask
Business frameworks are about process more than conscience: inventories, audits, logs and management systems. They also carry some of the sharpest political disagreements, between federal deregulation and state protections in the US, and between rights and speed in the EU.
Last reviewed 27 October 2026. Every claim links to its source.
At a glance
Govern, map, measure, manage
Know what AI you use, what could go wrong and who owns the risk.
Existing rules still apply
Rules on supervision, records and fair dealing cover AI, and overstating your AI is misleading marketing.
Test and log
Test before deployment, monitor afterwards, and log prompts, outputs and model versions.
Check hiring tools for bias and tell candidates
New York City requires annual bias audits and candidate notice.
Let people challenge decisions
Notice, an explanation after an adverse outcome, a chance to correct data and human review.
Who has spoken
- Binding law, regulation, court ruling or enforceable professional rule
- Voluntary guidance, principles or a code an organization chooses to follow
Voluntary 2023; 2024
US National Institute of Standards and Technology
AI Risk Management Framework and Generative AI Profile
Four functions: govern, map, measure, manage. Under revision as part of the White House AI Action Plan; planned edits drew industry pushback.
Voluntary Dec 2023
ISO and IEC
ISO/IEC 42001, AI management system
A management-system standard with plan-do-check-act cycles for organizations using AI.
Binding In force Jul 2026
European Union
AI Act, as amended by the Digital Omnibus
Transparency duties since 2 August 2026; high-risk duties for hiring, credit and education moved to December 2027, and for AI inside regulated products to August 2028.
Binding Since Jul 2023
New York City
Local Law 144, automated employment decision tools
Annual bias audits, public summaries and candidate notice. A December 2025 state audit found weak enforcement.
Binding Oct 2025 to Jan 2026
California, Illinois and Texas
State rules on AI in employment
Filled the gap after federal hiring guidance was removed in January 2025: notice duties and disparate-impact rules, with vendors liable in California.
Binding Signed May 2026; from Jan 2027
State of Colorado
SB 26-189, replacing the 2024 AI Act
Notice, explanation, correction and human review for consequential automated decisions, with enforcement by the Attorney General.
Binding 2024; Dec 2025
SEC and FINRA
AI-washing enforcement; 2026 Regulatory Oversight Report
Penalties for overstating AI use, and expectations for testing, logging and human oversight of AI agents.
Presented as factual information.
Binding and voluntary
Binding
The EU AI Act; New York City's hiring law; state employment laws in California, Illinois and Texas; Colorado's replacement law from 2027; SEC and FINRA rules.
Voluntary
The NIST framework, ISO/IEC 42001 and the EU's general-purpose AI Code of Practice, which is voluntary but a recognized way to show compliance.
What changed in 2025 and 2026
- The EU delayed its high-risk rules by about 16 months through the Digital Omnibus, in force 27 July 2026, while adding a ban on "nudifier" apps.
- US federal policy moved toward deregulation and preemption: federal hiring guidance removed (January 2025), a December 2025 executive order directing challenges to state AI laws, with carve-outs including child safety.
- Colorado's first-in-the-nation AI law was replaced before taking effect with a narrower, notice-based law.
Where people still disagree
Supporters of the US federal approach argue that a patchwork of state rules burdens innovation; supporters of state laws argue that people need protection from discriminatory automated decisions now. In the EU, the delays were driven by concern that the rules slow innovation, while critics of the delays say they weaken rights protection. Both positions are in the sources.
Questions to ask yourself
- Do I have a list of every AI tool my team uses, and who is responsible for each?
- If an applicant or customer were turned down partly by AI, could we explain why and let a person review it?
- Are our marketing claims about AI accurate enough to survive a regulator's question?
How this lines up with my everyday guidelines
| My everyday guidelines | The field's nearest rule |
|---|---|
2. Practice transparent collaboration Own all outputs that carry your name or business reputation. | Existing duties of supervision and fair dealing cover AI (FINRA). |
4. Use for good Put client welfare and truthfulness above convenience. | Overstating your AI is misleading marketing (SEC AI-washing cases). |
Not part of my everyday guidelines. | Check hiring and other high-stakes tools for bias, and give people a way to challenge decisions (NYC LL144; Colorado). |