US AI laws for companies that buy AI tools: what to ask your vendors
Most US companies will never build an AI model. They'll buy one, often without noticing: a resume screener inside the applicant tracking system, a support chatbot, a copilot added to software they already pay for, or an agent a team connected to the shared drive.
The US doesn't have a single AI law like the EU AI Act. But that doesn't mean buyers are off the hook. A patchwork of state and city rules already applies to companies that use AI, especially when it affects decisions about people, and existing laws on discrimination, privacy and consumer protection apply to AI too.
The rules that reach buyers today
AI in hiring (New York City, Illinois and others). New York City requires employers using automated employment decision tools to have an annual independent bias audit, publish a summary, and notify candidates. Illinois has amended its Human Rights Act to address discriminatory use of AI in employment decisions. If a vendor's tool screens or ranks candidates, these rules land on you as the employer.
Colorado's AI Act. Colorado passed the first broad state law on "high-risk" AI used in consequential decisions such as employment, lending, housing, insurance, education and healthcare. It puts duties on deployers, the companies using the AI, including a risk-management program, impact assessments and notices to consumers. Its start date has already been pushed back and the law may change further, so check its current status.
Privacy laws and automated decisions. State privacy laws such as California's CCPA/CPRA give people rights over their personal data, and California's privacy regulator has adopted rules on automated decision-making technology that phase in over time. If an AI tool processes personal data, your vendor contract needs the right service-provider terms.
Existing law still applies. Anti-discrimination, consumer protection and privacy laws don't stop applying because a decision was made by software. Regulators have said so repeatedly, and "the vendor's model did it" is not a defense.
The federal picture is still moving, including efforts to limit how far states can regulate AI. That's exactly why a framework-based approach helps: the voluntary NIST AI Risk Management Framework gives you a structure (govern, map, measure, manage) that holds up whichever way the rules go, and Colorado's law points to recognized frameworks like it.
Questions to ask every AI vendor
Where exactly is AI used in the product? Including features that were added after you bought it. AI often arrives in a product update, not a new contract.
Is it used in decisions about people? Hiring, promotion, lending, pricing, eligibility. If yes, which laws does the vendor think apply, and what support do they give you, for example bias audit results for hiring tools?
What are its known limitations, and how was it tested? Ask for documentation, not a sales deck.
Who can review or override its output? And what does a human see when they do?
Is our data used to train your models? Get the answer in the contract, including for any sub-processors such as model providers.
For agents: what can it access and do on its own? List systems, data and actions, and re-check after every major update. Agent permissions tend to grow quietly.
Build it into intake
The simplest control is a question at the front door: does this tool use AI, and is it used in decisions about people? If yes, route it to the right reviewers and record the answers. Our free third-party risk checklist includes the AI checks alongside security, privacy and contract terms.
Granur builds this into every evaluation: AI vendors pick up compliance screening against frameworks such as the NIST AI RMF and ISO/IEC 42001, agents get a permission registry showing what each can access and do, and shadow-AI discovery surfaces tools teams adopted without asking.