CANCanada has no AI Act — and four privacy regulators applied existing law to OpenAI anywayQCQuébec's automated-decision duty has applied since 22 September 2023 — notice at the decision, explanation on requestONOntario employers with 25+ staff must say when AI screens applicants — in force 1 January 2026CANFederal institutions and their vendors: the Directive on Automated Decision-Making, amended June 2025CAN2 bills would change all of this — C-36 and C-34 — and neither has passed
The chrome lion lighting a dark office where AI is running unwatched
Why this landed on your desk

Your team is already using AI

Not next year. Today, in tools nobody approved, on work nobody reviewed. AI governance is knowing what’s in use, deciding what’s allowed, and being able to show both. That’s it.

This page explains what the job actually is, in plain words, before you spend a dollar on it.

Take the free scorecard →

By , Founder & CEO · Published · Updated

Reviewed by Jim Tunnessen. Every legal claim was checked against its primary source by a person on July 29, 2026.

What governing AI actually means

Five questions you need answers to

Strip away the frameworks and the acronyms and this is the whole job. If you can answer these five in writing, you are governing AI.

What AI are we using?

Every tool, who owns it, and what data goes into it. Most organizations cannot answer this on the day they're asked.

What are people allowed to do with it?

A written policy and a practical standard, both short enough that staff will actually read them.

What could go wrong, and who's watching?

A named owner per risk, a sense of how likely and how bad, and a date you'll look again.

Does everyone know the rules?

Training, then a dated signature per person. Unsigned staff are the gap auditors find first.

Can you prove all of the above?

Dated records, a report each quarter, and a page you can send to anyone who asks. This is the part a template can't do.

Who’s asking

The question arrives from four directions

Your board

“What's our AI policy?”

Usually followed, one meeting later, by “and how do we know it's working?” The second question is the hard one.

Funders and members

“How are you handling AI?”

Increasingly a line item in grant applications and renewal packets. A live trust page answers it without a scramble.

Customers and insurers

“Complete this AI questionnaire.”

Security reviews now carry AI sections. The answers come straight out of your inventory and crosswalk.

Regulators

“Show your assessment.”

State and international AI rules are arriving on a schedule. Where they apply, they ask for records you either have or don't.

Law coverage

The laws, everywhere you operate

AI law stopped being one deadline in one state. GOVERNBOX cites specific statutes from 27 U.S. states, covers 43 state AI laws across 38 states with dedicated frameworks and crosswalks, and reaches U.S. federal law, the EU, Italy, the UK, Switzerland and Norway, Canada, the standards bodies and 26 countries in total — as selectable frameworks, not as a blog post. Pick the ones you operate under and every policy, crosswalk and gap report is generated and checked against exactly those.

27
U.S. states with statutes cited

38 states go further, with 43 state AI-law frameworks of their own — own controls, own crosswalk report. New states are added as they pass.

26
countries covered

National AI law and guidance, plus the EU as a bloc and the international instruments.

89
frameworks, laws & standards

Selectable per organization — your documents are generated and checked against the ones you pick.

500+
controls in the library

Expert-written, versioned, and cited by ID in every clause we generate. Nothing is invented.

U.S. state AI law coverage

The library cites specific statutes from 27 states in its state law landscape controls, and 38 states have 43 AI-law frameworks of their own, each with its own controls and crosswalk report. The rest are reached through the U.S. state law landscape framework, which tracks disclosure, chatbot, biometric, deepfake, health, insurance and employment-AI statutes as they pass — so a new law does not mean a new setting for you.

Alaska — covered by the U.S. state law landscape frameworkAKMaine — dedicated framework: Maine AI lawsMEWisconsin — dedicated framework: Wisconsin AI lawsWIVermont — dedicated framework: Vermont AI lawsVTNew Hampshire — dedicated framework: New Hampshire AI lawsNHWashington — dedicated framework: Washington AI lawsWAIdaho — dedicated framework: Idaho AI lawsIDMontana — dedicated framework: Montana AI lawsMTNorth Dakota — dedicated framework: North Dakota AI lawsNDMinnesota — dedicated framework: Minnesota AI lawsMNIllinois — dedicated framework: Illinois AI law & guidanceILMichigan — covered by the U.S. state law landscape frameworkMINew York — dedicated framework: New York AI lawsNYMassachusetts — covered by the U.S. state law landscape frameworkMARhode Island — dedicated framework: Rhode Island AI lawsRIOregon — dedicated framework: Oregon AI lawsORNevada — dedicated framework: Nevada AI lawsNVWyoming — dedicated framework: Wyoming AI lawsWYSouth Dakota — covered by the U.S. state law landscape frameworkSDIowa — dedicated framework: Iowa AI lawsIAIndiana — dedicated framework: Indiana AI lawsINOhio — covered by the U.S. state law landscape frameworkOHPennsylvania — covered by the U.S. state law landscape frameworkPANew Jersey — dedicated framework: New Jersey AI lawsNJConnecticut — dedicated framework: Connecticut SB 5 (PA 26-15); Connecticut AI laws (other statutes)CTCalifornia — dedicated framework: California ADMT Regulations; California AI laws (other statutes)CAUtah — dedicated framework: Utah AI lawsUTColorado — dedicated framework: Colorado ADMT Act (SB 26-189); Colorado Chatbot Safety (HB 26-1263); Colorado AI laws (other statutes)CONebraska — dedicated framework: Nebraska AI lawsNEMissouri — covered by the U.S. state law landscape frameworkMOKentucky — dedicated framework: Kentucky AI lawsKYWest Virginia — covered by the U.S. state law landscape frameworkWVVirginia — dedicated framework: Virginia AI lawsVAMaryland — dedicated framework: Maryland AI lawsMDDelaware — dedicated framework: Delaware AI lawsDEArizona — dedicated framework: Arizona AI lawsAZNew Mexico — covered by the U.S. state law landscape frameworkNMKansas — dedicated framework: Kansas AI lawsKSArkansas — specific statutes cited in the U.S. state law landscape controlsARTennessee — dedicated framework: Tennessee AI lawsTNNorth Carolina — covered by the U.S. state law landscape frameworkNCSouth Carolina — dedicated framework: South Carolina AI lawsSCDistrict of Columbia — covered by the U.S. state law landscape frameworkDCOklahoma — dedicated framework: Oklahoma AI lawsOKLouisiana — dedicated framework: Louisiana AI lawsLAMississippi — covered by the U.S. state law landscape frameworkMSAlabama — dedicated framework: Alabama AI lawsALGeorgia — dedicated framework: Georgia AI lawsGAHawaii — dedicated framework: Hawaii AI Acts (247 / 248)HITexas — dedicated framework: Texas TRAIGA; Texas AI laws (other statutes)TXFlorida — dedicated framework: Florida AI lawsFL
Own framework + crosswalkSpecific statutes citedReached via the landscape framework
  • Colorado — Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Colorado AI laws (other statutes)
  • Connecticut — Connecticut SB 5 (PA 26-15) · Connecticut AI laws (other statutes)
  • Texas — Texas TRAIGA · Texas AI laws (other statutes)
  • California — California ADMT Regulations · California AI laws (other statutes)
  • Hawaii — Hawaii AI Acts (247 / 248)
  • Alabama — Alabama AI laws
  • Arizona — Arizona AI laws
  • Delaware — Delaware AI laws
  • Florida — Florida AI laws
  • Georgia — Georgia AI laws
  • Idaho — Idaho AI laws
  • Illinois — Illinois AI law & guidance
  • Indiana — Indiana AI laws
  • Iowa — Iowa AI laws
  • Kansas — Kansas AI laws
  • Kentucky — Kentucky AI laws
  • Louisiana — Louisiana AI laws
  • Maine — Maine AI laws
  • Maryland — Maryland AI laws
  • Minnesota — Minnesota AI laws
  • Montana — Montana AI laws
  • Nebraska — Nebraska AI laws
  • Nevada — Nevada AI laws
  • New Hampshire — New Hampshire AI laws
  • New Jersey — New Jersey AI laws
  • New York — New York AI laws
  • North Dakota — North Dakota AI laws
  • Oklahoma — Oklahoma AI laws
  • Oregon — Oregon AI laws
  • Rhode Island — Rhode Island AI laws
  • South Carolina — South Carolina AI laws
  • Tennessee — Tennessee AI laws
  • Utah — Utah AI laws
  • Vermont — Vermont AI laws
  • Virginia — Virginia AI laws
  • Washington — Washington AI laws
  • Wisconsin — Wisconsin AI laws
  • Wyoming — Wyoming AI laws

Includes California's ADMT regulations and a pack of AI laws for each of 37 states (Illinois's covers the AI Safety Measures Act plus its employment, deepfake and mental-health AI laws). The CCPA privacy statute is a separate framework (Pro on the US plans; Agency elsewhere). All 51 jurisdictions shown are reachable through the U.S. state law landscape framework; 27 have their own statutes cited in it, and 38 have dedicated controls and a coverage report of their own. This map describes what GOVERNBOX covers — it is not a survey of which states have passed AI legislation, and it is not legal advice.

Regulatory jurisdictions — each enabled as one unit on your Organization Profile
  • U.S. State AI LawsAgency / Enterprise

    Colorado ADMT Act (SB 26-189) · Colorado Chatbot Safety (HB 26-1263) · Connecticut SB 5 (PA 26-15) · Texas TRAIGA · California ADMT Regulations · Hawaii AI Acts (247 / 248) · Alabama AI laws · Arizona AI laws · California AI laws (other statutes) · Colorado AI laws (other statutes) · Connecticut AI laws (other statutes) · Delaware AI laws · Florida AI laws · Georgia AI laws · Idaho AI laws · Illinois AI law & guidance · Indiana AI laws · Iowa AI laws · Kansas AI laws · Kentucky AI laws · Louisiana AI laws · Maine AI laws · Maryland AI laws · Minnesota AI laws · Montana AI laws · Nebraska AI laws · Nevada AI laws · New Hampshire AI laws · New Jersey AI laws · New York AI laws · North Dakota AI laws · Oklahoma AI laws · Oregon AI laws · Rhode Island AI laws · South Carolina AI laws · Tennessee AI laws · Texas AI laws (other statutes) · Utah AI laws · Vermont AI laws · Virginia AI laws · Washington AI laws · Wisconsin AI laws · Wyoming AI laws

  • United States — federal law & state landscapeAgency / Enterprise

    Federal legislation, executive orders and agency regulation, a cross-state view of AI disclosure and training-data laws. Per-state statutes — Illinois included — are the U.S. State AI Laws jurisdiction above.

  • CanadaStarter+

    PIPEDA and provincial privacy law, the Directive on Automated Decision-Making, and the Canadian Human Rights Act as they apply to AI.

  • AI frameworks, standards & healthcare guidelinesPro+

    NIST profiles, ISO/IEC standards, IEEE, OECD and the healthcare AI reporting/assurance frameworks (FDA, WHO, CHAI, CONSORT-AI…).

  • Europe — EU regulation, Italy, UK, Switzerland, NorwayPro+United Kingdom AI law & guidance from Starter+

    EU regulation beyond the AI Act itself (GPAI code of practice, guidance), plus Italy's national AI law and the UK, Swiss and Norwegian frameworks. The EU AI Act and GDPR are not part of this unit — select each on its own under Laws & regulations below.

  • Global — Americas, Middle East, Asia-Pacific, Central Asia & internationalAgency / Enterprise

    Twenty further countries' AI laws and guidance plus the international instruments (Council of Europe, OECD, UNESCO, UN).

The EU AI Act, GDPR, HIPAA, CCPA, NIST AI RMF, ISO/IEC 42001 and 42005 and SOC 2 are chosen individually alongside these. See coverage by plan for exactly what each plan can select. GOVERNBOX gives you a defensible starting point that you review and approve — it is not legal advice.

The honest version

What we won’t tell you

That you're already breaking the law

Most of these rules are new, and plenty may not apply to you. We'll tell you which ones do.

That software makes you compliant

It doesn't. It gives you a defensible starting point and the records to back it up. You review and approve everything.

That it's finished in one afternoon

The first package takes about an hour. Running the program is a rhythm, not an event, and that's the point.

Download the briefing (PDF)

The one-page version — designed to forward to a board, an executive team, or a funder.

Any working email — we’ll send the briefing there. Temporary/disposable addresses aren’t accepted. No spam — unsubscribe anytime.

Where this comes from

Primary sources

We link the law itself, not an article about the law. Every URL below was checked by a human on July 29, 2026.

Statutes and regulations
Research and analysis

Educational briefing, not legal advice. Laws change; check your obligations with counsel. Last verified: July 29, 2026.

See how you’d answer the five questions today

Ten minutes, free, and you’ll know exactly which of them you can’t answer yet.

Take the free scorecard →