US Model: Innovation + Security + Sectoral/State Governance

If the European Union represents one of the clearest examples of comprehensive, rights-oriented AI regulation, the United States presents a very different governance architecture.

The difference is not simply that the United States has “less regulation.”

The more important difference is institutional.

The US approach has developed through a combination of federal legislation, presidential executive action, technical standards, sector-specific regulation, national-security policy, research programmes, procurement rules and state-level legislation.

Instead of one comprehensive federal AI law governing the entire field, multiple institutions participate in AI governance from different directions.

This creates a distributed model.

Its defining characteristics can be summarised as:

Innovation + Security + Standards + Sectoral Governance.

But even this description is incomplete.

By 2025–26, AI governance in the United States increasingly became connected to infrastructure, semiconductors, energy, data centres, national security, export controls and international technology competition.

The result is a governance model in which AI policy is closely connected to the broader question of technological power.

The Historical Foundation

US AI governance did not begin with generative AI.

Federal policy around artificial intelligence developed through research programmes, national-security initiatives, public-sector technology policy and standards development.

The National Artificial Intelligence Initiative Act of 2020 gave the federal government a stronger institutional foundation for AI research, standards and risk management. It directed NIST to support AI standards, testing and risk-mitigation frameworks, while also supporting broader national AI research capacity.

This matters because the American governance model places significant weight on technical institutions.

Rather than beginning with a comprehensive legal classification of every AI system, the US system developed important governance capacity through agencies such as the National Institute of Standards and Technology.

NIST became particularly important because it could translate broad policy objectives into technical frameworks that organisations could actually use.

The NIST AI Risk Management Framework

One of the most influential components of the US approach is the NIST AI Risk Management Framework.

NIST released AI RMF 1.0 on 26 January 2023.

The framework was designed to help organisations manage AI risks and promote trustworthy and responsible AI. Importantly, it was designed as a voluntary, cross-sector and use-case-agnostic framework rather than a binding federal regulation.

Its basic structure is built around four functions:

Govern.

Map.

Measure.

Manage.

The significance of the framework is not simply the terminology.

It represents a particular philosophy of governance.

Instead of attempting to specify every possible AI risk in law, the framework provides organisations with a structured process for identifying, measuring and managing risks throughout the AI lifecycle.

This creates flexibility.

AI technology can change rapidly, while the framework can remain useful across different sectors and applications.

The model also recognises that AI risk management is not purely a technical task.

Organisations need governance structures.

They need to identify risks.

They need measurement and testing.

They need mechanisms for mitigation.

And they need accountability.

This is one reason NIST became such an important actor in the American AI governance ecosystem.

From Voluntary Frameworks to Federal Policy

The voluntary nature of the NIST AI RMF distinguishes it from the European AI Act.

The AI Act creates legally binding obligations for specified categories of AI.

NIST’s framework primarily provides a technical and organisational approach that organisations can voluntarily adopt.

That does not mean the framework is irrelevant to regulation.

Voluntary standards can influence procurement requirements, corporate governance, sectoral regulation, contractual obligations and international standards.

They can also become building blocks for future regulation.

This creates a different path toward governance.

Instead of starting with a law and then developing technical standards to implement it, governance can also develop from technical standards upward.

The two approaches can eventually interact.

This distinction is important for understanding the American model.

US AI governance is often less visible as a single regulatory structure because it is distributed across institutions.

The Role of Executive Action

Presidential executive action has also played an important role.

The Biden administration’s Executive Order 14110 on Safe, Secure, and Trustworthy Artificial Intelligence, issued on 30 October 2023, directed federal agencies to undertake extensive work on AI safety, standards, cybersecurity, privacy, civil rights and government use of AI.

The order was significant because it created a broad federal policy programme without requiring Congress to enact a comprehensive AI law.

However, the policy direction changed after the 2025 presidential transition.

Executive Order 14110 was rescinded on 20 January 2025. NIST records the rescission and notes that the subsequent administration directed a review of actions taken under the earlier order.

This illustrates an important characteristic of executive-driven AI governance.

Executive action can move quickly.

But it can also change when administrations change.

That creates a different form of policy flexibility compared with legislation.

It also raises an institutional question:

How much of AI governance should depend on executive policy, and how much should be embedded in durable law and institutions?

The answer remains contested in the United States.

The 2025 AI Action Plan

The policy direction changed substantially again in 2025.

On 23 July 2025, the White House released “Winning the AI Race: America’s AI Action Plan.”

The plan identified more than 90 federal policy actions under three broad pillars: accelerating innovation, building American AI infrastructure, and leading in international diplomacy and security.

This represented an important shift in the framing of AI policy.

AI governance was increasingly being connected to national competitiveness and strategic capacity.

The policy question was no longer only:

How should AI risks be controlled?

It also became:

How can the United States expand its AI ecosystem?

How can it build the infrastructure required for advanced AI?

How can it maintain technological leadership?

How can it protect national security?

And how can it shape international AI standards and technology markets?

This is where AI governance begins to overlap with industrial policy and geopolitics.

Innovation Becomes a Governance Objective

The American approach places considerable emphasis on innovation.

The objective is not simply to reduce AI risk.

It is also to enable AI development and adoption.

This produces a different regulatory philosophy from a purely precautionary model.

Risk management remains important, but it exists alongside policies designed to accelerate research, investment, infrastructure development and deployment.

This can create tension.

The faster AI systems develop, the more difficult it may become to assess and manage emerging risks.

At the same time, excessive restrictions may affect research, investment or deployment.

The governance challenge is therefore one of balancing multiple objectives.

Safety matters.

Innovation matters.

Economic competitiveness matters.

National security matters.

Scientific research matters.

Public trust matters.

The American system tends to address these objectives through multiple institutions rather than one unified regulatory framework.

AI Governance and National Security

National security is particularly important to understanding the US model.

Artificial intelligence is increasingly treated as a strategic technology with implications for defence, intelligence, cybersecurity and critical infrastructure.

This changes the governance environment.

Some AI capabilities may be governed not primarily as consumer technologies, but as strategic technologies.

The 2025 AI Action Plan explicitly connected AI leadership with national security, infrastructure and international diplomacy. It also called for strengthening the evaluation of national-security risks associated with frontier AI systems.

This means that AI governance in the United States cannot be understood only through civilian regulation.

National-security policy is part of the governance architecture.

That includes questions concerning advanced computing, model capabilities, cybersecurity, military applications, critical infrastructure and technology transfer.

AI Governance Becomes Infrastructure Policy

Another major development is the growing importance of infrastructure.

Advanced AI requires enormous amounts of computing capacity.

Computing requires specialised chips.

Large-scale AI requires data centres.

Data centres require electricity, cooling systems, land, networks and capital.

This means that AI policy increasingly intersects with energy policy, semiconductor policy, infrastructure planning and investment.

The 2025 AI Action Plan placed major emphasis on expanding American AI infrastructure and accelerating the construction of data centres and related energy infrastructure.

This reveals an important evolution.

AI governance is no longer only about governing AI systems after they are developed.

It is also increasingly about governing the conditions under which advanced AI can be developed.

Who has access to computing?

Who can build data centres?

Who supplies advanced chips?

Where can AI infrastructure be located?

How much energy can it consume?

Which technologies can be exported?

Which countries can access advanced AI systems?

These questions increasingly sit alongside traditional AI regulation.

Compute therefore becomes part of governance.

Semiconductors and Export Controls

The same logic applies to semiconductor policy.

Advanced AI depends heavily on sophisticated computing hardware.

The United States has increasingly used export controls and related technology policies as part of its broader strategy toward advanced computing and AI.

This creates an important distinction between conventional technology regulation and strategic technology governance.

A conventional regulatory framework may ask whether an AI system complies with rules.

A national-security framework may ask whether another country should have access to the computing resources necessary to develop that system in the first place.

These are different questions.

Together, however, they shape the global AI landscape.

This is why AI governance increasingly intersects with geopolitics.

The governance of AI is becoming partly the governance of technological capability itself.

NIST and the Standards-Based Approach

While national-security policy operates at one end of the American governance system, technical standards operate at another.

NIST remains deeply involved in AI measurement, evaluation, standards and risk management.

In 2026, NIST was continuing work on the AI RMF while also developing additional profiles and standards-related initiatives. Its AI standards programme explicitly connects technical standards with innovation, public trust and international alignment.

NIST released a concept note in April 2026 for an AI RMF profile focused on trustworthy AI in critical infrastructure. It also continued work on AI evaluation and standards development.

This is important because standards can function as governance infrastructure.

A law may say that an AI system must be secure.

A standard can help define what security means in practice.

A law may require risk management.

A framework can provide a process for identifying and managing risk.

A regulator may require evidence.

Testing methodologies can provide that evidence.

This relationship between law, standards and technical evaluation is becoming increasingly important across the global AI governance landscape.

Sectoral Governance

Another defining feature of the American model is sectoral governance.

Instead of one comprehensive AI regulator overseeing every application, different agencies may regulate AI within their existing areas of authority.

Healthcare, finance, employment, consumer protection, transportation, telecommunications and other sectors can therefore involve different regulatory institutions and legal requirements.

This creates advantages and challenges.

Sector-specific agencies may understand their industries deeply.

They may already possess regulatory expertise and enforcement powers.

But AI systems increasingly cross sectors.

A general-purpose model can be used in healthcare, education, finance and government simultaneously.

This raises a coordination problem.

Which agency should be responsible?

What happens when multiple agencies have overlapping authority?

How should general-purpose models be governed when their downstream uses are difficult to predict?

The rise of foundation models therefore places pressure on traditionally sectoral governance systems.

The State-Level Layer

The American model is also unusual because states play a major role.

US states have increasingly introduced their own AI-related laws, executive actions and regulatory measures.

These may address areas such as automated employment decisions, consumer protection, privacy, deepfakes, algorithmic discrimination and specific uses of AI.

This creates a complex policy landscape.

A company operating across the United States may have to consider federal requirements as well as rules in multiple states.

This is different from the European Union, where the AI Act establishes a common Union-wide regulatory framework while Member States remain responsible for many implementation functions.

The US system can therefore produce regulatory variation across jurisdictions.

This can create policy experimentation.

Different states can test different approaches.

But it can also create compliance complexity.

The relationship between federal and state AI policy is therefore becoming one of the important governance questions in the United States.

The Frontier AI Problem

Generative AI and frontier models have introduced another challenge.

Traditional sectoral regulation is designed around specific applications.

Frontier models are general-purpose.

Their capabilities can be used in many domains.

Their risks can emerge in ways that are difficult to predict before deployment.

This creates a governance gap between model-level development and application-level regulation.

A healthcare regulator may be able to regulate how AI is used in healthcare.

But it may have limited authority over the underlying general-purpose model.

A cybersecurity agency may care about a model’s cyber capabilities.

A national-security institution may care about advanced capabilities.

A consumer regulator may care about deceptive outputs.

The same model can therefore create multiple regulatory interests.

This is one reason frontier AI governance increasingly requires coordination across institutions.

The US model is still evolving around this problem.

From Voluntary Governance to Mixed Governance

The American experience also demonstrates that the distinction between voluntary and mandatory governance is becoming less clear.

NIST’s AI RMF is voluntary.

But companies may adopt it because customers, procurement rules, regulators or internal governance systems expect structured AI risk management.

Similarly, technical standards may begin as voluntary instruments but become influential through contracts, certification, regulation or market expectations.

This creates a layered system.

Not everything needs to be a law to have governance effects.

At the same time, voluntary frameworks cannot necessarily replace legally enforceable rules where significant risks or rights are involved.

The US model therefore increasingly consists of multiple layers:

law,

executive policy,

standards,

technical frameworks,

procurement,

sectoral regulation,

national-security measures,

and state-level governance.

The interaction between these layers is what creates the actual governance system.

The Strength—and Difficulty—of a Distributed Model

A distributed governance model can adapt quickly.

Different agencies can experiment.

Standards organisations can update guidance.

States can respond to emerging problems.

Presidential administrations can change policy direction.

Technical institutions can revise frameworks as technology evolves.

But the same flexibility creates fragmentation.

Different actors may use different definitions.

Rules can overlap.

Responsibilities can become unclear.

Companies may face multiple compliance requirements.

Policy can change with political transitions.

And national-security objectives can sometimes operate under different transparency conditions than civilian regulation.

The American governance model therefore illustrates a fundamental trade-off between flexibility and coherence.

A centralised system can create clearer rules but may be slower to adapt.

A distributed system can adapt through multiple institutions but may create greater complexity.

Neither approach eliminates the underlying governance problem.

The US Model and Global AI Governance

The American approach has consequences far beyond the United States.

The country remains central to global AI research, frontier-model development, semiconductor technology, cloud infrastructure and AI investment.

As a result, US policy can influence global AI development even when it is not formally international law.

American technical standards can become international reference points.

US export controls can affect global access to advanced computing.

US companies’ compliance practices can influence global products.

US AI infrastructure policy can affect international investment.

And US diplomatic initiatives can shape international discussions about AI security and standards.

This creates a form of governance influence that is different from the European regulatory model.

The EU often exercises influence through rules applied to access to its market.

The US can exercise influence through technology, infrastructure, standards, capital, research ecosystems and strategic trade policy.

These are different forms of regulatory and technological power.

Understanding both is essential to understanding global AI governance.

What the US Model Teaches

The American experience reveals several important lessons.

AI governance does not necessarily require a single comprehensive AI law.

Technical standards can become important governance infrastructure.

Risk-management frameworks can help organisations operationalise broad principles.

National-security policy can become a central component of AI governance.

Compute, chips and infrastructure increasingly matter alongside regulation.

Sectoral regulators remain important even as general-purpose models challenge sectoral boundaries.

State-level governance can create experimentation but also fragmentation.

And executive action can accelerate policy development while remaining vulnerable to changes in administration.

Most importantly, the US model demonstrates that AI governance and AI strategy are increasingly connected.

The question is no longer only:

How should AI be regulated?

It is also:

How should a country build and protect the technological ecosystem on which its AI capabilities depend?

This is a major difference in the global AI governance debate.

The European model places stronger emphasis on rights, risk classification and legal obligations.

The US model increasingly connects innovation, infrastructure, national security, technical standards and distributed regulation.

Neither system exists in isolation.

They interact with each other.

Companies operating globally must increasingly navigate both.

International standards attempt to bridge differences.

Governments observe each other’s policies.

And countries developing their own AI governance systems must decide which elements are relevant to their own institutional and economic conditions.

What This Means for Bangladesh

For Bangladesh, the US model offers a different lesson from the European experience.

The important question is not whether Bangladesh should copy American AI policy.

The more useful question is what institutional functions Bangladesh would need.

A functioning AI governance ecosystem could require technical standards capacity, AI risk-management expertise, sector-specific regulatory capability, national research infrastructure, public-sector AI expertise and mechanisms for evaluating advanced AI systems.

This also highlights the importance of infrastructure.

If Bangladesh wants to participate meaningfully in the AI economy, governance cannot be separated completely from computing, data, energy, cybersecurity, skills and research capacity.

AI policy therefore needs to connect with broader technology and development policy.

This is especially relevant for universities.

Universities can contribute not only to AI development but also to standards research, AI assurance, policy analysis, technical evaluation and public-sector capacity building.

For Atlas AI Institute, this creates a potentially valuable research direction:

How should Bangladesh design an AI governance architecture that combines rights protection, risk management, technical standards, sectoral oversight and national development priorities without simply copying either the European or American model?

That is a much more useful question than asking which foreign model Bangladesh should adopt.

The Global Governance Question

The deeper significance of the US model is that it demonstrates another possible path from AI principles toward governance.

The European trajectory can be described broadly as:

Rights → Risk → Law → Institutions → Enforcement.

The American trajectory is more distributed:

Innovation → Standards → Executive Policy → Sectoral Regulation → Security → Infrastructure → State and Federal Governance.

These descriptions are analytical simplifications rather than complete representations of either system.

Both jurisdictions contain elements of the other’s approach.

The EU also has innovation policy and security concerns.

The United States also has rights protections and risk-management frameworks.

But the institutional emphasis differs.

This divergence matters because the future of AI governance may not produce one universal regulatory model.

Instead, different governance systems may coexist and increasingly interact.

The next major question is therefore not simply how Europe and America regulate AI.

It is how other major AI powers have constructed their own governance systems.

China provides a particularly important case because its AI governance combines regulation, state strategy, cybersecurity, industrial policy, technical standards and state capacity in a distinctive institutional environment.

Understanding that model is essential for understanding the geopolitical future of AI governance.