AI security and governance for US enterprises: NIST AI RMF, SOC 2 and the state AI laws
The United States regulates AI state by state and sector by sector, so a US enterprise needs one inventory of its AI that satisfies many readers. Kapālins gives that inventory and proves each AI behaves as approved, against the frameworks US auditors already know.
What changes for the US enterprises, and when.
Texas's Responsible AI Governance Act took effect on 1 January 2026. Colorado's replacement law on automated decision-making takes effect on 1 January 2027, the same day California's CPPA regulations begin to bind businesses that use automated decision-making for significant decisions. NIST is drafting an AI RMF profile for critical infrastructure. US security spend is the largest in the world at roughly US$150 billion in 2026, and AI security is the only segment Gartner shows accelerating through 2030.
- In force
Texas Responsible Artificial Intelligence Governance Act (TRAIGA) in effect. Prohibited uses and disclosure duties for AI systems used in Texas. Source (secondary)
- In force
California CPPA regulations on ADMT, risk assessments and cybersecurity audits took effect. Risk-assessment duties began; ADMT duties follow in 2027. Source
- In force · upcoming
Colorado SB 26-189 (automated decision-making in consequential decisions) takes effect. Repealed and re-enacted SB 24-205; developer documentation duties begin. Source
- In force · upcoming
California ADMT requirements bind businesses making significant decisions with automated tools. Pre-use notices, opt-outs and access rights for automated decision-making. Source
Dates: each entry links to its source. A source marked secondary is a law firm, analyst or vendor summary; check the primary text before relying on the date. The full calendar is on the AI regulation tracker.
Mapped on the platform for the US.
Every framework page says which controls are proved by a live signal from the gateway, probes or device sensor, and which by assessment evidence. Both are exported in the regulator evidence pack.
Hosting and residency.
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon.
Industries and cities.
Questions buyers in the US ask.
Is Kapālins available in the US?
Yes. Kapālins is delivered remotely from Melbourne, Australia, and through partners in the Authorised, Premier and Elite tiers. Organisations in New York, San Francisco Bay Area, Washington DC, Chicago, Dallas–Fort Worth and Houston, Denver, Charlotte are served in the same way: a briefing on your own estate, then onboarding.
Which the US frameworks does the platform map?
NIST AI RMF, NIST SSDF, SOC 2, OWASP LLM Top 10, MITRE ATLAS, ISO/IEC 42001, ISO/IEC 27001. Each framework page lists the controls mapped and whether a control is proved by a live platform signal or by assessment evidence.
Where is our data hosted?
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon.
Does the platform map the state AI laws?
Texas TRAIGA, Colorado's ADMT law and California's CPPA regulations are tracked on the AI regulation tracker with their dates. The controls they require overlap heavily with NIST AI RMF, which the platform maps control by control.