Distributes a software product, in the United States

15 U.S.C. 1052(a) · Read the law's page

• Do not expect to register on the principal register a name, logo, or other mark that consists of or comprises matter which may falsely suggest a connection with persons, living or dead, institutions, beliefs, or national symbols (s. 1052(a)); this is a ground for refusing registration, not a rule against using the mark.

17 U.S.C. § 102 · Read the law's page

• Treat an original work of authorship fixed in a tangible medium of expression, in one of the listed categories such as literary works, as protected by copyright (s. 102(a)).
• Do not assume that copyright in a computer program protects an idea, procedure, process, system, method of operation, concept, principle or discovery it embodies, in whatever form it is described, explained, illustrated or embodied (s. 102(b)).
• Read section 102(b) for a computer program as the House report does: the expression the programmer adopted is the copyrightable element, and the actual processes or methods the program embodies are outside the scope of the copyright law.

17 U.S.C. §§ 105, 302 and 511 · Read the law's page

• Do not assume you need the Government's permission to reproduce a work of the United States Government: copyright protection under title 17 is not available for it (s. 105(a)).
• Get permission from the owner before you reproduce a copyright that the United States Government holds by transfer, whether by assignment, bequest, or otherwise (s. 105(a)).
• Treat the covered author, not the Government, as the owner of the copyright in a literary work produced by a civilian faculty member of a covered institution in the course of employment there for publication by a scholarly press or journal (s. 105(b), (d)).
• Count a work created on or after January 1, 1978 as protected for the life of the author and 70 years after the author's death, and a joint work not made for hire for the life of the last surviving author and 70 years after that author's death (s. 302(a), (b)).
• Count an anonymous work, a pseudonymous work, or a work made for hire as protected for 95 years from the year of its first publication or 120 years from the year of its creation, whichever expires first (s. 302(c)).
• Do not rely on section 511(a) to sue a State or State instrumentality for infringement: the Supreme Court held that Congress lacked authority to abrogate the States' immunity from copyright infringement suits in the Copyright Remedy Clarification Act (Allen v. Cooper (2020)).

17 U.S.C. §§ 106 and 501 · Read the law's page

• Get the copyright owner's permission before you reproduce a copyrighted work in copies or phonorecords, prepare a derivative work based on it, or distribute copies or phonorecords of it to the public by sale or other transfer of ownership, or by rental, lease, or lending, unless sections 107 through 122 allow the use (s. 106(1) to (3)).
• Get the copyright owner's permission before you publicly perform or publicly display a work of a kind clauses (4) and (5) of section 106 name, or publicly perform a sound recording by means of a digital audio transmission, unless sections 107 through 122 allow the use (s. 106(4) to (6)).
• Treat transmitting or otherwise communicating a performance or display of a work to the public by any device or process as performing or displaying it publicly, whether the recipients receive it in the same place or in separate places and at the same time or at different times (s. 101).
• Do not violate any of the exclusive rights provided by sections 106 through 122, or import copies or phonorecords into the United States in violation of section 602: anyone who does is an infringer, including a State, a State instrumentality, and a State officer or employee acting in an official capacity (s. 501(a)).
• Do not induce or encourage users to infringe, and do not profit from their infringement while declining to exercise a right to stop or limit it: the Supreme Court describes the first as contributory infringement and the second as vicarious infringement (MGM Studios v. Grokster, 545 U.S. 913 (2005)).

17 U.S.C. §§ 109 and 117 · Read the law's page

• You may sell or otherwise dispose of the possession of a particular copy or phonorecord you own that was lawfully made under title 17 without the copyright owner's authority; this does not extend, unless the copyright owner authorizes it, to a person who acquired possession from the copyright owner by rental, lease, loan or otherwise without acquiring ownership of it (s. 109(a) and (d)).
• Do not dispose of the possession of a copy of a computer program by rental, lease or lending, or by any act in the nature of rental, lease or lending, for direct or indirect commercial advantage unless the owner of copyright in the program authorizes it (s. 109(b)(1)(A)).
• That rental limit does not reach a program embodied in a machine or product that cannot be copied during its ordinary operation or use, a program in a limited purpose computer designed for playing video games, or lending for nonprofit purposes by a nonprofit library that affixes the prescribed copyright warning to each copy (s. 109(b)(1)(B) and (2)(A)).
• You may make another copy or adaptation of a computer program you own a copy of, without infringing, only as an essential step in using the program with a machine and for no other use, or for archival purposes only, and you must destroy all archival copies if continued possession of the program ceases to be rightful (s. 117(a)).
• Transfer exact copies made under section 117 only along with the copy they were made from and only as part of the transfer of all rights in the program, and transfer adaptations made under it only with the copyright owner's authorization (s. 117(b)).
• The owner or lessee of a machine may make a copy of a program solely by virtue of activating the machine that lawfully contains an authorized copy, for maintenance or repair of that machine only, if the copy is used in no other manner, is destroyed immediately after the maintenance or repair is completed, and any part of the program not necessary to activate the machine is not accessed or used other than to make the copy (s. 117(c)).

25 U.S.C. 305e · Read the law's page

• Do not, directly or indirectly, offer or display for sale or sell a good, with or without a Government trademark, in a manner that falsely suggests it is Indian produced, an Indian product, or the product of a particular Indian or Indian tribe or Indian arts and crafts organization, resident within the United States (s. 305e(b)).

47 U.S.C. 617 and 618; 47 CFR 14.1 to 14.38 · Read the law's page

• If you manufacture equipment used for advanced communications services (end user equipment, network equipment or software) and offer it for sale or distribute it in interstate commerce, make it accessible to and usable by individuals with disabilities, unless that is not achievable (47 U.S.C. 617(a)(1); 47 CFR 14.20(a)(1)).
• If you provide an advanced communications service (non-interconnected VoIP, electronic messaging, interoperable video conferencing, inmate audio or video communications, or interconnected VoIP not already subject to section 255 on October 7, 2010), make the service accessible to and usable by individuals with disabilities, unless that is not achievable (47 U.S.C. 617(b)(1); 47 CFR 14.20(a)(2) and 14.2(c)).
• Where accessibility is not achievable by building it in or by using third-party accessibility solutions available to the consumer at nominal cost, make the equipment or service compatible with existing peripheral devices or specialized customer premises equipment commonly used by individuals with disabilities, unless that is not achievable (47 CFR 14.20(a)(3)).
• As a provider, do not install network features, functions or capabilities that impede accessibility or usability, and do not impair the accessibility of content that already has accessibility built in (47 CFR 14.20(a)(4) and (5)).
• Consider the performance objectives of 47 CFR 14.21 at the design stage and identify barriers to accessibility and usability during evaluation (47 CFR 14.20(b)), and pass through the industry-standard codes and formats needed to deliver the service in an accessible format, if achievable (47 CFR 14.20(c)).
• Make the information and documentation you give customers accessible, if achievable, including bills, user guides and installation guides, and let individuals with disabilities reach call centers and customer support at no extra cost (47 CFR 14.20(d)).
• From January 12, 2027, an interoperable video conferencing service must provide at least one mode with accurate, synchronous captions and let users connect third-party captioning, enable third-party sign language interpretation, and provide user controls for captions, speakers and signers (47 CFR 14.21(b)(2)(iv) and (b)(4)).
• Keep records of your accessibility efforts and sign and file an annual compliance certificate with the Commission (47 CFR 14.31).
• The rules do not reach customized equipment or services not offered directly to the public (47 CFR 14.3), or a person that only transmits third-party communications or provides an information location tool, unless it relies on third-party solutions to comply (47 CFR 14.2); the Commission may waive them for multipurpose equipment and services designed primarily for other purposes (47 CFR 14.5).

47 U.S.C. 619; 47 CFR 14.60 and 14.61 · Read the law's page

• If you manufacture a telephone used with public mobile services that includes an Internet browser, or you are a mobile service provider that arranges for a browser to be included in telephones you sell to customers, make the browser's functions, including the ability to launch it, accessible to and usable by individuals who are blind or have a visual impairment, unless that is not achievable (47 U.S.C. 619(a); 47 CFR 14.61(a)).
• The duty reaches only the browser you include or arrange to include; it does not require you to make other browsers, or Internet content, applications or services, accessible, other than enabling individuals with disabilities to use the included browser to reach them (47 CFR 14.61(a)(1) and (2)).
• Consider the performance objectives that 47 CFR 14.60(b) makes applicable at the design stage, and make the information and documentation you give customers accessible, if achievable (47 CFR 14.60(b)(3) and (4)).

21 U.S.C. § 360j(o), read with 21 U.S.C. § 321(h) · Read the law's page

• This provision sets no duty of its own: it removes five kinds of software function from the definition of device in section 201(h), and a software function that meets the definition and falls outside those exclusions is a device under the Federal Food, Drug, and Cosmetic Act.
• Treat a software function as a device if it is intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, or to affect the structure or any function of the body, and it meets none of the exclusions in section 520(o)(1) (administrative support of a health care facility, maintaining or encouraging a healthy lifestyle unrelated to disease, electronic patient records, displaying clinical laboratory test or other device data and results, and clinical decision support).
• Do not rely on the clinical decision support exclusion if the function is intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system, or if it is not intended to let the health care professional independently review the basis for its recommendations so that the professional does not rely primarily on them to make a clinical diagnosis or treatment decision regarding an individual patient.
• Treat a software function described in section 520(o)(1)(C), (D), or (E) as a device from the date a final order of the Secretary identifies it, after notice in the Federal Register and at least 30 calendar days for public comment, on a finding that its use would be reasonably likely to have serious adverse health consequences.
• If you are required to register and propose to begin introducing a software function that is a device into interstate commerce for commercial distribution, report to the Secretary or an accredited person at least ninety days beforehand the class in which the device is classified and the action you took to comply with the requirements of section 514 or 515 that apply to it (section 510(k)).
• If your software function is a class III device that requires premarket approval, hold an approved application for premarket approval under section 515 before you market it, unless it is exempt under section 520(g).
• Do not introduce or deliver for introduction into interstate commerce a device that is adulterated or misbranded, and do not adulterate or misbrand a device in interstate commerce (section 301(a) and (b)).

Federal Food, Drug, and Cosmetic Act section 524B, 21 U.S.C. 360n-2 · Read the law's page

• It reaches you only if you are the sponsor of an application or submission for a device under section 360(k), 360c, 360e(c), 360e(f) or 360j(m) of title 21 (the Food and Drug Administration reads these as a 510(k), De Novo, premarket approval, product development protocol or humanitarian device exemption submission), and the device is a cyber device: a device that includes software validated, installed, or authorized by the sponsor as a device or in a device, has the ability to connect to the internet, and contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats (section 524B(a) and (c)).
• Include in the submission such information as the Secretary may require to ensure that the cyber device meets the cybersecurity requirements of section 524B(b) (section 524B(a)).
• Submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures (section 524B(b)(1)).
• Design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems that address known unacceptable vulnerabilities on a reasonably justified regular cycle and critical vulnerabilities that could cause uncontrolled risks as soon as possible out of cycle (section 524B(b)(2), (A) and (B)).
• Provide to the Secretary a software bill of materials, including commercial, open-source, and off-the-shelf software components (section 524B(b)(3)).
• Comply with such other requirements as the Secretary may require through regulation to demonstrate reasonable assurance that the device and related systems are cybersecure (section 524B(b)(4)).
• A device, or a category or type of device, that the Secretary has identified as exempt is not subject to these requirements (section 524B(d)).

15 C.F.R. 744.11; Supp. No. 4 to part 744 · Read the law's page

• Before you export, reexport or transfer any item subject to the EAR, software included, check whether a party to the transaction is on the Entity List or uses an address the list identifies as a high diversion risk, and obtain the license the entry requires (15 C.F.R. 744.11(a); 748.5(c) to (f)).
• Do not use a license exception for a transaction with a listed party unless the Entity List entry allows it, and do not proceed with a transaction BIS has informed you needs a license because of a circumvention, agent, front or shell company risk (15 C.F.R. 744.11(a), (c)).
• Check whether a foreign entity you deal with is owned 50 percent or more by one or more listed entities; the extension in 15 C.F.R. 744.11(a)(1) is stayed until November 9, 2026, as the eCFR's Effective Date Note records.

15 C.F.R. 744.21 · Read the law's page

• Before you export, reexport or transfer an item listed in Supplement No. 2 to part 744, or any item subject to the EAR where the end use or end user is in Belarus or Russia, find out whether you have knowledge that it is intended for a military end use or a military end user, and get a license if you do (15 C.F.R. 744.21(a); 772.1).
• Do not proceed with an export, reexport or transfer that BIS has informed you needs a license because of an unacceptable risk of use in or diversion to a military end use or end user in Belarus, Burma, Cambodia, China, Nicaragua, Russia or Venezuela (15 C.F.R. 744.21(b)).

H.R. 10362, 119th Congress · Read the law's page

• If it is enacted and you contract to supply or deploy AI agents for a federal agency under a contract entered into after enactment, maintain a continuous, machine-readable inventory of the AI agents deployed under the contract, using standardized, vendor-agnostic naming conventions (Section 2(b)(2)(A) and (4)).
• Implement AI agent identity verification mechanisms that are cryptographically verifiable at both the network and application layers (Section 2(b)(2)(B)).
• Make AI agent discovery and verification capabilities accessible to the agency without reliance on you, and enable the agency to allow, deny, or constrain AI agent-to-AI agent and AI agent-to-information system interactions (Section 2(b)(2)(C) and (D)).
• Enable the agency to provide cryptographically verifiable provenance information to authorized entities interacting with the AI agent, and generate tamper-evident, standardized logs of material AI agent actions that are portable and accessible to the agency (Section 2(b)(2)(E) and (F)).
• If you supply an information system that AI agents interact with under a contract entered into after enactment, maintain an inventory of the AI agents that interact with it and implement cryptographically verifiable identity and provenance verification for them (Section 2(b)(3)(A) to (C)).
• The standards NIST would publish provide that organizations deploying AI agents maintain a continuous, machine-readable inventory of all AI agents and do not rely solely on self-attested or single-provider assertions to establish an AI agent's identity (Section 2(a)(4)).
• This is a bill introduced on September 14, 2026 and referred to committee, so it binds no one unless it is enacted; as introduced its standards, rulemaking and guidance duties fall on the National Institute of Standards and Technology, the Federal Acquisition Regulatory Council and OMB, and it would reach a contractor through revised Federal Acquisition Regulation contract terms (Section 2).

H.R. 3460, 119th Congress · Read the law's page

• Do not discharge, demote, suspend, threaten, blacklist, harass, or otherwise discriminate against an employee or independent contractor, current or former, in the terms and conditions of employment or work, because of a lawful act in reporting an AI security vulnerability or AI violation, or conduct the person reasonably believes is one (Section 3(a)).
• Treat as protected a report to the appropriate regulatory official, the Attorney General, a regulatory or law enforcement agency, a Member or committee of Congress, a person with supervisory authority at the employer, or another individual at the employer whom the person reasonably believes can investigate or stop the misconduct, and the person's part in an investigation or action based on it (Section 3(a)(1) to (3)).
• Treat an AI violation as any violation of Federal law related to or committed during the development, deployment, or use of artificial intelligence, or a failure to respond appropriately to a substantial and specific danger that artificial intelligence may pose to public safety, public health, or national security (Section 2(2)).
• Treat an AI security vulnerability as any failure or lapse in security that could potentially allow emerging artificial intelligence technology to be acquired by a person, including a foreign entity, by theft or other means (Section 2(1)).
• Do not use a contract, agreement, policy form, or condition of employment, including a requirement to arbitrate or mediate first, to waive or alter the whistleblower's rights and remedies (Section 3(c)).

45 CFR § 170.315(b)(11), as amended by 91 FR 67916 (Oct. 28, 2026) · Read the law's page

• This criterion binds a health IT developer whose Health IT Module is certified to it, in a program of voluntary certification of health IT.
• Enable a limited set of identified users to select, meaning activate, electronic decision support interventions that are evidence-based decision support interventions using the listed data, or predictive decision support interventions using that data together with Clinical Notes and Assessment and Plan of Treatment data.
• Enable interventions to be configured by a limited set of identified users based on a user's role.
• Enable a user to provide electronic feedback data for evidence-based decision support interventions, and make that feedback data available to a limited set of identified users for export in a computable format.
• Provide interventions to a user while the user is interacting with the technology.
• Update a Health IT Module certified to a revised certification criterion, and provide the update to your customers, in accordance with the dates identified for each revised certification criterion.