# 19 AI Laws in Two Weeks as Agent Governance Converges > Nineteen AI bills became law across U.S. states in two weeks, Microsoft released an open-source toolkit covering all ten OWASP agentic AI risks, and DARPA announced a program to formalize agent-to-agent communication. The convergence signals that governance infrastructure for AI agents is arriving from multiple directions simultaneously, with enforcement deadlines starting in mid-2026. Content type: article Source URL: https://www.agentpmt.com/articles/19-ai-laws-in-two-weeks-as-agent-governance-converges Markdown URL: https://www.agentpmt.com/articles/19-ai-laws-in-two-weeks-as-agent-governance-converges?format=agent-md Updated: 2026-04-10T06:00:55.893Z Author: Stephanie Goodman Tags: Controlling AI Behavior, AI Agents In Business, AI Powered Infrastructure, Security In AI Systems, News --- # 19 AI Laws in Two Weeks as Agent Governance Converges Nineteen AI bills became law across U.S. states in the two weeks ending April 6, according to Plural Policy's governance tracker. In that same window, Microsoft released an open-source agent governance toolkit covering all ten OWASP agentic AI risk categories, and DARPA announced a new program to formalize the mathematics of agent-to-agent communication. Three separate institutions — state legislatures, a major platform vendor, and a federal research agency — arrived at the same conclusion within days of each other: AI agents need governance infrastructure, and they need it now. The convergence matters less as a coincidence and more as a signal. Agent deployment has reached the stage where legislators, engineers, and researchers are all responding to the same operational reality — autonomous systems are making decisions, spending money, and interacting with people at scale, and the scaffolding to audit, constrain, and verify those systems has [lagged behind](https://www.agentpmt.com/articles/automated-accounting-got-175m-governance-got-nothing). ## The Legislative Sprint The 19 new laws span frontier AI models, chatbot safety, healthcare AI, deepfakes, and education. Utah alone signed eight AI bills in two weeks, covering everything from AI literacy requirements in middle schools to deepfake intimate image bans to expanded oversight for its Office of Artificial Intelligence Policy. Washington state passed four bills, including chatbot transparency requirements and restrictions on AI use in health insurance prior authorizations. Tennessee's SB 1580, which prohibits AI systems from posing as mental health professionals, passed the House 94-0. The breadth is significant. These are not 19 variations of the same bill. They regulate different domains — education, healthcare, consumer protection, content authenticity — through different mechanisms. Some mandate disclosure. Some restrict specific uses. Some create new oversight bodies. The fragmentation reflects how quickly AI governance is splitting into specialized tracks, each with its own enforcement logic and compliance requirements. The bipartisan margins tell their own story. South Carolina's chatbot safety bill, HB 4591, passed the House 114-0. Tennessee's mental health AI restriction cleared with similar unanimity. These are not close votes on contested partisan issues. Legislators across the political spectrum have concluded that certain AI applications — posing as therapists, generating nonconsensual intimate images, making healthcare coverage decisions without physician oversight — require hard limits, and they are not waiting for federal action to set them. Behind the 19 that became law, another 27 bills have passed both chambers and await governor signatures. Over 600 AI bills have been introduced across [state legislatures in 2026](https://www.agentpmt.com/articles/ai-regulation-accelerates-19-state-laws-passed-in-two-weeks) alone. Many states with shorter legislative sessions are racing to finish before adjournment deadlines in mid-April, compressing months of debate into weeks. California alone has more than 25 AI bills in committee, spanning deepfakes, worker protections, and training data transparency. Illinois is advancing packages on AI liability, employment decisions, and frontier model safety. For organizations deploying AI agents across multiple states, the patchwork creates an immediate [compliance challenge](https://www.agentpmt.com/articles/ai-compliance-tools-face-a-state-by-state-regulatory-maze-in-financial-services). An agent operating in healthcare prior authorization in Washington faces different rules than one doing the same work in Kansas or New Hampshire. A chatbot serving minors in Oregon operates under different disclosure and safety requirements than one in South Carolina. The regulatory surface area is expanding faster than most compliance teams can map it. ## New York Sets the Template Among the new laws, New York's RAISE Act stands out as a likely model for other states. Governor Hochul signed it in December 2025, calling it "nation-leading legislation" for frontier AI safety. The framework specifically targets large-scale AI developers — companies with over $500 million in revenue operating at frontier-model scale. The requirements are concrete: publish safety protocols, report incidents of critical harm to the state within 72 hours, and submit annual safety reviews. The 72-hour window mirrors cybersecurity breach notification standards, treating AI safety failures with the same urgency as data breaches. Penalties reach up to $3 million for repeat violations, enforced by the Attorney General. A new oversight office within the Department of Financial Services will assess compliance and issue annual reports. The revenue threshold currently captures the largest AI labs — OpenAI and Anthropic both supported the legislation. But the framework is modular. Other states can adopt the same structure at lower thresholds, extending frontier-model obligations to a broader set of developers. The 72-hour reporting requirement, in particular, creates demand for audit trail infrastructure that can document what an AI system did and when it did it. ## Microsoft Ships Governance Code While legislatures wrote requirements, Microsoft released the tools to implement them. The Agent Governance Toolkit, published April 2 under an MIT license, ships seven packages: Agent OS, Agent Mesh, Agent Runtime, Agent SRE, Agent Compliance, Agent Marketplace, and Agent Lightning. Together they address all ten categories in the [OWASP agentic AI risk framework](https://www.agentpmt.com/articles/the-agentic-ai-security-crisis-is-here-most-organizations-aren-t-ready) — the first open-source toolkit to achieve that coverage. The architecture centers on a stateless policy engine in Agent OS that intercepts every agent action before execution. Imran Siddique, principal group engineering manager at Microsoft, described the design philosophy: "A governance toolkit is only useful if it works with the frameworks people actually use." The toolkit ships production-ready integrations for LangChain, CrewAI, Dify, and LlamaIndex, with published adapters for OpenAI Agents SDK, Haystack, LangGraph, and PydanticAI. It supports Python, TypeScript, Rust, Go, and .NET. Agent Mesh introduces the Inter-Agent Trust Protocol, which assigns dynamic trust scores on a 0-to-1000 scale across five behavioral tiers. Trust decays over time, meaning agents must continuously demonstrate reliable behavior to maintain elevated privileges. The execution model borrows from CPU privilege rings — agents operate within defined execution rings with resource limits, and an automated kill switch can terminate rogue processes. For developers already running agentic AI frameworks in production, the integration path avoids rewrites. LangChain governance works through callback handlers. CrewAI uses task decorators. LlamaIndex's TrustedAgentWorker integration already operates in production workloads. The toolkit layers governance onto existing codebases rather than requiring migration to a new framework. (For a concise overview, see our [summary of the Microsoft toolkit release](https://www.agentpmt.com/articles/microsoft-open-sources-ai-agent-governance-toolkit).) This is developer infrastructure — runtime-level policy enforcement on individual agent actions. Organizations that need governance at the operational layer, managing budgets, defining agent workflows, controlling tool access across business processes, and maintaining audit trails for compliance, need a platform built for that scope. AgentPMT provides that operational layer: marketplace access, [payment rails](https://www.agentpmt.com/agent-payments) with per-agent budget controls, workflow orchestration, and full audit logging of every agent interaction. Runtime governance and operational governance are complementary. One enforces safe execution; the other ensures the business logic around those executions is accountable. ## DARPA Formalizes Agent Communication DARPA's MATHBAC program, announced April 8, approaches agent governance from a research angle. The Mathematics of Boosting Agentic Communication program offers up to $2 million per Phase I award over a 34-month timeline, with proposals due June 16 and work starting September 2026. The program aims to develop foundational mathematics, systems theory, and information theory for autonomous agent communication — specifically, enabling agents to extract and share what DARPA calls "compact, generalizable nuggets" of scientific knowledge. Phase II directs researchers to build AI tools where agents self-evolve their communication protocols. DARPA cited rediscovering the periodic table from atomic data as an aspirational benchmark for the kind of structured reasoning it expects. The agency explicitly rejects incremental proposals. Existing agent communication approaches — ad hoc prompt chains, API calls between models, loosely structured multi-agent conversations — are insufficient for the autonomous collaboration DARPA envisions. The program wants researchers to produce new mathematical frameworks, not refinements of existing ones. Formalizing how agents talk to each other is now a funded national security research priority. That has downstream implications for governance: if multi-agent systems are going to operate with the kind of autonomy DARPA describes, the protocols governing agent-to-agent interaction will need to integrate with the same governance frameworks that legislatures and developers are building today. An agent that can autonomously evolve its communication strategy also needs verifiable constraints on what it can agree to, what it can share, and what actions it can commit to on behalf of a human principal. ## Enforcement Dates Are Set The legislative, technical, and research tracks are converging on a compressed timeline. Colorado's AI Act takes effect in June 2026. The EU AI Act's first enforcement provisions begin in August 2026. New York's RAISE Act requires compliance by January 2027. Each deadline carries specific obligations — disclosure requirements, safety documentation, incident reporting — that organizations deploying agents need [infrastructure to meet](https://www.agentpmt.com/articles/government-and-enterprise-mcp-adoption-when-compliance-sets-the-clock). Microsoft's toolkit gives developers open-source building blocks for runtime safety. State laws give compliance teams specific requirements to implement. DARPA's program signals that even the foundational science of agent communication is being formalized with public funding. The practical consequence is that organizations deploying AI agents now face governance requirements at multiple layers simultaneously. At the code level, runtime policy enforcement. At the business level, audit trails, [budget controls](https://www.agentpmt.com/articles/budget-ai-agents-like-cloud-not-like-headcount), and human oversight mechanisms. At the regulatory level, disclosure obligations, incident reporting windows, and annual reviews. No single tool covers all three layers, and the organizations that wait for a single solution will find themselves out of compliance before one arrives. What happened in the first week of April was a measurable closing of the gap between how fast organizations deploy agents and how slowly governance has followed. The tools exist. The deadlines are set. The compliance surface is expanding week by week as more states approach adjournment. The remaining question for organizations running agentic AI systems in production is whether they build governance into their agent operations before enforcement begins — or scramble to retrofit it after. * * * ## Sources - "AI Governance Watch: Nineteen New AI Bills Passed Into Law" — Plural Policy - "Introducing the Agent Governance Toolkit" — Microsoft Open Source Blog - "Microsoft's new agent governance toolkit targets top OWASP risks for AI agents" — InfoWorld - "Microsoft AI agent governance toolkit" — Help Net Security - "DARPA grants for AI-to-AI communication" — The Register - "Governor Hochul Signs Nation-Leading Legislation" — Office of the Governor of New York - "AI Legislative Update April 2026" — Transparency Coalition - "Hochul enacts New York's AI safety and transparency bill" — IAPP