As of mid-2026, US enterprises do not need new federal AI legislation to be exposed on AI governance; AI-touching workflows already fall under HIPAA Security Rule access and audit controls (45 CFR 164.312), GLBA Safeguards Rule (16 CFR Part 314) access-control and incident-notification obligations, SEC cyber-disclosure rules (Item 106 of Regulation S-K and Item 1.05 of Form 8-K, with the 4-business-day materiality clock), and FTC Section 5 deception and unfairness jurisdiction at the data layer. The structural pattern, captured in the UK ICO's May 2026 'AI-powered cyber threats' guidance and the seven threat categories it names, is that AI governance has become data governance; the most common 2026 implementation gap is the fragmented audit log (Kiteworks 2026 Forecast: 33% lack audit trails entirely, 61% have fragmented logs), not the absence of regulation.

Claim is scoped to the US-framework reading of AI workflow exposure in 2026 enterprises. Does not assert that no new AI-specific US legislation is desirable; asserts that the existing rule sets already cover the threat surface at the data layer, that the implementation gap is in audit evidence and runtime containment rather than in rule text, and that the four-move CIO playbook (classify AI access as data access, unify audit log, close containment gap, apply purpose binding) is operationally tractable in a single procurement and audit cycle. 90-day review cadence calibrated to regulatory rather than security-advisory pace. Trigger conditions: (1) US federal AI legislation passes or reaches near-passage at a level that materially changes the analysis — would move toward Partial; (2) a court ruling materially narrows the applicability of HIPAA, GLBA, SEC cyber-disclosure rules, or FTC Section 5 to AI systems specifically — would move toward Partial or Not holding depending on direction; (3) a published 2026 FTC, SEC, HHS OCR, or state-attorney-general enforcement action explicitly invoking one of these frameworks against AI-specific conduct — would confirm operational reading and strengthen case; (4) NIST AI RMF, ISO 42001, or HHS OCR publishes specific AI-adjacent implementation guidance under the existing rule sets — would harden the operational answer to the rule-text-without-implementation-guidance gap; (5) the ICO's seven-category threat framing appears verbatim or near-verbatim in a US enforcement action or state-attorney-general consent decree — would confirm the cross-border framing-adoption pattern this piece anchors on.