Artificial intelligence has moved from research demo to load-bearing infrastructure inside ordinary businesses, and the law has caught up faster than most companies realize. This UpLaw guide maps the whole compliance terrain: the EU AI Act's risk tiers, timelines, and extraterritorial bite; the NIST AI Risk Management Framework that has become the de facto American standard; the algorithmic-discrimination exposure that Title VII, the ADA, and the state bias-audit laws create for every AI hiring tool; the FTC's Section 5 authority over deceptive "AI washing" and unfair deployments; the intellectual-property fault lines running through training data, model output, and inventorship after Thaler; the biometric and privacy constraints that BIPA, the state ADM rights, and GDPR Article 22 impose; and the quiet catastrophe of trade secrets leaking into third-party prompts. It then turns practical, walking through vendor diligence and the contract terms that actually allocate AI risk, transparency and deepfake disclosure duties, evaluation and red-teaming, meaningful human review, and how to build an inventory-and-gates governance program that survives an audit. A running hypothetical -- Meridian Health, a hospital system deploying an AI resume screener and a clinical triage model -- carries the doctrine into the real world. Written for general counsel, compliance officers, product leaders, and litigators who need one map of a field that is still being drawn.