AI in the United States: states legislate, Washington threatens

On 1 July 2026, the federal consumer protection authority (United States · FTC) put a draft policy statement out to consultation: a state law that pushes companies to change the outputs of their AI models would be “impliedly preempted” where it conflicts with federal law. The FTC named Colorado’s AI law. It was responding to a presidential executive order of 11 December 2025 calling for a single national framework. Meanwhile, nearly 2,000 AI bills have been introduced in the states over two years, according to MultiState.

So who sets the rules? As of 29 October 2026, still the states. Federal pre-emption remains a threat, not a rule: Congress has passed no pre-emption law, and the only federal court action, against Colorado’s law, relies on equal protection, not pre-emption.

What is already settled

• California, frontier models (United States (California) · Governor): SB 53, signed on 29 September 2025 and applicable since January 2026, requires large developers to publish their safety framework, opens the reporting of critical safety incidents to the state’s Office of Emergency Services and protects whistleblowers.
• Texas, targeted prohibitions (United States (Texas) · Legislature): HB 149, signed on 22 June 2025 and in force since 1 January 2026, notably bans social scoring by government bodies and intentional discrimination; a disparate impact alone is not enough to prove it. The attorney general alone enforces it, after a 60-day cure period, with fines of up to USD 200,000 per violation.
• Utah, a time-limited law (United States (Utah) · Legislature): a 2025 law pushed back to 1 July 2027 the repeal of its Artificial Intelligence Policy Act.
• New York, the RAISE Act (United States (New York) · Governor): signed in December 2025 and amended in March 2026, it applies to large frontier model developers from 1 January 2027.
• Colorado, the pioneering law rewritten (United States (Colorado) · General Assembly): the 2024 law was replaced by a much narrower text (SB 26-189), signed on 14 May 2026 and applicable from 1 January 2027.
• The moratorium rejected (United States · Senate): on 1 July 2025, the Senate stripped from the big budget bill a ten-year moratorium on enforcing state AI laws, by 99 votes to 1.
• Executive Order 14365 (United States · White House): signed on 11 December 2025, it directs the Department of Justice to set up within 30 days a litigation task force against state AI laws, and the Department of Commerce to publish within 90 days a list of “onerous” laws, and it plans to deprive those states of part of their federal broadband funds. It excludes child safety, compute infrastructure and state procurement from the future pre-emption.

What is still in progress

• The Commerce list (United States · Department of Commerce): due on 11 March 2026, it still had not been published in the Federal Register by 29 October 2026. Yet the deadline set for the communications regulator (United States · FCC) to open its own proceeding only runs from that publication.
• The FTC statement (United States · FTC): consultation closed on 31 July 2026; the text was still a draft as of 29 October 2026.
• Lawsuits (United States · Department of Justice): the litigation task force, set up on 9 January 2026, has not brought a lawsuit of its own. On 24 April 2026, the Department joined xAI’s lawsuit against Colorado’s law, on equal protection grounds. Since 27 April, the state has undertaken before the court not to enforce it until xAI’s motion for a preliminary injunction is decided.
• A federal law (United States · Congress): the FRONTIER Act, introduced on 23 July 2026 by a Republican and a Democratic member, has not gone beyond referral to committee; pre-emption is the sticking point. Inaction remains the default scenario.

The real issue: an executive order does not replace a law

Federal law prevails over state law, but a presidential executive order cannot, on its own, repeal a state law. That takes an Act of Congress, or a federal agency acting within powers Congress has delegated to it, followed by judicial review. Hence the order’s indirect strategy: litigation, federal funding, FTC doctrine.

State legislative momentum did slow in 2026, and Colorado scaled back its law. But pre-emption itself has yet to be built: no list published, no lawsuit brought on pre-emption grounds. And the 99-to-1 vote is a reminder that in 2025 the idea of stopping states from legislating found no majority in the Senate. A company waiting for pre-emption is betting on a text that does not exist.

For a European group, there is also a risk of contradiction. Correcting a model’s biases, as European law and several states require, could be portrayed in Washington as altering outputs. The FTC targets undisclosed changes: documenting and explaining your corrections becomes a safeguard.

Three points of vigilance

1. Deadlines cluster in 2027. Colorado and New York on 1 January, Utah on 1 July unless its law is extended: the states’ calendar moves on while Washington’s stalls.

2. Pre-emption would not erase everything. The order itself excludes three areas. Child protection laws, including those on chatbots, would therefore escape the pre-emption sought by the White House.

3. Definitions diverge. Texas requires intent to discriminate; Colorado’s original law also targeted discriminatory effects; California’s SB 53 only covers frontier model developers. A single application can fall under three logics.

What a European company operating in the United States should do

1. Map its AI uses by state: where users are, which decisions, which models.
2. Classify the applicable laws: frontier model transparency (California, New York), targeted prohibitions (Texas), consequential decisions (Colorado), plus California’s rules on automated decisions.
3. Prepare for 1 January 2027 in Colorado: vendor documentation, notice to individuals, explanation of adverse decisions, human review.
4. Document corrections made to models: which ones, why, and how they are disclosed.
5. Reuse the AI Act compliance file: technical documentation, logging, human oversight, rather than opening a workstream per state.
6. Put pre-emption under watch with a named owner: the Commerce list, FTC doctrine, litigation, Congress.
7. Include adaptation clauses in contracts with model providers, as the laws evolve.

In the United States, the federal AI rule is an intention; state laws are obligations.

The question to ask on Monday morning

To your legal department: “Which state AI laws will apply to our systems on 1 January 2027, and who is tracking federal pre-emption attempts for us?”