The United States still has no comprehensive federal law governing artificial intelligence, and as of September 2026, that gap has become the defining story in American tech policy. A new analysis published August 31, 2026 by law firm Spencer Fane, titled “When the Models Move Faster Than the Rules — Inside America’s AI Policy Crisis,” lays out what it calls a structural mismatch: frontier AI systems now capable of autonomous, offensive operations against real-world targets are advancing faster than the institutions meant to govern them. Congress has not passed a cross-sector AI law. The White House has issued executive orders and frameworks that carry no binding force. And in the vacuum, at least 29 states have enacted their own AI statutes, according to TechPolicy Press, creating a compliance map that shifts depending on which state line a company’s AI system crosses.
This is not a hypothetical concern for software teams and product leaders. It is an operational one. Engineers building AI-powered products in 2026 now have to track obligations in California, Texas, Colorado, Illinois and dozens of other states simultaneously, while federal agencies signal — but have not delivered — a plan to simplify that picture. Here is what actually happened, what it means for the industry, and where the fight over who regulates AI in America goes next.
The AI Policy Gap, Defined
The stakes go beyond compliance paperwork. National-security officials have separately warned that data flowing into rival AI systems overseas is itself a policy blind spot, underscoring how far behind the rulebook has fallen. The core problem described in the Spencer Fane analysis and echoed across legal commentary from Baker Botts, Mintz, Morgan Lewis and the National Law Review is straightforward: model capability curves and legislative timelines move at completely different speeds. A frontier model can go from research paper to public deployment in months. A federal statute, by contrast, needs to clear committee votes, floor debate, reconciliation between House and Senate versions, and a presidential signature — a process that has consistently taken years for tech policy in the current Congress.
Unlike the European Union, which finalized its comprehensive AI Act, the United States has relied on a patchwork built from state privacy law, consumer protection statutes, and antitrust enforcement rather than AI-specific federal legislation, according to Reuters’ legal industry desk. The only standalone federal statute that substantively regulates AI systems is the TAKE IT DOWN Act, signed May 19, 2025, and effective May 19, 2026, which requires platforms to remove non-consensual intimate imagery — including AI-generated deepfakes — under FTC enforcement. It is narrow by design, covering one harm category rather than AI systems broadly.
That narrowness is the crux of the crisis framing. Everything from AI-driven hiring decisions to frontier model safety testing to AI-generated financial advice currently falls outside any dedicated federal AI statute, leaving those questions to a mix of state legislatures, agency enforcement discretion, and litigation.
How the US Got Here: A 2025-2026 Timeline
The regulatory whiplash of the past 18 months explains much of the current confusion. On January 20, 2025, President Trump revoked President Biden’s Executive Order 14110, the prior administration’s central AI safety directive, stripping out several testing and reporting requirements that had applied to frontier model developers. For most of 2025, the federal government operated without a replacement framework, and states used the opening to move fast.
By December 11, 2025, the administration signed a new executive order on “Ensuring a National Policy Framework for Artificial Intelligence.” The order set up a Department of Justice AI Litigation Task Force within 30 days, tasked specifically with challenging state AI laws the administration considers inconsistent with federal policy — including an explicit reference to Colorado’s AI Act, according to Baker Botts’ analysis. On March 20, 2026, the White House followed up with a National Policy Framework for Artificial Intelligence, a nonbinding blueprint pushing federal preemption of state AI rules deemed burdensome to innovation. The White House itself argues that “state-by-state regulation by definition creates a patchwork of 50 different regulatory regimes that makes compliance more challenging, particularly for start-ups,” according to a White House presidential action on the matter.
None of this, notably, amounts to enacted law. Executive orders and policy frameworks cannot override state statutes on their own — that requires congressional preemption legislation, which as of late August 2026 has not passed, according to Cloud Security Alliance research on AI governance fragmentation. Morgan Lewis captured the dynamic in an April 2, 2026 analysis titled “AI Enforcement Accelerates as Federal Policy Stalls and States Step In,” concluding that federal enforcement is still leaning on existing consumer protection and antitrust law while states move aggressively with AI-specific statutes, attorney general investigations and multistate actions.
States Fill the Vacuum — and the Patchwork Multiplies
With no federal ceiling in place, state legislatures have not waited around. Cloud Security Alliance research found that by May 2026, lawmakers across the country had introduced more than 2,182 AI-related bills, with inconsistent definitions of “AI system,” different audit timelines, and non-uniform enforcement mechanisms. TechPolicy Press’s mid-2026 survey, “Where State AI Legislation Stands Half Way Into 2026,” puts the number of states with enacted AI legislation at 29 and climbing, spanning employment decisions, biometric data, and high-risk automated decision-making.
For a national software company, this means the same AI feature can trigger four different compliance obligations depending on where a user is located. California’s frontier AI framework, Texas’s broad developer-and-deployer statute, Colorado’s high-risk-system disclosure regime, and Illinois’s employment-specific law do not share a common definition of what counts as a “high-risk” AI decision, let alone a common audit or disclosure format. The U.S. Chamber of Commerce has argued plainly that “the U.S. needs federal AI regulation to prevent a costly patchwork of conflicting state laws that burden businesses and threaten American innovation leadership,” in a Chamber analysis of the compliance costs involved.
The State AI Law Patchwork: What’s Actually on the Books
The table below summarizes the major state AI statutes now in force or scheduled to take effect, based on Baker Botts and Mintz legal tracking published through August 2026.
| State | Law | Effective Date | Who It Covers | Penalty |
|---|---|---|---|---|
| California | SB 53 (Frontier AI Framework) | Jan 1, 2026 | Developers with over $500M revenue building models above 10^26 FLOPs | Up to $1M per violation |
| Texas | TRAIGA | Jan 1, 2026 | Any AI developer or deployer reaching Texas residents | AG enforcement action |
| Colorado | SB 24-205 (Colorado AI Act) | June 30, 2026 | High-risk AI systems used in consequential decisions | Up to $20,000 per violation |
| Illinois | HB 3773 | Jan 1, 2026 | Employers using AI in employment decisions | Private right of action |
| Illinois | SB 315 (AI Safety Measures Act) | Jan 1, 2027 | Frontier AI model developers | First state-mandated annual third-party audits |
| California | SB 942 (AI Transparency Act) | Aug 2, 2026 | Generative AI providers | Watermarking and disclosure requirements |
Illinois’s SB 315 stands out in this list: Mintz’s “AI: Washington Report” for July 2026 flags it as the first state law requiring annual independent third-party audits of frontier AI models, a compliance obligation with no federal equivalent. California’s SB 942, enacted August 2, 2026, adds watermarking and latent-disclosure requirements for generative AI content on top of the state’s earlier frontier-model framework, further deepening California’s regulatory footprint just as the federal preemption push intensifies.
Trump’s Executive Order and the Preemption Fight
The administration’s strategy rests on the argument that a state-by-state approach to AI governance is untenable for companies trying to scale nationally. The White House’s National Policy Framework for Artificial Intelligence, released March 20, 2026, warns that “a patchwork of conflicting state laws would undermine American innovation and our ability to lead in the global A.I. race.” Morgan Lewis’s analysis of the framework describes it as putting “federal preemption at the center of the debate,” noting that the document argues a fragmented landscape of state AI laws risks undermining innovation, competitiveness and national policy coherence, according to the firm’s March 2026 client alert.
The mechanism the administration has chosen is not new legislation but litigation. The DOJ’s AI Litigation Task Force, created within 30 days of the December 2025 executive order, exists specifically to challenge state AI statutes the administration views as inconsistent with federal policy, using interstate commerce and preemption arguments. By mid-2026, legal analysts described this task-force-driven approach as a major source of uncertainty for enterprises, since it directly targets comprehensive state regimes — like Colorado’s — that had only just come into force.
Crucially, none of this displaces state law automatically. Reuters’ August 12, 2026 legal industry coverage advised companies to keep complying with existing state AI statutes, noting that without an actual act of Congress expressly preempting state AI law, executive branch action alone is unlikely to override state regimes already in effect.
The Obernolte-Trahan Bill: A Three-Year Freeze on States
The most concrete legislative vehicle so far is a bipartisan draft framework released June 4, 2026 by Rep. Jay Obernolte (R-Calif.) and Rep. Lori Trahan (D-Mass.). The draft would bar states from regulating AI model development for a period of three years and would codify the Commerce Department’s Center for AI Standards and Innovation — the office rebranded in 2025 from the original AI Safety Institute — as the central federal body for frontier AI governance and testing coordination.
Reuters reported the draft has drawn praise from major tech firms eager for regulatory clarity and pushback from consumer advocates who see it as premature. Brad Carson, president of the Algorithmic Responsibility Institute, criticized the approach directly, arguing it would be “turning the current floor on state AI legislation into a federal ceiling” and would prevent state lawmakers from addressing emerging AI harms during a period of rapid technological change. That tension — state laws as a protective floor versus a restrictive ceiling — is the single sharpest disagreement running through the entire 2026 AI policy debate.
As of this writing, the Obernolte-Trahan framework remains a draft. It has not been formally introduced as a bill with a floor vote scheduled, and Congress has already rejected broader AI preemption language in earlier vehicles, including provisions once attached to the National Defense Authorization Act discussions, according to Cloud Security Alliance’s governance tracking.
Federal Policy Timeline: The Full 2025-2026 Sequence
| Date | Event | Significance |
|---|---|---|
| Jan 20, 2025 | Trump revokes Biden’s Executive Order 14110 | Removes prior federal AI safety testing requirements |
| 2025 | AI Safety Institute rebranded | Becomes the Center for AI Standards and Innovation under Commerce |
| Dec 11, 2025 | Executive order on a National Policy Framework for AI | Creates DOJ AI Litigation Task Force within 30 days |
| Jan 2026 | DOJ AI-focused Task Force stood up | Targets state AI laws viewed as inconsistent with federal policy |
| Mar 20, 2026 | White House National Policy Framework for AI released | Nonbinding blueprint favoring federal preemption |
| Apr 2, 2026 | Morgan Lewis: “AI Enforcement Accelerates as Federal Policy Stalls” | Confirms no comprehensive federal statute enacted |
| May 19, 2026 | TAKE IT DOWN Act takes effect | Only standalone federal AI-specific statute in force |
| Jun 4, 2026 | Obernolte-Trahan bipartisan draft released | Proposes 3-year freeze on state AI model-development rules |
| Jul 2026 | FTC proposes AI accuracy policy | Tests AI “steering” against Section 5 deceptive-practices standard |
| Aug 2, 2026 | California AI Transparency Act (SB 942) enacted | Adds watermarking, disclosure duties for generative AI |
| Aug 31, 2026 | Spencer Fane publishes policy-gap analysis | Frames capability-governance mismatch as a structural crisis |
The Center for AI Standards and Innovation: A Quiet Rebrand
One of the least-covered but most consequential shifts of the past year has been the transformation of the federal government’s flagship AI safety body. The AI Safety Institute, established under Commerce during the Biden administration, was rebranded in 2025 as the Center for AI Standards and Innovation. The name change signals a shift in mission: from a body focused on binding safety testing norms to one oriented toward voluntary standards and innovation support.
The Obernolte-Trahan draft would give this office a formal statutory basis, but even its supporters describe its current role as guidance and coordination rather than enforcement. National Law Review’s federal policy tracking notes that Commerce’s evaluation work on frontier models remains partially stalled relative to the pace of AI deployment — there is, at this point, no mandatory, government-run testing regime for frontier models comparable to FDA drug approval or FAA aircraft certification, a gap Spencer Fane’s analysis singles out directly. That absence of binding testing standards is one reason recent frontier-model disclosures from labs like Anthropic have drawn scrutiny with no dedicated federal review process to evaluate them.
Agencies Try to Patch the Gaps: FTC, DOJ, FCC
In the absence of new legislation, federal agencies have leaned on existing authority. In July 2026, the FTC proposed a new policy position on AI accuracy: if a company steers its AI system toward outputs that serve goals other than what the user reasonably expects, and conceals how that steering works, the agency argues that behavior could constitute deception under Section 5 of the FTC Act, according to Spencer Fane’s tracking of the agency’s actions.
The Department of Justice created its AI-focused task force in January 2026, per National Law Review reporting, though the outlet notes that several other federal “pressure points” remain stalled — including Commerce’s model-evaluation work, the FTC’s formal policy statement on AI truthful-output standards, and an FCC proceeding on AI-related disclosure requirements that has not concluded. The overall picture is one of piecemeal, agency-by-agency improvisation layered on top of decades-old statutes never written with generative AI in mind, even as dozens of AI labs have jointly warned regulators about AI-enabled cyberattack risk without a federal body clearly empowered to act on that warning.
What Legal and Policy Analysts Are Saying
The disagreement over how to close the gap breaks down cleanly along one axis: who should hold the pen, Washington or the state capitals.
The Trump administration’s position, articulated through the White House’s own framework, is that “state-by-state regulation by definition creates a patchwork of 50 different regulatory regimes that makes compliance more challenging, particularly for start-ups,” per the White House’s presidential action on the matter.
Business groups broadly echo that view. The U.S. Chamber of Commerce has framed the fifty-state patchwork as a direct cost center for American companies, stating that “the U.S. needs federal AI regulation to prevent a costly patchwork of conflicting state laws that burden businesses and threaten American innovation leadership,” according to the Chamber’s own data-driven breakdown of compliance costs.
Law firms advising clients through the transition are, notably, more cautious than either side of the political debate. Morgan Lewis’s assessment of the White House framework observes that it “argues that a fragmented landscape of state AI laws risks undermining innovation, competitiveness, and national policy coherence,” according to the firm’s analysis of the framework — while stopping short of endorsing preemption as settled policy, since none of it has cleared Congress.
Consumer and civil-society advocates take the opposite view. As referenced above, Brad Carson of the Algorithmic Responsibility Institute argues the preemption push would flip today’s state-law floor into tomorrow’s federal ceiling, stripping states of the ability to respond to AI harms as they emerge — a especially pointed concern given that the technology’s risk profile is still changing month to month.
Market Impact: Compliance Costs and Investment Uncertainty
For AI companies and the software teams that build on top of frontier models, the policy vacuum translates directly into cost and risk. Legal teams at multistate operators now have to track separate audit cycles, disclosure formats, and penalty structures across dozens of jurisdictions — the same underlying AI feature can require a fundamentally different compliance workflow in California than in Texas or Colorado. Cloud Security Alliance’s tally of over 2,182 introduced state AI bills by May 2026 illustrates the sheer surface area involved: even bills that never pass still generate legal review cycles as companies assess exposure.
Venture investors and enterprise buyers face a parallel problem: uncertainty about whether today’s compliance program will hold up if Congress does eventually pass preemption legislation, or whether a state law drafted this year will be struck down by DOJ litigation next year. That uncertainty does not stop AI deployment — model adoption inside enterprises has continued to accelerate through 2026 regardless, alongside warnings that AI-driven cyberattacks are climbing sharply — but it does raise the legal and insurance overhead attached to every new deployment, particularly in regulated sectors like hiring, lending, and healthcare where state AI statutes bite hardest. Security leaders have also flagged that open-source model proliferation adds another layer of risk regulators have yet to address in any federal statute.
Historical Context: From EO 14110 to Today’s Standoff
It is worth remembering that the U.S. did have a functioning federal AI safety framework as recently as early 2025. Biden’s Executive Order 14110, signed in 2023, established reporting requirements for frontier model developers and tasked agencies with assessing AI risk across sectors. Trump’s January 20, 2025 revocation of that order did not replace it with an equivalent structure; it created a gap that state legislatures moved to fill throughout 2025 and into 2026. The current preemption push, in that sense, is partly a reaction to a vacuum the federal government itself created by revoking the prior framework without a ready successor.
That history matters for how the current fight is likely to resolve. A federal statute that both preempts state law and replaces it with an equivalent (or stronger) baseline is a fundamentally different proposition than preemption without replacement — and so far, the Obernolte-Trahan framework and the White House’s own policy document both lean toward the latter: fewer state rules, without a clearly codified, binding federal substitute yet in place.
Competitive Comparison: The US Approach vs. the EU AI Act
The contrast with the European Union is instructive. The EU’s AI Act established a single, comprehensive, risk-tiered framework applicable across all member states, giving companies one regulatory rulebook to satisfy across the entire bloc, per Reuters’ comparative coverage. The U.S. has taken the opposite path by default — not by design, but because no comprehensive federal statute has passed, leaving companies to satisfy whichever combination of state rules applies to their footprint.
Supporters of federal preemption argue this makes the U.S. less attractive for AI investment than a single-rulebook jurisdiction. Critics counter that the EU’s comprehensive approach took years of negotiation and that a rushed U.S. federal law, especially one that preempts state protections without replacing them, could leave American consumers with weaker AI safeguards than either the EU model or the current state patchwork provides. Neither side disputes the practical point: right now, complying with U.S. AI law means complying with up to 29-plus separate state regimes, not one national standard.
What Happens Next: Five Predictions
- The Obernolte-Trahan framework stays a draft through 2026. Given that Congress has already rejected broader preemption language once this year, a formally introduced bill with floor votes before January 2027 looks unlikely without significant compromise on the state-floor question Brad Carson raised.
- DOJ litigation against state AI laws intensifies, but slowly. The AI Litigation Task Force will likely file its first major challenges against comprehensive state frameworks like Colorado’s AI Act, but court timelines mean resolution is a 2027-2028 story, not a 2026 one.
- More states pass frontier-model-specific laws before Washington acts. With 29 states already on the board and Illinois’s SB 315 setting a new audit precedent, expect additional states to introduce similar third-party audit mandates rather than wait for federal clarity.
- Agency-level rulemaking, not new legislation, remains the main lever through 2027. The FTC’s Section 5 approach to AI accuracy is a template other agencies are likely to follow, using existing statutory authority rather than waiting on Congress.
- Compliance-as-a-service demand grows. The complexity of tracking 29-plus divergent state regimes is already spawning a market for AI compliance tooling and legal-tech platforms built specifically to map state-by-state AI obligations for enterprise deployments.
What This Means for Developers and Product Teams
For engineering and product teams shipping AI features in the U.S. market, the practical takeaway is that “wait for federal clarity” is not a viable compliance strategy in 2026. Products deployed nationally already have to account for California’s frontier-model disclosure thresholds, Texas’s broad developer-and-deployer coverage under TRAIGA, Colorado’s high-risk-system assessments, and Illinois’s employment-specific rules — with more state statutes arriving on a rolling basis and no indication that a single federal standard will replace them before 2027 at the earliest.
Teams building on frontier models should treat state-by-state mapping as a permanent line item, not a temporary bridge, and watch the NIST framework and the Center for AI Standards and Innovation for voluntary standards that, while not legally binding today, are the clearest signal of where mandatory federal requirements are likely to land if and when Congress finally acts.
Frequently Asked Questions
Does the U.S. have a federal AI law in 2026?
No. As of September 2026, there is no comprehensive federal statute regulating general AI use. The TAKE IT DOWN Act, effective May 19, 2026, is the only standalone federal statute that substantively regulates AI systems, and it covers a single harm category: non-consensual intimate imagery, including AI-generated deepfakes.
How many states have passed AI laws?
At least 29 states had enacted AI-specific legislation by mid-2026, according to TechPolicy Press, and Cloud Security Alliance research counted more than 2,182 AI-related bills introduced nationwide by May 2026.
What is the Obernolte-Trahan bill?
It is a bipartisan draft framework released June 4, 2026 by Reps. Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.) that would bar states from regulating AI model development for three years and codify the Center for AI Standards and Innovation as the federal body overseeing frontier AI governance. It remains a draft, not enacted law.
What happened to the AI Safety Institute?
It was rebranded in 2025 as the Center for AI Standards and Innovation under the Department of Commerce, shifting emphasis toward voluntary standards and testing coordination rather than binding safety enforcement.
Can Trump’s executive orders override state AI laws?
Not on their own. Executive orders and the White House’s National Policy Framework for AI are nonbinding. Overriding state law requires an act of Congress; in the meantime, the administration has used a DOJ AI Litigation Task Force to challenge specific state statutes in court.
Which state AI law is the strictest so far?
Illinois’s SB 315 (Artificial Intelligence Safety Measures Act), effective January 1, 2027, is notable as the first state law mandating annual independent third-party audits of frontier AI models. Colorado’s AI Act carries some of the broadest disclosure and impact-assessment requirements for high-risk systems.
How does the U.S. approach compare to the EU AI Act?
The EU AI Act is a single, comprehensive, risk-tiered framework covering all member states. The U.S. currently relies on a patchwork of state laws layered on top of general consumer protection and antitrust statutes, with no equivalent single national rulebook.
What should companies do while the federal picture stays unresolved?
Legal analysts including Reuters’ legal industry desk advise continuing to comply with existing state AI laws rather than betting on federal preemption, since executive action alone has not displaced any state statute currently in force.