"Federal Preemption Is Coming" Is the Most Expensive Thing a Compliance Team Can Believe
Washington is actively trying to displace state AI regulation. The states are legislating anyway. A lot of US software companies have quietly decided to wait it out — which is a bet that the obligations they are skipping come from AI-specific statutes. Mostly, they don't.
Where the Fight Actually Stands
The clean version — Congress passes a national AI framework that displaces the states — has not happened. A proposed moratorium that would have paused state AI enforcement for years was attached to federal legislation in 2025 and stripped out before passage, and no successor has been enacted.
What replaced it is preemption by other means: executive direction to challenge state AI laws in court, agency positions that treat state requirements as burdens on interstate commerce, and pressure applied through federal funding conditions. Those are real instruments and they may eventually narrow specific state laws. What they are not is a switch that turns off your obligations on a known date.
The Category Error Behind the Wait-It-Out Bet
Teams betting on preemption are implicitly modelling their AI exposure as coming from statutes with "AI" in the title. Run the inventory honestly and most of it comes from somewhere else.
- •AI-specific state acts with impact-assessment filing duties
- •State-mandated AI bias audit publication requirements
- •AI-specific disclosure and labeling mandates
- •State AI developer/deployer registration schemes
- •Biometric privacy statutes with private rights of action
- •Employment discrimination law reaching algorithmic screening
- •Comprehensive state privacy acts and their profiling rules
- •Consumer protection and deceptive-practices law
- •Insurance, lending, and health sector regulation
- •Contract and tort exposure to your own customers
Notice which column carries the money. Statutory damages under a biometric privacy law and a disparate-impact claim over an automated screening tool are the exposures that have actually produced nine-figure settlements. Neither depends on a state AI act existing.
Three Reasons Preemption Is Slower Than It Sounds
Preemption Has to Be Drafted, and Drafting It Is the Hard Part
A statute that voids 'state laws regulating artificial intelligence' either sweeps in anti-discrimination and privacy law — which is politically unpassable and constitutionally contested — or it carves them out, at which point it leaves your real exposure untouched. Every draft faces this tradeoff, which is why drafts keep failing rather than narrowing.
Litigation and Funding Conditions Move One Law at a Time
Challenging state laws in court produces rulings about specific provisions in specific circuits over years. Conditioning federal funds pressures state governments but does not repeal enacted statutes or extinguish private rights of action already accrued. Neither instrument gives a national compliance team a date to plan against.
States Legislate Faster Than Washington Preempts
Colorado, Texas, Utah, Illinois, California, and New York each moved AI-relevant law recently, and the state pipeline for the next session is larger than the one behind it. Even a successful preemption effort is aimed at a moving target, and states have shown they will re-legislate the same substance under a different statutory label — as employment law, insurance law, or privacy law.
Build the Evidence, Not the Paperwork
The way to be right under every scenario is to separate two things most teams conflate: the underlying evidence about how your AI behaves, and the jurisdiction-specific form you pour it into. Evidence is durable. Forms are disposable.
Durable — Build Now
- ☐One inventory of every AI feature and what decision it influences
- ☐A risk note per feature and the reasoning behind its tier
- ☐Bias/outcome testing results with dates and methodology
- ☐Human review and appeal paths for consequential decisions
- ☐AI-interaction and synthetic-content disclosures in-product
- ☐Training data provenance and retention records
Disposable — Defer Until the Deadline Is Real
- ☐State-specific filing templates and submission portals
- ☐Publication of audit results in one state's prescribed format
- ☐Registration in schemes not yet operational
- ☐Rewriting policy documents to a single state's headings
The Buyer Does Not Wait for Congress
There is a second enforcement channel that no preemption measure touches: your customers. Enterprise procurement, vendor security reviews, and AI-specific addenda now routinely ask whether your model was tested for bias, whether a human can override it, what data trained it, and whether you can support their own regulatory reporting. Those questions are contractual. They arrive whether or not a statute obliges you, and answering them badly costs the deal in the same quarter — which is a faster and more certain penalty than any regulator has yet imposed.
A Practical Order of Operations
- Sort your obligations by source. AI-specific statute, general law, or contract. Only the first column is preemptable.
- Fund the general-law column first. Biometric consent, hiring outcome testing, privacy profiling rights, honest marketing claims.
- Build the durable artefacts. Inventory, risk notes, testing records, appeal paths — these answer every jurisdiction and every buyer.
- Track enacted text and formal delays only. Not commentary, not momentum, not predictions about the next session.
- Comply with live deadlines as if they will hold. They usually do, and a retroactive excuse is not available to you if they don't.
- Re-check quarterly. The one thing everyone agrees on is that this landscape will not look the same in six months.
Frequently Asked Questions
If a federal AI law passes, will it be less work than the state patchwork?
Not necessarily. Preemption trades many moderate obligations for one national obligation, and the national one is set by whoever writes it. Companies that assume federal means lighter are extrapolating from a political framing, not from any drafted text. Plan for a change in shape, not a reduction in volume.
Our product only sells in a few states. Does the patchwork matter to us?
It matters where your users are, not where you are, and most SaaS products cannot control which state a signup comes from. If you can genuinely geofence, that is a legitimate strategy — but confirm your sales team is not already selling into the states you think you avoid.
Do the executive branch's preemption efforts change what our regulator can do today?
Generally no. A state attorney general enforcing a state statute, or a private plaintiff suing under a private right of action, is not bound by federal policy preferences. Only an enacted statute, a binding court ruling in the relevant jurisdiction, or a validly promulgated rule changes what you owe.
How do we explain this tradeoff to an executive who wants to defer the spend?
Reframe it away from statutes. The spend buys an AI feature inventory, evidence that consequential decisions were tested, and an appeal path — the same three things a discrimination claim, a customer's vendor review, and any future regulator will each ask for. None of those three depends on which level of government wins.
Does the EU AI Act change if the US preempts state law?
No, and that is the strongest practical argument against waiting. If you sell into Europe you are building the inventory, the risk classification, and the human-oversight design regardless. Doing that work well satisfies most US state requirements as a byproduct, which makes the preemption question largely irrelevant to your roadmap.
Bet on the Artefact, Not the Outcome
Nobody can tell you how the preemption fight ends. What is knowable is which compliance work retains its value in every branch of that tree — and it is the same short list every time: what AI you ship, what it decides, how you tested it, and how a person gets a human to look again.
Companies that build that list are covered whichever way Washington goes. Companies waiting for clarity are accumulating an undocumented decision surface, and the discovery request does not care that the statute was uncertain at the time.
This article is general information about an unsettled policy area, not legal advice. Preemption posture, pending bills, and state deadlines change frequently — verify the current status of any specific law with counsel before making a compliance decision.