Where things stand

Policy trackers and law-firm updates through the summer and early autumn of 2026 describe the same picture: there is still no comprehensive federal AI statute and no enacted federal preemption of state AI laws. A December 2025 executive order directed the Justice Department to challenge state AI laws, and a March 2026 White House framework was presented as a proposal to Congress, but neither is a statute that displaces state rules. Bipartisan preemption drafts have reportedly stalled.

Meanwhile states keep legislating and enforcing. California's frontier-model transparency law took effect on 1 January 2026, other states have chatbot and automated-decision rules, and Colorado rewrote rather than dropped its framework. Whether any specific state law is preempted is, for now, a matter for the courts.

The rational posture, repeated by several compliance guides, is to comply with state laws as written today while watching the federal docket.

Building one program that survives all outcomes

The good news is that most state laws ask for overlapping things: know what AI you use, tell people when it matters, test and monitor it, keep records, and give people a way to question outcomes. A single system inventory plus a documented risk process satisfies most of that, and adding a state is mostly a mapping exercise.

That structure is also resilient to federal change. If preemption eventually arrives, you will have a good baseline program; if it does not, you are already compliant with the states that matter.

Maintain one inventory

A single list of AI systems with owners, purposes, data, and risk level that every state requirement maps onto.

Keep a state-mapping sheet

A living table of which laws touch which systems, with owners and review dates.

Signals worth watching without betting on them

Track court decisions on challenges to state laws, any congressional movement on preemption language, and agency enforcement under existing consumer protection law, which has continued regardless of new AI statutes. Treat each as an input to a quarterly review, not a trigger to rebuild.

For a practical anchor that works across states, see our piece on using the NIST AI Risk Management Framework as the spine of your program.

Want a lightweight, state-ready AI governance program? Talk to us.

Key takeaways

  • As of autumn 2026 there is no comprehensive federal AI statute and no enacted federal preemption of state AI laws.
  • Executive-branch actions and proposals have not displaced state rules; courts will decide specific conflicts.
  • Build one inventory and one risk process, then map each state onto it.
  • Review court, congressional, and enforcement developments quarterly instead of rebuilding on each headline.
This is general information, not legal advice. It reflects law-firm and policy summaries as of October 2026, some of which disagree on details; confirm current status before acting.