The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →There is no single, comprehensive federal AI statute in the materials reviewed here, and a federal policy direction does not automatically switch off state law. As of the official materials available through October 12, 2026, federal AI governance includes executive actions and agency activity under existing authorities, while states continue to develop AI-specific measures. Whether a requirement applies to a particular business depends on its role, AI use, sector, locations, and the people affected—not simply on whether it operates nationally.
This is a dated overview, not a 50-state survey or legal advice. The federal and state developments below are separated by legal status so businesses can identify what is a law, what is an executive direction, and what remains a proposal or an unresolved legal question.
As an Amazon Associate I earn from qualifying purchases.
Is there federal AI regulation in the United States?
Federal AI governance is not one unified licensing or compliance regime. The official materials reviewed describe executive policy and agency action operating alongside existing law, rather than a comprehensive federal AI statute covering all businesses and uses. A Colorado Legislative Council Staff overview dated January 26, 2026 said that no federal legislation regulating AI had passed as of that date and characterized executive orders as the primary federal framework. That is a dated observation, not a statement about every subsequent congressional action.
Later federal activity in the materials includes a June 2026 executive order focused on cybersecurity and voluntary engagement concerning certain frontier models, and a July 2026 Federal Trade Commission (FTC) announcement describing a proposed policy statement about AI accuracy. Neither development, by itself, establishes a comprehensive federal AI statute or resolves whether a particular state law is preempted.
#1 Best Overall
Executive policy is not the same as a statute
An executive order directs the executive branch and states administration policy within the limits of applicable law. It does not, just by being issued, create a blanket exemption from state requirements for every private company. Executive Order 14179, signed January 23, 2025, set a policy of sustaining and enhancing U.S. AI leadership. It directed officials to develop an AI Action Plan within 180 days and to review actions taken under the prior administration’s October 2023 AI order, Executive Order 14110. EO 14179 also says implementation must be consistent with applicable law and that it creates no enforceable private right.
The order’s stated policy was: “It is the policy of the United States to sustain and enhance America’s global AI dominance in order to promote human flourishing, economic competitiveness, and national security.” That policy statement is relevant context, but it is not itself a detailed set of generally applicable business duties.
Existing federal authorities may still matter
The absence of a comprehensive AI statute does not mean AI-related conduct is outside federal law. For example, the FTC’s July 2026 announcement invoked Section 5 of the FTC Act, which the agency described as prohibiting unfair or deceptive conduct. The June 2026 executive order also directed prioritization of existing federal criminal laws where AI is used in unlawful computer access or related crimes. Those are different kinds of authority and apply according to their own legal standards; neither statement supplies a universal checklist for all AI systems.
What changed in federal policy in 2026?
June: cybersecurity and voluntary frontier-model engagement
The White House’s June 2, 2026 order, “Promoting Advanced Artificial Intelligence Innovation and Security,” directs federal cybersecurity actions and describes a voluntary framework for developers to engage with the government concerning “covered frontier models.” It expressly says the order does not authorize mandatory governmental licensing, preclearance, or permitting for the development or release of AI models. The text is therefore not a general private-sector AI licensing regime. Businesses should distinguish its federal implementation directions and voluntary engagement framework from duties imposed on them by an applicable statute, regulation, contract, or binding order.
July: an FTC proposal concerning AI accuracy
In July 2026, the FTC announced a proposed policy statement addressing AI accuracy. The release concerned AI companies that alter model outputs for undisclosed ideological purposes and advanced the agency’s view that Colorado’s AI law could be impliedly preempted to the extent it conflicts with a federal regulatory scheme. This was the Commission’s position in a proposal, not a court judgment invalidating Colorado’s law or a final ruling on state AI laws generally.
The announcement set July 31, 2026 as the public-comment deadline. The official materials summarized here do not establish whether a final policy statement or other action followed that deadline. Do not describe the proposal as final or assume its legal effect without checking subsequent FTC and Federal Register materials.
Federal and state developments at a glance
The legal form of a development matters as much as its subject. A policy announcement, proposed statement, enacted statute, and court ruling do not have interchangeable legal effects.
| Development | What the materials establish | What not to infer |
|---|---|---|
| EO 14179, January 23, 2025 | Federal policy direction; an AI Action Plan was directed within 180 days; prior EO 14110 actions were to be reviewed. The order says implementation must be consistent with applicable law and creates no enforceable private right. | It is not a comprehensive congressional AI statute or a blanket permission to disregard state law. |
| June 2, 2026 White House order | Federal cybersecurity directions and a voluntary engagement framework for covered frontier-model developers. The order disclaims authority for mandatory government AI licensing, preclearance, or permitting. | It does not establish a general licensing regime for private AI development or settle state-law applicability. |
| July 2026 FTC announcement | A proposed policy statement concerning AI accuracy, Section 5, and a possible implied-preemption conflict involving Colorado law; comments were due July 31, 2026. | It is not established here as final, a court ruling, or a determination that Colorado’s law or all state AI laws are invalid. |
| State measures, including California examples | Official state summaries describe AI-specific measures and oversight structures; the details and commencement of obligations require checking the enacted text and implementation materials. | A press release or bill summary alone does not establish every covered entity, effective date, exception, enforcement mechanism, or current litigation outcome. |
Do state AI laws still apply when federal policy is changing?
Do not assume that a federal policy preference displaces state law. Preemption is a legal question about the relationship between particular federal and state rules; it is not established merely because federal officials have announced a national policy or an agency has proposed a position. The FTC’s July 2026 announcement is important because it signals a federal agency’s argument concerning possible conflict with Colorado’s law. But the materials reviewed do not establish a court decision resolving that argument, the current operative text of Colorado’s law, or the proposal’s later status.
The same caution works in the other direction: the existence of a state AI measure does not tell a business whether that measure covers a particular system, use, entity, or person. Read the statute, its effective-date and transition provisions, any implementing regulations, official guidance, and relevant court orders. A summary can help identify what to investigate; it is not a substitute for those sources.
Check the legal status before treating a development as a duty
- Enacted law: confirm the signed statutory text, effective date, covered actors and systems, enforcement authority, amendments, and any implementing rules.
- Executive order: identify which federal officials or agencies it directs, what implementation is required, and whether it creates any direct obligation for the business in question.
- Agency proposal: label it proposed until its status and legal effect are verified. A comment deadline passing does not, on its own, establish that a proposal became final.
- Preemption claim or litigation: distinguish an agency’s or party’s legal theory from a court’s ruling. Check the ruling’s scope and any subsequent appeal or stay.
- Voluntary framework or guidance: do not call it legally mandatory unless a statute, regulation, contract, or binding order makes it so for the relevant party.
What state examples should businesses know about?
Colorado: a law at the center of a federal agency argument
The Colorado Legislative Council Staff’s January 26, 2026 overview provides a dated orientation to the national regulatory landscape. The FTC later cited Colorado’s Artificial Intelligence Act in its proposed implied-preemption argument. Those sources do not establish the Act’s current operative text, amendments, enforcement posture, or the outcome of any challenge. The FTC proposal should not be described as suspending or invalidating the state law.
For a business with a possible Colorado connection, the useful next question is not merely “Is there a Colorado AI law?” It is whether the operative version covers the business’s role and system, whether the relevant use falls within its scope, what dates apply, and whether any current court order changes enforcement or application. The materials reviewed here do not answer those company-specific questions.
California: frontier-model transparency and oversight measures
California Governor’s Office summaries describe SB 53, the Transparency in Frontier Artificial Intelligence Act, as requiring frontier AI developers to publicly disclose safety frameworks, report specified critical safety incidents to the state, and protect whistleblowers reporting serious risks. The summaries also describe SB 813 as establishing a framework for independent verification organizations, and AB 1405 as creating an AI auditor registry with independence, transparency, and integrity standards. These descriptions identify areas to review; businesses should use the enacted text and implementation materials to determine scope, deadlines, and details.
A September 18, 2026 release also describes an executive order to accelerate implementation and convene experts to develop recommendations. Onsite independent audits, verification of filed safety materials, an emergency shutoff or “kill switch,” and revised definitions of critical safety incidents were presented as possibilities under consideration, not as already enacted duties. Treating those ideas as current requirements would overstate what the release establishes.
A separate September 30, 2026 California release lists further legislation concerning employment automated decision systems, technological-displacement notice, AI transparency, digital replicas, and AI transparency and governance. A topic appearing in a release does not by itself answer which employers or developers are covered, when a duty begins, or what procedures apply. Confirm bill text, effective dates, regulations, and court decisions before translating a summary into a compliance deadline.
Why a “state AI law list” is not enough
AI-related obligations may arise through laws not titled as general AI statutes, including rules concerning privacy, consumer protection, employment, civil rights, elections, child safety, product safety, or regulated sectors. The materials reviewed do not support a comprehensive 50-state inventory, a ranked list of states, or a reliable count of current state AI laws. A company should therefore search by both jurisdiction and use case rather than relying only on laws labeled “AI.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How can a business determine which rules may apply?
Applicability is fact-specific. A company that builds a model, sells an AI-enabled service, integrates a vendor tool, and uses an automated system to influence a workplace decision may occupy different roles across its systems. The state where a headquarters is located may not be the only relevant jurisdiction; the location of operations and affected people also belongs in the analysis. The following review creates a practical map, but it is a governance method—not a universal legal test or a checklist established by one source.
Best Value
- Inventory AI systems and vendors. Record each system, product, model, third-party service, and internal tool in use or under development. Include pilots and embedded features so that the inventory does not omit systems simply because they are not sold as “AI.”
- Assign the company’s role for each system. Note whether the company develops, provides, deploys, or merely uses the system, and identify who controls relevant design, data, outputs, configuration, and customer-facing statements. Avoid assuming one company role applies to every product.
- Describe purpose and decisions influenced. Write down what the system is used to do, who relies on its output, and whether it informs or affects a consequential business or individual decision. This makes it possible to compare the actual use with the terms and thresholds in a law, rather than matching on the word “AI” alone.
- Map jurisdictions and affected people. List where the company operates and serves people, where the system is used, and where affected individuals are located. Check the relevant state statutes and rules for their own territorial scope rather than assuming that incorporation or headquarters alone resolves coverage.
- Flag sectors and sensitive contexts. Identify whether the use touches employment, consumer-facing services, privacy, civil rights, children, elections, safety, or a regulated industry. The point is to route the use to the laws that govern that context, whether or not they are branded as AI laws.
- Classify each authority by status. For every potentially relevant requirement, record whether it is an enacted and operative law, an executive direction, proposed agency action, voluntary guidance, contract term, or unresolved litigation position. Keep the source and date with the classification.
- Capture scope, dates, and enforcement details. Record covered entities and systems, exceptions, duties, effective dates, transition periods, rulemaking, responsible agency, remedies, and any private right of action stated in the actual text. Mark unresolved points rather than filling them with assumptions.
- Assign an owner and review trigger. Give a named internal function responsibility for checking changes in statutes, regulations, agency materials, litigation, and effective dates. Define triggers such as a new use, launch in another state, major vendor change, or a new official rule, so the map remains tied to business decisions.
How should a company compare a federal instrument with a state law?
Compare the actual legal instrument to the actual state requirement; do not compare broad labels such as “national policy” and “state AI law.” A useful review records the same dimensions for each rule and highlights where the evidence is missing.
| Comparison point | Questions to answer |
|---|---|
| Legal form and authority | Is this a statute, executive order, regulation, proposed statement, guidance, contract term, or court order? Who issued it and under what authority? |
| Covered parties and systems | Does it cover a developer, provider, deployer, employer, vendor, or another actor? What system definitions, thresholds, and exceptions apply? |
| Conduct and use | What must the covered party do or avoid? Does scope depend on an AI system’s purpose, its role in a decision, or the people affected? |
| Territory and people | Which locations and affected individuals create a connection to the rule? How does the text define that connection? |
| Duties and records | Does the rule call for notice, assessment, documentation, incident reporting, safety material, human review, or another specific action? |
| Timing and implementation | When does the rule take effect? Are there transition periods, regulations, implementation steps, or deadlines that change the analysis? |
| Enforcement and remedies | Which agency enforces it? What penalties or remedies are stated? Does the law provide a private right of action? |
| Federal-state relationship | Is there express preemption language, an asserted conflict, a court ruling, or only a proposed argument? What is the ruling’s scope and current procedural status? |
| Binding status | Is the requirement binding on this company now, proposed, voluntary, or binding only through a contract or other specific mechanism? |
What should businesses avoid assuming?
- “The federal government is developing a policy, so state law no longer applies.” A policy direction does not by itself establish displacement of a particular state law.
- “The FTC challenged Colorado, so Colorado’s law is invalid.” The July 2026 FTC announcement described a proposal and an agency preemption position; the materials here do not establish a final decision or court ruling.
- “A state press release is the complete compliance rule.” Summaries can omit definitions, exceptions, effective dates, procedures, and later changes. Review the official statutory and implementation materials.
- “Only laws with AI in the title matter.” Existing laws in areas such as employment, consumer protection, privacy, or safety may be relevant to an AI use even if they are not general AI statutes.
- “One company-wide answer fits every system.” Different systems, roles, uses, and affected populations can create different legal questions inside the same business.
How to keep the analysis current
Set a review cadence appropriate to the business’s AI use, and revisit the analysis when a system or its context changes. For each development, preserve the issuing authority, publication date, legal status, affected systems, jurisdictions, and next review date. A news release may alert a team to a development, but the operative text and current implementation status are what determine the concrete obligation.
As of the materials available through October 12, 2026, several details remain unsettled in this overview: the full current map of state requirements; Colorado’s operative text and any challenge outcome; the FTC proposal’s status after its comment period; and California measures’ detailed scope and implementation. Those limits mean a business cannot infer its own coverage from this national overview alone. Once its jurisdictions and uses are known, it can check the relevant primary statutes, regulations, official guidance, and court records or obtain counsel for an application-specific analysis.
Recommended Free Tools
What this means for business planning
The prudent operational stance is to build a jurisdiction- and use-based inventory while separating binding requirements from policy announcements and proposals. Federal actions may shape agency priorities and future rules, and state measures may impose or develop requirements for particular actors and uses. Neither observation answers whether a specific obligation applies today. That answer requires matching the company’s facts to current legal text and checking whether amendments, implementation actions, or court decisions have changed the picture.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
