AI regulation in the US is layered: a federal executive order and a White House legislative proposal push toward one national standard, while state laws such as Colorado’s already create enforceable duties. Businesses should build compliance around state requirements first.
This guide maps both layers into a practical plan. For the broader policy context, start with our ai regulation explained overview, then return here for the US detail.
The federal layer: an executive order and a legislative push
Federal AI policy currently centres on Executive Order 14365, signed December 11, 2025. Its title, Eliminating State Law Obstruction of National Artificial Intelligence Policy, signals the mechanism. Most directives aim at state AI laws rather than at AI systems directly, and each one assigns a task to a named official or agency.
What Executive Order 14365 directs
The table below sets out the actors named in the order, what each must do and when. Deadlines run from the order’s date unless stated.
| Federal actor | Action directed | Timing | Planning use |
|---|---|---|---|
| Attorney General | Establish an AI Litigation Task Force to challenge inconsistent state AI laws | Within 30 days of the order | Expect legal challenges to some state laws; do not assume any particular law survives or falls |
| Secretary of Commerce | Publish an evaluation identifying onerous state AI laws | Within 90 days of the order | Check whether the states where you operate appear on it |
| Federal Trade Commission | Issue a policy statement on applying the FTC Act’s prohibition on unfair and deceptive practices to AI models | Within 90 days of the order | Review marketing claims and product behaviour against the statement |
| FCC chairman | Start a proceeding on a federal AI reporting and disclosure standard that could preempt conflicting state laws | Within 90 days of the identification in section 4 | Disclosure design may eventually need to follow a federal standard |
| Special Advisor and OSTP head | Prepare a legislative recommendation for a uniform federal AI framework that preempts conflicting state laws | No deadline stated | Preemption depends on Congress acting |
| Federal funding | States with onerous AI laws are ineligible for certain BEAD non-deployment funds, to the maximum extent allowed by federal law | Follows the Commerce identification | Gives states a financial reason to revisit their laws |
The directives come from the White House text of the order.
Three points follow for planning. First, the FTC statement is the one directive that speaks to how existing consumer-protection law reaches AI models, so companies selling AI-enabled products should read it as soon as it is available and check whether each agency has delivered its deadline item. Second, being named as onerous is a signal and a funding pressure, not a repeal. A state law stays enforceable until a court or legislature changes it. Third, the order expressly leaves intact the functions of the OMB Director on budgetary, administrative or legislative proposals, so the ordinary budget and legislative-clearance process continues alongside it.
Where Congress stands
The uniform federal framework is still a proposal. The order tasks the Special Advisor and the OSTP head with a legislative recommendation, and Lawfare reports that the White House released a national AI framework with recommendations for Congress on March 20. That framework says states should be barred from three forms of regulation: regulating AI development, penalizing developers for third-party unlawful conduct, and unduly burdening lawful AI use. Lawfare also reports support from influential Republicans in Congress.
So the answer to whether a federal AI law exists is that a comprehensive one is being proposed, not applied. The order also shows what Congress would be asked to protect from preemption: child safety protections, AI compute and data center infrastructure (other than generally applicable permitting), and state government procurement and use of AI. Treat preemption as a risk to monitor, not a reason to pause state compliance, because the state duties below already have fixed start dates.
State laws: where enforceable duties sit
States are moving much faster than Congress. A UC Davis analysis found that of 1,116 AI-related state bills introduced between 2020 and 2025, 175 became law, and at least 40 states passed at least one. For a business operating nationally, the practical consequence is that state-by-state mapping, not a single federal checklist, determines the real obligations.
Colorado’s timeline
Colorado has the most detailed dated record, so it is the best template for planning. The list below follows its sequence.
- Colorado AI Act (SB 24-205): approved and effective May 17, 2024, with duties for developers of high-risk AI systems applying on and after February 1, 2026.
- SB 26-189: the Colorado Attorney General’s office says it was signed in May 2026 and repeals and re-enacts the automated decision-making technology (ADMT) provisions, effective January 1, 2027. Check the re-enacted text before building a program around the earlier wording.
- Chatbot Safety Act (HB 26-1263): signed July 1, 2026, effective January 1, 2027, with requirements for chatbot operators to estimate user age and disclose that users are interacting with AI.
- Rulemaking: the Attorney General must adopt rules implementing the ADMT Act before January 1, 2027. Proposed draft ADMT and Chatbot Safety rules were filed August 11, 2026, and written comments are accepted through October 26, 2026.
California, Texas, Maryland and Georgia
California SB 53 requires AI developers to publicly disclose their safety and security protocols, effective January 1 according to UC Davis. By volume, Texas, Maryland and Georgia passed the most AI legislation from 2020 to 2025, with 43 laws between them. Companies with operations in those states should check for existing statutes before assuming they are starting from a blank page.
Timing also matters for monitoring. UC Davis found that time from introduction to enactment ranged from 4 to 18+ months, with a median of 10 months, so a bill that is only in committee can still reach your compliance calendar within a year.
A compliance roadmap for businesses
The most defensible approach is to comply with the strictest state regime that applies to you, then adjust as federal preemption develops. Colorado’s statute offers the clearest concrete duties, so these stages use it as the baseline.
- Establish your role. Decide whether you develop or deploy high-risk AI systems, since Colorado assigns different duties to each.
- Meet the developer duty. On and after February 1, 2026, developers of high-risk AI systems must use reasonable care to protect consumers from algorithmic discrimination.
- Meet the deployer duties. Deployers must review high-risk systems annually, complete impact assessments and give consumers an opportunity to appeal via human review if technically feasible.
- Disclose AI interaction. Systems intended to interact with consumers must disclose to each consumer that they are dealing with AI. Chatbot operators face the added age-estimation duty from January 1, 2027.
- Adopt a recognized framework. Colorado offers an affirmative defense for organizations in compliance with a nationally or internationally recognized risk management framework who also take steps to discover and correct violations. This is the most useful lever in the statute, because the same framework work supports documentation in other states.
- Track rules and federal moves. Follow the Colorado Attorney General’s rulemaking, the FTC statement and any FCC proceeding, and note which could change your disclosure wording.
Start with the inventory and role question, because every later duty depends on it. Organizations that sell into Colorado but have no presence there should not assume they fall outside the statute without checking how it defines consumers and deployers.
What citizens can expect
For individuals, the visible effects so far are disclosure and a route to challenge decisions. Colorado requires that consumers be told when they interact with an AI system and offered an appeal via human review where technically feasible. The Colorado Attorney General is also taking written comments on proposed ADMT and Chatbot Safety rules through October 26, 2026, which makes the rulemaking an open channel for public input.
Federal comment channels depend on the agency proceedings that the executive order starts, so watching those notices is the most direct way to be heard on national standards.
Cross-border context
US companies rarely operate only in the US. Model providers with European customers face separate obligations under the gpai code of practice, and companies with Chinese operations should compare this layered approach with China’s AI Regulation 2026: What Companies Need To Know Now – Technopolicy. A single governance programme built on a recognized risk framework is the most efficient way to serve all three.
Frequently asked questions
Who enforces Colorado’s AI rules?
The Colorado Attorney General has exclusive enforcement authority and rulemaking authority under the act. Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act.
Which state laws would federal preemption leave alone?
The order’s recommended preemption excludes child safety protections, AI compute and data center infrastructure (other than generally applicable permitting), and state government procurement and use of AI.
How quickly do state AI bills become law?
UC Davis reports a range of 4 to 18+ months from introduction to enactment, with a median of 10 months, so pending bills deserve early attention.
Can the executive order cancel state AI laws?
The order’s tools are a litigation task force, a Commerce list of onerous state laws, funding conditions and a legislative recommendation for Congress. Until a court or legislature acts, existing state duties continue.
