The United States has no single law governing artificial intelligence. Instead, rules come from a patchwork: existing consumer protection and civil rights laws, agency actions, court rulings and, increasingly, state legislatures. States have passed hundreds of AI-related laws, on topics from election deepfakes to hiring algorithms to the safety of the most powerful models. The federal government, under the Trump administration, is now trying to push many of those laws aside.
The result is one of the most consequential legal fights in technology policy, and it turns on an old question: who gets to make the rules, Congress, the president or the states?
What the states have done
State AI laws fall into a few groups:
- Frontier-model safety and transparency. California’s Transparency in Frontier Artificial Intelligence Act, signed in September 2025 and in effect since January 2026, requires the largest AI developers to publish their safety frameworks, report serious safety incidents to the state, and protect employees who raise concerns. Penalties can reach $1 million per violation. New York and Illinois have passed their own laws aimed at the largest developers, and Massachusetts lawmakers are negotiating a proposal that could require independent evaluations of AI models and safety practices.
- Automated decisions about people. These laws cover AI used to decide who gets a job, a loan, an apartment, insurance or public benefits. Colorado’s is the best known (more below).
- Elections and deepfakes. Dozens of states require labels on AI-generated political ads or ban deceptive synthetic media close to an election. Some of these have been challenged on free speech grounds, and a federal court has blocked parts of Montana’s. See AI deepfakes and elections.
- Specific harms. Laws on AI-generated sexual images, chatbots that impersonate licensed professionals, and AI companions for minors. State attorneys general are also using existing law: Pennsylvania’s, for example, sued a chatbot operator whose bot presented itself as a licensed psychiatrist.
Colorado: the test case
In 2024, Colorado passed the first broad state law on “high-risk” AI systems, which would have required companies to assess and manage the risk of algorithmic discrimination. It drew heavy criticism from industry and was delayed. In May 2026, Colorado replaced it with a narrower law, SB 26-189, that takes effect January 1, 2027. It focuses on automated decision-making technology that materially influences “consequential decisions” in employment, lending, insurance, housing-related financial services, health care, education and government services. Under it:
- Companies must tell people when such a system is used to decide something about them.
- After an adverse decision, people must be told within 30 days what happened and what role the system played.
- People can ask to correct inaccurate personal data and request human review “to the extent commercially reasonable.”
- Developers must give businesses that use their tools documentation on intended uses, limitations and known risks.
- The attorney general enforces the law. There is no private right to sue, and companies get a chance to fix violations before penalties, through 2029.
In April 2026, Elon Musk’s company xAI sued to block Colorado’s law, and the Justice Department joined the case, arguing that the 2024 law violated the Equal Protection Clause because preventing disparate outcomes would effectively require companies to consider race, sex and religion. It was the first time the federal government moved to invalidate a state AI law. The replacement law dropped many of the provisions under attack, and the court fight over what remains continues.
What Washington has done
Congress tried first. In 2025, House Republicans added a 10-year moratorium on enforcing state AI laws to the budget bill. The Senate stripped it out by a vote of 99 to 1, after objections from both parties and from Republican governors about child safety and states’ rights. Efforts to revive it in later must-pass bills have not succeeded, and as of this writing Congress has not passed a law preempting state AI rules.
Then the White House acted. On December 11, 2025, President Trump signed an executive order titled “Ensuring a National Policy Framework for Artificial Intelligence.” It:
- Directed the attorney general to create an AI Litigation Task Force to challenge state AI laws that conflict with a “minimally burdensome” national policy.
- Told the Commerce Department to publish an evaluation identifying burdensome state laws.
- Directed Commerce to set conditions that could make states with such laws ineligible for some remaining federal broadband (BEAD) grant money.
- Asked White House advisers to draft legislation for a uniform federal standard that would override conflicting state laws.
At the same time, the Justice Department has said it will not use prosecutions to create new AI rules on its own. That leaves state attorneys general and private lawsuits as the main enforcers for now.
Can a president override state law?
Not by executive order alone. Under the Constitution’s Supremacy Clause, federal law beats conflicting state law, but “federal law” means statutes passed by Congress, treaties, and regulations agencies adopt under authority Congress gave them. An executive order directs the federal government’s own work; it cannot by itself void a state statute. That is why the order relies on other tools:
- Lawsuits arguing that particular state laws are unconstitutional, for example under the First Amendment, the Equal Protection Clause, or the Commerce Clause if a law burdens interstate business too heavily.
- Funding conditions. The federal government can attach conditions to grants, but the Supreme Court requires them to be stated clearly by Congress, related to the program’s purpose, and not so coercive that they leave states no real choice. Attaching AI conditions to broadband money is likely to be tested on those grounds.
- Agency rules. Agencies such as the Federal Trade Commission or Federal Communications Commission might claim their rules preempt state laws, but only within powers Congress actually gave them.
Lasting national preemption almost certainly requires Congress.
The arguments on each side
For a single national standard: AI companies operate nationwide, and complying with 50 different rulebooks is costly, especially for startups. Supporters argue a patchwork slows innovation and helps foreign competitors, particularly China, and that some state laws regulate speech or require companies to consider protected characteristics.
For state authority: Congress has not passed comprehensive AI rules, and states have traditionally protected consumers, workers and children. Supporters argue states act as testing grounds for policy, and that blocking them without a federal replacement leaves people with fewer protections, not uniform ones. Many Republican state officials have taken this side too.
Both sides agree on one point: the clearest way out is a federal law that says what the national rules are and how much room states keep. The fight is over what it should say.
What to watch
- January 1, 2027: Colorado’s new law takes effect unless a court blocks it.
- The Commerce evaluation and BEAD conditions, and the lawsuits likely to follow them.
- Congress after the midterms. A preemption bill would need 60 Senate votes to advance, so it would require bipartisan support.
- State legislatures in 2027, including whether states keep passing AI laws despite federal pressure.
For the law that shapes how online platforms are treated, see Section 230 explained. For the debate over AI’s effect on work, see what the evidence says about AI and jobs.