Redistributed

Congress has not passed comprehensive AI legislation. As of early 2026, there is no federal framework governing how artificial intelligence systems are built, tested, or deployed across the United States. Into that vacuum, state legislatures have stepped — each writing their own rules, with their own priorities, at their own pace.

The result is a regulatory patchwork. Some states have enacted binding laws targeting AI discrimination in hiring or lending. Others have passed narrow disclosure requirements. Many have done nothing at all. For anyone building, deploying, or subject to AI systems, the question is no longer whether regulation is coming, but which of fifty different versions you'll need to comply with.

This is not an abstract governance debate. The shape of this patchwork determines who can afford to build AI products, who gets protected from AI harms, and who gets left navigating a system designed for someone else.

The Federal Vacuum

The 117th and 118th Congresses both considered AI legislation. None of it passed. The Bipartisan Framework for AI Legislation, the SAFE Innovation Framework, various disclosure and watermarking bills — all stalled. The reasons are familiar: partisan divides, industry lobbying, genuine disagreement about what AI regulation should accomplish, and a legislature that struggles to keep pace with fast-moving technology.

The Biden administration issued an Executive Order on AI Safety in October 2023 — the most comprehensive federal action to date. It established reporting requirements for large model training runs, directed agencies to develop sector-specific guidelines, and invoked the Defense Production Act to require safety testing. But executive orders are not legislation. They can be weakened or revoked by subsequent administrations, and they lack the enforcement teeth of statutory law.

Without a federal statute, the field is open. And state legislatures, which meet regularly and face direct constituent pressure, have been filling the gap.

The States That Moved First

California's SB 1047 was the most ambitious attempt. Introduced in 2024, it would have required developers of large AI models — those trained above a specific compute threshold — to conduct pre-deployment safety testing, implement shutdown capabilities, and submit to third-party audits. It passed both chambers of the California legislature with broad support.

Governor Gavin Newsom vetoed it in September 2024, arguing that the bill's one-size-fits-all approach to safety testing could stifle innovation and would apply the same requirements regardless of whether a model was being used for a high-risk purpose or something benign. The veto disappointed safety advocates but didn't kill the underlying agenda. And Newsom's critique was not entirely without merit — calibrating regulation to risk level rather than model size is a legitimate design principle, one the EU AI Act also grapples with. SB 1047 established a template — compute thresholds, safety evaluations, developer liability — that subsequent state bills have borrowed from. Even in failure, it shifted the Overton window.

The Colorado AI Act, signed into law in May 2024, took a different and more promising approach. Rather than regulating model development, it targets deployment in "high-risk" decision-making: employment, housing, insurance, lending, education, and similar domains where algorithmic decisions materially affect people's lives. Deployers of high-risk AI systems must conduct impact assessments, provide notice to consumers when AI is being used in consequential decisions, and take reasonable steps to prevent algorithmic discrimination (Colorado SB 24-205). It is the first US state law to directly regulate AI-driven discrimination, and it takes effect in February 2026.

Illinois moved earlier and more narrowly. The Artificial Intelligence Video Interview Act, effective since 2020, requires employers to obtain consent before using AI to analyze video interviews of job candidates. The law also mandates that employers explain how the AI works and restricts data sharing. It's narrow in scope — it covers only video interviews — but it established the principle that AI-assisted employment decisions require informed consent.

New York City's Local Law 144, effective since July 2023, requires employers and employment agencies to conduct annual bias audits of automated employment decision tools (AEDTs) and publish the results. The law defines an AEDT as any system that "substantially assists or replaces" human decision-making in hiring or promotion. Bias audit results must be posted publicly (NYC DCWP, Local Law 144).

Texas passed the Texas Responsible AI Governance Act (HB 2060) in 2025, establishing an AI advisory council and requiring state agencies to inventory their AI systems. Utah's Artificial Intelligence Policy Act, signed in 2024, requires disclosure when consumers interact with generative AI and creates regulatory sandboxes for AI experimentation. Several other states — Connecticut, Virginia, Maryland — have enacted or considered narrower AI-related measures covering deepfakes, data privacy implications, or government AI use.

The Compliance Nightmare

Here's where the redistribution dynamics get sharp.

If you're Microsoft or Google, a patchwork of fifty state AI laws is annoying but manageable. You already have compliance departments in every jurisdiction. You have lawyers who specialize in navigating regulatory complexity. The cost of compliance is real but proportionally small — and it creates a moat around your market position.

If you're a ten-person startup building an AI hiring tool, or a university research lab releasing an open-source model, the same patchwork is potentially fatal. Do you need a bias audit in New York? An impact assessment in Colorado? Consent mechanisms that satisfy Illinois? Safety testing to the standard California almost required? Each state's requirements differ in scope, definitions, and enforcement mechanisms. "High-risk AI system" means one thing in Colorado and another in a proposed Virginia bill. Compliance isn't just expensive — it requires legal expertise that smaller organizations don't have.

This is a familiar pattern in American regulation. As the legal scholars Ari Ezra Waldman and Daniel Solove have documented in the context of privacy law, regulatory fragmentation tends to advantage incumbents. Large firms absorb compliance costs and use regulatory complexity as a competitive barrier. Small firms and open-source projects — often the source of innovation and the check on concentrated power — face disproportionate burdens (Waldman, 2021).

The historical parallel is instructive. Before GDPR, European data protection was a patchwork of national laws implementing the 1995 Data Protection Directive differently in each member state. The result was compliance chaos and uneven enforcement. GDPR replaced this with a single framework. In the US, state privacy laws — California's CCPA, Virginia's CDPA, Colorado's CPA — still operate without federal preemption, and the compliance burden falls most heavily on mid-sized companies too large to ignore the rules but too small to easily absorb them.

The Preemption Debate

This fragmentation has produced a predictable lobbying response: the technology industry wants federal preemption. A single federal AI law that overrides state laws would simplify compliance and — depending on how it's written — could set a lower floor of regulation that prevents states like Colorado or California from imposing stronger requirements.

Industry groups including the US Chamber of Commerce, TechNet, and the Information Technology Industry Foundation have advocated for federal legislation that would explicitly preempt state AI laws. Their argument: a unified framework reduces uncertainty and prevents a race to the regulatory top.

Civil society groups see the same dynamic differently. Organizations like the ACLU, the Electronic Privacy Information Center (EPIC), and the Algorithmic Justice League argue that federal preemption risks locking in weak protections nationally while eliminating the ability of individual states to experiment and respond to local harms. As Virginia Eubanks documents in Automating Inequality, algorithmic harms often manifest differently in different communities, and local responses may be better calibrated than one-size-fits-all federal rules (Eubanks, 2018).

The preemption debate is really a redistribution question. Federal preemption with weak standards redistributes power toward companies and away from affected communities. Strong state protections without federal coordination redistribute compliance burdens toward smaller developers. The optimal outcome — strong federal standards that serve as a floor, not a ceiling, with states free to go further — is precisely what the technology industry is lobbying against.

The Regulatory Haven Problem

Without coordination, some states will inevitably become regulatory havens for AI development — the Delaware of algorithms. States competing for AI investment have incentives to keep regulation light. This creates a race-to-the-bottom dynamic where companies incorporate or host operations in the most permissive jurisdictions while deploying products everywhere.

This is already visible. When Newsom vetoed SB 1047, he explicitly framed California's competitiveness as a factor. States courting AI companies — and the jobs and tax revenue they bring — face real pressure to avoid regulations that might drive investment elsewhere. The people who lose in this competition are the residents of permissive states, who get fewer protections, and the residents of strict states, whose protections may be undermined by companies that structure themselves to minimize regulatory exposure.

What to Watch in 2026

Several developments will shape the patchwork over the coming year:

Colorado's AI Act takes effect in February 2026. How enforcement works in practice — how "algorithmic discrimination" is defined, how impact assessments are evaluated, what penalties look like — will set precedent for other states.

California will try again. Multiple AI bills are advancing in Sacramento, informed by the SB 1047 debate. Some focus narrowly on specific applications (healthcare AI, government use), while others attempt another comprehensive approach.

Federal legislation remains unlikely but not impossible. The 119th Congress includes several AI-related proposals, though none has achieved the bipartisan momentum needed to pass.

The EU AI Act's high-risk system requirements take full effect in 2026, and the extraterritorial reach of EU law will continue to influence US companies' practices regardless of domestic regulation. As with GDPR and privacy, external regulation may accomplish what Congress cannot.

For readers navigating this landscape — whether as developers, deployers, or people subject to AI decisions — the practical advice is unglamorous but important: know which states' laws apply to you, track the compliance calendar, and pay attention to enforcement actions, which will reveal what these laws mean in practice rather than on paper.

The deeper structural question remains open. A patchwork of state laws is better than no regulation at all — people in Colorado and New York have protections that people in many other states lack. And the state-level experimentation serves a valuable function: it generates evidence about what works, stress-tests different regulatory approaches, and builds institutional capacity that federal legislation will eventually need. And the longer Congress waits, the more entrenched the patchwork becomes, the harder harmonization gets, and the more the compliance burden tilts toward those least able to bear it.

Sources

Colorado General Assembly. "SB 24-205: Concerning Consumer Protections for Artificial Intelligence." 2024. Colorado Legislature
Eubanks, Virginia. Automating Inequality: How High-Tech Tools Profile, Police, and Punish the Poor. St. Martin's Press, 2018. Publisher
New York City Department of Consumer and Worker Protection. "Automated Employment Decision Tools." 2023. NYC DCWP
Waldman, Ari Ezra. Industry Unbound: The Inside Story of Privacy, Data, and Corporate Power. Cambridge University Press, 2021. Publisher
White House. "Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence." October 30, 2023. White House

General

State-Level AI Regulation: The Patchwork Problem