US AI law in 2026: no federal statute, a patchwork of state rules, one compliance standard

In short: there is no comprehensive federal AI statute, and federal action against state AI laws, from Executive Order 14365 to the White House’s March 2026 recommendations, cannot preempt them by itself. The binding obligations come from the states: Texas, California and Illinois laws in force since January 1, 2026, New York City’s bias-audit rule, and from January 1, 2027 Colorado’s replacement law, California’s automated-decision rules and New York’s RAISE Act. Build each control once, to the strictest rule that applies.^{1,2,3,4,5,6,7,8}

There is no comprehensive federal AI statute in the United States, and in 2026 federal policy is moving against the states that have written their own. That makes the map harder to read, not shorter. For an organization with customers, applicants or employees in several states, the binding general obligations on AI still come from state law, now contested in court.

This briefing summarizes the federal posture and the state laws that matter most as of October 2026, then gives the one approach that keeps compliance affordable. It is educational, not legal advice; state laws changed several times in 2025 and 2026, so verify the current text. Our earlier briefing on the three laws that took effect on January 1 covers Texas, California and Illinois in more detail.

The federal posture

Executive Order 14148 revoked the 2023 order on safe, secure and trustworthy AI on January 20, 2025,⁹ and Executive Order 14179 (January 23, 2025) ordered agencies to review and rescind actions taken under it.¹⁰ The Office of Management and Budget issued memoranda on federal agency use and procurement of AI on April 3, 2025,¹¹ and the AI Action Plan followed in July 2025.¹² Executive Order 14365 (December 11, 2025) called for a “minimally burdensome national policy framework,” directed the Attorney General to set up an AI Litigation Task Force to challenge state laws seen as inconsistent with national policy, and ordered the Commerce Department to list “onerous” state laws.^1,13 On March 20, 2026 the White House sent Congress legislative recommendations for a national framework that would preempt state AI laws it considers unduly burdensome.²

None of this preempts state law by itself. Preemption needs Congress or a court, and Congress has not acted: on July 1, 2025 the Senate struck a ten-year moratorium on state AI laws from the reconciliation bill by 99 to 1.¹⁴ Existing federal law on civil rights, consumer protection, finance and health applies to AI as it does to anything else.

The state laws that matter most

• Texas. The Responsible Artificial Intelligence Governance Act (HB 149) took effect on January 1, 2026. It prohibits AI intended to incite self-harm, crime or certain abusive content, requires government agencies (and health-care providers in treatment contexts) to disclose AI interactions, is enforced only by the Attorney General with a 60-day cure period, and protects an organization from liability for a violation it discovers itself, for example through red-team testing or through an internal review process run in substantial compliance with the NIST AI RMF Generative AI Profile or another recognized framework.³
• California. SB 53 requires large frontier-model developers to publish safety frameworks and report critical incidents, with most provisions effective January 1, 2026.¹⁵ The California Privacy Protection Agency’s rules on automated decision-making technology require pre-use notice, opt-out and access rights for significant decisions in employment, housing, credit, education and health care, with compliance by January 1, 2027.⁴ The AI Transparency Act (SB 942, as amended by AB 853) has required covered generative AI providers to offer detection tools and content disclosures since August 2, 2026.¹⁶ For employers, the Civil Rights Council’s regulations under the Fair Employment and Housing Act, in force since October 1, 2025, make clear that discrimination through an automated-decision system can violate the Act, extend liability to agents acting for the employer, and require four years of records, including data used in or produced by the system.¹⁷
• Colorado. The 2024 Colorado AI Act was delayed and then challenged by xAI. The Department of Justice moved to intervene with its own complaint on April 24, 2026;¹⁸ a stipulated court order paused enforcement on April 27;¹⁹ and SB 26-189, signed on May 14, replaced the Act with a narrower notice-based framework effective January 1, 2027.⁵ Our briefing on SB 26-189 sets out the new duties.
• Illinois. HB 3773 amended the Human Rights Act from January 1, 2026: employers must notify employees when AI is used for covered employment decisions and may not use AI in ways that discriminate.⁶ The Department of Human Rights proposed implementing rules on May 15, 2026 and withdrew them on June 2, 2026, so the duty applies while its details are unsettled.²⁰
• Utah. The Artificial Intelligence Policy Act, narrowed in 2025 by SB 226, requires a business to disclose generative AI use when a consumer clearly asks, and requires prominent disclosure only in high-risk interactions in regulated occupations; it also created a regulatory sandbox. The Act is scheduled to be repealed on July 1, 2027.²¹
• New York. In New York City, Local Law 144, in force since July 2023, requires an independent bias audit within a year before an automated employment decision tool is used for hiring or promotion decisions, and notice to candidates and employees who live in the city.⁷ Statewide, the RAISE Act as amended on March 27, 2026 applies from January 1, 2027 to large frontier-model developers (more than $500 million in annual revenue): they must publish a frontier AI framework, file disclosures with a new office in the Department of Financial Services and report critical safety incidents within 72 hours, or within 24 hours where an incident poses an imminent risk of death or serious physical injury.⁸

Build once, to the strictest rule

The threads are common: notice to people affected by AI decisions, bias and impact assessment for consequential uses, documentation and logging, and a strong role for state attorneys general. That is why the affordable approach is to build each control to the highest standard that applies anywhere your affected people are, then use it everywhere. One notice template adapted per state, one bias-testing procedure that satisfies the strictest rule, one record-keeping standard and one calendar cost far less than fifty variations.

Start with your highest-risk systems. For each, list the states where the affected people are (not only where your offices are) and the single strictest obligation that applies. Note the Texas defense as you do: an internal review process run to the NIST AI RMF is not only good practice, it is part of a recognized answer if a regulator asks. The IAIM regulatory calendar tracks each state date, and the AI regulation guide sets the state laws beside the EU and other regimes.