As of November 2026, no federal law preempts state AI laws. Executive Order 14365 set up a DOJ AI Litigation Task Force and funding pressure, and the DOJ has joined xAI's suit against Colorado. But state laws such as California SB 53 still apply, and New York's RAISE Act and Colorado's replacement law take effect in 2027. Build for the states.
Updated 13 November 2026. Since December 2025 the White House has tried to replace the growing patchwork of state AI rules with one national framework. Plenty of product teams have read the headlines as "state AI laws are dead". They are not. This post separates what the federal government has actually done from what it has proposed, and covers the one court case that matters. It ends with what an engineering team should build so a product survives either outcome. It is an engineering guide, not legal advice.
Does federal law preempt state AI laws in 2026?
No. Preemption normally comes from an act of Congress or a court ruling, and neither has happened for AI. Congress has rejected a federal moratorium more than once. In July 2025 the Senate voted 99 to 1 to strip a 10-year state-law freeze from the budget bill, and a similar provision was left out of the defense bill in December 2025, as StateScoop reported. We found no enacted federal statute that preempts state AI laws as of 13 November 2026.
What exists instead is executive pressure: an executive order, a DOJ task force, a proposed FTC policy statement and a legislative wish list sent to Congress. Each can change the risk picture. None of them, on its own, switches off a state law.
What does Executive Order 14365 actually do?
It tells federal agencies to challenge and discourage state AI laws, and asks Congress for a preemptive national standard. Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence", was signed on 11 December 2025 and published at 90 FR 58499. Its main moves:
| Lever | What the order directs | Status we could confirm (13 Nov 2026) |
|---|---|---|
| DOJ AI Litigation Task Force | Attorney General to set up a task force within 30 days to challenge state AI laws | Created by AG memorandum of 9 January 2026; intervened in X.AI v. Weiser (Colorado) |
| Commerce evaluation | Publish an evaluation of state AI laws, flagging "onerous" ones | We could not confirm a published list on commerce.gov or ntia.gov |
| BEAD broadband funds | Restrict non-deployment BEAD funding for states with flagged laws | Legal authority contested; no final action confirmed |
| FTC policy statement | Explain how the FTC Act applies to state laws that require altering truthful AI outputs | Proposed 1 July 2026; comments closed 31 July 2026 |
| Legislation | Recommend a federal framework that preempts conflicting state laws, with carve-outs | White House framework sent to Congress 20 March 2026; not enacted |
The order's own carve-outs matter. The White House fact sheet and the order say the proposed legislation should not preempt state laws on child safety, data center infrastructure (apart from general permitting reform), or a state's own procurement and use of AI.
Has the DOJ sued Colorado over its AI law?
Not on its own. The DOJ joined a lawsuit that xAI filed. In April 2026, xAI sued Colorado's Attorney General in federal court (X.AI LLC v. Weiser, No. 1:26-cv-01515, D. Colo.) to block the Colorado AI Act, SB 24-205. On 24 April 2026 the Justice Department moved to intervene, the first time it had joined a challenge to a state AI law. Its main argument is Equal Protection: that the law both pushes developers to treat people differently by protected characteristics and permits discrimination to avoid disparate impact.
xAI's own claims, as summarised by Norton Rose Fulbright, are broader. They include the First Amendment (model design and compelled disclosures as speech), extraterritorial reach and burden on interstate commerce, and vagueness. On 27 April 2026 the court suspended enforcement after the Attorney General agreed to a stay while the legislature reworked the law. The court has not ruled on the merits.
What Colorado did next
In May 2026 Colorado repealed and replaced SB 24-205 with SB 26-189, a narrower law built around notices for automated decision-making technology (ADMT), effective 1 January 2027. Commentators disagree on whether the xAI case is now partly moot, and the docket shows it stayed rather than dismissed. Our state healthcare AI law guide covers what SB 26-189 means for health systems, including the HIPAA carve-out.
We found no standalone lawsuit filed by the Task Force against any other state as of 13 November 2026, including California.
What did the FTC say about state AI laws?
On 1 July 2026 the FTC voted 2 to 0 to publish a proposed policy statement on the "suppression of accuracy" in AI systems. It says that distorting AI outputs for undisclosed ideological goals can be deceptive under Section 5 of the FTC Act. It also names Colorado's AI Act as a law that appears to pressure companies to change outputs, and calls such a law "impliedly preempted" to the extent it conflicts with a federal scheme.
Two things to keep in mind. First, it was a proposal with comments due 31 July 2026; we could not confirm a final version. Second, a policy statement is the agency's view, not a court ruling. Law firms reviewing it, such as Arnold & Porter, note that it does not itself preempt anything. The practical point for product teams is different. If you change how a model answers, whether for safety, compliance or policy reasons, be ready to explain and disclose that steering. The FTC's theory is about hidden steering.
Which state AI laws still apply to product teams?
All of them that are in force. Unless a court blocks a specific law, it applies. The ones engineering teams ask us about most:
| State law | Who it hits | Effective | Federal challenge? |
|---|---|---|---|
| California SB 53 (Transparency in Frontier AI Act) | Large frontier model developers | 1 Jan 2026 | No federal suit found |
| Texas HB 149 (TRAIGA) | Developers and deployers; AI disclosure in healthcare | 1 Jan 2026 | None found |
| Colorado SB 26-189 (replaced SB 24-205) | Developers and deployers of ADMT for consequential decisions | 1 Jan 2027 | xAI suit (DOJ intervened) stayed |
| New York RAISE Act, as amended (Ch. 96 of 2026) | Frontier developers; "large" above $500M revenue | 1 Jan 2027 (per most firms) | None found |
| State healthcare AI laws (CA, TX, UT, IL and others) | Providers, payers, health apps | 2025–2027 | None found |
The New York RAISE Act was finalised by a chapter amendment signed on 27 March 2026. Wiley reports a 10^26 FLOP compute threshold, a $500 million revenue trigger for "large frontier developers" and a new oversight office within the Department of Financial Services. One firm cites a later date for full effect, so check the enacted text before you set a deadline.
Most application teams are not frontier developers. The laws that reach you are usually the sector and use-case laws: hiring, lending, insurance, healthcare and chatbot disclosure. That is also where the federal carve-outs (consumer protection, child safety, laws of general applicability) leave states the most room.
What is in the White House's March 2026 AI legislative framework?
On 20 March 2026 the White House sent Congress a "National Policy Framework for Artificial Intelligence" with legislative recommendations. According to Morgan Lewis, its centre is express preemption of state AI laws that conflict with a light federal standard. Laws of general applicability, child safety, consumer protection, fraud, zoning for AI infrastructure and state procurement would be left alone.
It is a blueprint, not a bill that passed. House leadership backed it, while other members pushed narrower approaches, and we found no preemption statute enacted since. Even if Congress acts in 2027, a federal standard will come with its own duties. Expect transparency, safety testing and incident reporting in some form, so the engineering work below is not wasted.
Should we wait for federal preemption before building state compliance?
No. Waiting is the most expensive option. A product that ignores state law today is exposed now, and a federal standard, if it comes, will probably keep a floor of transparency and consumer protection duties. The work that survives every scenario is the same work: know which rules apply to which user, record what the AI did, and be able to explain it.
The likely outcomes and what they mean for a roadmap:
- Status quo (most likely through 2027): state laws apply on their own dates; litigation picks off a few provisions. You need per-state configuration.
- Courts narrow specific laws: provisions on compelled speech or disparate impact may fall, but disclosure, notice and record-keeping duties are harder to strike down. Keep the plumbing; switch off rules as courts rule.
- Congress preempts: one federal standard replaces many state ones for covered areas. Your rules table shrinks, but the logging and disclosure infrastructure stays.
What should product teams build now?
Build a compliance layer that treats jurisdiction as data, not as code branches. Six pieces cover most US state AI rules and the likely federal floor:
- Jurisdiction rules table. Map user location, business entity and use case to the rules that apply, with effective dates. Change rules by config so a court order or a new law does not need a release.
- Disclosure and notice engine. Show the right AI disclosure or ADMT notice per channel (chat, voice, email), and log that it was shown.
- Decision records. For consequential decisions, store inputs, model version, prompt version, output, and the human who reviewed it. This is what an attorney general or a plaintiff will ask for.
- Explanation and appeal path. A way for a person to get a plain-language reason and reach a human. Colorado's new law and several healthcare laws expect this.
- Impact assessment workflow. A lightweight, versioned assessment per AI feature, refreshed when the model or the use changes.
- Steering register. Document every system prompt, filter and fine-tune that changes what the model says, and why. That is the direct answer to the FTC's "hidden steering" theory.
If your product also serves EU users, the same building blocks carry most of the load for the EU AI Act. See EU AI Act deadlines after the Digital Omnibus. For agent-specific risk, read our posts on the AI Agent Accountability Act and AI agent governance.
How BeevR builds this
We build AI products for US companies in healthcare and fintech, where state rules arrive every legislative session. We put jurisdiction rules, disclosures and decision records in a separate policy layer next to the AI runtime, so a new state law is usually a configuration change and a test, not a rebuild. Every model call and tool call is logged with the version of the prompt and model that produced it.
BeevR is a senior, founder-led team in Hanoi with a 5.0 rating on Clutch. We work in fixed-scope, fixed-price phases from $10K, show a working demo every Friday, and you own the code and IP from day one. See how we build production AI agents for regulated industries.
Not sure which state rules reach your product? Book a 30-minute call and we will sketch the rules table with you.