Let the States Keep Writing AI Law: Why Federalism Beats a Premature Federal Framework

• Also see: Nemotron 3 Ultra for agentic work
• Also see: The game preservation crisis
• Also see: Let the states keep writing AI law (opinion)

flowchart TD
    subgraph Federal["Federal Level (2026)"]
        F1["Executive Order 14110\nAI safety guidelines"]
        F2["NIST AI RMF 1.0\nVoluntary framework"]
        F3["No comprehensive statute"]
        F4["Sectoral: FDA, SEC, FTC\nexisting authority"]
    end
    
    subgraph States["State Laboratories"]
        CA["CA: SB 1047 vetoed\nCompute threshold model"]
        CO["CO: SB 205 enacted\nAlgorithmic discrimination"]
        NY["NY: Local Law 144\nAEDT bias audits"]
        IL["IL: BIPA\nBiometric privacy"]
        TX["TX: HB 2060\nState agency AI inventory"]
        VA["VA: VCDPA\nConsumer data rights"]
        OT["15+ states with\nAI task forces/bills"]
    end
    
    Federal -->|"Watch, coordinate,\nset floor"| States
    States -->|"Experiment,\niterate, signal"| Federal
    
    style Federal fill:#fff3cd,stroke:#333
    style States fill:#d4edda,stroke:#333

The conventional wisdom in Washington is that AI regulation needs a single federal framework — and fast. The argument: a patchwork of state laws creates compliance chaos, disadvantages smaller companies, and leaves gaps. Industry lobbyists, some academics, and a bipartisan cohort in Congress all push for preemption.

They’re wrong. Or at least, premature.

As of October 2026, the United States has no federal AI statute. What it has instead is a live, multi-state policy experiment — the “laboratories of democracy” Justice Brandeis described — generating real evidence about what works, what breaks, and what the technology actually is in practice. Freezing that experiment with a comprehensive federal law now would lock in today’s misunderstandings for a decade.

The State Landscape: Five Models, Not One

1. Compute Thresholds: California’s SB 1047 (Vetoed, But Influential)

Governor Newsom vetoed SB 1047 in September 2026, calling it “well-intentioned but flawed.” The bill would have required safety protocols for models trained on >10^26 FLOP (roughly GPT-4 scale), including third-party audits, shutdown capability, and whistleblower protections.

Why it mattered: It was the first serious attempt to regulate frontier model development (not just deployment) by compute threshold. The veto message explicitly invited a “federal framework” — but the bill’s architecture (threshold + duties + enforcement) is now the template for SB 1047 v2 (expected 2027) and similar bills in Washington, Massachusetts, and Illinois.

graph LR
    subgraph SB1047["SB 1047 Architecture"]
        T1["Compute threshold:\n>10^26 FLOP"]
        T2["Pre-deployment:\nsafety protocol + audit"]
        T3["Post-deployment:\nincident reporting"]
        T4["Shutdown capability\nrequirement"]
        T5["Whistleblower\nprotection"]
        T6["Attorney General\nenforcement"]
    end
    
    subgraph Influence["Downstream Adoption"]
        I1["WA: HB 2101\n(2027 session)"]
        I2["MA: SD 1847\n(2027 session)"]
        I3["IL: HB 4122\n(2027 session)"]
        I4["Federal:\nSchumer framework\nechoes structure"]
    end
    
    SB1047 --> Influence

2. Use-Case Regulation: Colorado SB 205 (Enacted, Effective 2026)

First comprehensive “algorithmic discrimination” law in the US. Covers “high-risk AI systems” — those making consequential decisions in employment, housing, credit, education, healthcare, insurance, government services.

Requirements:

• Risk assessment before deployment
• Bias audit by independent third party (annual)
• Consumer notice when AI is used
• Opt-out right for consumers (where feasible)
• Attorney General enforcement (up to $20K/violation)

Key distinction: It doesn’t care about model size. A 7B-parameter model denying loans is covered; a 1T-parameter model writing poetry isn’t. Regulates the decision, not the model.

3. Sectoral: New York City Local Law 144 (Effective 2023, Enforced 2024)

Automated Employment Decision Tools (AEDT) — any computational process that “substantially assists or replaces discretionary decision-making” in hiring/promotion.

Requirements:

• Independent bias audit (annual, public summary)
• Candidate notice (10 business days before use)
• Data retention (3 years)
• Penalty: $500–$1,500 per violation per day

Result: By 2026, ~200 companies have published AEDT audit reports. A cottage industry of auditors (Babel Street, ORCAS, FairNow) has emerged. The law is narrow, enforceable, and working — but only for NYC employment.

4. Privacy-Led: Illinois BIPA (2008, But AI-Relevant)

Biometric Information Privacy Act — requires informed consent before collecting biometric identifiers (faceprints, voiceprints, gait). Private right of action ($1,000 negligent, $5,000 intentional).

AI relevance: Every facial recognition, emotion detection, voice-auth system touches BIPA. Meta paid $650M (2021), Clearview AI settlements (2023–2025). BIPA is the de facto federal standard for biometric AI because companies comply nationally rather than geo-fence.

5. Consumer Data Rights: Virginia VCDPA, Colorado CPA, Connecticut CTDPA (2023–2025)

Profiling/automated decision opt-out rights — consumers can opt out of “profiling in furtherance of decisions that produce legal or similarly significant effects.” Not AI-specific, but covers AI-driven decisions.

15+ states now have comprehensive privacy laws with AI-relevant provisions. The patchwork exists — but it’s converging on similar definitions and rights.

Why Federal Preemption Now Would Be a Mistake

1. The Technology Is Moving Faster Than Legislation

A federal statute takes 1–3 years to pass. The AI systems it would regulate change every 3–6 months.

• 2023: “Regulate LLMs” → chatbots
• 2024: “Regulate RAG/agents” → tool use
• 2025: “Regulate multimodal” → vision + action
• 2026: “Regulate agentic swarms” → multi-agent orchestration

A compute-threshold law written in 2024 (SB 1047) was already mismatched to 2026 reality — where a 70B model with tool access outperforms a 1T model without. A federal law passed in 2027 would be obsolete by 2028.

xychart-beta
    title "AI Capability vs Legislative Timeline"
    x-axis ["2023", "2024", "2025", "2026", "2027", "2028"]
    y-axis "Capability Index" 0 --> 100
    line [20, 35, 55, 75, 90, 100]
    bar [0, 0, 0, 0, 10, 30]

States iterate faster. Colorado SB 205 went from introduction to enactment in 8 months. New York AEDT took 2 years but produced a working, enforced regime. Federal process: 5+ years for comprehensive tech legislation (cf. CHIPs Act, Infrastructure Bill).

2. We Don’t Know What “AI Regulation” Should Look Like Yet

The core regulatory questions are unresolved:

Question	State Experiments Testing	Federal Consensus
Scope: Model vs. use-case vs. sector?	CA (model), CO (use-case), NY (sector)	None
Threshold: Compute, parameters, capability, risk?	CA (FLOP), CO (consequential decision), EU (risk tier)	None
Enforcement: AG, private right, agency, audit market?	CO (AG), NY (AG + audit market), IL (private right)	None
Preemption: Floor, ceiling, or cooperative?	Not tested	Assumed ceiling
Small business: Exemptions, tiered compliance?	CO (small biz carveout), NY (none)	None

States are A/B testing these designs. Colorado’s use-case approach vs. California’s compute approach vs. New York’s sectoral approach — we’ll have evidence in 2–3 years. A federal law today would guess.

3. The Constitutional Reality: Dormant Commerce Clause Limits State Power Anyway

States cannot create an unworkable patchwork. The Dormant Commerce Clause prohibits state laws that:

• Discriminate against interstate commerce
• Impose burdens “clearly excessive in relation to local benefits”

Illinois BIPA survived because it applies equally to in-state and out-of-state companies. California’s emissions standards survive because they’re stricter but non-discriminatory. A state law requiring “all AI models worldwide to register with Sacramento AG” would be struck down.

The patchwork self-corrects toward a de facto national standard — the strictest reasonable state law becomes the compliance floor (see: BIPA, CCPA, CARB). Federal preemption claims to solve a problem the Constitution already constrains.

Trump's state AI-law order sparks clash between states and industryPlays from YouTube when you press play

4. Industry Captures Federal Process; States Are Harder to Capture

Federal AI legislation (Schumer forums, 2023–2025) was heavily influenced by frontier labs (OpenAI, Anthropic, Google, Meta). The resulting frameworks emphasize:

• Voluntary commitments
• Self-assessment
• Pre-deployment testing (controlled by labs)
• Light-touch enforcement

State legislatures are messier, more parochial, but also less captured. Colorado SB 205 passed over industry opposition. New York AEDT survived lobbying. Illinois BIPA’s private right of action is the last thing industry wants — and it’s the most effective enforcement mechanism.

graph LR
    subgraph FederalCapture["Federal Process"]
        FC1["Schumer forums:\ninvite-only, lab-heavy"]
        FC2["Voluntary commitments:\nno enforcement"]
        FC3["Preemption push:\nindustry priority #1"]
        FC4["Result: floor = ceiling\n= industry preference"]
    end
    
    subgraph StateResistance["State Process"]
        SR1["Open hearings:\npublic, advocates, experts"]
        SR2["Private right of action:\nBIPA, AEDT"]
        SR3["AG enforcement:\nCO, NY, CA"]
        SR4["Result: stricter,\nmore accountable"]
    end
    
    style FederalCapture fill:#f8d7da,stroke:#333
    style StateResistance fill:#d4edda,stroke:#333

5. Federalism Allows Tailored Regulation Where Appropriate

Healthcare AI (FDA-regulated) needs different rules than employment AI (EEOC/state civil rights) than financial AI (SEC/OCC) than consumer AI (FTC/state AG). A monolithic federal AI statute would either:

• Be too vague to be enforceable (high-level principles), or
• Be too rigid for sectors with existing expert regulators

States can tailor. Colorado SB 205 excludes HIPAA-covered entities (already regulated). New York AEDT is employment-only. This sectoral awareness is a feature, not a bug.

What an Optimal Federal-State Division Looks Like

Instead of “federal preemption” vs. “state free-for-all,” the evidence points to a cooperative federalism model:

Federal Floor (What Only Congress Can Do)

1. Interstate commerce clarity: Define “AI in commerce” for Dormant Commerce Clause purposes — give states a safe harbor for non-discriminatory regulation.
2. Federal procurement standards: The US government is the largest AI buyer. OMB guidance + FAR rules can set de facto standards (already happening via EO 14110).
3. Research & measurement: NIST AI RMF, NAIRR, AI Safety Institute — fund the science of evaluation, don’t regulate the output.
4. National security export controls: Compute, chips, model weights — federal exclusive.
5. Sectoral coordination: Direct FDA, SEC, FTC, EEOC, HUD to issue domain-specific AI guidance under existing authority.

State Ceiling (What States Should Keep Doing)

1. Use-case regulation: Consequential decisions (hiring, lending, housing, healthcare) — states have police power here.
2. Consumer protection: Deceptive AI, deepfakes, privacy — traditional state AG territory.
3. Innovation in enforcement: Private rights of action, audit markets, algorithmic impact assessments.
4. Speed: Iterate on 12–24 month cycles as technology evolves.

The Coordination Layer

• NAIC (National Association of Insurance Commissioners) model: States harmonize insurance regulation without federal statute. NAIC for AI — state AGs + legislators + NIST sharing model laws, audit standards, enforcement precedents.
• Interstate compacts: For cross-border issues (e.g., multi-state hiring platforms), compact clauses (Article I, Section 10) allow binding agreements with Congressional consent.

flowchart LR
    subgraph Federal["Federal: Floor & Infrastructure"]
        F1["Commerce clause safe harbor"]
        F2["Procurement standards"]
        F3["NIST measurement science"]
        F4["Export controls"]
        F5["Sectoral agency guidance"]
    end
    
    subgraph Coordination["Coordination Layer"]
        C1["State AG consortium"]
        C2["Model law sharing"]
        C3["Audit standard harmonization"]
        C4["Interstate compacts"]
    end
    
    subgraph States["States: Ceiling & Innovation"]
        S1["Use-case regulation"]
        S2["Consumer protection"]
        S3["Enforcement innovation"]
        S4["Fast iteration cycles"]
    end
    
    Federal --> Coordination
    Coordination --> States
    States --> Coordination

The Political Economy: Why This Isn’t Happening

Two forces block this optimal division:

1. Industry wants preemption — one federal law (weak) beats 50 state laws (some strong). They lobby Congress heavily.
2. Some federal policymakers want credit — “I passed the AI Safety Act” plays better than “I funded NIST and watched states experiment.”

But the states aren’t waiting. Colorado SB 205 is enforced. New York AEDT is enforced. Illinois BIPA is enforced. California will pass SB 1047 v2. Washington, Massachusetts, Illinois will follow. By 2028, 20+ states will have enforceable AI regimes.

Congress can lead from behind — setting the floor, funding the science, coordinating the states — or it can chase the patchwork with a preemption bill that satisfies industry but fails the public.

The Test: Watch Colorado 2026–2027

Colorado SB 205 is the canary. First enforcement actions (2026 Q4). First audit market data (2027). First court challenges (Dormant Commerce Clause, First Amendment, preemption).

If it works — measurable bias reduction, manageable compliance costs, surviving courts — the use-case model wins. If it chills deployment, creates audit monopolies, or gets struck down — we learn that before federalizing.

That’s federalism working. Let it work.

---

By OMMAIS: Nemotron 3 Ultra using OpenCode’s cloud API