There is no federal AI law. There is a state map.
For brand teams operating across U.S. markets, that map is now the regulatory reality. Five states are doing the heavy lifting. A White House executive order is trying to override them. The Senate killed a 10-year preemption moratorium 99-1. Bipartisan resistance to broad federal preemption is structurally durable.
This is the operating map.
California — the maximalist.
Three AI-specific laws went live January 1, 2026:
AB 2013 (training data transparency) requires developers of generative AI systems to publish a high-level summary of datasets used in training, including data point counts, IP status, and personal information disclosures.
SB 942 (AI Transparency Act) requires generative AI providers to offer watermarks, latent disclosures, and detection tools for AI-generated content. Enforcement begins August 2, 2026.
SB 53 (Transparency in Frontier AI Act) requires frontier developers — those training models with more than 10^26 FLOPS — to publish risk frameworks and report critical safety incidents.
The CPPA's automated decision-making regulations are also in force, with significant-decision obligations phasing in through April 2027. California's Civil Rights Department AI employment regulations have been live since October 2025.
Texas — the broad-jurisdiction regime.
TRAIGA (HB 149) entered force January 1, 2026. The law applies to developers and deployers conducting business in Texas, serving Texas residents, or developing or deploying AI within Texas. It prohibits AI systems built for "restricted purposes" including encouragement of self-harm, AI-generated CSAM, unlawful deepfakes, and impersonation of minors. The law established the Texas AI Council and a regulatory sandbox program.
For brands with national footprints, Texas's broad jurisdictional language means compliance is effectively triggered by serving any Texas consumer.
New York — the disclosure state.
RAISE Act — signed December 2025, amended to align with California's frontier model framework.
Synthetic Performer Disclosure Act (S.8420A) — effective June 9, 2026. Requires clear and conspicuous disclosure when an advertisement uses an AI-generated synthetic performer. Civil penalty of $1,000 first violation, $5,000 subsequent. Limited carveouts for translation use and certain entertainment-adjacent contexts.
Algorithmic Pricing Disclosure Act — in active enforcement. The NY AG opened an investigation into Instacart on January 8, 2026.
Post-mortem digital replica protections — restricts unauthorized use of deceased individuals' likenesses in advertising.
New York City's Local Law 144 — bias audits for automated employment decision tools — remains the most operationally significant local AI regulation in the country.
Colorado — stayed, not dead.
SB 24-205 was the first comprehensive state AI law in the U.S. — covering "high-risk AI systems" used in "consequential decisions" with affirmative obligations for risk management, impact assessments, and consumer disclosures. Civil penalties up to $20,000 per violation.
On April 27, 2026, a federal court stayed enforcement in xAI v. Weiser. DOJ joined the suit on April 24. A working-group draft circulated in March would repeal and reenact the law with a January 1, 2027 effective date and a 90-day notice-and-cure window — narrowing scope to automated decision-making technology rather than the broader "high-risk AI" frame.
Treat Colorado as suspended, not removed. The stay can lift on short notice. The replacement law is more focused, not more permissive.
Illinois, Connecticut, and the long tail.
Illinois requires employer notification and candidate consent for AI-analyzed video interviews — effective February 2026. Connecticut requires AI impact assessments for state agencies. Maryland and New Jersey restrict AI in hiring decisions. New York City, Washington State, Oregon, Idaho, Nebraska, Maryland, and Vermont have all enacted new AI laws in early 2026.
The pattern: states that were quiet in 2024 are active in 2026.
The federal preemption fight.
President Trump's December 11, 2025 executive order directed federal agencies to identify state AI laws inconsistent with administration policy and refer them to a DOJ AI Litigation Task Force announced January 9, 2026. The order named Colorado's law specifically.
On March 20, 2026, the White House released the National Policy Framework for AI, urging Congress to enact federal preemption.
The Congressional landscape:
SANDBOX Act (S. 2750) — Cruz — federal regulatory waivers of up to 10 years
Future of AI Innovation Act (S. 3952) — Cantwell, Young, Blackburn — codifies NIST AI Safety Institute
Blackburn discussion draft — released March 18, 2026 — child safety, IP, censorship, broader governance
GUARDRAILS Act — Beyer, Matsui, Lieu, Jacobs, McClain Delaney — introduced March 20, 2026 to repeal Trump's EO
The Senate has already rejected a 10-year state moratorium 99-1. It was stripped from the FY26 NDAA. The structural read: federal AI legislation before the midterms is most likely narrow and sector-specific — not broad preemption.
The strategic implication for brands.
Three operating principles:
Build to California. It is the strictest, the most prescriptive, and the most likely to be replicated. Compliance with California's stack approximates compliance everywhere else.
Assume Texas jurisdiction. The "doing business in" trigger is broad. If you serve a Texas consumer, you are in.
Do not bet on preemption. Federal harmonization is a tailwind, not a strategy. Brands that built to the federal floor in 2025 are now retrofitting for state requirements in 2026.
The brands that operationalize the state map as a marketing capability — not a legal afterthought — will define the credible standard. The brands that wait will write settlement checks.
