If your US compliance framework assumes that federal AI regulation will eventually consolidate state-level activity into a single national standard, the December 2025 executive order signals the federal-state relationship is moving in a different direction than consolidation. US state legislatures passed 150 AI-related bills into law in 2025, up from fewer than 10 in 2020. In December 2025, the White House issued an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence" that directed the Department of Justice to establish an AI Litigation Task Force to challenge state AI laws in court, instructed Commerce to identify state laws considered overly burdensome, and tied some federal funding to states' willingness to avoid enacting conflicting AI legislation. The compliance landscape for organisations operating across US states now includes an active federal-state conflict that is not yet resolved.

The state-level legislative trajectory is the operating context. Annual bill counts: fewer than 10 in 2020. Approximately 30 in 2022. Around 60 in 2023. Roughly 90 in 2024. 150 in 2025. The growth is non-linear and accelerating. The 2025 acceleration is partly explained by the absence of comprehensive federal AI legislation: states have filled the policy vacuum with their own frameworks.

The distribution across states is highly uneven. California enacted 20 AI-related bills in 2025 alone. Texas 12. New York 10. Over the full 2016-2025 period, California has 62 enacted bills, more than double any other state. Maryland 28, Virginia 25, Utah 24. Two states (Missouri and Rhode Island) have not enacted any AI legislation. The operational implication: a multi-state organisation faces materially different compliance environments in California versus Missouri, and the gap is widening over time as the active states pass more bills.

The bill content varies in important ways. Categories include:

  • Companion chatbot regulation: Utah HB 452 (Mental Health Chatbot Act), California SB 243 (companion bot disclosure requirements). Effective January 2026.
  • Algorithmic discrimination: Colorado's Artificial Intelligence Act (signed May 2024, compliance dates pushed to mid-2026 after operationalisation difficulties).
  • High-impact AI: Texas's Responsible Artificial Intelligence Governance Act (HB 149), passed 2025, effective January 2026, focused on behavioural manipulation and child sexual abuse material.
  • Watermarking and provenance: Washington HB 1170 (large provider provenance), Illinois SB 1929, Florida HB 369, following California's AI Transparency Act (SB 942).
  • Right to compute: Montana SB 212 (April 2025), establishing individual and business rights to own and use computational resources for lawful AI activities.
  • Deepfakes and nonconsensual imagery: multiple states; the federal Take It Down Act (May 2025) covers this category at federal level.

The federal executive order positions itself as preventing "a fragmented patchwork of state regulations from hindering U.S. innovation and global competitiveness." The Litigation Task Force under the Attorney General has authority to challenge state AI laws in court. The Commerce Department is directed to identify state laws it considers overly burdensome. Federal funding may be withheld from states with non-compliant legislation. The order carves out areas state legislatures can oversee: child safety, data centre infrastructure, and state government AI procurement.

The compliance implications for organisations are immediate and structural.

The first compliance implication: organisations need to track state legislation as a primary compliance variable. The historical default, that federal regulation is the primary US compliance layer, does not match the 2025-2026 operating reality. The active legislative layer is at the state level, and the volume is enough that systematic tracking is required. Generic compliance frameworks that assume federal-state alignment will produce mis-calibrated compliance positions.

The second compliance implication: the federal-state conflict is now itself a compliance variable. Organisations need to model scenarios where specific state laws are challenged in federal court, where federal funding sanctions affect their state-level operations, and where the federal preemption framework limits which state laws have enforceable effect. The 2026-2027 legal landscape may resolve some of these conflicts, but the resolution timeline is uncertain. Compliance planning needs to accommodate multiple resolution scenarios.

The third compliance implication: the multi-state operational model now produces materially different compliance load by state. California's 62 bills since 2016 plus 20 in 2025 alone represents one operational reality. Missouri's zero bills represents a different operational reality. Organisations with significant California operations need California-specific compliance infrastructure (companion bot disclosure, generative AI provenance, mental health AI protocols, deepfake response). Organisations whose primary US footprint is in low-legislation states have a different compliance profile.

The prescription: build state-level compliance tracking as a first-class component of the AI compliance stack. The compliance frameworks that historically prioritised federal alignment (HIPAA, FTC, SEC) need to extend to systematic state-level tracking specifically for AI provisions. The cost is non-trivial, but the cost of operating in California specifically without engaging with the 62 enacted bills is materially higher than the cost of building the tracking infrastructure.

The second prescription: scenario-plan for the federal-state conflict outcomes. Three plausible scenarios over 2026-2028:

  • Scenario A (federal preemption succeeds): state laws are systematically challenged and federal authority over AI regulation consolidates. Compliance environments simplify substantially.
  • Scenario B (federal preemption fails): state laws remain operative. The 50-state compliance landscape continues to fragment.
  • Scenario C (partial preemption): federal authority consolidates some categories (e.g., interstate commerce, national security) while states retain authority in carved-out areas (child safety, procurement). The compliance landscape becomes more structured but remains multi-jurisdictional.

The federal executive order signals movement toward Scenario A. The state legislative activity continues regardless of the federal signal. The actual outcome will be shaped by litigation results, congressional action, and inter-state cooperation that is not yet visible. Planning for a single scenario will mis-position the organisation. Planning for all three with weighted probabilities will produce more resilient compliance positions.

The third prescription: engage proactively with state policy formation in operationally significant states. California is operationally significant for most multi-state organisations. The 62-bill compliance load is the consequence of organisations not engaging early in the legislative process. State-level policy engagement (through trade associations, direct testimony, or coalition participation) is now an organisational capability that produces measurable compliance value.

For US-operating organisations setting AI governance maturity targets, the planning anchor needs to incorporate the 50-state landscape explicitly. The federal-state conflict is real, the resolution timeline is uncertain, and the compliance load by state is now substantially varied. Plans that match this complexity will be operationally aligned. Plans that assume federal consolidation will be reading a future state that may or may not materialise.

Sources

  • Primary: Stanford AI Index 2026, Chapter 8 (Policy and Governance) 8.4 — hai.stanford.edu/ai-index/2026
  • State legislation tracking: Stanford AI Index 2026 state legislation database — 50-state AI bill tracking 2016–2025
  • Regulatory analysis: Digital Policy Alert, 2026 — cross-jurisdictional policy tracking
  • Federal executive action: December 2025 Executive Order "Ensuring a National Policy Framework for Artificial Intelligence"
  • Federal legislation context: Take It Down Act (May 2025) — federal deepfake and nonconsensual imagery framework