Federal AI Laws in 2026: What Exists, What Preempts, What to Prove

Ask a compliance lead in October 2026 which federal AI laws apply to the company and the honest answer is short. One statute written for AI binds private companies. A dozen older statutes bind them through their sector regulators. Everything else is executive action aimed at federal agencies, at their vendors and at the states. That answer surprises readers who have followed eighteen months of headlines about preemption, because the headlines describe a fight while the compliance file describes what an examiner, a plaintiff or a procurement officer can ask you to produce.

This guide takes the second view. It lists the federal AI laws in force on 31 October 2026, the orders and memoranda that govern agencies and the companies that sell to them, what the preemption campaign has achieved and what it has not, the state layer that still applies, and the records that satisfy the federal layer, the state layer and the EU AI Act at once.

Key takeaways

• Congress has enacted no comprehensive federal AI law. The 119th Congress passed one AI statute aimed at companies, the TAKE IT DOWN Act, plus AI provisions in the FY2026 defence authorisation; every attempt to preempt state AI laws by statute has failed.
• Federal AI duties reach companies through older law: Section 5 of the FTC Act, Regulation B, Title VII, securities law, Section 1557 of the ACA and bank model risk guidance, all enforced or updated in 2025 and 2026.
• Executive Order 14365 of 11 December 2025 opened a preemption campaign. As of October 2026 no state AI law has been preempted, struck down or enjoined on preemption grounds.
• OMB memoranda M-25-21, M-25-22 and M-26-04 are the de facto federal AI standard for anyone selling AI to an agency: inventories, impact assessments, testing, acceptable use policies, model cards.
• The same dated records satisfy federal, state and EU obligations, which makes a single evidence file per AI system the cheapest compliance strategy.

Is there a federal AI law? The answer in October 2026

There is no comprehensive federal AI statute, no federal AI licensing or registration law, and no statute preempting state AI laws. The Congressional Research Service’s survey R48555 lists what Congress has passed, and most of it binds the government itself. The National Artificial Intelligence Initiative Act of 2020 (Division E of the FY2021 NDAA, Pub. L. 116-283) created the National AI Initiative Office and the legal definition of artificial intelligence at <code>15 U.S.C. 9401(3)</code> that every later order and memorandum points to. The AI in Government Act of 2020 set up an AI Center of Excellence at the GSA and told OMB to guide agencies. The Advancing American AI Act of 2022 requires agencies to inventory and publish their AI use cases. The AI Training Act (Pub. L. 117-207) trains the acquisition workforce. The FY2026 NDAA (Pub. L. 119-60, signed 18 December 2025) adds a ban on “covered” foreign AI inside the Department of Defense and its contractors, a framework for assessing and approving AI models, and an AI sandbox task force. None of these tells a bank, a hospital or a retailer what to do with its models.

One statute does. The TAKE IT DOWN Act (Pub. L. 119-12, signed 19 May 2025) is the only AI-specific law of the 119th Congress aimed at private companies, and the next section treats it as the live duty it became on 19 May 2026.

A word about words. Executive Order 14434, “Inaugurating the Era of Super Intelligence”, signed on 29 September 2026 and published at 91 FR 63129, tells federal agencies to write “Super Intelligence” and “SI” in place of “Artificial Intelligence” and “AI” in non-statutory documents. Section 3 keeps the meaning of the statutory definition in <code>15 U.S.C. 9401(3)</code> and gives the President’s science adviser 60 days, to late November 2026, to propose statutory language. Prior regulations, contracts and grants need no revision. For a compliance team the vocabulary changes, the law does not, and federal documents will now carry both terms for a while.

The federal AI laws that bind a private company today

The duties below are what “federal AI laws” means in practice for a company that is not a government agency. None of them says “AI law” in its title. Every one of them produces a record.

Three patterns run through the table. First, the only AI-specific statute is a takedown law. Section 3 of the TAKE IT DOWN Act obliges a covered platform to remove reported nonconsensual intimate images and known copies within 48 hours of a valid request, and treats a failure as a violation of an FTC rule with civil penalties of USD 53,088 per violation after inflation adjustment. The FTC began enforcing on 19 May 2026, opened TakeItDown.ftc.gov for complaints, and the Chairman wrote to fifteen platforms the week before the deadline. No enforcement action had been published by late October 2026, which makes the request log and the timestamps the evidence a platform should be able to show on day one.

Second, guidance went, statutes stayed. The CFPB withdrew its 2022 and 2023 circulars on adverse-action notices from complex models on 12 May 2025; the duty under Regulation B to state specific principal reasons did not move. The EEOC removed its 2022 and 2023 AI technical assistance on 27 January 2025 and Executive Order 14281 told agencies to deprioritise disparate-impact enforcement; Title VII, the ADA and private litigation are intact, and the state laws in the section below fill the gap. Our AI bias and automated employment decision tools guides cover the testing record both regimes expect.

Third, the sector regulators moved in 2026. The Federal Reserve, OCC and FDIC issued SR 26-2 on 17 April 2026, retiring SR 11-7 after fifteen years while keeping its core of inventory, independent validation and documentation and replacing the de facto annual review with a cadence tied to materiality and change velocity. HHS confirmed in a Federal Register notice of 2 June 2026 that <code>45 CFR 92.210</code>, the nondiscrimination duty for patient care decision support tools, stays in force. The SEC, quiet on AI in the first half of 2026, settled with GenesisAI on 26 August and filed two complaints over fake “AI trading” platforms on 29 September. Our model risk management and HIPAA compliance AI guides go deeper on the banking and health files.

Executive orders and OMB memoranda: the federal AI policy for agencies and their vendors

The second body of federal AI law is executive. Executive Order 14179 of 23 January 2025 revoked the Biden-era order 14110 and asked for an action plan; America’s AI Action Plan followed on 23 July 2025 with three same-day orders on data centre permitting, “woke AI” in federal procurement and the export of the American AI stack. The Plan directs NIST to revise the AI Risk Management Framework and signals that federal funding should weigh a state’s regulatory climate, but it preempts nothing.

The instruments with teeth are OMB’s. Memorandum M-25-21 of 3 April 2025 requires every agency to name a Chief AI Officer, convene an AI governance board, publish a compliance plan and an annual public use case inventory, and apply minimum practices to “high-impact AI”, defined as AI whose output is “a principal basis for decisions or actions that have a legal, material, binding, or significant effect on rights or safety”. The practices are the ones a European reader will recognise: pre-deployment testing, an AI impact assessment, ongoing monitoring, human oversight and training, a remedy and appeal route for affected individuals, and public reporting of waivers; high-impact AI that cannot meet them must be paused. Its twin, M-25-22, governs acquisition: contracts for solicitations from 1 October 2025 must bar the vendor from training on government data without consent, address lock-in and portability, and allow lifecycle monitoring. M-26-04 of 11 December 2025 adds, for every large language model solicitation, contract terms on two “Unbiased AI Principles” and a vendor transparency package: an acceptable use policy, model or system cards and a channel to report outputs, with agency procurement policies updated by 11 March 2026.

Two 2026 orders complete the picture. Executive Order 14409 of 2 June 2026 directs CISA, Treasury and the NSA toward AI-enabled cyber defence, creates a classified benchmark to define a “covered frontier model” and a voluntary route for developers to give the government up to 30 days of pre-release access; section 3(c) states that nothing in it authorises mandatory licensing, preclearance or permitting. NSPM-11 of 5 June 2026 replaced the 2024 national security memorandum on AI. The output of all this is visible in the 2025 consolidated federal AI use case inventory released on 14 April 2026: 3,611 use cases from 56 agencies, 445 of them flagged high-impact, 1,818 deployed or piloted.

The point for a private company is simple. If you sell AI to a federal agency, the memoranda are your federal AI law in practice, flowed down through the contract, and the records they demand are the same ones that state laws and the EU AI Act demand: an AI inventory, an impact assessment, a model card and an acceptable use policy.

Federal preemption of state AI laws: what EO 14365 has done, and has not

Congress tried twice to stop the states and failed twice. On 1 July 2025 the Senate voted 99-1 to strike a ten-year moratorium on state AI laws from the reconciliation bill. In early December 2025 a preemption rider was dropped from the FY2026 NDAA after 36 attorneys general and about 280 state legislators from 43 states objected. Four days after the defence bill text appeared without it, the White House signed Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence”, on 11 December 2025.

The order names Colorado’s algorithmic-discrimination law as the problem and gives six instructions. Section 3 creates an AI Litigation Task Force at the Department of Justice “whose sole responsibility shall be to challenge State AI laws”. Section 4 asks Commerce, within 90 days, to identify “onerous” state laws, at a minimum those that “require AI models to alter their truthful outputs”. Section 5 conditions BEAD broadband non-deployment funds on a state not having such laws. Section 6 asks the FCC to open a proceeding on a federal AI disclosure standard that would preempt conflicting state law. Section 7 asks the FTC for a policy statement on when state laws requiring the alteration of truthful outputs are preempted by the FTC Act. Section 8 orders a legislative recommendation and tells its drafters not to propose preempting state laws on child safety, AI infrastructure or state government procurement. Section 9 creates no enforceable rights. The order itself preempts nothing; only Congress or a court can do that.

The Task Force was created by Attorney General memorandum on 9 January 2026. Its only courtroom action is an intervention on 24 April 2026 in X.AI LLC v. Weiser, xAI’s challenge to Colorado’s law, arguing that the Act compels discrimination in breach of equal protection. Three days later the parties stipulated a stay: Colorado will not enforce the law, or any legislation replacing it, until fourteen days after a preliminary-injunction ruling, and xAI’s motion is due 28 days after the Attorney General’s implementing rules are final. Those rules are due on 1 January 2027, so the stay now reaches Colorado’s replacement statute. The only merits ruling on a state AI law went the other way: on 4 March 2026 the Central District of California denied xAI a preliminary injunction against California’s training-data transparency law AB 2013, which remains enforceable pending appeal.

The policy track is equally unfinished. The National Policy Framework released on 20 March 2026 is a short set of recommendations to Congress in seven areas: it asks for preemption of state laws that regulate model development or impose developer liability for third-party misuse, leaves child protection, fraud, consumer protection and state procurement with the states, and criticises transparency and incident-reporting duties of the California SB 53 type. The FTC’s proposed policy statement of 1 July 2026 argues that a state law requiring a company to alter truthful AI outputs is impliedly preempted where it conflicts with federal regulatory schemes; it is a litigation posture, not a rule. In Congress, H.R. 5388 has not been marked up, Senator Blackburn’s TRUMP AMERICA AI Act exists as a 291-page discussion draft without a bill number, Senator Cruz’s SANDBOX Act sits in committee, and the Senate Commerce AI markup slipped from July to September 2026 with nothing reported out. On 23 September 2026 26 attorneys general asked congressional leaders to write an explicit no-preemption clause into any federal AI law.

The compliance conclusion follows from the dates. A programme that assumed preemption in December 2025 has spent ten months out of step with the law as applied. Both layers bind, and the global AI laws picture still has the United States as a patchwork.

The state layer a federal reader cannot ignore

The state statutes are where the operational duties live, and the preemption campaign has not slowed them. Orrick’s tracker counted more than 190 state AI laws by March 2026, and the Transparency Coalition counts fourteen chatbot-safety laws enacted in 2026 alone. The spokes of this cluster carry the detail; the dates below are the ones a federal reader needs.

Colorado repealed its 2024 Act and replaced it with SB 26-189 on 14 May 2026: a transparency and consumer-rights regime for automated decision-making technology in consequential decisions, effective 1 January 2027, with Attorney General rules that went to hearing on 26 October 2026 and are due by 1 January 2027. Enforcement is stayed by the xAI stipulation. Our Colorado AI Act guide tracks the rulemaking.

California runs the densest regime. SB 53 has required frontier developers since 1 January 2026 to publish a frontier AI framework and report critical safety incidents to the state. AB 2013 on training-data disclosure survived its first court test. The CCPA regulations on automated decision-making technology phase in: notices, opt-out and access rights for significant decisions by 1 January 2027, risk assessments completed by 31 December 2027 and attested to the agency by 1 April 2028, cybersecurity audits from 2028. SB 243 on companion chatbots has applied since 1 January 2026. In September 2026 the Governor signed 22 further AI and privacy bills, including a state registry of AI auditors (SB 813 and AB 1405) and SB 947 on automated decision systems in employment. The California AI laws hub and the California AI Transparency Act guide carry the texts.

Texas’s TRAIGA has applied since 1 January 2026 with Attorney General-only enforcement, a 60-day cure period and a safe harbour for programmes aligned with the NIST AI RMF. Illinois HB 3773 bars employers from AI with a discriminatory effect and from zip codes as proxies since the same date. New York’s RAISE Act, amended on 27 March 2026, takes effect on 1 January 2027 for frontier developers, and the state signed the broadest chatbot-safety law to date on 28 October 2026, also effective 1 January 2027. Utah’s AI Policy Act sunsets on 1 July 2027 unless renewed. New York City’s Local Law 144 bias audit has applied since July 2023, and the State Comptroller’s audit of December 2025 found one violation in 32 sampled employers, a reminder that weak enforcement is not absence of duty.

Federal AI laws as a records problem: the evidence file that covers both layers

Read side by side, the federal AI laws, the OMB memoranda, the state statutes and the EU AI Act ask for the same nine records. The difference is who can demand them and when. A company that keeps each record once, dated and linked to the AI system it describes, answers all four at the price of one.

Two rows deserve a note. The TAKE IT DOWN Act is not an incident-reporting law, but its 48-hour clock only survives scrutiny as a logged workflow with timestamps, which is why it sits in the incident row; the same log serves the Article 73 serious-incident duty for a European deployer. And the model card row is where federal procurement, California and Brussels converge most exactly: M-26-04 asks vendors for model or system cards, AB 2013 asks for a training-data summary, and Annex XI of the EU AI Act asks for both from general-purpose model providers. One document, three readers.

The practical rule is one record per AI system, dated, with the obligation it proves written on it, kept in the platform that holds the inventory so that compliance monitoring runs on the records an examiner will read. That is what makes a system auditable under any of the four regimes, and it is the loop AI Sigil runs: the inventory first, the controls attached to each system, the evidence dated and linked to the control it satisfies. The EU AI Act operator’s guide shows the same file from the European side, and the AI compliance guide explains why the file, not the policy binder, is what regulators read.

What to watch between now and 2027

The federal calendar for the next fourteen months is a list of deliverables that may or may not arrive, so the watch list is as much about absences as events.

• Late November 2026: the proposed statutory definition of “Super Intelligence” under section 3 of EO 14434, which would be the first attempt to change <code>15 U.S.C. 9401(3)</code>.
• Any day: the Commerce evaluation of “onerous” state laws, overdue since 11 March 2026; its publication would trigger the BEAD funding condition and the FCC proceeding.
• The FTC’s final “Suppression of Accuracy” policy statement, and whether the Commission uses it as an amicus position in state litigation.
• 1 January 2027: Colorado’s Attorney General rules, followed 28 days later by xAI’s preliminary-injunction motion in Weiser; the same day Colorado SB 26-189, New York’s RAISE Act and chatbot law, Washington’s HB 2225 and the CCPA notice and opt-out duties for automated decision-making technology take effect.
• The Ninth Circuit’s decision in xAI v. Bonta, the first appellate word on a state AI transparency law.
• The lame-duck session: the NO FAKES Act, blocked on the Senate floor on 30 September 2026, the Kids Online Safety Act and the House’s KIDS Act, and the CREATE AI Act reported 29-0 in June; then the 120th Congress in January 2027.
• NIST’s revision of the AI RMF announced in the Action Plan, the Cyber AI Profile still in draft after an August 2026 workshop, and the bill that would codify the Center for AI Standards and Innovation.
• For multinationals, the European clock runs in parallel: Article 50 transparency duties have applied since 2 August 2026, and the Annex III high-risk obligations apply from 2 December 2027 after the Digital Omnibus, Regulation (EU) 2026/1744.

FAQ

<b>Is there a comprehensive federal AI law in the United States?</b>

No. As of 31 October 2026 Congress has enacted no comprehensive AI statute, no AI licensing or registration law and no law preempting state AI laws. The AI statutes on the books (the National AI Initiative Act of 2020, the AI in Government Act, the Advancing American AI Act, the AI Training Act and the AI provisions of the FY2026 NDAA) govern federal agencies. The one AI-specific statute aimed at companies is the TAKE IT DOWN Act. Everything else that binds a company comes from existing law applied to AI: the FTC Act, Regulation B, Title VII, securities law, Section 1557 and bank supervisory guidance.

<b>What does the TAKE IT DOWN Act require, and who is a covered platform?</b>

The Act makes it a federal crime to knowingly publish nonconsensual intimate imagery, including AI-generated “digital forgeries”, and since 19 May 2026 requires covered platforms to run a notice-and-removal process that removes reported images and known identical copies within 48 hours of a valid request. A covered platform is a public website, app or service that primarily hosts user-generated content, not only a social network. Failures are treated as violations of an FTC rule, with civil penalties of USD 53,088 per violation. The FTC has opened TakeItDown.ftc.gov for complaints; no enforcement action had been announced by late October 2026.

<b>Does Executive Order 14365 preempt state AI laws?</b>

No. An executive order cannot preempt state law; only a federal statute or a court applying one can. EO 14365 of 11 December 2025 directs the Department of Justice to litigate against state AI laws, Commerce to list “onerous” laws, the FTC to issue a policy statement, the FCC to open a proceeding and the White House to propose legislation. By 31 October 2026 the Task Force had intervened in one case, which is stayed; the Commerce list had not been published; the FTC statement remained a proposal; the FCC proceeding had not opened; and no preemption bill had left committee. Every state AI law that was enforceable in December 2025 is still enforceable, apart from Colorado’s, which is stayed by agreement of the parties.

<b>Does OMB M-25-21 apply to private companies?</b>

Not directly. M-25-21 binds federal agencies, and M-25-22 governs how they buy AI. A private company meets them through the contract: an agency that uses your system as high-impact AI must evidence pre-deployment testing, an impact assessment, monitoring, human oversight and an appeal route, and it will ask you for the inputs. M-25-22 adds clauses that bar training on government data without consent and require portability and lifecycle monitoring, and M-26-04 asks every large language model vendor for an acceptable use policy and model or system cards. For a vendor to government, these memoranda are the closest thing to a federal AI law in force.

<b>Which federal agencies enforce AI rules today, and under which laws?</b>

The FTC under Section 5 of the FTC Act and the TAKE IT DOWN Act; the CFPB under ECOA and Regulation B, where the duty to give specific adverse-action reasons survived the May 2025 withdrawal of its circulars; the EEOC under Title VII and the ADA, with its AI guidance removed but the statutes intact; the SEC under the securities laws, with three “AI washing” actions in August and September 2026; HHS under Section 1557, with <code>45 CFR 92.210</code> confirmed in force in June 2026; the banking agencies under SR 26-2 since April 2026; and the FDA for AI-enabled devices under guidance that is still partly in draft. The Department of Justice enforces no AI statute but litigates against state AI laws through its Task Force.

<b>What did the “Super Intelligence” executive order change?</b>

Executive Order 14434 of 29 September 2026 directs federal agencies to use the terms “Super Intelligence” and “SI” instead of “Artificial Intelligence” and “AI” in non-statutory documents, reports and websites, to the extent current law allows. It states that the terms carry the same meaning as the statutory definition in <code>15 U.S.C. 9401(3)</code> and asks for proposed statutory language within 60 days. Prior regulations, contracts and grants need not be revised. A voluntary White House Accord on Super Intelligence was signed by major developers the same day; it creates no enforceable obligations. The order changed nothing in the law that binds companies.

Conclusion

The federal AI laws that bind a company in October 2026 are few, old and specific: a takedown statute with a 48-hour clock, and a set of sector laws whose regulators have kept enforcing while their AI guidance was withdrawn. The federal AI policy that governs agencies and their vendors is detailed and current, and it reads like the EU AI Act in American procurement language. The preemption campaign, ten months on, has produced one stayed intervention, one lost injunction motion, an unpublished list and a proposed policy statement, while the states enacted another year of statutes. The practical response is not to pick a layer but to keep the records all layers ask for, one per AI system, dated and linked to the obligation each proves. Start with the inventory; every other record attaches to it.