An attempt to sneak a nationwide ban on state-level AI regulation into this year’s defense bill was again rejected, a temporary defeat for proponents of broad federal preemption that failed to garner enough support. House Majority Leader Steve Scalise has told colleagues he will look for other ways to make the idea a reality, and said President Trump supports the idea but that it is in the wrong place in defense policy.
The measure marks the second major failure this year to prevent states from enacting their own AI rules, after a previous tax-and-spend push to suspend state AI laws for 10 years surfaced and died in the face of cross-aisle resistance. Industry groups say one national standard is needed. Lawmakers from both parties argue that without comprehensive federal legislation, states’ pre-emptive strikes will continue to widen the regulatory vacuum.
Veto of defense bill dashes hopes for pre-emptive action
It is not uncommon for major technology policy priorities to be added to defense bills that must be passed. But this time, the plan to block state regulation of AI was met with immediate resistance. Republican leaders told The Hill that they recognized the political and procedural issues of including broad AI preemption in a Pentagon policy bill and said they would instead try to add it to a separate bill next time.
The White House has pursued a parallel path. A leaked draft executive order indicated the administration was willing to use any enforcement authority to push back on state AI regulations, but such efforts have since been paused. Legal experts said a full preemption of state law would normally require an act of Congress. Any executive action would likely be in line with federal procurement and agency guidance and would be more limited.
Why tech companies want federal AI regulation preemption
Major software and cloud companies, along with industry groups such as the U.S. Chamber of Commerce and BSA The Software Alliance, are warning that a patchwork of national AI requirements will increase compliance costs and hinder adoption. Their arguments parallel the privacy jungle in which an industry group of privacy experts is monitoring a dozen state comprehensive privacy bills that most large companies currently manage through elaborate and overlapping compliance programs.
The industry argues that harmonizing different state standards on “high-risk” AI, disclosure, auditability, and liability is particularly difficult. Inconsistent model transparency and impact assessment thresholds can disrupt product roadmaps and complicate incident response, companies say. In CISO surveys by corporate consultancies, regulatory fragmentation consistently ranks among the top non-technical AI risks listed by security professionals, along with model security and data provenance.
Countries are formulating new AI rules anyway.
The state capitol doesn’t wait. According to the National Conference of State Legislatures, an overwhelming majority of states have proposed artificial intelligence legislation since last year, and some have passed targeted legislation. Colorado enacted an artificial intelligence law that created responsibilities for developers and those deploying “high-risk” systems, including impact assessments and post-deployment monitoring. Tennessee’s ELVIS law protects voice and likeness from AI cloning in a new way. New York City Local Law 144 requires bias audits of automated hiring tools, leaving a de facto national standard that many employers must meet.
Many of these approach practical guardrails such as safety, transparency, consumer protection, and discrimination. Supporters argue that in the absence of comprehensive federal law, states serve as an important check on high-impact uses such as employment, housing, health care and elections. State attorneys general have also indicated that they are prepared to apply their existing consumer protection and anti-unfair practices laws against deceptive AI claims.
What happens next in Washington regarding AI preemption?
Note the renewed push to adopt a federal AI bill based on a pre-emption model. This line is well known. A safe harbor for developers to comply with industry-wide standards such as risk-based liability, mandatory disclosure for high-stakes systems, incident reporting of model failures, and the NIST AI Risk Management Framework. The question is how preemptive state rules should be and whether there will be a role for state regulators in enforcement.
Regulators already have the tools. The Federal Trade Commission also said that false promises or discriminatory outcomes made by AI could violate current law. The National Institute of Standards and Technology framework has emerged as the de facto governance blueprint for all sectors, and the National Telecommunications and Information Administration is also developing policy guidance on AI liability. But these are only partial solutions, as without Congressional intervention, state and federal policies will remain mixed.
What it means for developers and businesses
In the meantime, we expect compliance leadership to continue to fluctuate at the state level. Specific steps to consider include mapping your AI use cases to your jurisdiction’s needs, operationalizing NIST risk controls, conducting independent bias and security testing as needed, and developing an incident response strategy that takes into account your state’s notification obligations. Vendor monitoring is important. Dozens of state laws impose obligations on both developers and adopters, and liability can invalidate contractual representations regarding training data, safety testing, and model monitoring.
The battle for the right to take the lead is not yet over. But this week’s snub shows that a sweeping defense bill shortcut won’t solve the problem. Until Congress decides on a viable national structure, national experimentation and scrutiny will likely determine the path of AI.
