The United States does not have a federal AI law. Congress has been trying to write one for years and, so far, has not managed it. In the meantime, states got tired of waiting.

According to NPR’s reporting from March 28, 2026, states have passed dozens of their own AI laws covering child safety, transparency, and whistleblower protections. Lawmakers in state capitals are finding bipartisan agreement on AI rules that their federal counterparts cannot reach. And now, the Trump administration wants to stop them.

What Is Actually Happening

The Trump administration and AI and crypto policy czar David Sacks have argued that a growing patchwork of state AI laws creates an unworkable compliance burden for companies operating across multiple states. Their solution: make it a federal matter.

The House version of Trump’s budget reconciliation bill includes a provision that would block all state AI regulation for 10 years. If that provision survives the Senate, states would be prohibited from passing or enforcing their own AI laws for a decade while Congress figures out what federal rules should look like.

That provision is now facing significant pushback from within the Republican Party. More than 50 Republicans have signaled opposition. State legislators who have already passed AI laws are objecting loudly. Legal experts quoted by NPR say an executive order attempting to preempt state law would almost certainly be challenged in court, because only an act of Congress can actually restrict state regulation.

The result is a legislative impasse that affects any business deploying AI in the United States right now.

The Compliance Problem Businesses Face Today

Here is the practical situation as it stands. Federal AI legislation does not exist. State AI laws do, and more are being passed. Those state laws vary by state, cover different use cases, and carry different compliance requirements. Recent signed examples: Idaho’s Conversational AI Safety Act sets disclosure and crisis protocol rules for public-facing chatbots. Tennessee banned AI from posing as licensed mental health professionals with a private right of action. Washington created consumer lawsuit rights over AI companion chatbots via the Consumer Protection Act. These are signed laws with penalties, not proposals.

For a business deploying an AI customer service agent across multiple US states, the compliance picture is fragmented. California’s requirements around AI transparency differ from Colorado’s algorithmic discrimination rules. Texas has its own framework in development. Some states are moving faster than others.

If you are waiting for a clean, unified federal standard before deploying AI, you may be waiting for a long time. If you are deploying AI now, you are operating in a multi-jurisdictional compliance environment with no guarantee of harmonisation.

The administration’s 10-year freeze proposal, if it passes, would resolve this by essentially pausing state-level AI regulation. But the political path to that outcome is contested, and the legal durability of such a provision is not certain.

Why States Are Moving Without Congress

The NPR reporting highlights something that should not be surprising but is worth noting: state legislatures are finding bipartisan agreement on AI regulation in areas where Congress cannot.

Child safety provisions, requirements for AI transparency, whistleblower protections for AI workers — these are not especially partisan issues when handled at a state level, close to constituents. The same issues become entangled in broader political fights at the federal level.

This dynamic explains why the state patchwork exists in the first place. Nature abhors a vacuum. In the absence of federal standards, states acted. The Trump administration’s response is to try to reverse that, but it is doing so against a backdrop of state laws that are already on the books and already being enforced.

What This Means for Business

If you are a business leader making AI deployment decisions, here is the honest read on this situation.

Do not wait for perfect regulatory clarity. The trajectory of US AI regulation is moving toward some form of federal standard, but the timeline is genuinely uncertain. Waiting for clarity before deploying AI means handing a competitive window to businesses that moved earlier.

Build for compliance from the start. Whether federal preemption happens or not, the categories of AI regulation that matter to businesses — transparency, bias, data handling, accountability — are not going away. Building AI systems with those requirements in mind protects you in either scenario.

Know which states matter for your operations. If you operate primarily in one or two states, the compliance picture is more manageable than if you are deploying AI-powered tools nationally. Understand the specific requirements in the states where your customers and employees are located.

Sector-specific regulation is already active. Even without a federal AI law, sector-specific agencies are already applying existing frameworks to AI deployments. Healthcare AI faces FDA and HHS oversight. Financial AI faces SEC and CFPB scrutiny. Employers using AI in hiring face EEOC attention. The absence of a federal AI statute does not mean the absence of regulatory exposure.

The direction is pro-deployment, but the details are unsettled. The administration’s posture is clearly in favour of AI adoption and opposed to regulatory friction. That is a meaningful signal. It does not resolve the compliance questions businesses face today, but it does suggest that regulatory risk at the federal level is lower than it might otherwise be.

The Bigger Picture

The US is navigating a genuinely difficult governance challenge. AI is developing faster than legislative processes can respond. States are acting to fill the gap. The federal government wants to coordinate the response but cannot get Congress to move.

For businesses, this situation is not going to resolve cleanly in the near term. The practical approach is to build AI systems that take compliance seriously, deploy in a way that is defensible under existing state and sector-specific frameworks, and plan on the regulatory environment continuing to evolve.

The businesses that will be best positioned are not the ones that waited for certainty. They are the ones that built AI capabilities with a compliance mindset from the beginning, so that adapting to new requirements as they arrive is an adjustment rather than a rebuild.

Enterprise DNA put together a free field guide on exactly this: the full Claude ecosystem, Claude Code, and how to roll agents out without breaking things. Get the guide.