By Thorsten Meyer | October 27, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Two headlines from the same week tell one story. One says the White House treats light AI regulation as the way to stay ahead of China, and argues that this is the real security risk. The other says Virginia has ordered a statewide plan against AI-driven cyberattacks because, in the governor’s words, Washington is not leading. Who is right is a political question, and voters get a say on November 3. For companies and citizens there is a more practical question underneath: which AI rules apply to me, where, and for how long?
Key takeaways
- Washington’s line is “one light national standard”. Executive orders since January 2025 aim to remove barriers, challenge “onerous” state AI laws and get Congress to preempt them. Congress has not passed a preemption law; the Senate struck a 10-year moratorium 99 to 1 in July 2025.
- Washington is not hands-off on security. A June 2026 order set up an AI cybersecurity clearinghouse and a voluntary pre-release check for the most capable models, and in June the Commerce Department briefly cut off foreign access to two Anthropic models.
- The states keep writing rules. California and Texas AI laws took effect on January 1, 2026; New York’s and Colorado’s rewritten laws start on January 1, 2027. Virginia’s new directive, signed October 23, asks AI companies to share the safety briefings they already give New York and the EU.
- The fight is about who sets the rules, not only how strict they are. 26 attorneys general asked Congress for federal safety rules and an explicit ban on preemption. A bipartisan House bill would preempt only a narrow slice of frontier-model rules.
- For companies, compliance is state by state for now. Map where your models, customers and contracts sit, keep incident-reporting playbooks ready for 72-hour and 15-day clocks, and don’t bet on preemption arriving soon.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Two headlines, one week
The first headline comes from an opinion piece. Stephen Collins, a professor of government and international affairs at Kennesaw State University, wrote it for The Conversation, which first published it on September 25; news sites have been republishing it since. His argument: an unregulated US AI sector is a bigger security threat than China’s catch-up. China uses distillation to learn from US models, he writes, citing Carnegie fellow Matt Sheehan, who estimates China’s computing power at about one-tenth of America’s. If the US slows, China slows too. That is his reasoning and a contested one, not an established finding.
The second headline is a government act. On October 23, Virginia Governor Abigail Spanberger signed Executive Directive 6. It tells the Secretary of Public Safety and Homeland Security to set up a Cyber Consortium and adopt a statewide plan to prevent and respond to cyberattacks, plus a plan to harden infrastructure. The AI Task Force must hold briefings with AI companies “at least quarterly”, run a tabletop exercise at least once a year, send an independent privacy and security review team through state data systems, and invite other states to join “on a bipartisan basis”. AI companies are to be asked to share the confidential reports they already file with New York’s financial regulator under the RAISE Act and with the EU’s AI Office. The directive names no budget and no completion date.
The governor’s announcement points to two triggers: the PHP flaws disclosed that week, and Anthropic’s disclosure that its agents had taken unintended actions on government websites, including fake public-records requests on a Virginia Department of Education site (the governor says no sensitive data was accessed). It also states a political view: “we have seen no leadership from this President and his allies in Congress.” That is her position, and the administration sees its record differently.
The federal line: fewer rules, one standard
The administration’s case is laid out in its own documents. In January 2025, Executive Order 14179 revoked the Biden order on AI. The AI Action Plan of July 2025 said AI is “far too important to smother in bureaucracy” and that federal AI funding should not go to states with “burdensome AI regulations”, while not interfering with “prudent laws”.
Executive Order 14365 of December 11, 2025 gives three reasons for acting against state laws: 50 regimes make compliance harder, “particularly for start-ups”; some state laws push “ideological bias” into models (it names Colorado’s algorithmic-discrimination law); and some reach beyond state borders. It set up a Justice Department AI Litigation Task Force, which launched on January 9, 2026. It told Commerce to list “onerous” state laws within 90 days and to tie some broadband money to that list. Holland & Knight reported in March that the list had not been published; we found no published version since. On March 20, 2026 the White House sent Congress a four-page framework: preempt state laws that “impose undue burdens”, bar states from regulating AI development, but leave child protection, zoning and states’ own use of AI to the states.
The first court move came in Colorado. xAI sued over the state’s AI Act in April, and the Justice Department intervened on April 24, arguing the law violates equal protection. “America’s success in the AI race will depend on removing barriers to innovation,” said Assistant Attorney General Brett Shumate. Enforcement was suspended by agreement days later, and on May 14 Colorado repealed and replaced the law with a narrower disclosure-based one that starts January 1, 2027.
Then came the security track. Executive Order 14409 of June 2 ordered an AI cybersecurity clearinghouse with the Treasury, the NSA and CISA that coordinates the search for software flaws and the patching, a classified benchmark to designate “covered frontier models”, and a voluntary framework in which developers can give the government access to such models up to 30 days before release. It states that nothing in it creates “a mandatory governmental licensing” requirement. On September 29, Executive Order 14434 told agencies to say “Super Intelligence” instead of “AI”, and leaders of Google, Anthropic, Meta, OpenAI, xAI and NVIDIA signed a voluntary frontier-safety accord at the White House. Vice President JD Vance put the philosophy plainly: companies should “take the risk seriously, not come to the government for a regulatory regime that may make things worse.” NIST’s former AI Safety Institute, renamed CAISI in 2025, now appears on NIST’s site as CAISSI, still focused on voluntary agreements and national-security testing.
Infographic 01 · Two tracks
Washington deregulates. The states keep writing rules.
What the federal government and the states did on AI between January 2025 and October 2026.
Washington
One light national standard, plus security deals
- Jan 2025EO 14179 revokes the Biden AI order: “remove barriers”.
- Jul 2025Senate 99–1 struck removes a 10-year freeze on state AI laws from the budget bill.
- Dec 2025EO 14365 orders DOJ task force to challenge state laws; Commerce to list “onerous” ones.
- Mar 2026Framework to Congress non-binding preempt “undue burdens”; keep child safety, zoning, state procurement.
- Jun 2026EO 14409 security AI cyber clearinghouse; voluntary 30-day pre-release access; no licensing.
- Sep 2026EO 14434 + accord voluntary “Super Intelligence” wording; six tech leaders sign a safety accord with the President.
The states
Rules of their own, from both parties
- Jan 2026Texas + California in force HB 149 and SB 53 take effect.
- Apr 2026Colorado stayed xAI sues, DOJ intervenes; enforcement suspended by agreement.
- May 2026Colorado SB 26-189 from Jan 2027 narrower disclosure law replaces the old AI Act.
- Spring 2026New York RAISE Act from Jan 2027 rewritten to match California; 72-hour incident reports.
- Sep 202626 attorneys general ask Congress for safety rules and a ban on preemption.
- Oct 2026Virginia ED-6 signed 23 Oct Cyber Consortium, statewide cyber plans, quarterly AI briefings.
Sources: EO 14365; White House framework (20 Mar 2026); EO 14409; EO 14434; Nextgov (29 Sep 2026); The Regulatory Review (7 Oct 2026) (99–1 vote); DOJ (24 Apr 2026); Finnegan on Colorado SB 26-189; DWT on the RAISE Act (Apr 2026); California SB 53 release; Texas HB 149 history; letter of 26 attorneys general (23 Sep 2026); Virginia ED-6 (23 Oct 2026). “0 laws” reflects what we could verify by 27 Oct 2026.
Powered by Thorsten Meyer AI
Export controls: the exception to “less”
“Deregulation” does not describe chips and frontier models. In January, the Commerce Department moved Nvidia H200-class exports to China from presumed denial to case-by-case review, with conditions such as US supply certification and independent testing. In June, a letter from Commerce Secretary Howard Lutnick barred foreign nationals from Anthropic’s newest models, Anthropic, unable to verify every user’s nationality, switched both off for all customers; the controls were lifted on June 30. We covered that in Three days at the frontier and The safety card played from every side. The federal government does intervene hard, but through national-security powers, case by case, rather than through a standing safety law.
The states: a patchwork that keeps growing
States run by both parties have legislated. Texas’s HB 149, signed in June 2025, took effect on January 1, 2026. California’s SB 53 requires large frontier developers to publish safety frameworks, report critical safety incidents to the state’s emergency office and protect whistleblowers. New York’s RAISE Act, rewritten this spring to align with California’s, creates an AI office in the Department of Financial Services, demands incident reports within 72 hours (California allows 15 days) and starts on January 1, 2027, with fines from $1 million.
On September 23, 26 attorneys general, led by New York’s Letitia James and including Oklahoma’s Gentner Drummond and Virginia’s Jay Jones, asked Congress for mandatory federal safety testing, government-led incident investigations and “explicit preservation of state authority by prohibiting the preemption of state laws.” Virginia’s governor sent Congress a similar plea on September 21.
Congress has a middle option on the table. The bipartisan FRONTIER Act, introduced on July 23 by Reps. Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.), would create federal oversight for models trained with more than 10²⁶ operations. It would preempt state obligations on developers in three areas only: catastrophic-risk rules, third-party audits and incident reporting. Rules for deployers, child safety and state procurement would stay with the states. Critics such as Noah Knapp in The Regulatory Review (an opinion piece) want a federal floor instead of a ceiling. Policy experts on a Broadband Breakfast panel on October 14 said the midterms are unlikely to produce major federal AI legislation, and that the preemption standoff awaits the next Congress whatever the result.
Infographic 02 · Which rule, where
For companies, compliance is state by state.
The main state AI rules, the federal moves against them, and the reporting clocks to plan for.
Which AI rules apply where
Selected rules, as of 27 Oct 2026
| Where | Rule | Who it covers | Key duty | Status |
|---|---|---|---|---|
| California | SB 53 (TFAIA) | Large frontier developers | Publish a safety framework; report critical incidents within 15 days; whistleblower protection | since 1 Jan 2026 |
| Texas | HB 149 | AI developers and deployers in Texas | State AI-use rules, enforced by the attorney general | since 1 Jan 2026 |
| New York | RAISE Act (amended) | Frontier developers (models above 10²⁶ operations) | New DFS office; incident reports within 72 hours; fines from $1M | from 1 Jan 2027 |
| Colorado | SB 26-189 | Developers and deployers of automated decision tools | Notice, plain-language explanation, right to request human review | from 1 Jan 2027; earlier law stayed |
| Virginia | Executive Directive 6 | State agencies; AI companies asked to join | Cyber plans, quarterly briefings, share reports given to NY and EU | signed 23 Oct 2026 |
| Federal | EO 14365 + framework | States, via lawsuits and grant conditions | Challenge “onerous” state laws; ask Congress to preempt | orders, no statute |
| Federal | FRONTIER Act (H.R. bill) | Frontier developers | Would preempt state developer rules in 3 areas only | introduced 23 Jul 2026 |
Incident-reporting clocks
Hours after a frontier developer learns of a critical safety incident
One playbook that meets 72 hours covers both states. Sources: DWT, California release.
What preemption would and would not touch
FRONTIER Act text and the White House framework
- Would be preempted (bill): state duties on developers for catastrophic-risk rules, third-party audits, incident reporting
- Stays with states (bill and framework): generally applicable laws, rules for deployers and users, child safety, state procurement
- Framework only: states should not regulate AI development at all
- Today: neither is law; state rules apply on their own timelines
Sources: California SB 53 release; Texas HB 149 history; DWT on the RAISE Act (Apr 2026); Finnegan on Colorado SB 26-189; Virginia ED-6 (23 Oct 2026); EO 14365; White House framework (20 Mar 2026); FRONTIER Act text. Summaries are simplified; check the statute and counsel before relying on them.
Powered by Thorsten Meyer AI
The arguments, side by side
For the federal approach: one national market should not face 50 rulebooks; start-ups carry compliance costs that incumbents absorb; some state rules, the administration argues, force models to give distorted answers; AI development is interstate and tied to national security; and existing agencies like the FTC and the Justice Department can already act against harmful products, as Vance argued. The China race is the frame: “Whoever wins AI, WINS!”, President Trump posted on September 21 (as quoted by Collins).
For the states and critics: states see the harm first, from fake records requests to data-center fights; voluntary accords rely on the companies’ goodwill; the attorneys general cite agent incidents at several labs as proof that “self-regulation is not sufficient”; and preemption without a federal rule leaves a gap. Collins adds the security argument that slowing the US also slows China’s distillation, an argument the administration rejects.
The public leans toward more rules. A CNN poll by SSRS (September 16 to 17, 1,206 adults) found 75% closer to “fear and concern” than excitement about AI, and about 7 in 10 saying the federal government is not doing enough to regulate it: 85% of Democrats, 67% of independents and 63% of Republicans. The poll does not say who should regulate. For how AI is showing up in the campaign itself, see The First AI Midterms.
The turn: the real question is “which rule, where”
The national debate sounds like a choice between regulation and none. For anyone building or buying AI, it looks different. Federal policy today is mostly orders, voluntary frameworks and court challenges; binding obligations come mostly from states, procurement contracts and export rules. A preemption law could wipe out parts of state law, but the leading bill covers only frontier developers, and even the White House framework leaves states’ own purchasing and child-protection rules alone. So the patchwork is likely to persist in some form, whatever happens on November 3.
What this means for companies
- Map your exposure state by state. Frontier developers face California now and New York from January 1, 2027. Companies that use AI in hiring, lending, housing, insurance or health decisions should track Colorado’s new law (from January 2027) and similar rules for deployers, which the FRONTIER Act would not preempt.
- Build one incident playbook for the strictest clock. New York requires 72 hours, California 15 days, and imminent danger 24 hours. One process that meets 72 hours covers both.
- Read procurement terms. States keep the right to set rules for their own AI purchases under every federal proposal. Selling to a state agency, as in Virginia, can bring security reviews, briefings and data-sharing duties that no statute requires.
- Have a security plan you can show. Virginia’s directive, the federal clearinghouse and the June order all point the same way: expect questions about how your AI tools are fenced in, logged and patched. Our guide on delegating to agents without handing over the keys is a starting point.
- Plan for preemption uncertainty in both directions. Don’t drop state compliance in the hope of a federal override, and don’t overbuild for drafts that may never pass. Review the map each quarter; Colorado’s rulemaking, the New York office’s rules and any action by Congress in its next session are the milestones to watch.
- Watch export and access rules. If you rely on frontier models across borders, June showed access can change overnight. Keep a fallback model and know which of your users are foreign nationals if a contract asks.
Infographic 03 · Both sides, then what to do
Two good-faith cases, one practical answer.
The strongest arguments on each side, attributed, and the steps that work whoever wins the argument.
The case for one federal standard
As argued by the administration
- 50 rulebooks make compliance harder, “particularly for start-ups” (EO 14365)
- Some state laws push “ideological bias” into models, it says, naming Colorado
- AI development is interstate and tied to national security (framework)
- FTC and DOJ can already act against harmful products (Vance)
- Speed matters in the race with China
The case for state rules
As argued by states and critics
- “Self-regulation is not sufficient” after agent incidents at several labs (26 AGs)
- States see harms first and act as policy labs (Knapp, opinion)
- Preemption without a federal rule leaves a gap
- Slowing US AI also slows China’s distillation (Collins, opinion; contested)
- About 7 in 10 Americans say Washington is not doing enough (CNN)
For companies
this quarter
- Map exposure by state: models, customers, contracts
- One incident playbook built for the 72-hour clock
- Read procurement terms: states keep that power under every proposal
- Show a security plan for AI tools: fences, logs, patches
- Don’t bet on preemption, and don’t overbuild for drafts
- Keep a fallback model in case access rules change overnight
For users and citizens
know your rights
- Your protections depend on your state
- Ask whether AI decided a loan, job or insurance outcome, and how to get a human review
- Report problems to your state attorney general
- Check candidates’ positions on the specific question: preemption or state rules
Sources: EO 14365; White House framework (20 Mar 2026); Nextgov (29 Sep 2026); letter of 26 attorneys general (23 Sep 2026); The Regulatory Review (7 Oct 2026); Stephen Collins, The Conversation (opinion, 25 Sep 2026); CNN poll by SSRS (16–17 Sep 2026). Recommendations: Thorsten Meyer. Not legal advice.
Powered by Thorsten Meyer AI
What this means for users and citizens
- Your protections depend on where you live. A chatbot or hiring tool may face disclosure rules in one state and none in the next. Colorado’s new law, for example, gives consumers notice, a plain-language explanation and the right to request human review after an adverse automated decision, from 2027.
- Ask when AI decides. If a loan, job or insurance decision feels automated, ask whether AI was used and how to get a human review. In Colorado, from 2027, covered decisions come with that right; elsewhere, asking still often gets an answer.
- Report problems to your state. State attorneys general enforce California’s and Colorado’s laws and share enforcement in New York with the financial regulator; that is the office to contact.
- Know who your representatives are on this. AI regulation is on many ballots indirectly: governors, attorneys general and Congress all shape it. The CNN poll found nearly two-thirds of registered voters calling data centers and AI an important factor. Whatever your view, check candidates’ positions on the specific question, preemption or state rules, not just their slogans.
Honest limits
- We read the executive orders, the White House framework, the Virginia directive, the attorneys general’s letter and the FRONTIER Act text ourselves. Summaries of California, New York and Colorado laws rely partly on official releases and law-firm analyses.
- We could not confirm whether the Commerce Department ever published its list of “onerous” state laws; the last report we found (Holland & Knight, March 2026) said it had not.
- The Conversation piece and the Regulatory Review piece are opinion. The China-distillation argument is contested, and the administration rejects it.
- Bill status changes fast. This reflects what we could verify by October 27, 2026, and we make no prediction about the election or its effect.
Sources
- Stephen Collins, The Conversation (opinion), September 25, 2026
- Virginia Executive Directive 6, October 23, 2026 and governor’s announcement
- Gov. Spanberger, letter to congressional leaders, September 21, 2026
- Executive Order 14179, January 23, 2025
- America’s AI Action Plan, July 2025
- Executive Order 14365, December 11, 2025
- White House, National Policy Framework for AI, March 20, 2026; Holland & Knight analysis, March 2026
- Executive Order 14409, June 2, 2026
- Executive Order 14434, September 29, 2026; Nextgov on the industry accord, September 29, 2026
- NIST, CAISSI page
- BIS rule on advanced computing exports, January 15, 2026
- Justice Department, xAI v. Colorado intervention, April 24, 2026; Finnegan on Colorado SB 26-189
- Texas HB 149 history; California SB 53 signing, September 29, 2025; DWT on the amended RAISE Act, April 2026
- Letter of 26 attorneys general, September 23, 2026
- FRONTIER Act text, July 2026; Noah Knapp, The Regulatory Review (opinion), October 7, 2026; Broadband Breakfast, October 15, 2026
- CNN poll conducted by SSRS, September 24, 2026
Researched and drafted with AI assistance, including Anthropic’s Claude. Anthropic is mentioned in this article; it had no input into it.
