AI Preemption Under Executive Order 14365: 6 Directives, 0 State Laws Preempted

Executive Order 14365 gave federal agencies 6 instructions aimed at state AI laws. It was signed on 11 December 2025, and 319 days later the count of state AI laws actually preempted, by Congress, a court or a final agency rule, is 0. AI preemption is still a campaign, not a legal fact. This ledger tracks each directive against the official record, so your compliance plan rests on what happened rather than on what was announced.

The short answer

Where does federal AI preemption stand in October 2026? No state AI law has been preempted. The order created a Justice Department task force and asked Congress for a national standard, but Congress has passed nothing, the Commerce list of targeted laws has not been published, and the only court action produced a stipulated stay, not a ruling.

What Executive Order 14365 told agencies to do

The order, titled "Ensuring a National Policy Framework for Artificial Intelligence", appears at 90 FR 58499. Its policy line is a "minimally burdensome national policy framework for AI". Its only named target is Colorado, whose 2024 law the preamble said "may even force AI models to produce false results".

It then split the work across 6 actors, each with a clock. The Attorney General had 30 days to stand up an AI Litigation Task Force. Commerce had 90 days to publish an evaluation naming "onerous" state laws. NTIA had 90 days to issue a notice cutting those states out of leftover broadband money.

The FTC had 90 days to issue a policy statement on when state laws requiring altered AI outputs are preempted by the FTC Act. The FCC had 90 days to open a proceeding on a federal disclosure standard, but its clock starts only when the Commerce list is published. Two White House advisers were told to draft legislation, with no deadline at all.

Here is the part most vendor briefings skip. An executive order cannot preempt a state law by itself. It can direct federal lawyers to sue, attach conditions to federal grants and ask Congress to legislate. Every one of those routes ends somewhere other than the White House, which is why the ledger below tracks agencies, courts and Congress rather than the order.

The order also limited its own reach. Section 8(b) says the legislative proposal "shall not propose preempting" state laws on child safety, AI compute and data centre infrastructure, or state government procurement and use of AI. That carve-out list matters more for your planning than any of the deadlines.

The AI preemption ledger, directive by directive

Each row below is dated to the primary record where one exists. Where we could not find a primary record, the row says so plainly instead of guessing. Days are counted from the signing date of 11 December 2025.

Sources: EO 14365 text; Broadband Breakfast on the 9 January memo; Roll Call, 30 June 2026; FTC notice at 91 FR 41638; White House framework PDF. "Not found" means absent from the Federal Register, agency release pages and the law firm trackers checked on 26 October 2026, not proof that no internal document exists.

The Commerce list is the missing keystone

Section 4 is not one task among six. It is the input the other tools need. The Task Force was meant to take referrals from it, the BEAD notice applies only to states "identified pursuant to section 4", and the FCC clock starts on its publication.

Congressional Republicans wrote to Commerce Secretary Howard Lutnick on 19 February 2026, urging the department to include Colorado's AI Act and New York's RAISE Act, according to a Butzel Long client alert. The deadline then passed without a public list. My read is that a published list would invite immediate lawsuits from named states, and keeping it unpublished keeps the threat flexible. That is an inference, not something Commerce has said.

The BEAD funding lever is still unpulled

The money lever is the BEAD broadband programme's leftover "non-deployment" funds. In testimony reported by Roll Call on 30 June 2026, NTIA Administrator Arielle Roth said "no final decision" had been made on the AI policy notice, and deferred specifics on whether funds would be withheld. A September 2026 Light Reading report said NTIA guidance freed savings for deployment and left other uses to later guidance.

The trade-off this lever forces is real for some states. A Texas think tank analyst told CQ-Roll Call in February that choosing between an AI law and broadband money would be "a tremendously hard political decision". Until the notice exists, no state has actually had to make that choice.

The March framework: what Congress was asked to preempt

On 20 March 2026 the White House released the National Policy Framework for Artificial Intelligence: Legislative Recommendations. It runs to 7 sections and 27 bullet recommendations, which we counted from the PDF itself. It is a request to Congress and creates no legal obligation on its own.

Section VII carries the preemption ask. It tells Congress to "preempt state AI laws that impose undue burdens" so the country has a national standard, "not fifty discordant ones". It also tells Congress not to create "any new federal rulemaking body to regulate AI", leaning instead on existing regulators and industry standards.

The three things states would lose

The framework names three zones where states should not act. States "should not be permitted to regulate AI development", which it calls "an inherently interstate phenomenon". States should not "unduly burden Americans' use of AI" for activity that would be lawful without AI. And states should not penalize developers for a third party's unlawful conduct involving their models.

The first zone is the one that maps onto existing statutes. Frontier model laws such as California's SB 53 regulate developers directly, which places them squarely inside what the White House wants removed. The third zone reads like a direct answer to deployer liability models such as the one Colorado originally wrote.

The three things states would keep

Section VII also lists what a national standard should not preempt. States keep "traditional police powers" to enforce generally applicable laws, "including particular laws to protect children, prevent fraud, and protect consumers". They keep zoning authority over where AI infrastructure goes. They keep control over their own use of AI, through procurement and public services.

Read those two lists together and the design becomes clear. The White House is not asking Congress to wipe out state power over AI. It is asking Congress to move the regulation of how models are built to Washington, while leaving states their existing tools for policing what companies do with them.

Congress: discussion drafts, no preemption statute

This is the only branch that can deliver broad AI preemption, and it has not. The history weighs against it. In July 2025 the Senate voted 99 to 1 to strip a state AI enforcement moratorium from the budget bill, and every attempt since has been a draft rather than a law.

On the Senate side, Senator Marsha Blackburn released an updated 291-page discussion draft, the TRUMP AMERICA AI Act, on 18 March 2026, two days before the framework. Covington's reading is that it "does not expressly preempt all state and local laws related to AI" and in places lets states go further. July reporting said her package was still being negotiated with the White House.

Senate Commerce chair Ted Cruz then postponed a planned 29 July AI markup to September after senators could not agree on a bipartisan package. The committee did advance 4 children's online safety bills on 5 August, including the Kids Online Safety Act, by unanimous vote, according to IAPP. None of those bills carries broad preemption, and we found no report of the postponed AI markup taking place.

The House route is slower still. Representatives Jay Obernolte and Lori Trahan released a 269-page discussion draft, the Great American AI Act, on 4 June 2026. Broadband Breakfast reported on 17 September that 11 bills carrying most of that package cleared the House Science Committee in July, none had reached the floor, and a combined floor vote might come in December.

So the congressional score on 26 October 2026 is simple. We found no introduced congress.gov bill number for either comprehensive draft in the sources checked, no floor vote, and no enacted preemption clause. I would not plan around a preemption statute before the current Congress ends, and nor should your legal budget.

Courts and the FTC route: one intervention, zero rulings

The AI Litigation Task Force has not, as far as we could find, filed a lawsuit of its own against any state. Its one appearance is in a case someone else started. On 9 April 2026, xAI sued Colorado Attorney General Philip Weiser over the 2024 Colorado AI Act, case 1:26-cv-01515 in the District of Colorado.

On 24 April 2026 the Justice Department filed a complaint in intervention, raising Equal Protection claims, as Legal 500 reported. Three days later a magistrate judge stayed enforcement. That stay came on a joint motion that Colorado's own Attorney General agreed to, citing a pending legislative rewrite. It was not a finding that the law was unconstitutional.

Governor Jared Polis signed SB 26-189 on 14 May 2026. It repeals the 2024 Act and replaces it with a disclosure and rights framework for automated decision-making, effective 1 January 2027, per Carpe Datum Law. The detail of what that rewrite requires is covered in the Colorado AI Act status tracker, and the draft rules are mapped in the breakdown of Colorado's draft ADMT rules for deployers.

The FTC route is different in kind. On 7 July 2026 the Commission published a proposed "Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems" at 91 FR 41638. It argues that state law "is impliedly preempted to the extent it conflicts" with the FTC Act, and it names Colorado's revised Act as one example.

A policy statement is an enforcement posture, not a rule, and this one is still a proposal. Comments closed on 31 July 2026, and we found no final version on the FTC's release pages through 22 October. How the statement collides with Colorado's law in practice is the subject of the analysis of the FTC statement against Colorado's AI law. This is the route I would watch most closely, because it works case by case and does not need a Commerce list or a vote in Congress.

How the states responded to the preemption push

States did not stop legislating. A count by New York University's Center on Technology Policy, dated 6 July 2026 and reported by Model Diplomat, found 109 AI laws and 28 data centre statutes enacted in the first half of 2026. Fewer states were acting, 29 against 39 at the same point in 2025, which is a directional sign of a chill rather than a halt.

The mix shifted too. The same count describes states converging on child safety, data centre and consumer protection bills. Those are the categories the order and the framework both carve out, so states are moving toward the ground that federal preemption is least likely to reach.

Individual states split. Colorado rewrote its law under litigation pressure. California officials said they would fight any lawsuit, and its frontier transparency law, SB 53, has applied since 1 January 2026, as covered in the guide to California AI laws for software vendors. Texas lawmakers described a wait-and-see posture, and the enforcement record of its own statute is tracked in the review of Texas TRAIGA enforcement.

The administration also used pressure that leaves no court record. CQ-Roll Call reported in February that the White House Office of Intergovernmental Affairs sent Utah lawmakers a memo calling a pending bill, HB 286, "an unfixable bill that goes against the Administration's AI Agenda". In my view this quiet channel has done more to shape state bills than the formal tools in the order.

Where this ledger is weakest

A status ledger is only as good as the records it can see. Three gaps deserve stating, because each could change a row above.

Absence of a record is not absence of action

The Commerce evaluation, the BEAD notice and the FCC proceeding are marked "not found". That rests on searches of the Federal Register, agency release pages and law firm trackers, not on a statement from any agency. An internal draft list could already be shaping Justice Department referrals. We also could not open the live Colorado docket, so a filing after May 2026 could be missing here.

Preemption does not need a list or a statute

The stronger counter-argument is legal, not factual. Implied conflict preemption already exists. A company sued under a state law can argue that the law conflicts with a federal scheme, and the FTC's proposed statement hands it that argument in writing. A court could accept it in a private case next month without any of the six directives being finished.

The "0 preempted" headline is accurate as a count. It would be wrong to read it as "no risk to state laws". The pressure is real, it is just not yet a ruling. Colorado shows the more likely path: states amending their own laws under pressure, which never appears as preemption in any count.

Which state AI obligations vendors can still count on

For a founder or director, the useful question is not whether preemption wins. It is which state obligations to keep funding. The table sorts common duties by how exposed they are, using the order's carve-outs and the framework's own lists as the test.

Exposure is our judgement from the carve-out language, not a legal opinion. Every row above remains enforceable on its effective date until a court, a final rule or Congress says otherwise.

The practical rule follows from that last line. Plan for every state AI law on your list to be enforceable on its effective date. I would not budget a single dollar of compliance savings on federal preemption in 2026, because the only preemption mechanism that has moved at all is a proposed FTC statement.

The one adjustment worth making is in documentation. If you alter or filter model outputs to meet a state rule, write down why the altered output is still accurate. That record answers the Colorado-style duty and the FTC's deception theory at once, which is cheaper than picking a side. For state deployer duties beyond Colorado, the Connecticut AI law deployer obligations breakdown shows the same pattern.

Frequently asked questions

Where to start this week

Pull your state compliance register and add one column: federal exposure, scored low, medium or high using the table above. Any line item marked low that someone has paused "pending preemption" should be restarted now, because nothing in the federal record supports pausing it.

Then set three alerts: the Federal Register for any Commerce or NTIA notice citing Executive Order 14365, the FTC press page for a final accuracy statement, and the Colorado docket 1:26-cv-01515. Those three sources will tell you before any vendor newsletter does whether a row in this ledger has changed.

Related reading