Federal AI Law Is Stalled. States and Plaintiffs Are Filling the Vacuum — and the Compliance Map Is Getting Complicated

There is no federal AI law. Congress has not passed one. The Trump administration’s December 2025 executive order directing agencies to preempt state AI rules is facing constitutional challenges, and enforcement agencies are working with whatever statutes they already had. In that vacuum, states and private plaintiffs have moved fast.

The analysis published by Morgan Lewis on April 2 maps the current enforcement landscape clearly: companies deploying AI in the U.S. are now navigating a fragmented multi-jurisdiction compliance environment that, paradoxically, creates more legal exposure than a single federal standard would.

The FTC is the most active federal actor. It is using Section 5 of the FTC Act — unfair or deceptive acts or practices — to police AI systems that mislead consumers, generate false claims, or enable discriminatory outcomes in credit, housing, and employment. The commission’s enforcement posture hasn’t changed dramatically under the new administration, but its January walk-back of the Rytr enforcement order shows that some AI-specific initiatives face internal political pressure.

Colorado is the most important state case to watch right now. The Colorado AI Act takes effect June 30, 2026. It imposes risk management and algorithmic discrimination requirements on developers and deployers of “high-risk AI systems” — systems that make consequential decisions in employment, education, financial services, healthcare, and housing. Compliance requires documented impact assessments, bias audits, and consumer disclosure obligations. Colorado is not a small market, and its law applies to any system that affects Colorado residents regardless of where the company is headquartered.

California, Texas, and Illinois are pursuing enforcement through existing consumer protection, biometric privacy (BIPA in Illinois), and antitrust statutes. California’s AG has opened several AI-related investigations since 2025, targeting companies that deployed AI hiring tools without adequate bias testing and marketing platforms that used AI to target protected demographic groups.

The EU AI Act is the global pressure point. High-risk system compliance rules under the Act take effect in August 2026. Any company with EU exposure is already deep in compliance prep — and multinationals tend to apply EU-level standards globally rather than maintain separate rule sets, which means EU rules functionally set the floor for global deployments.

Private litigation is adding a layer on top of regulation. Plaintiffs’ attorneys are testing novel liability theories across healthcare (AI diagnostic errors), financial services (algorithmic lending discrimination), and employment (AI screening tools that disproportionately reject protected groups). Several cases are advancing in federal court, and early discovery has produced damaging internal documents from AI deployers who did not conduct pre-deployment bias assessments.

The practical implication for teams shipping AI products: waiting for federal clarity is no longer a viable compliance strategy. Colorado’s June 30 deadline is real. EU August requirements are real. And state AG enforcement is happening now, without waiting for new legislation.

Document your bias testing. Run impact assessments before deployment. Keep records. A federal law may eventually preempt state rules, but building on the assumption that it will arrive in time to matter is a bet that an increasing number of legal teams are unwilling to make.