The conventional wisdom was that AI would be regulated federally or not at all — that fifty state regimes were unworkable and Washington would eventually act. The opposite has happened: Washington has not acted, and the states have.
The tally is no longer trivial. Comprehensive framework laws, sector-specific rules for hiring and insurance, deepfake statutes covering elections and intimate imagery, and disclosure requirements for chatbots and generated content now span most of the country.
Why it matters
Patchwork regulation changes product decisions. A feature that is legal in forty states and regulated in ten does not ship with ten different behaviors; it ships to the strictest standard or not at all. That gives the largest regulating states — California and Colorado in particular — effective national influence, the same dynamic that made California's privacy law and emissions standards de facto national rules.
It also creates real compliance cost, and the cost lands hardest on smaller companies that cannot maintain fifty-state legal review — an irony, since the laws' stated targets are usually the largest labs.
How the patchwork formed
Three waves. First came targeted statutes: election deepfakes, nonconsensual intimate imagery, algorithmic hiring audits in New York City and Illinois. Then comprehensive attempts, led by Colorado's risk-based AI act and California's frontier-model safety law. Then a flood of narrower bills — chatbot disclosure, training-data transparency, government procurement rules — passing in both red and blue states.
Federal preemption has been the counter-move: proposals to bar or pause state AI laws have been attached to must-pass legislation more than once, and have been stripped out each time under bipartisan state-level opposition.
Evidence
Legislative trackers count hundreds of AI bills introduced per session and dozens enacted. Colorado's law survived an amendment fight and delayed implementation rather than repeal; California's frontier-model law survived industry opposition and veto-risk to become the template other states cite.
On the federal side, the record is the absence of one: no comprehensive AI statute has passed either chamber, and executive action has focused on procurement and deregulation rather than binding rules for developers.
The competing read
Industry argues the patchwork chills innovation and that a single federal standard — even a light one — beats fifty experiments. State legislators counter that the experiments are the point: nobody knows what good AI regulation looks like yet, and the states are the only institutions actually trying to find out.
What happens next
Watch the first enforcement actions under the comprehensive laws, which will define what the statutes actually mean; watch Colorado's implementation, which other states are using as a template; and watch whether the next Congress attempts preemption again with a broader coalition behind it.