For Policy Intelligence Purposes Only. Not Legal Advice. Consult an attorney if you need legal guidance.
§ 01
The 60-Second Version
Key Takeaway
A state law died before it ever took effect. Colorado's SB 24-205 was the first comprehensive AI duty-of-care statute in American history, and it never reached a single consumer.1 Before it could take effect, the federal government moved systematically to dismantle it.
The infrastructure that ended Colorado's law is in place and will likely outlast this administration — as the statutes and agency actions that could lock it in permanently at the federal level are still being written. This is the gap this brief addresses.
EO 14365's Five Tracks
5×
Commerce evaluation, NTIA BEAD conditioning, DOJ litigation, FCC proceeding, FTC policy statement — running simultaneously.
AGs Opposing FCC Preemption
23+
Attorneys general representing 22 states and DC filed opposition to FCC AI preemption inquiry, December 2025.36
OSTP Docket Comments
793
Comments received on OSTP regulatory reform docket No. OSTP-TECH-2025-0067; 503 posted as of May 2026.9
Executive Order 14365, signed December 11, 2025, did not preempt Colorado in a single stroke.2 It mobilized five parallel pressure tracks: a Commerce evaluation to identify conflicting state laws under Section 4, NTIA BEAD grant conditioning under Section 5, a DOJ litigation task force, an FCC disclosure proceeding under Section 6, and an FTC policy statement directive. Each track was designed to pressure any state with comprehensive AI regulation to retreat.
Those five tracks produced fast results. In April 2026, DOJ filed as an independent plaintiff-intervenor in Elon Musk's xAI lawsuit challenging Colorado's algorithmic discrimination statute, asserting federal preemption theories independent of xAI's own case.3 Governor Polis signed SB 26-189 on May 14, 2026.4 The replacement statute stripped out the duty of care and the private right of action, and removed mandatory algorithmic impact assessments from the compliance framework. What remained was a disclosure, documentation, correction, and human-review regime enforced by the Attorney General alone.
Senator Blackburn's TRUMP AMERICA AI Act would codify that sequence into permanent federal law and preempt state AI regulation nationwide. As of May 22, 2026, it remains a discussion draft without a bill number.5 The GUARDRAILS Act would repeal EO 14365 entirely, but it has no committee action scheduled under the current Republican majority.6 The 10-year state AI moratorium in early versions of the One Big Beautiful Bill was stripped by a 99-1 Senate vote on Byrd Rule grounds — reconciliation is not a preemption vehicle.7
What the administration has not yet published matters as much as what it has. The Commerce evaluation of state AI laws under Section 4 has not been confirmed as publicly released, and neither the FTC policy statement nor the FCC proceeding docket number has appeared as of May 22, 2026.8
§ 02
The Reality Check
Two errors are spreading through corporate AI compliance conversations right now, and both carry real cost.
1
Error One: Reading Colorado as a Compliance Reset.
Colorado replaced its AI Act. It did not abandon AI oversight.35 SB 26-189 retains mandatory disclosure when a high-risk AI system materially influences a consequential decision, documentation requirements for developers and deployers, consumer correction rights, and meaningful human review after an adverse outcome — all enforceable by the Attorney General from January 1, 2027. Meanwhile, 23 attorneys general representing 22 states and the District of Columbia filed opposition to the FCC's AI preemption inquiry in December 2025.36 States are not surrendering. They are retreating to legally defensible ground. Companies that read the Colorado replacement as evidence that all state AI compliance obligations have cleared may face enforcement under the surviving laws without any infrastructure to meet them.
2
Error Two: Treating the Federal Push as Reversible.
Not all of EO 14365's mechanisms are equally reversible.38 The DOJ litigation posture is a policy choice this administration has made; a future administration could unwind it. BEAD grant conditioning is harder to reverse: agencies that have built compliance structures around grant conditions tend to maintain those structures through administration changes even when the underlying policy direction shifts. The question is not whether this pressure eventually eases, but which mechanisms may survive long enough to define the compliance landscape your business will actually operate in.
"The gap between retreating state standards and arriving federal standards is not neutral compliance space. Companies that treat it as a compliance holiday will be rebuilding from scratch when the next wave lands."
Lexora Group — Policy Intelligence Brief · May 2026
Realistic Timeline as of May 22, 2026: The Blackburn draft has not been formally introduced. The Commerce evaluation has not been confirmed as a publicly available standalone document. Neither has the FTC policy statement nor the FCC proceeding docket number. The OSTP regulatory reform docket (No. OSTP-TECH-2025-0067) received 793 comments with 503 posted, window now closed.42 The 10-year state AI moratorium was removed from the One Big Beautiful Bill by a 99-1 Senate vote. The SECURE Data Act and other AI-adjacent bills are committee referrals with no markup scheduled in either chamber.45
§ 03
So What, By Client Type
The preemption trend is favorable for your category. Colorado's replacement statute eliminated the duty of care framework and the private right of action, and dropped mandatory algorithmic impact assessments from the compliance requirements.46 Any state that modeled its legislation on the original Colorado AI Act is likely to retreat as well — this removes the compliance ceiling that was about to require the most resource-intensive overhaul of how AI products are built and deployed.
Do not mistake favorable conditions for a clear compliance field. The floor is moving, not disappearing. Disclosure, documentation, correction rights, and meaningful human review are now the minimum viable compliance posture in every state with active AI legislation, and they will likely become the federal standard when the Blackburn draft formally introduces.51 Build compliance posture around those obligations now, before the federal standard arrives and requires you to prove a baseline you have not yet documented.
Even without final rules, there is still the possibility of enforcement action. The FTC operates today under its Section 5 authority without a published AI-specific policy statement, which makes FTC enforcement on AI less predictable rather than less likely.47 The DOJ AI Litigation Task Force is actively consulting the Section 4 state evaluation outputs as part of its enforcement planning.48
Action Items
Audit your state-level compliance footprint by June 30, 2026. Map every state where your product is deployed or sold against the current status of that state's AI legislation. Document the assessment in writing as a compliance decision record.49
Start building toward the federal compliance standard now, before the Blackburn draft formally introduces. The disclosure, documentation, correction, and human-review model in SB 26-189 aligns closely with the White House National Policy Framework's recommendations.51 Document your compliant baseline now.
Assign one person to track the Commerce evaluation and the FTC policy statement directed by EO 14365 on a monthly cadence, and extend tracking to the FCC disclosure proceeding once a docket number is confirmed.52
Monitor regulations.gov weekly for new AI-related RFIs and draft your submission before any comment window opens. File in the first half of any comment window with concrete detail about how your system works and the real compliance costs any proposed rule would impose.53
When to Contact a Lawyer
Contact a lawyer before you make deployment decisions that could trigger Colorado SB 26-189's materially-influences standard. If DOJ's Complaint in Intervention in the xAI case has shifted your read on preemption exposure, or if EO 14365 grant conditioning is touching funding your operations depend on, those are the questions outside counsel handles alongside your in-house team.
For this category, the preemption debate is important context but not the main risk driver. The more immediate AI risk is likely to come from copyright, licensing, training-data, output, and contract issues, because federal efforts to preempt state AI rules would not automatically resolve federal copyright questions.55 Managing these two tracks as a single AI risk category is the primary error companies in your space are making right now.
The output-reproduction theory (the idea that AI-generated content can create copyright risk when the output looks, reads, or functions too much like someone else’s protected work) is the risk area to watch most closely. The risk does not require word-for-word or pixel-for-pixel copying. Two cases are driving this theory right now:
- New York Times Co. v. Perplexity AI Inc. (S.D.N.Y., filed Dec. 5, 2025): alleges that Perplexity's AI outputs reproduce and displace the market for NYT's copyrighted journalism, targeting what the model produces rather than how it was trained.56
- Disney Enterprises, Inc. v. Midjourney, Inc. (C.D. Cal., filed June 11, 2025): applies the same theory to AI-generated visual content. Expert discovery closes September 21, 2026; all motions due November 23, 2026; post-mediation status conference August 31, 2026.57,58
For this category, two AI risk factors deserve separate attention:
Track One — Training Data: Review your AI vendor contracts and identify any indemnification language that addresses copyright infringement, training data, or model outputs. Recent lawsuits against major AI developers show why this matters. Carreyrou v. OpenAI, Anthropic, xAI (N.D. Cal., filed Dec. 22, 2025) named several major LLM developers in the same action, while 59 Concord Music Group, Inc. v. Anthropic PBC — brought alongside UMG and ABKCO — alleges Anthropic built Claude on pirated training data and seeks roughly $3.1 billion, described as the largest non-class copyright action in U.S. history.60 If your platform depends on a third-party model, your practical risk may turn less on whether you trained the model yourself and more on what your vendor does, does not, or refuses to cover. The key question is whether your contracts clearly allocate responsibility for training-data disputes before a problem arises.
Track Two — Output Reproduction: Review a sample of AI-generated outputs against the sources, prompts, or reference materials being used. The fair use landscape remains unsettled, and recent cases point in different directions depending on the facts, the source materials, and the way the AI system is used. Thomson Reuters v. Ross Intelligence rejected fair use for AI training on its facts.62 Bartz v. Anthropic found training on lawfully acquired books to be fair use but reached the opposite conclusion for pirated-library retention.62 Kadrey v. Meta found for Meta on the specific record but explicitly warned the ruling does not establish that all AI training use of copyrighted material is lawful.62 The practical takeaway is that companies should not rely on a general assumption that “AI use is fair use.” They should evaluate the risk based on their specific product, workflow, source materials, and commercial use case.
When to Contact a Lawyer
Contact a lawyer before you finalize commercial contracts that allocate AI risk and before you respond to an enforcement letter. If you are making public claims about how your model handles copyrighted content, a privileged review before those claims publish is worth the investment. Outside counsel helps operators work through the full compliance picture, from the contract language that allocates AI risk to the board-facing documentation that positions the company when enforcement arrives.
You sit at the intersection of two moving regulatory targets. The federal preemption push reshaping state AI law directly affects the state laws governing automated decision-making and consumer data rights that your operations depend on today. At the same time, the SECURE Data Act introduces a federal alternative that has not passed but could significantly cut your compliance burden depending on how it lands.64
California’s CPRA is one of the most important state standards for automated decision-making and privacy compliance, and covered AdTech operations should treat it as a key compliance benchmark. If the SECURE Data Act passes with broad preemption, it could limit California’s ability to impose stricter automated decision-making rules than the federal standard.65 The problem: CPRA enforcement is running today. The SECURE Data Act sits in committee with no markup scheduled as of May 22, 2026, and you cannot wind down compliance with state law based on what Congress may do in 18 months.
If your operations touch health services, add a third layer. SB 26-189 retains more enforcement teeth for AI in healthcare settings than the general framework. HIPAA-covered entities are broadly exempt for non-employment uses; FDA-regulated medical devices are excluded entirely. Non-HIPAA entities and employment-related uses in healthcare are still covered.29
Action Items
Map your data pipeline against the CPRA's automated decision-making provisions now, not after the SECURE Data Act moves. California's rulemaking on automated decision-making rights is ongoing.66 Operationalize CPRA compliance first, then position for transition once federal preemption takes legal effect.
Review every third-party data provider contract and isolate the consent chains governing automated profiling. Identify every provider relationship where consent scope for automated profiling is ambiguous or undocumented, and treat each gap as a renewal-negotiation priority.67
Monitor the FCC preemption proceeding at fcc.gov and set an alert for when a formal docket number is assigned to the EO 14365 AI disclosure proceeding. The 23-AG coalition opposed FCC AI preemption in December 2025; the FCC's response will signal whether the proceeding moves on a fast or slow track.68,69
When to Contact a Lawyer
Contact a lawyer when overlapping state, federal, and sector-specific rules make it unclear how a particular workflow should be classified or governed. A state AG inquiry is another moment to bring in outside counsel before the inquiry becomes an investigation. Outside counsel pairs federal preemption analysis with the sector-specific compliance review your auditors expect, and works alongside in-house teams on use-case mapping across covered and non-covered operations inside the same business unit.
§ 04
Where You Can Actually Get Heard
The primary engagement channels available right now are informal rather than formal, and the companies building relationships in those channels today will have the advantage when formal windows open.
Formal comment periods, when they open, are the official window for companies to explain how a proposed rule would affect their operations.71 A strong submission should give the agency concrete facts it has to take seriously, not just a general policy position. Describe how your system works. Identify what the proposed rule would require you to change. Document the real compliance cost. Monitor regulations.gov weekly and start building the substance of your submission before any window opens, not during the final week when the docket is crowded with broad position statements.
Informal engagement is where companies can help shape the conversation before formal rules or bills are locked in. The White House National Policy Framework reflects months of industry consultation before its March 2026 publication.72 The Blackburn discussion draft is still developing through direct engagement with the Senator’s office and Senate Commerce Committee staff before formal introduction.73 The Senate Commerce, Science, and Transportation Committee is the expected referral destination.74 Contact the committee’s AI staff lead and request a technical briefing slot now, while the bill is still being written.
State AG engagement: If your company operates in a state whose AG joined the coalition that opposed FCC AI preemption in December 2025,75 and your AI operations involve consumer data or high-impact decisions, outreach to the AG’s technology policy team may be a useful informal channel.AG offices often shape enforcement priorities based on what they hear from companies, advocates, and the public. A company that has already explained its compliance posture before an issue arises is in a better position than one that first appears after receiving a formal demand.
Early-stage companies without the bandwidth to file independently should engage through trade associations. The CCIA filed comments in the OSTP regulatory reform docket.76 Membership can place your operational concerns into the formal comment record through coalition submissions at a fraction of the cost of filing independently.
§ 05
What to Watch
EO 14365 Section 6 directs the FCC Chairman to start a proceeding within 90 days after Commerce identifies state AI laws that may burden national AI policy. 77 Commerce’s deadline fell around March 11, 2026, which makes June 9, 2026 a useful monitoring date for possible FCC action, but not a confirmed docket deadline.78 A coalition of 23 attorneys general representing 22 states and DC opposed the FCC's AI preemption inquiry in December 2025.79
If the FCC moves forward with a formal proceeding over AG opposition, federal preemption gains a second institutional pillar independent of the Blackburn draft, and the timeline for legal challenges from the AG coalition accelerates. If the FCC narrows scope or delays in response to AG pressure, the preemption strategy becomes more dependent on the Blackburn draft, extending the realistic timeline for any federal preemption standard.
The Blackburn discussion draft has not been formally introduced as of May 22, 2026.80 Formal introduction starts the legislative clock and compresses the window for industry engagement faster than most companies expect. The Senate Commerce, Science, and Transportation Committee is the expected referral destination.81 Every company with active state-law compliance obligations or a product roadmap that depends on the current regulatory landscape needs a one-page legislative position paper ready before introduction, not drafted in response to it. Identify the committee's AI staff lead and request a technical briefing now, while the bill is still being written.
The district court's fair use denial is the most consequential pending precedent for AI companies operating on licensed or scraped datasets.82 The Delaware district court certified an interlocutory appeal on May 23, 2025, and the Third Circuit granted review on June 17, 2025, docketed as No. 25-8018.83 If the Third Circuit affirms, binding circuit precedent holds that fair use does not protect the core AI training-data use case for at least one category of commercial content.84
That precedent reaches AI startups building on licensed or scraped datasets, digital media companies using AI to synthesize existing content, and AdTech companies whose behavioral data analysis depends on third-party content. A Third Circuit affirmance would accelerate settlement pressure in the OpenAI Copyright Infringement MDL, centralized as MDL No. 3143 before Judge Stein in the Southern District of New York.85 Track the Third Circuit docket directly through the court's portal.
Appendix A
What Is Actually Being Proposed
The preemption pillar rests on Executive Order 14365, Eliminating State Law Obstruction of National Artificial Intelligence Policy, signed December 11, 2025 and published in the Federal Register on December 16, 2025.10 EO 14365 is not a single preemption rule. It is a coordinated agency mobilization directed at state AI laws across five tracks operating in parallel, and each track must be assessed separately to understand the practical impact.
Track One — Commerce and NTIA Evaluation
Section 4 directed the Secretary of Commerce, in consultation with NTIA, to evaluate state AI laws within 90 days of publication and to identify those that conflict with national AI policy, compel changes to AI model outputs, or raise First Amendment concerns.11 The 90-day window placed the deadline on or about March 11, 2026.12 As of May 22, 2026, the resulting Commerce identification has not been publicly released.
Track Two — NTIA BEAD Grant Conditioning
Section 5 conditions remaining BEAD Program non-deployment funds on state AI policy alignment with national AI policy and directs federal agencies to assess other discretionary grant programs for similar conditioning.13 The legal validity of conditioning federal grants on state regulatory policy remains contested, and any client recommendation that depends on the grant track should travel with that caveat.
Track Three — DOJ Litigation Posture
The Attorney General established a DOJ Artificial Intelligence Litigation Task Force to coordinate federal litigation against state AI laws identified through the Section 4 process.14 On April 24, 2026, DOJ filed its own Complaint in Intervention as an independent plaintiff-intervenor in X.AI LLC v. Weiser, No. 1:26-cv-01515-DDD-CYC (D. Colo.), asserting federal preemption and constitutional theories that DOJ owns regardless of xAI's case posture.15 No independent DOJ-originated federal lawsuit against a state AI statute has been filed as of May 22, 2026, but the institutional infrastructure is in place.
Track Four — FCC Disclosure Proceeding
Section 6 directs the FCC Chairman to initiate a proceeding within 90 days of publication of Commerce's Section 4 identification.16 Counting 90 days from the on-or-about March 11, 2026 Commerce deadline places June 9, 2026 as a 180-day EO-sequencing monitoring trigger — not a docket-specific deadline.17 As of May 22, 2026, no formal EO 14365 FCC docket number is confirmed; monitor the FCC Electronic Comment Filing System rather than waiting for secondary reporting.18
Track Five — FTC Policy Statement
The order directs the FTC to issue a policy statement to coordinate federal AI enforcement with the preemption posture, working through the Commission's authority under Section 5 of the FTC Act.19 As of May 22, 2026, no FTC AI-specific policy statement has appeared in the Commission's policy-statements library.20
Companion Statutory Push
The White House National Policy Framework for AI is the March 2026 legislative recommendations document built on the EO's foundation.21 Senator Blackburn's TRUMP AMERICA AI Act is the discussion-draft vehicle designed to convert those recommendations into statute. The Senator released the draft on March 18, 2026, with an April 22, 2026 momentum update; no bill number is assigned as of May 22, 2026.22
The GUARDRAILS Act would repeal EO 14365 entirely and prohibit federal funds from implementing it. H.R. 8031 was introduced March 20, 2026; S. 4216 was introduced March 26, 2026; both bills are committee-referred with no markup scheduled.23 The SECURE Data Act is a federal privacy bill with national preemption language and automated decision-making provisions. House companion H.R. 8413 sits with House Energy and Commerce, with anticipated hearings but no markup scheduled as of May 22, 2026.24
Appendix B
What Survives
The preemption pressure under EO 14365 and the Blackburn draft targets a specific category of state AI law: comprehensive duty-of-care frameworks, algorithmic impact assessment mandates, risk management program requirements, and private rights of action.25 Colorado SB 26-189, signed May 14, 2026, is the clearest evidence of what survives and what does not.26
What Survives
Under SB 26-189
Mandatory consumer disclosure when a high-risk AI system materially influences a consequential decision in employment, housing, credit, healthcare, education, and government services; documentation requirements for developers and deployers; correction rights; right to request meaningful human review after an adverse outcome; Attorney General enforcement. Takes effect January 1, 2027.27
What Did Not Survive
The duty of care, algorithmic impact assessments, risk management program requirements, and any private right of action. SB 26-189 expressly forecloses a private right of action and leaves enforcement to the Attorney General alone — enforcement depends on the AG's exercise of discretion rather than on whether affected individuals can sue.28
Healthcare Carve-Outs
HIPAA-covered entities are broadly exempt from the core obligations for non-employment uses. FDA-regulated medical devices are excluded entirely. Non-HIPAA entities and uses related to employment in healthcare are still covered. Healthcare clients require a use-case map before concluding they are out of scope.29
Implications by Sector
AI startup and product companies: A disclosure, documentation, correction, and human-review compliance posture is now the minimum viable floor in states with active AI legislation — the duty-of-care standard has been politically eliminated at the state level.30 Build compliance posture around those obligations rather than around risk assessment mandates that are retreating from the regulatory landscape.
Digital media and creator economy companies: The preemption pressure in EO 14365 and the Blackburn draft does not reach federal copyright doctrine.31 The output-reproduction theory developing in NYT v. Perplexity and Disney v. Midjourney operates on tracks separate from state AI regulation.32 State law retreating under preemption pressure gives AI companies no cover for what their models produce because copyright infringement arises under federal law independently of state regulatory frameworks.33
Data and AdTech companies: If the SECURE Data Act advances in a form that preempts the California CPRA's automated decision-making rights, the result is a federal ceiling rather than a floor.34 Healthcare-specific AI provisions under SB 26-189 retain more enforcement teeth than the general framework, and any client in health-adjacent services must evaluate those provisions separately.