Congress Has No AI Law, But Wants to Kill State AI Laws Anyway

The United States Congress has passed zero federal laws regulating artificial intelligence. Thirty-eight states have. The response from Washington is not to finally pass a federal standard, but to invalidate the state laws that already exist, leaving nothing in their place.

This is the core contradiction now defining American AI policy. President Donald Trump and Senate Commerce Committee chair Ted Cruz are pushing a preemption doctrine that would render state AI regulations subservient to federal law, despite the absence of any federal AI statute to serve as the replacement. The result is a regulatory vacuum that benefits exactly one group: the technology companies that would prefer to operate without any binding rules at all.

The Preemption Play

Cruz has made preemption a central priority of his Commerce Committee chairmanship. The legal doctrine, which makes state-passed laws subservient to federal statutes, is not new. But applying it to AI is novel because there is no federal statute to serve as the preempting authority. Cruz has acknowledged the gap. When asked by reporters about the path forward, he offered no timeline and no specific legislation, only a general statement about evaluating which elements would command sufficient support to pass.

The practical effect of a preemption-first approach without a federal replacement is straightforward. It eliminates existing consumer protections in 38 states without substituting anything. California's transparency requirements for AI systems, Colorado's risk-based framework, and Utah's disclosure mandates, all passed by elected state legislatures, would become unenforceable. No federal guardrails would replace them.

The Anthropic Problem

The urgency of the regulatory debate has been dramatically amplified by Anthropic's decision to withhold its Claude Mythos model from public release. The company determined that the model's capability to exploit internet security vulnerabilities was too dangerous for unrestricted deployment. Instead, Anthropic is making Mythos available only through Project Glasswing, a restricted program limited to select cybersecurity companies.

This self-imposed restraint by a private company has become the de facto standard for AI safety in the United States, because no government body has the authority to require it. Anthropic chose to restrict its model. Nothing prevents the next company, or even Anthropic itself under different leadership, from making a different choice.

Sen. Mark Warner of Virginia captured the problem precisely when he noted that there is no guarantee every AI company would be this responsible. Warner pointed out that the United States lacks not only a federal AI law but also a federal privacy law and a federal social media regulation. The preemption push, in his view, only makes sense if it is paired with strong federal guardrails that replace the state protections being eliminated.

The States That Stepped Up

In the absence of federal action, state legislatures have become the primary battleground for AI regulation. Utah was among the first movers with its 2024 Artificial Intelligence Policy Act, which extended consumer protections to AI interactions and imposed disclosure requirements on companies deploying AI systems. By 2025, under pressure from Silicon Valley lobbying, Utah lawmakers rolled back some of those same provisions.

California, New York, and Colorado followed similar trajectories. Each state passed initial regulatory frameworks, then weakened them after facing coordinated pushback from technology industry groups arguing that state-level rules would create a patchwork of compliance requirements that stifled innovation.

The patchwork argument has merit. Companies operating across state lines face genuine compliance costs when regulations vary by jurisdiction. But the industry's preferred solution, federal preemption without federal standards, does not resolve the patchwork problem. It resolves it by eliminating all the rules, which is not the same as harmonizing them.

The Human Cost of Delay

While Congress debates whether to debate, the consequences of regulatory absence are accumulating. An estimated 85,000 job cuts in 2026 have been attributed at least in part to AI adoption, according to reporting cited during congressional discussions. The Pentagon is expanding AI integration into military operations under Defense Secretary Pete Hegseth, a development that multiple senators from both parties have expressed unease about.

Sen. Josh Hawley, a Republican from Missouri, has partnered with Democratic Sen. Richard Blumenthal of Connecticut on the GUARD Act, which would protect children from chatbot interactions, and the Artificial Intelligence Risk Evaluation Act, which would establish an AI risk assessment program within the Department of Energy. Hawley described his own legislation as modest, but argued that something is better than the current nothing.

Sen. Andy Kim of New Jersey was more direct. He told reporters he does not trust the current defense leadership with AI technology and acknowledged that Congress has consistently fallen short on cutting-edge technology regulation, a pattern he sees repeating with AI.

The Fundamental Question

The real issue is not whether federal preemption is appropriate in the abstract. For an interstate technology deployed across national and global networks, a federal framework makes logical sense. The issue is sequencing. Preemption before replacement is not a framework. It is a void.

Even Republican Sen. Cynthia Lummis of Wyoming, who supports federal jurisdiction over AI as an interstate commerce matter, acknowledged the core problem. The question is not whether the federal government has the authority, she said. The question is what level of protection that authority would enforce. And on that question, there is no agreement, even within her own party.

What This Means For You

If you work in technology, the regulatory uncertainty is already affecting your operations. Companies building AI products for the U.S. market must navigate 38 different state compliance regimes, with the constant threat that all of them could be invalidated at once. That is not a stable environment for long-term investment decisions.

If you are a consumer, the state protections you currently rely on, which govern how AI systems interact with your data, make decisions about your credit, or present information to your children, could disappear without replacement. The companies advocating for preemption are not simultaneously advocating for federal substitutes. Their position is that the market will self-regulate, despite the fact that market self-regulation has already produced models deemed too dangerous for public release.

If you are an investor, the current regulatory vacuum creates both opportunity and risk. Companies that can navigate the patchwork have a competitive moat against smaller competitors who cannot afford the compliance overhead. But a sudden shift to preemption without standards could trigger legal challenges, market disruption, and a wave of state-level litigation that creates more uncertainty than it resolves.