A Proposed Federal Moratorium on State AI Laws: How to Plan Under Regulatory Ambiguity

A federal moratorium on state AI laws has been proposed, voted down, and revived by executive order inside eighteen months. If you are building an AI-governance programme against that backdrop, you are aiming at a target that keeps moving — and the temptation is to either freeze or over-commit, both of which cost money you will not get back.

The question I keep getting from boards is not “what does the law require” — it is “which law, and for how long.” That is a fair question, because the honest answer right now is that nobody knows. Build for the state patchwork and Washington may sweep it away; ignore the patchwork and it may harden into the thing you are actually judged against. This is a field note on making AI-governance decisions when the regulatory destination is genuinely unknown, and on spending in a way that does not strand your investment whichever way it resolves.

What has actually happened

Strip out the noise and the sequence is short. In 2025 a moratorium on state enforcement of AI laws — first floated at ten years, later negotiated down — was written into the budget reconciliation bill. On 1 July 2025 the Senate voted 99-1 to remove it. It did not survive a second attempt either: the FY2026 National Defense Authorization Act, where a version was rumoured to reappear, was published in December 2025 without it.

Then the route changed. On 11 December 2025 the President signed Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence.” It does not repeal anything. It directs the Attorney General to stand up an AI Litigation Task Force to challenge state AI laws on grounds such as interference with interstate commerce and federal preemption, tasks the Department of Commerce with identifying “onerous” state laws for referral, and signals that federal funding — broadband money among it — could be conditioned on a state’s regulatory posture.

Here is the point most coverage buries. An executive order cannot, on its own, preempt state law. Preemption of that kind flows from an Act of Congress, and Congress has now declined twice. So EO 14365 is not a moratorium; it is a programme of litigation and funding pressure aimed at producing one outcome by other means. It raises the probability of federal displacement without delivering it, and it does nothing to pause the state laws already on the books. That is precisely the shape of a planning problem: more uncertainty, no resolution.

Why this is a planning problem, not a legal one

Two futures are live at once. In the first, federal preemption of state AI law eventually arrives — through legislation, or through courts striking down state statutes one at a time — and the compliance work you did to satisfy Colorado, Texas, Utah or California turns out to have been aimed at rules that no longer bind. In the second, preemption stalls, the litigation grinds on, and the state patchwork not only stands but grows, because the states have kept legislating throughout. Texas’s Responsible Artificial Intelligence Governance Act took effect on 1 January 2026; Colorado’s headline law has been delayed and rewritten more than once; more states file bills every session.

The expensive mistake is to bet the programme on either future. Build a heavyweight, state-specific compliance apparatus and you carry sunk cost and maintenance if preemption lands. Down tools on the assumption that Washington will rescue you and you are exposed, today, to laws that are already enforceable. Both bets can lose. The move that survives contact with reality is to spend on the things that hold their value under either outcome, and to keep the jurisdiction-specific commitments cheap to unwind. I have made the same argument about surviving executive-order reversals: the discipline is to design for reversibility rather than to guess the direction.

The controls that pay off under any outcome

Some governance work is regime-independent. It is worth doing because it is good engineering and good risk management, and because every plausible rule — state, federal, or the EU AI Act your multinational clients already sit under — asks for a version of it. That is where the safe money goes.

• A live inventory of AI systems and their uses. You cannot govern, defend or decommission what you have not catalogued. No regime penalises you for knowing what you run.
• Risk classification by use, not by tool. Sort each deployment by error cost and reversibility. This is the layer every state law and the federal framework key off, and it is where the developer-versus-deployer classification actually bites — get it wrong and you build the wrong controls regardless of who ends up writing the rules.
• Documentation you can re-point. Impact assessments, model cards, data-provenance records and decision logs are demanded, in some form, by everything from Colorado to the EU. Write them to a neutral internal standard, not to one statute’s template, and they survive a change of destination. The same reusable-artefact logic underpins a workable state privacy readiness posture.
• Human review where the blast radius is large. A human check on consequential outputs is cheap insurance that no future rule will make you regret.

None of that is wasted if preemption arrives, because it is the substance of governing AI well. A control framework built to absorb Colorado, Texas, Utah and California at the control level, rather than to chase each statute’s wording, is the same framework you keep if the whole patchwork is federalised — you just re-map it upward.

The commitments to keep reversible

The other half of the discipline is refusing to hard-wire anything that only makes sense in one future. Do not buy tooling that encodes a single state’s registration or reporting scheme so deeply that a change of law means a re-platform. Keep policy documents modular, so a jurisdiction can be added or dropped by swapping a section rather than rewriting the whole. Where you can, negotiate contract and vendor terms that let you scale AI-specific obligations up or down without penalty. Treat any spend whose entire justification is “because Statute X currently says so” as a reversible commitment, and size it accordingly — small, dated, and easy to stop.

What I would tell a board this quarter

Fund the inventory, the classification and the documentation now, in full — that money is safe under every scenario. Comply with the state laws that are actually in force today, because an executive order challenging them is not the same as their repeal, and “we assumed preemption” is not a defence a regulator or a plaintiff will accept. But hold the state-specific build to the minimum the live laws require, keep it modular, and put a review date on it. You are not trying to predict where federal AI policy lands. You are trying to make sure that when it lands, you are neither exposed nor holding a pile of compliance work aimed at a law that no longer exists.

The firms that lose money on this will not be the ones that guessed wrong. They will be the ones that guessed at all.