Who Governs a Machine? Washington and the States

What a headline leaves out

When a headline says the President banned state AI laws, what actually happened? Usually something smaller and more interesting. Four kinds of power can touch a business’s AI. Congress makes laws, and the President directs the executive branch. An agency acts under a statute, and a state protects its own people. Each power reaches a different distance. Name the power behind an action, and you can say what the action does to a client. That is the question this reading prepares you to answer.

The client is Beacon Pet Supply, a Daytona Beach retailer with a customer chatbot called Ask Beacon, a résumé screener, and workers in Florida, Texas, and Colorado. In the activity you trace eight federal and state actions to their sources and then tell Beacon’s owner what binds the business today. The sections below take the four powers in turn, starting with the strongest.

Congress: the power to displace, mostly unused

Only one power can sweep a state law away by itself, and it belongs to Congress. Under the Supremacy Clause, a valid federal law displaces a state law that conflicts with it, the doctrine called preemption. The Supreme Court put the limit plainly in Kansas v. Garcia, 589 U.S. 191 (2020) (opens in a new tab): the federal rule must come from the Constitution or “a valid statute enacted by Congress.” A rule an agency adopts under a statute counts, because the statute stands behind it. A policy announced without one does not.

Congress came close to using that power on AI in 2025. On May 22, 2025, the House passed a budget bill by a vote of 215 to 214. Section 43201(c) of that bill, H.R. 1, said that no state could enforce a law “limiting, restricting, or otherwise regulating” AI for ten years. That is express preemption, written into the bill’s own words. It did not survive. On July 1, 2025, the Senate voted 99 to 1 (opens in a new tab) to strike the section, and the bill the President signed three days later had no moratorium in it.

That is bicameralism at work. A provision one chamber passes is only a proposal until the other chamber passes the same words. The House’s ten-year pause had the votes of one chamber, which meant it had nothing.

The fight did not end there. In July 2026 a bipartisan group of House members introduced the FRONTIER Act, H.R. 9925 (opens in a new tab). It would bar states from imposing new duties on AI developers in three areas: disclosing how they manage catastrophic risks, outside audits of that work, and reporting safety incidents. Read its section 9(c)(2) closely. It leaves the states free to regulate how deployers and users put AI to work, through consumer-protection, civil-rights, and privacy laws. A business like Beacon, which builds no model and only uses two, sits on the side the bill would leave to the states. And the bill is only a bill. Unless both chambers pass it and the President signs it, it displaces nothing.

Congress has passed a few laws about AI, each aimed at a narrow harm. The TAKE IT DOWN Act’s rules for intimate images, which a later activity takes up, are one. None sets general rules for a store’s chatbot or its hiring software.

The President and the agencies: steering, not repealing

An executive order is a President’s instruction to the executive branch. It can be sweeping, and it can be undone. In January 2025 the new President revoked the previous President’s 2023 order on AI. A few days later, Executive Order 14179 (opens in a new tab) told agencies to review everything done under it. The next President can do the same to any order now in force.

Executive Order 14365 (opens in a new tab), signed on December 11, 2025, is the order behind the headlines about a ban. Read its verbs. It tells the Attorney General to form a task force to challenge state AI laws in court. It tells the Commerce Department to list the state laws it finds onerous and to tie some broadband money to that list. It tells the Federal Communications Commission to consider a federal disclosure standard and the Federal Trade Commission to issue a policy statement. It tells two White House advisers to draft a bill for Congress that would preempt conflicting state laws. Every one of those is an instruction to someone in the federal government. None is addressed to a state or a business, and section 9(c) says the order creates no right anyone can enforce.

So the order can start lawsuits, studies, and proposals. It cannot repeal Colorado’s statute, because an executive order is not a statute, and only valid federal law displaces a state’s. The Attorney General formed the task force on January 9, 2026, and the section on the states shows where the Justice Department has gone to court.

The agencies carry the order’s instructions out, and their reach is set by agency power: whatever a statute gives them, and no more. In July 2026 the FTC proposed a policy statement (opens in a new tab) built on Section 5 of the FTC Act, the 1938 ban on deceptive acts in commerce. Its theory runs in two steps. First, a company that secretly steers its AI away from accurate answers deceives consumers. Second, a state law that requires such steering conflicts with Section 5 and is impliedly preempted. The statement names Colorado’s revised AI law as one that could push a company in that direction.

Notice what kind of document that is. A policy statement tells the public how an agency reads a statute and plans to enforce it. Whether a state law actually conflicts with Section 5 is a question for a court, and the statement cannot answer it for one.

Section 5 matters to Beacon in a plainer way. It is a generally applicable law: it forbids deceiving customers, whoever or whatever does the deceiving. Suppose Ask Beacon tells a customer that a used dog crate can be returned for a full refund, and Beacon’s policy says otherwise. Section 5 already reaches that statement. Title VII does the same for the screener, which may not sort applicants by race, sex, or another protected trait any more than a manager could. These laws bind Beacon today, and none of them was written for AI.

The states: the power to protect, and the Colorado test case

The states need no permission to regulate AI. Their police power, the general power to protect the health, safety, and welfare of people within their borders, is the source of state consumer-protection and civil-rights law. It reaches new technology as easily as old. State legislatures have used it heavily since 2024, as the National Conference of State Legislatures’ database (opens in a new tab) shows. Texas’s AI law, for one, took effect on January 1, 2026.

Colorado shows how such a law changes under pressure. In 2024 it passed a broad AI act, built on risk tiers, with duties for anyone deploying a high-risk system. It delayed the act’s start. Then, in May 2026, it repealed and reenacted the whole thing as Senate Bill 26-189 (opens in a new tab), a narrower law about automated decision-making technology. The new law reaches technology that materially influences a consequential decision, such as hiring. Its definition leaves out a chatbot that answers consumers’ questions and is not used for those decisions. So Beacon’s screener, ranking applicants for the Denver center, is the kind of system the law has in view. Ask Beacon, answering questions about returns, is not.

The law’s duties apply to decisions made on or after January 1, 2027. Before using covered technology, a business must give notice. After a decision goes against someone, it must explain the technology’s role and offer a way to correct wrong data and to ask for human review. Enforcement authority belongs to the attorney general alone, who must first give written notice and sixty days to cure where the attorney general finds a cure possible. Colorado passed a second law the same year, House Bill 26-1263, on chatbots. Before you place Ask Beacon under it, read what its definition leaves out.

Colorado is also where the federal government chose to fight. xAI sued Colorado’s attorney general in April 2026, and the United States joined the suit within weeks. The government’s claim was not preemption. It argued that the law violates the Equal Protection Clause, a constitutional ground that needs no statute from Congress. On April 27, 2026, on the parties’ joint motion, the court ordered a pause. Colorado will not enforce the law, or any law replacing it, for conduct until fourteen days after the court rules on xAI’s request for a preliminary injunction. That request is due after Colorado adopts its final rules. A statute can be enacted and still go unenforced for months.

Florida has taken the other path, so far. Its Senate passed an AI Bill of Rights twice in 2026, 35 to 2 in March and 37 to 1 in an April special session. Both times the bill died in the House. Florida still reaches Beacon through generally applicable law. The Deceptive and Unfair Trade Practices Act, passed in 1973, forbids deceptive acts in trade (section 501.204, Florida Statutes (opens in a new tab)). A customer who lost money can sue under it. The Florida Civil Rights Act forbids an employer with fifteen or more employees to refuse to hire because of a protected trait. Neither statute mentions a machine, and neither needs to.

From the powers to the table

Each row of your table asks one thing four ways: who acted, under what power, against whom, and with what effect today. The powers in this reading answer the first three, and the source text answers the last. A moratorium one chamber struck has no effect. An order binds the agencies it directs. A proposed policy statement binds no one yet. A state law binds the businesses it defines, from the date it names, unless a court has said otherwise.

The trap is the date. Most actions in your table have moved within the last two years. A chatbot trained before the latest move will describe the earlier one with complete confidence. It may call the moratorium law, the FTC’s statement final, or Colorado’s 2024 act current. Draft your rows from the sources, check each against its text with the Statute Verifier, and look up where each one stands on the day you post. Then open the activity and start with Beacon’s facts in Part 1.