Washington is fighting about whether states may regulate AI. The states already are.

The most popular idea in Washington's AI debate right now is that the country needs one rule instead of fifty. Let the federal government set a single national standard, the argument goes, and preempt the states before they bury a young and strategically vital industry under a patchwork of conflicting laws. It is an appealing idea, and the people making it are not fools. It is also built on a category error — the quiet assumption that "AI regulation" is a single thing you can switch on or off from one place — and that error is now colliding with the unglamorous reality that the states have stopped waiting for the argument to be settled. I say this as someone who would have been on the federal side of the table.

Six months ago the administration moved to head the states off. A December executive order directed the attorney general to assemble a task force to challenge state AI laws deemed more than "minimally burdensome," instructed the Commerce Department to compile a list of the offending regulations, and dangled the threat that states with such laws could lose access to federal broadband and grant funding. Alongside it came a national policy framework urging Congress to preempt state AI laws outright and pass a federal standard in their place. The intent was clarity: one regime, one set of obligations, drafted in one city. Half a year later, more AI bills have been introduced in statehouses than the year before — including, notably, from Republicans — and several have become law. The moratorium has not stopped the states. It has annoyed them.

The strongest version of the case for one rule

Let me make the preemption argument properly, because it deserves better than the strawman its opponents usually swing at. Software does not respect state lines. A model trained in California, hosted in Virginia, and queried in Texas is a single product touching every jurisdiction at once, and if each state writes its own definitions of what an "AI system" is, what counts as a "consequential decision," what disclosure a company owes and to whom, a national developer faces fifty overlapping and occasionally contradictory compliance regimes for one piece of code. That is a real cost, and it is not trivial. We accept federal preemption in exactly these situations all the time — securities law, aviation safety, food labeling — because some things genuinely need to be uniform to function, and a balkanized rulebook can impose more drag than the harms it addresses. If the choice were truly between one coherent federal standard and fifty incompatible ones, I would take the federal standard. Most people who have actually drafted a rule would.

But that is not the choice on the table, and the gap between the argument's premise and the actual bills is where it falls apart.

Read what the states are actually passing

Look at the laws themselves rather than the abstraction. California is advancing the No Robo Bosses Act, which would bar employers from relying solely on an automated system to fire or discipline a worker — a human has to be in the loop on the decision. Its legislature is also moving to stop chatbot outputs aimed at children from being turned into advertising. Connecticut has restricted how companion chatbots may interact with minors, requiring that such systems be built not to encourage self-destructive behavior and that they give parents management tools. Colorado now requires disclosure when an automated system materially influences a consequential decision in employment, housing, lending, or education. Other states — Idaho, Iowa, Nebraska, Oregon — have passed narrower measures requiring a company to tell you when you are talking to a machine instead of a person.

Notice what these are. None of them is "AI regulation" in the grand sense the preemption debate imagines — a sweeping licensing regime for frontier models, a federal gatekeeper deciding which systems may be released. They are employment law, consumer-protection law, and child-safety law, with an automated system as the instrument of the harm rather than its subject. A rule that says you cannot fire someone purely on an algorithm's say-so is a labor rule; the question it answers — must a human be accountable for the decision to end a livelihood — long predates the model doing the scoring. A rule that says a company must disclose when a chatbot is selling to your eight-year-old is a consumer-protection rule of the kind states have written since before the internet. The thing being regulated is not "intelligence." It is conduct, in domains the states have always governed.

These are not rules about artificial intelligence. They are rules about firing people, selling to children, and denying someone a loan — with a model standing where a person used to.

This is the category error, stated plainly. Treating these statutes as "AI policy" — a single federal subject ripe for one national standard — mistakes the tool for the activity. We do not have a federal "spreadsheet law" preempting every state rule that happens to involve a spreadsheet. We regulate the underlying conduct — the hiring, the lending, the marketing to minors — and we let the tool fall under whichever body of law already governs that conduct. The states writing these bills are not seizing a new and dangerous power. They are applying old and well-settled ones to a new instrument, which is the most ordinary thing a statehouse does.

Ask who actually enforces it

The procedural question the preemption framing skips is the one that matters most: who enforces this, and how? A federal moratorium that bars the states from acting but is not paired with an operative federal rule does not produce "one clear national standard." It produces zero standards — a vacuum — because Congress has not passed the substitute and shows little sign of doing so soon. That is why the administration's own order had to carve out exceptions for laws addressing fraud and the protection of children and consumers. Read that exemption closely, because it is a confession. If even the order written to clear the field has to admit that fraud rules and child-safety rules should survive, then the drafters already concede the central point: these are not really "AI laws" to be swept away, they are consumer and child-protection laws that happen to touch AI, and the people who enforce them are state attorneys general and existing agencies operating under statutes that predate the technology entirely.

Strip the exemptions out and ask what preemption-without-replacement actually delivers, and the answer is uncomfortable for its champions: the firms with the most to gain from no enforcement are the largest and best-lawyered, the ones that can absorb a patchwork and would prefer a vacuum. That is precisely why the moratorium drew criticism from both parties. A bipartisan House proposal to formalize preemption met, in the words of those tracking it, withering criticism from key members on both sides, because lawmakers who otherwise disagree about almost everything could see that banning state action while offering nothing in its place is not deregulation in any principled sense. It is the removal of the only accountability currently on the field.

The states can see it too, and they are not subtle about it. When the White House sent Utah a one-sentence memo declaring itself categorically opposed to legislation modeled on New York and California, the message was about jurisdiction, not substance. Illinois — where a bill requiring independent audits of companies' AI-compliance protocols passed with nearly unanimous, bipartisan support — was blunter still. "I don't know if you've met Illinois," one of its state senators said of the federal threats, "but we're pretty independent." That is not defiance for its own sake. It is a legislature noticing that the harms its constituents actually experience — a kid manipulated by a companion bot, a worker fired by a model with no human to appeal to — are not waiting for Congress, and neither will it.

The better frame, and what it costs

So here is the realistic version, with its costs admitted, because a column that pretends its own position is free is not worth reading. Preempt narrowly, where uniformity genuinely matters and only there: the things that are irreducibly national — model-level transparency obligations, testing and disclosure standards for frontier systems, the interstate plumbing where conflicting definitions would actually break a product. Set that floor federally, and set it for real, with an agency that can enforce it. Then leave the application layer — the chatbot lying to a child, the algorithm denying a loan, the system firing a worker — to the bodies of law that already govern lying, lending, and firing, enforced by the state officials who already do it. That division tracks the actual structure of the harms instead of the marketing category of the technology.

The cost of that approach is honest and worth naming: you will still have a patchwork at the edges. A company operating in forty states will still face some variation in disclosure language and in exactly when a human must be kept in the loop, and that variation is a genuine compliance burden, not a phantom. I am not going to pretend otherwise. But annoying-and-accountable beats uniform-and-empty. A patchwork of narrow rules that someone can actually enforce protects more people than a single elegant federal standard that does not exist, and it protects far more than a moratorium that clears the field and calls the silence clarity. The states understood the assignment before Washington finished arguing about whether they were allowed to take it. The honest move now is not to stop them. It is to give them a federal floor worth standing on — and to stop pretending that the absence of one is the same thing as a national plan.