As state legislatures across the country prepare to convene in early 2026, a predictable panic is setting in among the architects of the artificial-intelligence (AI) revolution.
From Sacramento to Hartford, legislation appears certain to proliferate seeking to regulate everything from algorithmic discrimination to the fundamental compute power used to train large language models (LLMs). The industry response has been equally predictable: a desperate plea for federal preemption, a moratorium on state action, or an aspirational reliance upon the Dormant Commerce Clause to strike down fractured compliance regimes.
While legally plausible, we’ve seen over the past week that this lobbying strategy is fraught with political risk for the long-term viability of AI governance.
It is true that a patchwork of 50 contradictory AI regimes would be an economic nightmare that could stifle U.S. innovation. And it is equally true that, under Dormant Commerce Clause jurisprudence, states cannot unduly burden interstate commerce or regulate conduct that occurs wholly outside their borders. But waiting for a gridlocked Congress to pass a sweeping preemption bill, or hoping the courts will briskly invalidate state laws, is a gamble on a timeline that fast-paced AI innovation and a race to beat our international peers and adversaries does not afford.
The debate has become stuck in a binary trap: total federal control versus chaotic state experimentation. Against the backdrop of these choices, we need to take seriously the idea that the still-in-progress AI revolution (which, in truth, comprises an incredibly broad array of tools and technologies) requires nuanced and diverse approaches to deal with both its promises and its perils.
What we really need is a new conceptual framework—one grounded not just in constitutional law, but in the practical reality of regulatory competency. The path forward isn’t to ask whether states can regulate AI, but to rigorously define what states are competent to regulate.
This approach requires a return to the principle of subsidiarity—the idea that governance should occur at the level most capable of effectively addressing a specific issue. In the context of AI, this forces us to ask a difficult question: What harms are states actually capable of preventing, and what regulatory tools do they possess that will not inevitably spill over into the sovereignty of their neighbors?
Consider the nature of the technology. The development of foundational models—the massive, compute-intensive training of systems like GPT-4 or Claude—is an inherently national, if not global, enterprise. The physical infrastructure, data flows, and capital investment ignore state lines. When a state attempts to regulate the training of these models (as seen in recent ambitious proposals), they are asserting a regulatory competency they simply do not possess.
A state legislature inevitably lacks the technical capacity to audit the weights of a neural network effectively. Moreover, any attempt to impose safety standards on model training in one state inevitably dictates the technological architecture for the entire nation. This is the classic “California Effect,” where one jurisdiction’s policy preferences become a de facto national mandate, bypassing the democratic preferences of citizens in Texas or Ohio.
This is where the Dormant Commerce Clause argument is strongest, but also where it is the most politically brittle. Telling a state legislator they cannot protect their constituents from “AI risks” because of an abstract constitutional doctrine reads as evasion. A better argument—and a better policy—is to channel state energies toward where their competency actually lies: the specific application of AI modalities within their particular jurisdictions.
For example, states are eminently competent to regulate how their own government agencies use AI. They can and should set rules on how local police departments use facial recognition, or how state benefit agencies use automated decisionmaking systems to determine eligibility for Medicaid. These are local contexts involving local actors, and the redress (administrative hearings, tort liability) is well within the traditional state police power.
Furthermore, states have a valid role in regulating the outputs of AI where they intersect with existing state laws and cause demonstrable harm. If an AI system is used to make hiring decisions in New York, it must comply with New York’s employment-discrimination statutes. If a chatbot gives medical advice in Florida, it touches upon Florida’s medical-licensing regime. In these instances, the state is not regulating the architecture of the AI—an area where they lack competency—but rather the conduct of the deployer, an area where they have centuries of experience. Previous episodes in tech policy demonstrate how this works.
The 9th U.S. Circuit Court of Appeals’ decision in Fair Housing Council v. Roommates.com offers a helpful structural analogy. That case asked whether Section 230 of the Communications Decency Act foreclosed state enforcement of fair-housing laws against an online roommate-matching service. While the holding ultimately turned on the statutory limits of Section 230—specifically, that the platform had materially contributed to the unlawful conduct—the result is instructive. It demonstrates how federal law governing aspects of online infrastructure does not automatically insulate downstream conduct from state civil-rights enforcement.
The Roommates case was not about federalism per se, but it reflects a similar subsidiarity logic: a federal rule can set the background architecture of an online system, while states retain authority to police discriminatory outcomes within their traditional domains. That division of labor is a useful mental model for thinking about AI governance.
The distinction between fundamental development of AI and the behavior of AI systems is crucial. When states focus on conduct and outcomes within their borders, they allow for a healthy laboratory of democracy. For better or worse, one state might prefer a strict liability regime for automated-vehicle accidents; another might prefer a negligence standard to encourage automated-vehicle adoption. These differences reflect local risk tolerances and preferences. They do not break the internet, nor do they force a developer in Seattle to recode their model to suit a regulator in Tallahassee.
But when states attempt to regulate the design and development of the technology itself—requiring predeployment impact assessments for general-purpose models, or mandating specific watermarking technicalities—they step outside their zone of competency. They move from governing local behavior to governing the interstate market for computation.
The industry’s path forward should not be a blanket “No” to any state role, but a nuanced “Here, not there.” We must concede that states have a duty to police the specific harms that occur within their boundaries. These harms may relate to bias in housing, privacy in public spaces, preventing fraud and other torts, and the administration of state justice. In exchange, we must insist that the technology’s architecture—the “code” of the AI itself—remains the domain of federal oversight—or, better yet, competitive market standards.
Our normative preferences about how any individual state chooses to wield its police powers will inevitably diverge. Even so, it is essential to preserve space for states to exercise those traditional authorities where they are most effective. The purpose of a new federal framework for AI should not be to displace state governance, but to ensure that AI systems can be created within a regulatory environment calibrated to their inherently interstate and international character. That division of labor protects innovation at the architectural layer, while respecting the states’ longstanding role in policing concrete harms that occur within their borders.
By reframing the debate around subsidiarity and competency, we move past the stalemate of preemption. We acknowledge that states have a role, but cabin that role to where it is effective and legitimate. This would prevent the Balkanization of the digital economy while respecting the federalist impulse to keep governance close to the people.
It is a harder argument to make than a simple slogan about innovation, but it is the only one likely to survive the political realities of the coming decade.