The State Preemption Debate: Could Federal Law Override State AI Statutes?

DOJ's most advanced attempt to knock out a state AI law didn't fail in court. It never got that far. The Justice Department intervened in a lawsuit against Colorado's AI Act in April 2026, a federal judge paused the law's enforcement two days later — and three weeks after that, Colorado's own legislature passed a replacement statute that repealed the exact provisions the government was suing over. No ruling on the merits. No verdict on whether states can even be forced to bow to a national AI standard. Just a moving target that moved before anyone had to answer the question.

That outcome is the clearest evidence available right now for a question a lot of compliance teams are asking with more confidence than the facts support: can federal law actually override a state's AI statute? The honest answer requires separating what preemption legally requires from what's actually happened so far — and those two things have diverged sharply in 2026.

Three ways federal law could override a state AI statute — and one way it can't

Real preemption has exactly three legitimate paths under US constitutional law. Congress can pass a statute that expressly displaces state law under the Supremacy Clause — that's the cleanest route and the one specifically rejected, 99-1 in the Senate, when a ten-year moratorium on state AI enforcement was stripped from the 2025 budget reconciliation bill. A federal court can rule that a specific state law creates an unconstitutional conflict with federal authority, either because it obstructs a federal regulatory scheme or because it violates the Dormant Commerce Clause by regulating conduct that occurs wholly outside the state's borders. Or the federal government can attach conditions to money states want badly enough to change their own laws to keep it — not preemption in the technical sense, but functionally similar if the leverage is strong enough.

What doesn't make that list is an executive order acting on its own. A president can direct federal agencies to prioritize enforcement a certain way, or instruct the Department of Justice to go looking for lawsuits to bring. What a president can't do by signature alone is erase a state statute. That distinction is the one most coverage of this fight glosses over, and it's the one that actually determines whether a compliance team should treat any given state law as at risk.

Congress said no twice, so the fight moved to litigation and funding

The reconciliation-bill moratorium and a parallel push to attach similar language to the FY2026 National Defense Authorization Act both failed in 2025 — the fuller legislative history is covered in our breakdown of why the US doesn't have a federal AI law, so it's worth only a fast recap here: twice, in two different Congresses, lawmakers who agreed on almost nothing else agreed that overriding state AI law wasn't something to do by attaching it to an unrelated must-pass bill.

President Trump signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," on December 11, 2025 — the latest entry in a longer run of AI executive orders that goes back to 2019. This one does three specific things. It directs the Attorney General to stand up an AI Litigation Task Force within 30 days — done January 9, 2026 — whose job is to sue over state AI laws on the theory that they burden interstate commerce or conflict with federal law. It directs the Commerce Department to publish, within 90 days, an evaluation naming state AI laws it considers "onerous" — published on deadline, March 11, 2026, naming Colorado's statute specifically. And it directs Commerce to condition the roughly $21 billion in remaining BEAD broadband program's non-deployment funds on states not maintaining laws that make the list. Notably, the order carves out child-safety protections, AI compute and data-center infrastructure, and state government procurement from its reach — an implicit admission, even from the people who wrote it, that a blanket claim of total preemption wasn't going to hold up.

The test case: DOJ's flagship lawsuit hit a moving target

The AI Litigation Task Force's first real action wasn't a case it filed. It was intervening, on April 24, 2026, in a suit xAI had already brought against Colorado's attorney general two weeks earlier, seeking to block Colorado's AI Act before its scheduled June 30 effective date. xAI's complaint argued the law violated the First Amendment by compelling the company to alter its Grok model's outputs and disclose bias-mitigation practices, violated the Dormant Commerce Clause by reaching conduct entirely outside Colorado — the company is organized in Nevada and headquartered in California, with no Colorado office — and was unconstitutionally vague in places. DOJ's intervention marked the first time the department had joined a private challenge to a state AI law.

Three days after DOJ joined, the court granted a joint motion staying enforcement of the statute. That looked, briefly, like momentum for the federal position. Then Colorado's legislature — which had already been negotiating a rewrite for months — passed SB 26-189, and Governor Jared Polis signed it on May 14, 2026. The new law repeals the duty-of-care and impact-assessment framework xAI was suing over and replaces it with a narrower regime built around pre-use notice and post-decision disclosure, effective January 1, 2027. The specific provisions at the center of the federal government's marquee case no longer exist in the form that was challenged. No court ever ruled on whether the Dormant Commerce Clause or First Amendment arguments actually held up.

A win wouldn't have done what people assume it would

Even setting the mooting aside, it's worth being precise about what a federal court victory in that case would and wouldn't have accomplished. A district court ruling against Colorado's original statute would have bound the parties to that case. It would not have automatically struck down California's transparency requirements, New York's algorithmic-accountability law, or any other state's differently worded AI statute. Other courts could treat the ruling as persuasive, but nothing short of a Supreme Court decision resolving the underlying constitutional question — or an actual act of Congress — reaches every state at once. That case isn't close to the Supreme Court, and after Colorado's rewrite, it may never get there on this particular statute.

The Dormant Commerce Clause theory itself is genuinely unresolved, not quietly settled in either direction. States can generally regulate the in-state effects of out-of-state conduct; what they can't do is regulate conduct that happens entirely outside their borders with no connection to the state. Where an AI company's model training, fine-tuning, and deployment decisions fall on that line hasn't been tested by a court that actually reached a verdict. And the funding-leverage route has its own ceiling: in South Dakota v. Dole, the Supreme Court upheld conditioning highway funds on states raising their drinking age precisely because the amount at stake — 5% of one program's funding in year one — was too small to cross "the point at which pressure turns into compulsion." Tying a state's AI statute to a much larger, all-or-nothing share of broadband funding is a more aggressive bet on that same doctrine, and it hasn't been tested in court either.

What this looks like for a company that actually has to decide

Take a hypothetical company like Larkspur Screening, which sells AI-driven tenant background-check software to property managers licensed across a dozen states, including Colorado. In April 2026, Larkspur's compliance lead could have read the stay on Colorado's AI Act as a green light to deprioritize the impact-assessment work the statute would have required and wait for the litigation to resolve the broader question. Companies that made that bet are now racing to meet SB 26-189's different notice-and-disclosure requirements by January 2027, instead of having had eight extra months to build toward them. The company that kept building against whatever version of the law was actually enacted, and treated the litigation as background noise rather than a reason to pause, comes out ahead regardless of how the underlying constitutional fight eventually resolves.

What it would actually take

Three things could genuinely produce federal preemption of state AI law, and none of them is close. Congress could pass an actual preemption statute — which means reversing a position the Senate held 99-1 against as recently as mid-2025, not a small ask. A case could reach a ruling that squarely resolves the Dormant Commerce Clause question, ideally at the Supreme Court, which the Colorado case shows is further away than the pace of litigation news suggests. Or states could simply converge on similar frameworks voluntarily — Colorado's own rewrite moved it toward a lighter-touch, disclosure-based model closer to what industry has been asking for, which reduces the practical case for federal override without requiring anyone to win a constitutional argument.

None of that has happened yet. For a company deciding what to build toward, the state statute currently on the books — reviewed against the federal landscape it sits inside — remains the only enforceable answer, whatever an executive order or a pending lawsuit might eventually change.