Commentary. The most consequential fact about artificial-intelligence policy in the United States may be how little of it is being made in Washington. States are moving first, often separately and sometimes in direct tension with one another. Connecticut’s new rules, effective this month, add protections for AI-company whistleblowers, restrictions involving facial recognition and surveillance pricing, and employment-disclosure requirements; other provisions governing AI companions arrive later.[1] That activity reflects a legitimate failure of federal lawmakers to keep pace. It also risks turning basic rights into a map-reading exercise.
Our view is straightforward: the United States needs enforceable national safeguards for high-impact AI, but not a single sweeping statute that tries to predict every future system. A practical federal floor—covering discrimination, privacy, transparency, safety testing and access to remedies—would protect people while allowing states to go further where local experimentation produces better answers.
Why state action matters
The case for state leadership is stronger than critics sometimes acknowledge. AI already affects hiring, insurance, health care, education, policing and consumer finance. When national legislation stalls, residents still face automated decisions. Connecticut’s employment provisions, for example, require companies to prepare a framework explaining when and how AI is used in employment decisions.[1] Such requirements can give workers a basic opportunity to understand a decision that might otherwise appear to come from an invisible machine.
State laws can also expose problems early. Different rules create laboratories for testing which disclosures people understand, which audits identify genuine harms and which obligations merely generate paperwork. The European Union’s risk-based approach and emerging national frameworks likewise show that governments are attempting to distinguish high-risk uses from ordinary software.[2]
Industry has a reasonable objection, however. A patchwork can impose conflicting definitions, deadlines and documentation requirements, especially on smaller companies that lack large compliance departments. A firm operating across the country may have to build to the strictest state standard or maintain multiple systems. That cost can slow useful innovation and entrench the largest technology companies—the very outcome many regulators say they want to avoid.
The federal answer should be a floor, not a ceiling
Those concerns do not justify pre-empting state protections wholesale. They argue for interoperability. Congress should establish common definitions and a single baseline for high-impact applications, while allowing states to address local risks and provide stronger consumer rights. It should also create a clear private right to challenge consequential automated decisions, rather than relying entirely on agencies with limited resources.
The alternative is a familiar political bargain: broad federal pre-emption in exchange for promises of voluntary safety. That would simplify compliance, but it would place too much trust in companies’ incentives. Developers may be rewarded for speed and market share, while the harms of a flawed system—lost employment, denied benefits or exposure of sensitive data—fall on individuals who cannot negotiate the terms.
Nor should regulation become a disguised ban on general-purpose AI. The industry is right that rigid rules written for today’s models can become obsolete quickly. A small business using an AI assistant to draft routine correspondence should not face the same obligations as a hospital deploying software that influences clinical decisions. Regulation should follow the consequences of a use, not the novelty of the technology’s branding.
What responsible regulation would require
- Mandatory risk assessments and independent testing for systems used in employment, housing, credit, health care and public services.
- Plain-language notice when AI materially shapes a decision, plus a meaningful human review and appeal process.
- Protection for employees and contractors who report unsafe or unlawful AI practices.
- Privacy limits that prevent companies from treating personal data as an unlimited training resource.
- Federal standards that reduce duplicative paperwork without preventing states from adopting stronger safeguards.
These measures would not eliminate error, bias or malicious use. They would make responsibility visible. That is the essential political choice. The question is not whether AI regulation will impose costs; it already does, through compliance, litigation and social harm. The question is who pays, who gets heard and whether the rules are designed before the next failure rather than after it.
State experimentation has filled a vacuum, and it deserves credit for doing so. But a durable system cannot depend on geography to determine whether a person receives an explanation for an automated decision. Federal lawmakers should set the floor now—carefully, narrowly and with room for stronger state action. Leaving the country with fifty overlapping experiments is not innovation. It is an abdication.
Sources
Connecticut Public: new Connecticut AI and data-privacy provisions; AI Policy Tracker: international and state AI frameworks; Hinshaw & Culbertson: 2026 AI compliance developments.