For two years the practical answer to "what are the AI rules?" was simple: wait for Washington. That answer expired this month. A new Congress arrives in January with no federal AI statute on the books, and the rulebook that actually applies to anyone shipping AI in the United States is now a stack of state documents, each with its own definitions, deadlines, and paperwork.
The shift is not subtle. Federal legislation is still a promise, while state text is already enforceable, already dated, and already showing up in procurement questionnaires. Here is what moved this week, followed by the checklist that keeps a deployment on the right side of it.
What just changed in Washington and the states
California's AI regulator is moving to Washington. Scott Wiener won California's 11th District seat, the one Nancy Pelosi held for decades. He did not run as a neutral on machine learning: AI regulation has been a cornerstone of his political career, and the profile that landed this week described him as the lawmaker who is ready to regulate it. If that agenda reaches the House floor, the federal conversation stops being theoretical. Hearings become markup sessions, and the text lands on vendors to read line by line.
Illinois already went further than California and New York. Illinois passed an AI bill requiring third-party review of the systems built by the largest labs, a step beyond what California and New York enacted. That distinction matters in practice. Self-attestation means you write a document saying you are safe. Third-party review means someone with a research budget checks whether the document is true. Vendors selling into Illinois should assume they will be asked for evidence, not summaries.
Florida wrote the classroom rules and attached a deadline. Florida's Board of Education approved statewide rules covering students and teachers in public schools, colleges, and universities. Parents must opt in before a child uses an AI tool directly, and a non-AI instructional alternative must exist for families who opt out. Schools are barred from deploying AI built to meet students' social or emotional needs, including tools designed to simulate friendship. Agentic tools require adult supervision, a logged activity trail, and the ability for an instructor to switch the tool off. Teachers cannot use AI as a decision maker without human review for grading, evaluations, or referrals.
The mechanics are where teams get caught. Districts and charter boards must adopt the guidelines by July 1, 2027, and private schools, including the ones that have leaned hardest into AI, are untouched. Colleges must bar AI on graded assignments unless the instructor explicitly allows it, and must notify parents of enrolled minors when a child uses an AI tool. That is a consent workflow, not a policy paragraph.
Ohio is the control group. Ohio has no substantial AI regulations, and reporting this week suggests it will not pass any before the year ends despite interest from lawmakers on both sides. That gap is the whole story of American AI policy in 2026: not a national standard, but a map where the rules change when you cross a river.
The seven-step compliance checklist
If you build or deploy AI for US users, work through these items in order. Most teams fail at step four, and that is the expensive one.
- Inventory before you argue. List every model call by business function: grading, hiring, support, code generation, content. "We only use AI in one place" is almost never true once you check.
- Find your strictest state, not your headquarters state. Rules attach to where users are, not where your office is. A Kansas company serving Illinois customers inherits Illinois obligations.
- Write the human-in-the-loop policy down. Florida's education rule is a template: no AI as decision maker without human review. Apply the same sentence to hiring, credit, and support escalation while the stakes are low.
- Prepare for third-party review now. Keep model cards, evaluation logs, data provenance notes, and incident reports in one place. Illinois-style review is cheap when the evidence already exists and brutal when someone has to reconstruct it.
- Treat autonomous agents as a separate risk class. Any tool that takes actions without a click needs supervision, an activity log, and a kill switch. That is now written into state text, not just into vendor security questionnaires.
- Build consent and notice flows for education customers. Opt-in, opt-out, a working non-AI alternative, and parental notification for minors in college programs. Retrofitting consent into a student product mid-semester is a support nightmare.
- Put the deadlines in a calendar. July 1, 2027 is the Florida district adoption date, and it will drive procurement questions long before the date itself.
What to watch next
Three moving pieces will decide whether this patchwork gets simpler or thicker.
- The federal push. Illinois Governor JB Pritzker has called for federal AI regulation with the new Democratic Congress, framing the risk on the level of nuclear weapons. Maryland Governor Wes Moore, speaking for the National Governors Association, says states cannot confront AI risk alone. Both arguments now have a sympathetic chamber.
- Data centers as the first real test. A new bill would block federal funding for data centers that fail to secure state and local approval, and a bipartisan energy permitting bill is already being read as a proxy fight over AI infrastructure. Watch this before you watch any model bill.
- Procurement creep. The July 2027 Florida deadline will push district legal teams into vendor contracts this spring. Vendors without a compliance packet will lose deals they never knew were contested.
Bottom line: AI compliance in 2026 is not a legal problem you hand to lawyers in December. It is a documentation habit. Inventory the systems, map the strictest jurisdiction, keep the evidence current, and make the human review step explicit in code rather than in a policy PDF. Do that and the patchwork becomes manageable. Skip it and the first state audit becomes your product roadmap.
Comments