Small business owners keep waiting for ‘the AI law’ to arrive at the federal level. It hasn't, and whether it will soon is genuinely unresolved — but that does not mean AI use is unregulated in the meantime. It means your obligations come from a patchwork of overlapping layers, and the patchwork is where the real risk lives.
Four Layers, Not One Law
There is no single federal AI statute in the United States. Instead, AI obligations come from federal law — the FTC's consumer protection authority, federal anti-discrimination law, copyright law — stacked with state-specific AI legislation, sector-specific rules, and now a genuinely active state-by-state patchwork covering hiring, chatbots, and automated decision-making. If you use AI tools anywhere in your business — hiring screens, customer service chatbots, marketing automation, credit or pricing decisions — you may already be subject to a state law you have never heard of, layered on top of federal rules that apply regardless of which state you are in.
The Preemption Fight Is Real, and Unresolved
A December 2025 executive order criticized the growing state-by-state patchwork of AI laws as creating what it called 50 different regulatory regimes, and directed the Department of Justice to establish an AI Litigation Task Force to challenge state AI laws it considers preempted by federal authority or unconstitutional. Whether federal action will actually override specific state AI laws, and which ones, remains genuinely unsettled. Until, and unless, federal preemption legislation actually passes, businesses must comply with the state laws that apply to them. Treat any claim that federal preemption already means you can ignore state AI law with real skepticism until it is confirmed by an actual court ruling or enacted statute — commentary and executive orders are not the same as settled law.
Why This Matters Even If You Only Use Third-Party Tools
Using AI you did not build yourself does not transfer responsibility to the vendor. If you use a hiring platform with an AI resume-screening feature and it produces a discriminatory outcome, you as the employer are very likely still on the hook — a vendor's terms of service disclaiming liability does not bind a regulator or a rejected candidate. This is true across pricing, lending, insurance, and other consequential decisions too: the fact that a third party built the tool does not remove your obligation to understand what state and federal rules apply to how you use it.
What This Actually Means for What You Do Next
Rather than waiting for a single federal answer that may not arrive soon, the practical move is inventorying every AI tool actually in use across your business, then checking which states' laws could plausibly apply based on where your customers and employees are located — not just where your business is headquartered, since several state laws (New York City's hiring rule among them) apply based on the location of the person affected, not your company's address.
Where to Go From Here
AI Compliance for Small Business walks through the federal foundation, the states with the most developed AI-specific rules, and a verified profile for every remaining state, so you can check your specific exposure rather than relying on general federal-level assumptions.
Get AI Compliance for Small Business →
📖 Also available on Amazon: Kindle | Paperback
This article is for educational and informational purposes only and does not constitute legal advice. Federal and state AI law is changing rapidly — confirm current requirements with a qualified attorney.