WASHINGTON, D.C., October 17, 2026 —
The Justice Department has stepped back from regulating artificial intelligence, leaving states to fill the void. Here’s what it means for companies, consumers, and the law—and why the patchwork approach could create more problems than it solves.
Why the DOJ is staying out of AI oversight
The Trump administration has made clear it won’t use federal prosecutors to enforce new rules on AI companies. Attorney General Todd Blanche has ruled out standalone enforcement actions, saying the DOJ won’t prosecute companies for violations unless they break existing laws. Think of it like this: If a carmaker built a car with no brakes, the government wouldn’t create a new law against brake-less cars. Instead, it would charge the company under existing traffic laws—if it could prove intent to harm.
This approach mirrors the DOJ’s stance on cryptocurrency. In April 2025, the department declared it “is not a digital assets regulator” and told prosecutors to stop treating crypto cases as regulatory enforcement. The same logic now applies to AI. A December 2025 executive order even formalized this hands-off policy, creating an AI Litigation Task Force focused on “minimally burdensome” oversight—meaning the goal is to protect U.S. AI dominance, not police the industry.
The practical upshot? Federal enforcement remains tied to outdated laws like the 40-year-old Computer Fraud and Abuse Act, which requires proving criminal intent—a high bar for AI-related crimes. FBI Director Kash Patel confirmed this in a recent hearing, saying the bureau will only scrutinize models “created with the intent to commit a crime.”
States step in with their own rules
With the federal government sitting out, states have taken the lead. Violations can cost up to $1 million per offense. Illinois goes further, mandating annual independent audits of AI safety practices. Connecticut’s law is broader: Any company using AI in hiring must document bias testing and notify workers if an automated tool leads to an adverse decision.
Here’s the catch: These laws mostly target big AI labs like OpenAI or Google DeepMind. But smaller companies may still feel pressure to comply—either to avoid lawsuits or to keep larger clients from cutting ties over regulatory risks. Corporate legal teams are already scrambling to vet AI providers and rewrite liability clauses. Procurement departments must now ask: Is this tool built by a company that could get shut down in another state?
States aren’t just passing new laws—they’re testing old ones. Pennsylvania’s attorney general sued an AI chatbot operator for falsely claiming to be a licensed psychiatrist, violating the state’s Medical Practice Act. Florida’s AG investigated OpenAI’s ChatGPT after it allegedly gave advice to a gunman in a 2025 campus shooting. These cases show how existing laws, stretched thin, are being used to hold AI accountable.
The corporate scramble to comply
For businesses, the shift to state-level enforcement creates a compliance nightmare. A company operating in California, Illinois, and Connecticut must now navigate three different sets of rules—each with its own penalties and enforcement style. The practical upshot? Legal departments are adding “AI risk” to their due diligence checklists, and procurement teams are treating AI vendors like high-stakes suppliers.
Take TD Bank, which operates in 15 states. If the bank uses an AI tool for loan decisions, it must ensure that tool complies with Connecticut’s bias testing rules—and that its developer meets California’s transparency requirements. Get it wrong, and the bank could face fines, lawsuits, or even operational halts if regulators block a tool mid-use.
Smaller companies face an even tougher choice: Comply with every state’s rules (costly and complex) or risk being left behind by clients who demand compliance. The result? A two-tier system where only well-funded firms can afford to play by the new rules.
What happens next?
The DOJ’s retreat follows a voluntary safety pact signed by AI CEOs under Trump’s administration, letting the industry self-regulate. But with states moving fast, the question isn’t whether AI will be regulated—it’s whether the rules will be consistent. Right now, the answer is no.
Some states will keep pushing for stricter laws. Others may follow the DOJ’s lead and avoid enforcement unless harm is clear-cut. The risk? A fragmented system where a company’s legal exposure depends on where it operates. For now, the safest bet for AI developers is to over-comply—document everything, audit often, and hope the patchwork doesn’t unravel.
One thing is certain: The federal government’s hands-off approach won’t last forever. But until Congress acts—or states coordinate—companies will be left guessing. And that’s a problem for everyone.
Sources
- DOJâs Retreat on AI Enforcement Puts Focus on State Regulators
- Streaming Execution Would Be a National Security, Moral Failure
- DOJ’s Hands-Off AI Enforcement Leaves States to Police the Agents
Photo: Cashen Turner (Public domain (US government work))
