The White House published a National Policy Framework for Artificial Intelligence on March 20, prioritizing child safety, community protections, and "targeted federal preemption" -- a framework, not a law, meant to guide Congress rather than bind anyone directly. Congress hasn't turned it into a statute. States haven't waited.
Five additional states passed AI legislation this year. Connecticut's SB 5 is the most complete of the batch: a regulatory sandbox alongside chatbot controls and a requirement to disclose when an automated system made an adverse decision about someone. Separately, at least six states -- a mix of Republican- and Democrat-led, including Iowa and Washington -- passed laws specifically restricting how health insurers can use AI in coverage decisions, one of the few areas where this year's state activity has been genuinely bipartisan rather than following the usual coastal-versus-not split.
California adds a harder deadline on top: businesses using automated decision-making technology for significant consumer decisions must provide pre-use notices and opt-outs starting January 1, 2027 -- fifteen months out, not hypothetical planning-horizon compliance. And the aggregate pressure is what Gartner is now quantifying directly: more than half of large enterprises are projected to face a mandatory AI compliance audit this year, up from a regime where "AI governance" was mostly a voluntary internal policy a year ago.
The practical shape this creates is a 50-state patchwork with real teeth on specific verticals (health insurance, employment, housing, finance, education) years before a comprehensive federal statute is likely, if one arrives at all in this form. For anyone building a product that touches automated decisions about real people, "wait for federal guidance" stopped being a defensible compliance posture sometime this year -- the operative rules are already state-by-state, and the list of states is still growing.
A federal policy framework is not federal law, and several states have stopped waiting for one -- if your product makes or influences automated decisions about people (health, employment, housing, finance), the compliance deadline that matters is very likely a specific state's, not Washington's, and California's January 2027 disclosure requirement is close enough to plan against now.