State laws quietly build national AI safety standard
The most consequential decisions about artificial intelligence are no longer being made in Silicon Valley boardrooms or White House strategy sessions. They are being made in state capitals, by legislators who have never written a line of code, through bills that most Americans will never read. This is not a failure of governance. It is the beginning of something unexpected: a democratic feedback loop that is building a national safety standard from the ground up, one state law at a time. What OpenAI calls “reverse federalism” is actually a slow-motion revelation about who gets to decide what safe AI looks like, and it is happening precisely because the federal government has been unable to act OpenAI.
The mechanism is simple and brutal. When California passed its frontier safety legislation, it did not just regulate companies within its borders. It created a de facto national standard because no company building frontier models can afford to ignore the world’s fifth-largest economy. New York followed, and then Illinois. Each state added a layer of oversight that the previous one had not considered. California established the core disclosure framework. New York showed that the approach could travel across jurisdictions. Illinois demanded independent verification of key disclosures. Together, these three states have built something that Congress has not managed in years: a coherent, enforceable system for democratic oversight of the most powerful technology ever created.
The trick is that this system works precisely because it is not comprehensive. Each state law focuses on a narrow set of requirements: documented safety frameworks with risk assessments, mandatory reporting of serious incidents, and independent audits. These are not aspirational guidelines. They are enforceable obligations that create real accountability. The companies building frontier models must now answer to someone other than their own shareholders and their own internal safety teams. That is the point. The state legislators who wrote these laws understood something that the tech industry has resisted for years: that safety cannot be self-certified by the people who stand to profit from cutting corners.
The historical precedent is instructive. In the late 1960s, when no federal agency had the authority to regulate automobile emissions, California passed its own standards. The auto industry fought it bitterly, predicting economic catastrophe. Instead, California’s standards became the template for national policy, and eventually for global standards. The same pattern is repeating itself with AI, but with a crucial difference. The technology is moving far faster than the regulatory process. By the time a federal framework is in place, the models will have evolved beyond what the original legislation anticipated. This is not an argument against regulation. It is an argument for regulation that is designed to adapt, and that is exactly what the state-level approach provides.
The federal government is not standing still. The current administration is working with technical and national security experts on a framework for testing the most capable AI models on cybersecurity. That framework will establish testing standards, timelines, and processes. OpenAI is engaged in constructive discussions with the administration, peer companies, and other stakeholders. The goal is to have this framework in place by early August 2026. But the federal effort is necessarily focused on national security concerns that no state can address: classified systems, critical infrastructure defense, and the tools needed to stay ahead of malicious actors. The state-level work fills a different gap. It addresses the public safety questions that affect every citizen, not just the ones who work in government or defense.
The danger is mission creep. As states gain confidence in their ability to regulate frontier AI, there will be pressure to expand their authority into areas that are better handled at the federal level. No state should be making national security decisions on behalf of the entire country. No state should be conducting highly technical reviews that require access to classified systems. The division of labor must be clear: states handle public safety and transparency, the federal government handles national security and technical evaluation. Any legislation that blurs this line will produce chaos, not safety.
The companies building these systems have their own incentives. OpenAI has been surprisingly supportive of the state-level approach, and its reasoning is instructive. The company understands that a patchwork of conflicting state laws would be a nightmare to navigate. It would divert resources from safety to compliance. It would create confusion for consumers and regulators alike. A coherent national standard, even if it emerges from state-level action, is preferable to regulatory chaos. This is not altruism. It is self-interest. But it aligns with the public interest in a way that pure industry self-regulation never could.
The deeper question is whether any of this actually makes AI safer. The answer depends on what you mean by safety. If safety means preventing catastrophic failures that could harm millions of people, then the state-level approach is a start but not a solution. The most dangerous failure modes of frontier AI are not going to be caught by state auditors. They are going to be caught by federal experts with access to classified systems and the resources to conduct deep technical reviews. The state-level work is necessary but not sufficient. It creates the infrastructure for accountability, but it does not build the capability for prevention.
The real value of the state-level approach is political. It forces the conversation about AI safety into the open. State legislators have to explain to their constituents why they are voting for a particular bill. They have to justify their decisions in public hearings. They have to respond to criticism from both industry and advocacy groups. This is messy and inefficient, but it is also democratic. It ensures that the decisions about how to govern AI are made by people who are accountable to voters, not by engineers who are accountable to their product managers.
The feedback loop between state action and federal policy is already visible. Members of Congress in both chambers and on both sides of the aisle have taken note of the state-level developments. Representatives Jay Obernolte and Lori Trahan have put forward proposals for a federal framework that incorporate elements from the state laws. No discussion draft with a realistic path to passage is perfect, but the direction is clear. The state-level work is creating a template that federal legislators can adopt without having to start from scratch. This is how democratic governance is supposed to work, even if it rarely does.
The contradiction at the heart of this approach is that it relies on the very companies it seeks to regulate. The state laws require transparency and audits, but they do not mandate specific safety outcomes. They create obligations to report incidents, but they do not define what constitutes an acceptable level of risk. They require independent verification, but they do not specify who qualifies as independent. The details matter, and the details are being negotiated in private between companies and regulators. This is not a conspiracy. It is the inevitable result of regulating a technology that no one fully understands.
The most honest assessment of the state-level approach is that it is better than nothing, but not by much. It creates the appearance of oversight without ensuring the reality of safety. It satisfies the political demand for action without addressing the technical challenges of prevention. It builds a system of accountability that will only catch failures after they happen, not before. This is not a reason to abandon the approach. It is a reason to be clear-eyed about what it can and cannot achieve. The scaffolding is in place; the real work of filling it with substance lies ahead.
The future of AI safety will not be decided by state legislators. It will be decided by the engineers who build the models, the researchers who test them, and the policymakers who fund them. But the state-level work is creating the conditions for that future. It is establishing the norm that democratic governments, not private companies, should make the critical decisions about frontier safety. It is building the political momentum for a national standard. And it is demonstrating that the United States can lead on AI governance without waiting for international consensus.
The quiet architecture of control that is emerging from state capitals is not a solution. It is a scaffolding. It creates the structure for accountability, but it does not fill in the content. That work will require federal action, international coordination, and sustained public engagement. The state-level approach is a beginning, not an end. But it is a beginning that matters, because it proves that democratic governance of AI is possible. The question is whether we have the will to finish what the states have started.