Great American AI Act's Federalism Bet

The Great American AI Act's Quiet Bet on Federalism

Why the bipartisan GAAIA's narrow three-year preemption — not Trump's executive order or the EU AI Act — is the framework most likely to govern U.S. artificial intelligence through 2029.

The Great American AI Act, unveiled as a discussion draft on June 4, 2026 by Representatives Lori Trahan (D-MA) and Jay Obernolte (R-CA), would preempt state laws that regulate AI model development for three years — and only development. Everything downstream — hiring, housing, health, chatbots, election deepfakes, criminal-justice algorithms — remains with the states. That narrow bargain is the most consequential thing happening in Washington on artificial intelligence right now: it is the only preemption architecture that has survived contact with a Senate that killed a broader moratorium 99–1, a Trump executive order stalled in the courts, and more than 1,500 AI bills moving through statehouses in 2026. If it becomes law, it — not Brussels' AI Act, not Beijing's algorithm rules, not the White House's executive orders — will be the operative U.S. rulebook when GPT-6-class systems arrive.

The bill that had to exist

The GAAIA is a policy retreat dressed as a compromise, and it is a better bill for it. According to the section-by-section summary released by Trahan's office, Section 121 "preempts any state or local law or regulation specifically targeting the development of AI models" while "expressly" preserving laws of general applicability, common-law remedies, and any state law regulating AI use or deployment. The moratorium sunsets three years after enactment. That sunset is the load-bearing wall: it converts an open-ended power grab into a time-limited experiment that state legislators can tolerate.

Compare the maximalist alternative still sitting on the House Energy and Commerce docket. H.R. 5388 — a "national framework" bill — would impose a five-year preemption on "any law or regulation… limiting, restricting, or otherwise regulating artificial intelligence models, artificial intelligence systems, or automated decision systems entered into interstate commerce." That is essentially the ten-year moratorium the Senate rejected 99–1 in July 2025, warmed over. It is dead on arrival, and every serious staffer on the Hill knows it.

The GAAIA is what Trahan and Obernolte built after watching every broader version fail. In a June 12, 2026 op-ed, Trahan framed the bet in the plainest terms yet: two lanes, one federal rulebook for "how the most powerful models are developed and tested," and full state authority "to govern how AI is deployed and used, from hiring and housing to health care, education, chatbots, and more." The genius of the language is that it concedes the emotional terrain — deepfakes, discrimination, kids on chatbots — where state AGs and governors of both parties have already planted flags.

Why the maximalist path is closed

President Trump has spent 18 months trying to preempt state AI law by executive fiat, and the sequential failure is what makes GAAIA possible. On December 11, 2025, he signed an executive order directing the Department of Justice to establish an "AI Litigation Task Force" empowered to sue states over AI laws deemed "onerous," while directing federal agencies to condition Broadband Equity, Access, and Deployment (BEAD) funds on state deregulation, NPR reported. The order also instructs the Federal Trade Commission and Federal Communications Commission to declare state AI safeguards preempted where possible.

The pushback was immediate and bipartisan. Utah Governor Spencer Cox and Florida Governor Ron DeSantis publicly opposed the order — DeSantis noting on X, "An executive order doesn't/can't preempt state legislative action." Forty state attorneys general, 17 Republican governors, and 260 state lawmakers had already rejected the earlier moratorium version, according to a November 2025 Dear Colleague letter from House Democrats organizing opposition. CSIS analyst Gregory Allen wrote in a December 2025 assessment that the EO "puts the cart before the horse" and would "certainly attract legal challenges and unproductively consume both federal and state resources."

The Brookings legal team was blunter. "The order itself has no preemptive power whatsoever," Brooke Tanner, Josie Stewart, and Nicol Turner Lee wrote in a Brookings analysis, noting that FCC statutory authority is "limited specifically to the communications industry" and that FTC assertions of preemption would require proving state anti-discrimination laws are somehow "deceptive." One preemption advocate cited by Brookings called any such contortion "a Quixotic exercise in futility."

Meanwhile, Trump's allies have kept trying to smuggle preemption into must-pass bills. A December 2025 attempt to insert an AI moratorium into the FY2026 National Defense Authorization Act failed after Senator Josh Hawley (R-MO) publicly rejected it, and Senators Ed Markey and Elizabeth Warren organized Democratic opposition through a Dear Colleague letter. Two congressional defeats inside 18 months, one executive order in legal limbo — that is the political landscape the GAAIA is negotiating.

The Trahan-Obernolte draft exists because both routes to broad preemption are closed. They have identified the one narrow slice — model training and pre-deployment safety testing — where a coalition can actually hold.

What the executive branch is doing in the meantime

While Congress negotiates, the White House is filling the void through executive action — and doing something arguably more consequential than preemption. Executive Order 14409, signed on June 2, 2026, orders the Committee on National Security Systems and the Secretary of War to prioritize cyber defense of national security systems within 30 days, and directs the Cybersecurity and Infrastructure Security Agency to issue Binding Operational Directives that "facilitate access to cybersecurity tools and services including, where appropriate, covered frontier models for agencies, State and local authorities, and operators of critical infrastructure such as rural hospitals, community banks, and local utilities."

Section 3 of the order is quieter but structurally bigger. Within 60 days of signing — meaning by August 1, 2026 — the administration must establish a voluntary framework under which frontier developers may submit models for federal evaluation up to 30 days before public release. According to an analysis at AITechModel, participation is optional and the government develops a classified benchmarking process, meaning the state acquires pre-release visibility into the most advanced systems without imposing licensing. In practice, that is the beta version of what GAAIA would statutorily require. If EO 14409's voluntary framework works, the case for the GAAIA's licensed-auditor regime gets easier; if labs stonewall CAISI, the case gets harder.

A National Security Presidential Memorandum, NSPM-11, signed a week later on June 12, 2026, accelerates AI adoption across intelligence and warfighting agencies with vendor-control and contract-accountability provisions that will reshape procurement for defense contractors and federal research institutions.

The state pressure the bill cannot ignore

Illinois lit the fuse on July 8, 2026 by becoming the first U.S. state to mandate annual third-party audits of frontier AI models, CSIS reported in its AI Policy Podcast the following day. That is precisely the kind of development-stage law the GAAIA would preempt for three years — and precisely the kind of law New York's RAISE Act, sponsored by Assemblyman Alex Bores, is designed to expand. As Bores told NPR, the RAISE Act was "largely based on voluntary commitments that all the companies had already made and pledged to do," which he argued is definitionally not "onerous."

Colorado's AI Act was repealed and re-enacted through SB 26-189, pushing automated-decision-making duties to January 1, 2027, according to Vorp Labs' regulatory tracker. The delay is itself revealing: even the state that went furthest on deployment regulation is having trouble making it stick. A Carnegie Endowment analysis argued the Colorado model has not "taken off elsewhere," and that Texas — the state most likely to follow — passed "a far more lightweight set of rules."

The auditing model at the heart of the Illinois law is not fringe. A June 2026 paper led by Miles Brundage, Noemi Dreksler, and Lennart Heim proposed four AI Assurance Levels for frontier developers, arguing AAL-1 should be baseline and AAL-2 a near-term target for the most advanced labs. AEI's James Pethokoukis, writing at the American Enterprise Institute, argues the auditing regime is the most important part of the GAAIA, not the preemption clause — it would give the Center for AI Standards and Innovation, housed inside Commerce, the power to license private auditors, oversee them, and yank licenses when they fall down on the job. The design echoes the Public Company Accounting Oversight Board created after Enron.

That is the quiet story: Congress is importing Sarbanes-Oxley into AI safety. The 2002 template — a government-authorized but privately run oversight body, licensed auditors doing the actual inspection, criminal liability for fraud — is the model most likely to survive both Silicon Valley's lobbying and the states' distrust.

The international dimension nobody in the room is discussing

Here is what the Washington debate is quietly conceding to Brussels. The EU AI Act's general-purpose model rules — including transparency, model-evaluation, and cybersecurity requirements — entered their operational compliance phase in June 2026, with a new AI-generated content Code of Practice and Transparency Code layered on top, according to Real Instituto Elcano's analysis of the AI Act's global reach.

An Atlantic Council issue brief noted in April 2026 that the U.S. and EU "have embraced opposing models" on data — the U.S. favoring open cross-border flows, the EU moving toward localization and intra-European AI development where "training algorithms are tested and utilized within closed infrastructure." That divergence means the GAAIA's federal safety-audit standard, if enacted, becomes the U.S. counter-anchor to the Brussels Effect. If it fails, U.S. firms selling into Europe default to EU standards for their global product — and American law becomes irrelevant to how the most advanced systems are actually built.

A separate bipartisan vehicle, S. 4915, the AI Labeling Act of 2026, introduced June 24 by Senators Brian Schatz, John Curtis, and Mark Warner, would require both visible and machine-readable disclosures on AI-generated image, video, and audio content — the U.S. answer to the EU's content-provenance Code of Practice. In Curtis's press release, sponsors framed the bill as the U.S. catching up to "jurisdictions around the globe" — a rare public admission that Washington is behind.

The semiconductor front tells the same story of American ambivalence. On the same week Illinois moved on audits, the Trump administration lifted export controls on Anthropic's Fable model, per CSIS. That followed Commerce Department action permitting Nvidia H200 chip sales to China with a volume cap and 25% federal fee — a policy CFR's Gregory Allen called "strategically incoherent and unenforceable", estimating the cap could still authorize roughly one million H200s and one million H100s to Chinese buyers, increasing installed Chinese AI compute by roughly 250% in 2026 alone. Washington is tightening domestic oversight through EO 14409 while loosening the export controls that were the last line of technological defense — two policies running in opposite directions from the same building.

Who wins, who loses

The GAAIA's real winners are the four largest frontier labs — OpenAI, Anthropic, Google DeepMind, and xAI — which gain a three-year single-rulebook window for model development and a defined, auditable path to compliance run by CAISI. The regime lets them plan capital expenditure against one standard rather than 50, and it hands them a credentialed defense against future state litigation. The audit-firm ecosystem — the Deloittes, PwCs, and specialist boutiques that will apply for CAISI licenses — is the second-order winner, replicating the accounting-oligopoly economics of Sarbanes-Oxley.

The losers are Illinois, New York (via the RAISE Act), and California — states that had planned to set the pace on development-stage safety and will be preempted for three years. Smaller open-source developers face a harder squeeze: a licensed-auditor gate is more expensive than a light-touch state regime, and unlike the largest labs they cannot absorb audit costs across a large revenue base. Anthropic co-founder Jack Clark told a June 2025 House hearing that "truly consequential technology" could arrive by "late 2026 or early 2027." If Clark is right, GAAIA's three-year window covers precisely the period when the most dangerous systems will be built.

The wildcard remains the Trump White House. If the administration decides GAAIA's three-year sunset and preservation of state deployment authority is insufficient, it will keep pushing broader preemption through the NDAA and the courts. If it treats the bill as a workable floor, GAAIA has a path.

What to watch

• August 1, 2026: 60-day deadline under EO 14409 for the classified frontier-model evaluation framework to stand up at CAISI. First evidence of whether labs will voluntarily submit.
• Fall 2026: Formal introduction of the Great American AI Act after the discussion-draft comment period (GAAIA@mail.house.gov) closes; watch for a Senate companion sponsor.
• January 1, 2027: Colorado's automated-decision-making obligations take effect — the first stress test of a comprehensive state deployment regime.
• FY2027 NDAA markup: The next opportunity for AI preemption to be smuggled into must-pass legislation. Markey-Warren opposition is already teed up.

Diplomat View

The GAAIA will pass, in modified form, before the 119th Congress adjourns — because it is the only preemption vehicle that has already survived the coalition math that killed everything else. Its three-year development-stage moratorium plus federal safety-audit regime is narrow enough to hold 40 state attorneys general at bay and broad enough to give frontier labs the legal certainty they will pay for.

The forecast changes if two things happen. First, if the Trump administration insists on broader preemption in the FY2027 NDAA and burns bipartisan trust, GAAIA collapses back into partisan gridlock. Second, if a major AI safety incident — a model release causing measurable public harm — occurs before markup, the auditing regime gets rewritten toward FDA-style premarket approval, and industry support evaporates.

The historical parallel is Sarbanes-Oxley after Enron: a bipartisan safety-audit regime enacted under industry pressure, run by a licensed private-auditor ecosystem, that outlasted its authors' expectations. Bet on Congress building the same architecture for frontier AI. Bet on Brussels writing the deployment rules Americans actually live under, unless GAAIA becomes law.

The Bottom Line

The Great American AI Act's bet is that a three-year federal preemption limited to model development — paired with a licensed third-party audit regime at Commerce's CAISI — is the only politically survivable route to a U.S. AI rulebook. If it becomes law, Washington will have chosen Sarbanes-Oxley over the FDA, and left the states in charge of everything AI actually does to Americans. If it fails, the EU AI Act becomes the operative global standard by default, and American AI governance remains a patchwork of executive orders and litigation into 2028.