State AI Laws Hit 109 as Compliance Becomes a Moat for the Biggest Players

America's AI regulatory map keeps compounding. With no federal law preempting the states, state-level AI statutes reached 109 by mid-year, alongside 28 data center laws, spread across 29 states.

Those rules are stacking on top of countervailing federal activity: a late-2025 executive order created a litigation task force to challenge state laws deemed burdensome and threatened to withhold broadband funding from strict states, after the Senate rejected a proposed moratorium on state AI rules. So far, federal pressure has changed the substance of state laws rather than their volume, steering legislatures toward child safety, companion chatbots and data centers.

The texture is wide: Illinois now requires yearly third-party audits of frontier models, 14 states have companion chatbot laws, at least six restrict health insurers' use of AI, and others regulate AI-driven dynamic pricing.

For any AI company selling into both markets, compliance mapping across the EU, US federal and state regimes is now a standing workstream, not a one-off project, with dedicated budgets and teams growing every quarter.

That is the deeper economic effect: the burden advantages later-stage companies that can amortize compliance cost across large revenue, raises the entry barrier for small startups, and adds another concentration force to an industry already consolidating around big players.

Regulation does not stop the race; it redistributes its cost. When the compliance map sometimes costs more than the model, law stops being a referee between competitors and becomes a gate deciding who gets to compete at all.

Key terms explained:

Preemption: When a federal law overrides state laws on the same subject; without it, every state can set its own rules.

Executive order: A directive issued by the US president that carries legal force across federal agencies without going through Congress.

Frontier models: The largest and most capable AI systems at the leading edge of the field, which regulators treat as higher risk.

Compliance: The work of proving a company meets every applicable legal requirement — documentation, audits and reporting.

Dynamic pricing: Prices that change automatically based on demand, user data or other signals, increasingly set by algorithms.

Barrier to entry: A cost or requirement that makes it harder for new companies to enter a market, favouring incumbents.