What AI rules apply to US companies after Executive Order 14110 was revoked?

After Executive Order 14110 was revoked on January 20, 2025, the federal government moved to a deregulatory AI policy, so the binding AI rules US companies face now come mainly from states, cities and sector regulators. The most relevant for security leaders are Colorado's automated decision law taking effect January 1, 2027, California's SB 53, Texas's TRAIGA, New York City's Local Law 144 and the New York Department of Financial Services' cybersecurity expectations.

What replaced Executive Order 14110 at the federal level?

Three days after the revocation, Executive Order 14179 declared a policy of sustaining and enhancing America's global AI dominance and ordered a review of every action agencies had taken under the revoked order.

That order told the Office of Management and Budget to revise its federal AI memoranda M-24-10 and M-24-18, and on April 7, 2025 OMB issued two replacements, M-25-21 on agency use and M-25-22 on acquisition. Those memos bind federal agencies, and companies meet them mainly as vendors.

On June 2, 2026, Executive Order 14409 turned to security. It gave CISA 30 days to issue binding operational directives for civilian federal systems, set up a voluntary AI cybersecurity clearinghouse with industry and critical infrastructure operators, and stated that it creates no mandatory licensing requirement for new AI models.

Does the December 2025 executive order override state AI laws?

Not by itself. Executive Order 14365 of December 11, 2025 sets a policy of a minimally burdensome national framework and directs the Attorney General to form an AI Litigation Task Force to challenge state AI laws, but displacing those laws is left to litigation and to legislation it asks advisers to draft.

The order also told Commerce to publish an evaluation of onerous state laws within 90 days and to tie some broadband funding to it. The legislative recommendation it requests would preempt conflicting state laws, while leaving areas such as child safety and state procurement of AI alone.

Until courts or Congress act, state statutes remain on the books, and compliance plans should treat them as enforceable.

Which state and city AI laws should a security leader track?

Among the laws reviewed here, those of Colorado, California, Texas and New York City are the most concrete, and each targets a different slice of AI use. Each creates records, disclosures or incident duties that tend to land on security and risk teams.

Colorado replaced its 2024 AI act in May 2026 with SB26-189, which repeals and reenacts it around automated decision-making technology used in consequential decisions about education, employment, housing, lending, insurance, health care and government services. From January 1, 2027, developers must give deployers technical documentation, and both must keep compliance records for at least 3 years.

The Colorado attorney general enforces it under the consumer protection act, with a 60-day notice and cure period before January 1, 2030. The office filed proposed rules on August 11, 2026 and is taking comments through October 26, 2026.

California's SB 53, the Transparency in Frontier Artificial Intelligence Act, was signed on September 29, 2025. It applies to developers of frontier models trained with more than 10^26 operations, and requires frontier developers to report a critical safety incident to the Office of Emergency Services within 15 days of discovering it.

Its heavier duties fall on large frontier developers, meaning those with annual gross revenues above $500,000,000, and penalties can reach $1,000,000 per violation in actions brought by the Attorney General. Most enterprises will meet SB 53 indirectly, through the safety frameworks their model vendors must publish.

Texas's Responsible Artificial Intelligence Governance Act took effect on January 1, 2026. It bars developing or deploying AI with intent to unlawfully discriminate against a protected class, among other prohibited uses, and gives the attorney general exclusive enforcement with penalties of $80,000 to $200,000 for each uncurable violation.

New York City's Local Law 144 of 2021 bars employers and employment agencies from using an automated employment decision tool unless it has had a bias audit within the past year, the audit information is public, and notices have gone to candidates or employees.

What do sector regulators expect?

Sector regulators mostly apply existing rules to AI rather than writing new ones. The New York Department of Financial Services said so in its October 16, 2024 industry letter: the guidance adds no requirements beyond its Part 500 cybersecurity regulation, but explains how regulated entities should use that framework for AI risks.

The letter says risk assessments must account for deepfakes and other AI threats, and it urges authentication that deepfakes cannot impersonate, such as digital certificates and physical security keys, over SMS, voice or video. It also asks entities that use AI to inventory every information system that uses or relies on it.

What should a US security leader do now?

Build the compliance map by state and sector, not by federal mandate. List where the company deploys automated decisions affecting Colorado residents, hiring tools used on New York City candidates, and any Texas consumer-facing AI; confirm which model vendors fall under SB 53 and collect their published frameworks. Financial institutions supervised in New York should treat the DFS letter as the examiner's checklist. Watch the Commerce evaluation and Task Force litigation under the December 2025 order, since either could change which state duties survive.