Executive Order 14365 targets state AI laws with a national policy framework

Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence, was signed on 11 December 2025. It sets a US policy of a minimally burdensome national framework for AI and directs federal agencies to challenge or discourage state AI laws that conflict with that policy.

What it is

The order argues that state-by-state rules produce a patchwork of 50 regulatory regimes whose weight falls particularly on start-ups, and that some state laws push ideological bias into models; it cites a Colorado algorithmic discrimination law as an example. It asks Congress for a single national standard that would displace conflicting state laws.

What it requires

• Within 30 days, the Attorney General must create an AI Litigation Task Force whose sole job is to challenge state AI laws inconsistent with the policy.

• Within 90 days, Commerce must publish an evaluation naming onerous state AI laws, at minimum those forcing models to alter truthful outputs or compelling disclosures that may violate the First Amendment.

• States with laws on that list are to lose eligibility for non-deployment BEAD broadband funds as far as federal law allows, and agencies must weigh conditioning discretionary grants on similar terms.

• The FCC is to consider a federal AI reporting and disclosure standard that preempts conflicting state laws, and the FTC is to explain when state laws requiring changes to truthful model outputs are preempted.

The legislative proposal the order requests must leave alone otherwise lawful state rules on child safety, AI compute and data center infrastructure, and state procurement and use of AI.

What security leaders should do

• Keep state-law compliance programs running until a court ruling, a statute or a state amendment actually changes your obligations.
• Watch for the Commerce evaluation and any Task Force filings affecting the states where you operate.
• Run AI security controls on their own track; the order's stated targets are state rules on model outputs and disclosure, not baseline security practice.