Did the Department of Commerce report override state AI laws?

No. The DOC's March 2026 report evaluated state AI laws as required by the December 2025 executive order, but it cannot unilaterally preempt or invalidate them. Actual preemption requires either DOJ litigation challenging specific state laws in federal court, or voluntary agreements between states and executive agencies. Neither has happened. State AI laws currently in force — including Texas TRAIGA (effective January 1, 2026), Illinois HB 3773 (effective January 1, 2026), and Colorado CPAIA (compliance deadline June 30, 2026) — remain in effect and enforceable.

What does 'federal preemption' of state AI laws actually require?

Federal preemption of state law requires an act of Congress or a court ruling finding that a specific state law conflicts with federal law. An executive order or a report issued by an executive agency cannot preempt state law on its own. The December 2025 executive order established a framework through which the federal government could challenge state AI laws — but that challenge process requires litigation or negotiation, not just a report. Ropes & Gray's March 2026 analysis confirmed that the executive order 'establishes a framework for federal challenge' but cannot override state laws directly.

Which state AI laws are currently in effect for professional services firms?

Texas TRAIGA (Texas Responsible AI Governance Act) went into effect January 1, 2026, and applies to companies with Texas employees using automated decision systems. Illinois HB 3773 (effective January 1, 2026) requires disclosure when AI is used in employment and hiring decisions — directly relevant for any professional services firm doing any hiring or staffing in Illinois. Colorado's CPAIA has a June 30, 2026 compliance deadline for high-risk AI systems. Oregon HB 4154 (passed March 2026) creates a private right of action for AI chatbot deception, affecting firms with Oregon-based clients. New Hampshire SB 640 (passed committee March 2026) prohibits AI from providing licensed professional services without meaningful oversight.

What is the risk of a 'wait and see' approach to state AI compliance?

Direct legal liability. If your firm uses AI in Texas, Illinois, or Colorado and has not completed the required compliance steps for those states' current laws, you are already exposed — regardless of what the federal government might do in the future. State AGs do not pause enforcement while federal preemption debates play out. For law firms and accounting firms with professional liability exposure, non-compliance with state AI laws also creates E&O risk, as insurers are beginning to incorporate AI governance into renewal applications.

What are the minimum compliance steps for a small professional services firm operating in multiple states?

Start with three: (1) If you have Texas employees or Texas-based clients and use any AI for decision-making, complete a TRAIGA compliance audit — specifically the inventory of automated decision systems, vendor review for third-party AI tools, and documentation requirements. (2) If you do any hiring or staffing in Illinois, review HB 3773's employment AI disclosure requirements and update your hiring workflow accordingly. (3) Begin your Colorado CPAIA documentation before June 30. The documentation — AI system inventory, risk assessment, and oversight policy — takes 2-4 weeks to prepare properly and should not be left to the final week of June.

State AI Laws: What the DOC Report Means

Published: March 15, 2026 | By: The Crossing Report | 6 min read

Summary

On March 11, 2026, the Department of Commerce published its evaluation of state AI laws — a report required by the December 2025 executive order on AI policy. Some professional services firm owners read headlines about "federal scrutiny of state AI laws" and concluded they could pause their compliance planning. That reading is wrong. The DOC report does not preempt, override, or suspend any state AI law. Your compliance obligations in Texas, Illinois, Colorado, Oregon, and New Hampshire are unchanged. Here's why the confusion happened — and what you actually need to do this week.

What the DOC Report Is — and What It Isn't

The December 2025 executive order on AI directed several federal agencies, including the Department of Commerce, to study state AI regulations and identify those that conflict with the administration's AI policy goals.

The DOC report, published March 11, is the output of that study. It is an analysis, not a legal ruling.

Ropes & Gray's March 2026 analysis of the executive order framework is clear on this point: the executive order "establishes a framework for federal challenge" to state AI laws — meaning it creates a pathway through which the federal government could contest state laws in court or negotiate changes with states. But that pathway requires either:

DOJ litigation: The federal government suing a state in federal court to challenge a specific law as unconstitutional or preempted by federal statute
State agreements: Voluntary arrangements between states and executive agencies to modify or pause enforcement

Neither has happened. No state AI law has been enjoined by a federal court. No state has agreed to pause enforcement. The executive order and the DOC report are the beginning of a possible future challenge process — not the end of current state compliance obligations.

The "Wait and See" Risk

Some firm owners have adopted a "wait and see" posture: deferring AI compliance planning until the federal preemption debate resolves. This strategy creates real legal exposure for two reasons.

First, currently effective laws don't wait. Texas TRAIGA went into effect January 1, 2026. Illinois HB 3773 is effective January 1, 2026. If your firm has been using AI tools in those states since January without completing the required documentation and disclosure steps, you have been out of compliance — and state AGs do not pause enforcement activity because a federal agency published a report.

Second, the resolution timeline is long and uncertain. Even if the federal government files litigation challenging one or more state AI laws, those cases take 18-36 months to resolve. The Colorado CPAIA June 30 deadline will arrive before any court reaches a final ruling on preemption. Planning your compliance around a hoped-for federal preemption is a bet on an outcome nobody controls.

The minimum viable posture: treat currently effective state laws as compliance obligations that exist now, regardless of what federal policy does next.

The State AI Law Landscape for Professional Services Firms

Here are the laws that directly affect professional services firm owners in 2026:

Texas TRAIGA (effective January 1, 2026) Applies to any company with Texas employees that deploys AI systems used in decisions affecting those employees or customers. Three compliance obligations: (1) inventory of automated decision systems, (2) vendor review for any third-party AI tools, (3) documentation of oversight procedures. Relevant for law firms, accounting firms, consulting firms, and staffing agencies with Texas operations.

Illinois HB 3773 (effective January 1, 2026) Requires disclosure when AI is used in employment decisions — including hiring, promotion, and performance evaluation. Directly relevant for any professional services firm doing hiring in Illinois, and critically relevant for staffing firms that use AI tools to screen or rank candidates.

Colorado CPAIA (compliance deadline June 30, 2026) Requires risk assessments, bias testing, and oversight policies for "high-risk" AI systems — those that make or substantially assist consequential decisions affecting individuals. Any professional services firm using AI for client intake, staff evaluation, or service delivery decisions should begin their CPAIA documentation now. The documentation process takes 2-4 weeks; starting in late June is too late.

Oregon HB 4154 (effective March 2026) Creates a private right of action — meaning individual clients can sue — for harm caused by AI chatbot deception. If your firm uses AI for client-facing intake, scheduling, or communication with Oregon-based clients, you need disclosure language and a human review checkpoint in that workflow now.

New Hampshire SB 640 (passed committee March 2026) Prohibits AI from "providing licensed professional services" without a licensed professional's meaningful oversight. The standard is not yet defined, but the practical implication is conservative: document human review for any AI-assisted professional output.

Three Actions for This Week

1. Confirm your Texas TRAIGA posture. If you have Texas employees and use any AI tool in decision-making workflows — hiring, client intake, performance management, scheduling — complete a brief inventory: What AI systems do you use? Which ones affect people? What oversight exists? That inventory is the foundation of TRAIGA compliance. If you haven't started, start this week.

2. Review Illinois HB 3773 if you do any hiring in Illinois. This applies to staffing firms most directly, but any professional services firm using AI tools in the hiring process — resume screening, candidate ranking, interview scheduling — should confirm that their process includes the required disclosures. If your ATS uses AI and you have Illinois-based candidates, this applies to you.

3. Begin your Colorado CPAIA documentation before June 30. Don't leave this to May. The documentation process — AI system inventory, risk assessment, oversight policy — takes time to do correctly. Block 2-4 weeks, start in April, and give yourself a June 15 internal deadline. If you're preparing for Issue #12 compliance content from The Crossing Report in April, that brief will include templates and a step-by-step walkthrough.

The Bottom Line

The DOC report is not a compliance holiday. It is a signal that federal attention to state AI law is intensifying — which may eventually produce changes in some states, but produces no changes today.

The professional services firm owners who will be in the best position 18 months from now are the ones who treat state AI compliance the same way they treat any professional obligation: confirm what applies, document what they're doing, and build the policy before they need to defend it.

The "wait and see" window closed when Texas and Illinois went into effect on January 1.

Sources: Department of Commerce Evaluation of State AI Laws (March 11, 2026) | Ropes & Gray: Examining the Landscape and Limitations of the Federal Push to Override State AI Regulation (March 2026) | Mondaq: 2026 AI Policy Outlook — Federal Preemption, State AI Laws

The Feds Won't Save You From State AI Laws — Here's What the DOC Report Actually Means for Your Firm