The FTC Published Its AI Rules. Does Federal Preemption Make Your State Compliance Easier — or Harder?
Published December 30, 2025 · By The Crossing Report
Published: March 15, 2026 | By: The Crossing Report | 6 min read
Summary
On March 11, 2026, the FTC published its AI policy statement — required under the December 2025 Trump executive order on AI. The statement covers AI advertising, consent for training data, and automated decision-making transparency. The part that matters most for professional services firm owners in Colorado, California, and Illinois: the FTC is laying the legal groundwork to preempt state AI laws it views as conflicting with federal consumer protection standards.
If you're hoping that means your state compliance obligations just got lighter, they didn't. Federal preemption arguments take years to resolve in courts. Your state obligations are in full force today. The correct posture right now is comply with the strictest standard that applies to you — and document that you're doing it.
What the FTC Statement Actually Says
The FTC's March 11 statement has three main components.
AI advertising. Existing FTC deception standards — Section 5 of the FTC Act — apply to AI-generated advertising and marketing content. This isn't new authority; it's the FTC saying its existing rules already cover AI. If your firm uses AI to generate client-facing marketing, the same prohibition on misleading claims applies.
Training data consent. The statement addresses consent frameworks for using consumer data to train AI models. For most small professional services firms, this is relevant if you're using client information in AI tools that may feed model training — something worth verifying with your software vendors.
Automated decision-making transparency. This is the piece most relevant to accounting, staffing, and financial advisory firms. The FTC statement specifically calls out credit scoring, underwriting, and employment decisions made with AI assistance. If AI influences which candidates you advance, which clients get approved for financing, or how you assess financial risk, the FTC is signaling disclosure requirements apply.
The Preemption Question
Here's the consequential part that's largely underreported: the FTC's statement argues that state laws requiring "alterations" to AI outputs — meaning state rules that would force AI systems to behave differently — may be preempted by federal consumer protection law. The states in the crosshairs are Colorado, California, and Illinois.
Colorado's SB24-205 requires developers and deployers of high-risk AI systems to implement impact assessments, bias audits, and consumer notification obligations. California's AI-related obligations under the CPRA and several pending bills impose transparency and opt-out requirements. Illinois has the AI Video Interview Act (AIVIA) and BIPA, which apply directly to firms using AI in hiring.
The FTC's position is that federal consumer protection law sets the floor — and potentially the ceiling — and that state rules mandating specific alterations to how AI outputs are presented or generated may conflict with that federal framework.
What this does not mean: It does not mean those state laws are suspended. It does not mean courts have agreed. It does not mean enforcement has stopped. It means the FTC is signaling its preferred legal theory, which will now be litigated — for years.
What This Means for Firm Owners in CO, CA, and IL
If you own a law firm, accounting firm, consulting firm, staffing agency, or marketing agency in Colorado, California, or Illinois, here is the plain-language version:
Your state AI obligations are still in effect. Full stop.
The practical question is what preemption uncertainty does to your compliance calculus. The answer: it makes the cost of cutting corners higher, not lower. If you let state compliance slide because you heard "the feds might preempt that," and preemption doesn't hold — or takes four years to resolve — you've been non-compliant under state law the entire time. State attorneys general in all three states have enforcement authority and have shown willingness to use it.
The FTC preemption argument may eventually simplify the national landscape for AI compliance. That is a 2028 or 2029 conversation. It is not a 2026 compliance strategy.
One more angle worth flagging: even if federal preemption ultimately prevails on automated decision-making, the FTC's own rules in that space still require transparency and documentation. You're trading one set of obligations for a parallel set — not escaping them.
What to Do Now
This week, do one thing: Pull up whatever AI tools your firm currently uses — contract drafting, document review, client intake, hiring workflows, financial modeling — and identify which involve automated decision-making in credit, employment, or financial assessments. Those are your highest-exposure points under both the FTC statement and your state law.
If you're in Colorado, California, or Illinois and you don't have a written AI use policy that covers those workflows, that's your gap. It doesn't need to be a 40-page governance document. It needs to document what AI tools you use, what they're used for, that a licensed professional reviews AI-assisted outputs before delivery, and that clients are notified of AI use in engagement letters.
If a client, prospect, or regulator asks whether your firm is "AI compliant," the correct answer is: yes, and here's how. Not "we're waiting to see how the federal preemption issue resolves." That's not an answer. That's a liability.
Related Reading
- The FTC Just Defined AI Deception — What It Means for Client Communications — The companion piece to this post: how the FTC's existing deception standards apply to AI-generated client work, independent of the preemption question.
- New Hampshire SB 640: What It Means When AI Can't Practice Without a Human — NH's approach to licensed professional oversight of AI, and how it fits into the national state-law picture.
- Oregon HB 4154: Your Clients Now Have the Right to Sue Over Your AI Chatbot — Oregon's private right of action for AI chatbot disclosure failures — the most aggressive enforcement mechanism in any state AI bill to date.
- What AI Compliance Actually Costs a Professional Services Firm — The real cost of building a defensible AI compliance posture for a 5-50 person firm, broken down by what you can do in-house and what needs outside help.
- The Feds Won't Save You From State AI Laws — Here's What the DOC Report Actually Means for Your Firm — The DOC's March 2026 AI report evaluated state laws but cannot preempt them. Texas, Illinois, and Colorado compliance obligations are unchanged.
- Trump's AI Executive Order Names Colorado — But Your June 30 Compliance Deadline Is Still On — Trump's EO named Colorado's CPAIA as a preemption target. Every major law firm analysis says the June 30 deadline is unchanged. Here's what to do now.
The Crossing Report covers AI, legal, and regulatory developments for owners of professional services firms. This post is informational, not legal advice. If your firm has specific compliance questions related to the FTC statement or applicable state AI laws, consult qualified legal counsel.
Frequently Asked Questions
What did the FTC's March 2026 AI policy statement say about state laws?
The FTC's March 11, 2026 policy statement — issued under the December 2025 Trump executive order on AI — argues that state AI laws requiring 'alterations' to AI outputs may be preempted by federal consumer protection law. This directly targets state-level AI disclosure and transparency frameworks in Colorado, California, and Illinois. Preemption, if upheld, would supersede conflicting state rules with a single federal standard.
Does federal preemption mean I don't have to comply with Colorado SB24-205 or California's AI rules?
No. Federal preemption is a legal argument, not a settled rule. The FTC's position has to survive court challenges before it binds anyone. That process takes years. Until courts rule definitively, your state obligations remain in full force. Treating preemption as a compliance holiday now is how firms generate liability.
Which states are specifically targeted by the FTC's preemption argument?
Colorado, California, and Illinois are the primary targets, as they have enacted or implemented the most specific AI transparency and automated decision-making rules affecting professional services. Colorado's SB24-205 (high-risk AI systems), California's CPRA-based AI obligations, and Illinois's AI Video Interview Act and BIPA framework are the main state-level rules in the FTC's crosshairs.
What is automated decision-making transparency and does it apply to my firm?
The FTC's statement addresses automated decision-making in three areas: credit scoring, underwriting, and employment. If your firm uses AI-assisted tools in hiring decisions, credit evaluation for clients, or insurance underwriting, you have transparency obligations under both the FTC framework and applicable state law. Accounting firms using AI for financial assessments and staffing firms using AI in candidate screening are the most directly affected firm types.
What should I tell a client who asks if my firm is 'AI compliant'?
Tell them: your firm operates under applicable federal FTC guidelines and the strictest state standard that applies to your work together. You have a written AI use policy, your AI-assisted deliverables are reviewed by licensed professionals before delivery, and you disclose AI use in engagement letters. That's an accurate, defensible, and reassuring answer — and it's what compliance actually looks like right now.