Executive Order 14365 State AI Law Review — What the Commerce Evaluation Actually Does

The Commerce Department's evaluation of state AI laws under Executive Order 14365 does not preempt California, Colorado, or any other state AI rule. What it creates is a federal targeting mechanism — a structured path through which the administration can sort state laws into those it may tolerate, pressure through DOJ litigation, or use as conditions against BEAD program funding.

That distinction has direct consequences for compliance planning at multi-state companies. Organizations that interpret federal hostility as permission to pause state compliance may underinvest while state obligations remain fully operative. Organizations that treat the order as symbolic may miss a genuine escalation path now structurally embedded in the executive branch's AI posture.

Executive Order 14365 was signed December 11, 2025 and published in the Federal Register on December 16, 2025 (90 Fed. Reg. 58499, FR Doc. 2025-23092). It directed the Secretary of Commerce to publish, within 90 days, an evaluation identifying state AI laws deemed "onerous" or inconsistent with a "minimally burdensome national policy framework," and to identify laws suitable for referral to the DOJ's AI Litigation Task Force. That deadline was March 11, 2026. Executive Order 14365 required the Secretary of Commerce to publish the evaluation by March 11, 2026. As of March 18, 2026, no public evaluation has been identified in sources reviewed. The Colorado AI Act — currently the clearest near-term operational test — takes effect June 30, 2026, delayed from its original February 1 date by Senate Bill 25B-004, signed August 28, 2025.

What the Federal Targeting Mechanism Actually Means for State AI Law Compliance

Existing state AI laws remain the operative compliance baseline. Executive Order 14365 does not itself displace California, Colorado, or any other state AI rule. What it creates is an escalation architecture: once the Secretary of Commerce publishes the evaluation identifying "onerous" laws, those states become candidates for DOJ challenge and — under Section 5(a) of the order — ineligible for BEAD non-deployment funds "to the maximum extent allowed by Federal law."

White & Case's analysis frames the near-term posture clearly: existing state AI laws are likely not impacted in the short term, and the prudent course is to continue complying until there is greater clarity.

If the Secretary of Commerce has published the evaluation, the targeting mechanism moves closer to operational. Absent a verified public evaluation, the safer planning posture is to treat the mechanism as established in structure but not yet confirmed in operation.

The BEAD Funding Language Is Narrower Than Public Commentary Suggests

The most analytically important detail in EO 14365 is what the funding threat does not say. Public commentary has often characterized this as a threat to all BEAD broadband funding. Section 5(a) of the order is more constrained: it applies specifically to non-deployment funds and only "to the maximum extent allowed by Federal law."

That qualifier signals the administration anticipates legal limits on its ability to condition BEAD funds on state AI law compliance. The evaluation's practical force, in the near term, is leverage, litigation positioning, and negotiation pressure channeled through a federal funding mechanism — not automatic financial shutdown.

The Compliance Decision EO 14365 Actually Forces

The move: The White House, through Executive Order 14365 (signed December 11, 2025; published Federal Register December 16, 2025, 90 Fed. Reg. 58499), directed the Secretary of Commerce to publish within 90 days an evaluation of state AI laws identifying those deemed "onerous" and those to be referred to the DOJ's AI Litigation Task Force. The deadline for that evaluation was March 11, 2026. Section 5(a) simultaneously directed the Secretary of Commerce to issue a BEAD Policy Notice by the same date — meaning both the evaluation and the funding conditions mechanism carried the same 90-day deadline. As of March 18, 2026, neither has been verified as publicly issued.

Why it matters: The second-order consequence is not preemption — it is compliance fork risk. Companies must now maintain documentation that can defend two positions simultaneously: why they continued building to state requirements despite federal hostility, and why they did not reduce state compliance investment despite the federal escalation path. That governance documentation burden exists regardless of whether any specific state law is ultimately challenged or displaced.

Who should care: Chief Compliance Officers and VP-level compliance and privacy leads at multi-state companies with Colorado or California AI exposure; AI product counsel and governance leads responsible for impact assessments, transparency obligations, and bias-mitigation compliance; and legal and compliance teams managing consumer-facing AI disclosure requirements.