US AI regulatory fragmentation: the hidden cost of federalism

In early August 2026, Illinois became the first US state to require mandatory audits of so-called "frontier" AI systems, backed by civil penalties of up to $3M per violation. Colorado, for its part, strengthened its chatbot-specific disclosure obligations. At the federal level, the GAAIA (Government Advancing Artificial Intelligence Act) preemption bill, meant to unify these disparate state rules, remains stalled in Congress — per law firm Mintz's "AI: The Washington Report" (August 2026 edition).

Charles Tiebout's 1956 model of jurisdictional competition assumes mobile agents who "vote with their feet," sorting efficiently across territories offering different bundles of regulation and taxation. That model doesn't fit AI deployment: a national or multinational company's AI system operates simultaneously across all 50 states through its customer base, cloud footprint, or supply chain. It cannot simply pick one "AI-friendly" state and exit the rest. The result isn't competition disciplining regulators — it's additive compliance cost: N states legislate, N audit or certification regimes must be satisfied in parallel.

A different reading, David Vogel's "Trading Up" (1995), shows that a strict rule adopted by a single state can become a de facto national standard — as California's vehicle emissions rules did — when the cost of differentiating products state-by-state exceeds the cost of simply meeting the strictest rule everywhere. Whether Illinois's mandatory audit law will follow that trajectory is an open question. An early counter-signal: Colorado chose a different mechanism (chatbot transparency rather than model audits), suggesting no consensus standard is emerging yet, unlike the auto-emissions precedent.

Against this fragmentation, the European Union offers a useful point of comparison. The AI Act, despite its own repeated schedule slippages that Cardan-AI has tracked since July (a two-speed compliance calendar, the Digital Omnibus deferral of "Day 1"), remains a single text for all 27 member states. Its fines, capped at €35M or 7% of global turnover for prohibited practices (Article 99), are roughly ten times Illinois's cap in absolute terms (chart). But total compliance cost depends on both penalty severity and the number of distinct regimes to satisfy: by Vogel's logic, one strict rule can be cheaper to comply with than many milder but uncoordinated ones.

For aerospace, energy, or luxury groups with a US presence, the near-term question isn't whether GAAIA will pass — federal preemption bills have repeatedly failed in Congress since 2024 — but whether to map state-by-state obligations now or bet on convergence toward a de facto standard. Vogel's logic suggests watching which state rule other states start copying, rather than waiting for unlikely federal action.

This is precisely the kind of reading — turning a complex regulatory stack into a prioritized AI governance roadmap — that Cardan-AI's advisory work aims to provide to legal and AI leadership in these sectors.