The silent clock on federal AI policy
The comment period on the SEC’s Regulation Crypto Assets proposal closes at 11:59:59 p.m. Eastern tonight, which is 03:59:59Z on October 21. Treasury’s NPRM comment period closed at 03:59:59Z today. Together they are the last public window before the GENIUS Act compliance stack takes effect on January 18, 2027. After tonight, that stack has zero open comment periods. While the federal government finalizes these rigid compliance requirements, the broader framework for artificial intelligence remains stuck in a state of legislative paralysis.
Three federal vehicles at a standstill
The primary vehicle intended to settle American AI governance, the Great American AI Act, exists only as a 269-page discussion draft released on June 4, 2026, by Representatives Lori Trahan and Jay Obernolte. Despite the intent to solicit feedback, the draft has not been formally introduced. It lacks a bill number, committee referral, hearing, or markup. As Representative Trahan put it in the June 4 press release, the threats AI poses to our national security, our safety, and our workforce are “here and growing by the day,” and the bipartisan framework is designed to meet them “without smothering American innovation.”
Other federal efforts are equally stalled. Senator Mark Warner introduced S.5051 on July 21, 2026, but the bill has sat at the Senate Committee on Commerce, Science, and Transportation for 91 days with no further action. Meanwhile, Senators Josh Hawley and Chris Murphy announced the AI Agent Accountability Act on October 1, 2026, following a Senate hearing. This proposal currently lacks a bill number in the public record and has no confirmed committee referral. Three vehicles, three stages of not happening: no introduction, no action, no bill number. The space left behind is being filled by state legislatures and private firms.
The mirror and the preemption trap
The Great American AI Act draft contains a specific mechanism that creates a conflict with existing state-level progress. Section 111 of the draft mirrors the requirements found in California’s SB 53, and it applies them to large frontier developers with over $500 million in revenue. Both regimes require a published frontier AI framework and a transparency report at deployment, and both set a 15-day clock for critical safety incident reports, cut to 24 hours when life is at risk: the federal draft routes them to CAISI, SB 53 to California’s Office of Emergency Services. However, Section 121 of the draft proposes to preempt any state or local law specifically targeting the development of AI models for a period of three years.
Whether Section 121 would actually reach SB 53 is unresolved. The draft preserves laws of general applicability and laws regulating AI use or deployment while reaching those that specifically target development, and where SB 53 sits on that line is an open legal question. While groups like the BSA have called the draft a credible effort, labor and civil society organizations have criticized the preemption provision for potentially undermining safety standards.
State momentum and private ordering
Governor Gavin Newsom signed SB 53 on September 29, 2025, the first-in-the-nation frontier AI safety law, in force since January 1, 2026. It requires published frameworks and transparency reports, critical safety incident reports to state emergency authorities, independent third-party audits beginning in 2030, whistleblower protections, and civil penalties up to $1 million per violation enforceable only by the state attorney general. In the absence of federal statute, financial firms are turning to private ordering to manage the risks of AI agents. As detailed in Schwab and JPMorgan, major institutions are blocking unauthorized agents from executing transactions. Schwab CEO Rick Wurster laid the worry out plainly on Bloomberg TV: “We don’t want someone just giving their password to Muse, and letting Muse come in and take action on that client’s behalf. We can’t control it, the client can’t control it, something could go wrong and who’s liable?”
At the same time, the industry is building the authorization layer it wants: protocols like Poppy and Proof x401, covered in our analysis of the layer, use OAuth-based session authorization and signed cryptographic mandates to give agents limited access instead of none. These firms are defining the boundaries of AI agency through private contracts, leaving liability questions for ordinary users largely unresolved by law.
What to watch
Once tonight’s close passes, the compliance stack that governs financial systems from January has no open comment window left. The federal AI framework remains a draft with no bill number. The watch list is concrete: formal introduction of the Great American AI Act and whether its preemption provision survives the feedback process; any movement on S.5051 in Senate Commerce; a bill number and referral for Hawley-Murphy; and whether California’s SB 53 regime persists if federal preemption is ever enacted. The rules being written in the meantime are coming from state legislatures and private firms, one statute and one contract boundary at a time.