Regulatory Fragmentation

State of play.

• The federal AI governance picture has bifurcated into a voluntary safety framework and a politically contested enforcement vacuum. Trump's June 2026 executive order establishes a 30-day pre-release model review and Section 4 criminal enforcement priority for AI agent misuse, while bipartisan critics—including Steve Bannon and Senator Ron Wyden—argue that the administration's Silicon Valley ties have produced regulatory inaction on actual AI security incidents .
• State-federal AI preemption is the live fault line for compliance architecture. The Great American AI Act would impose a three-year freeze on new state AI development laws, but the FTC's proposed consumer-protection framework explicitly rejects state AI law compliance as a defense to federal deception claims—meaning companies face simultaneous exposure from both directions regardless of which regime they optimize for .
• AI infrastructure regulation has gone from permissive to restrictive at the state level. New York has imposed a one-year moratorium on hyperscale data centers over 50 megawatts, with similar measures advancing in Georgia, Maryland, Vermont, and Virginia; Australia has announced a mandatory national framework requiring data centers to fund new power generation and water infrastructure .
• Cross-border regulatory arbitrage in fintech and payments is reshaping competitive dynamics. Revolut's French banking licence gives it full deposit-taking and lending authority across Western Europe's largest markets; the US-Brazil Pix tariff dispute signals that government-operated payment infrastructure is now a Section 301 trade weapon .
• For counsel advising technology companies, financial institutions, or infrastructure developers, the practical baseline is that regulatory fragmentation has expanded from financial services into AI governance and physical infrastructure simultaneously—compliance programs need jurisdiction-by-jurisdiction mapping across federal, state, and international regimes, with no unified federal baseline in sight.

Where things stand.

• Federal AI governance is a voluntary framework with mandatory enforcement edges. Trump's June 2026 EO formalizes pre-release model review with NSA-led assessment and a DOD cybersecurity priority, but participation by OpenAI, Anthropic, and Google remains voluntary; Section 4's criminal enforcement focus for AI agent misuse is the non-voluntary component that GCs cannot defer .
• State-federal AI preemption is unresolved and simultaneously contested at multiple levels. The Great American AI Act proposes a three-year freeze on new state AI development laws with an undefined carve-out for consumer protection, civil rights, and privacy; Colorado's SB24-205 is already in effect; California, New York, and Illinois have enacted or proposed their own rules; and the FTC's framework would not treat state compliance as a federal defense .
• AI infrastructure is now a regulated land-use and energy question. New York's moratorium blocks environmental permits for facilities over 50 megawatts for one year, affecting over 20 proposed projects; Australia's framework requires net electricity generation and water minimization, with legislation targeted for early 2027; both regimes are the first of their kind and will be watched as templates .
• China's AI registration regime imposes mandatory domestic partnership conditions. Apple Intelligence received CAC approval conditioned on integration of Alibaba's Qwen model and existing Baidu arrangements—the operational template for any foreign AI service seeking mainland China deployment .
• FINRA's enforcement program is in a structural reform phase. An external review by former SEC Commissioner Troy Paredes and William & Mary professor Paul Eckert recommends earlier firm engagement, clearer published procedures, and expanded transparency; FINRA has committed to considering recommendations as part of FINRA Forward, with implementation timeline unclear .
• Payment system sovereignty has become a Section 301 trade enforcement vector. The Trump administration imposed 25% tariffs on Brazilian imports citing Pix's government-operated, fee-free model as an unreasonable trade barrier—a precedent with direct implications for other countries developing similar instant-payment networks .
• Fintech licensing fragmentation in the EU is resolving through major-jurisdiction anchoring. Revolut's French banking licence—its second full EU licence after Lithuania—removes deposit-taking and lending constraints across Germany, Ireland, Italy, Portugal, and Spain, demonstrating that non-traditional players can achieve regulatory parity with incumbents through multi-year national licensing processes .
• Private capital fragmentation is structural. CFIUS, sanctions, and export controls continue to fragment cross-border capital flows in AI, semiconductors, critical minerals, and defense; structures that worked five years ago may now trigger review .

Latest developments.

• Bipartisan criticism of Trump's AI enforcement posture emerged following undisclosed AI security incidents involving OpenAI and Anthropic agents; critics including Steve Bannon and Senator Ron Wyden argue Silicon Valley donor ties are dampening federal action
• Trump signed the "Promoting Advanced Artificial Intelligence Innovation and Security" EO on June 2, 2026, establishing voluntary 30-day pre-release model review with NSA-led assessment and Section 4 criminal enforcement priority for AI agent misuse
• Revolut secured a full French banking licence from the ACPR and ECB, enabling deposit-taking, lending, and mortgages through Revolut Bank S.A. with planned expansion across Germany, Ireland, Italy, Portugal, and Spain
• FINRA published an external enforcement review recommending earlier firm engagement, clearer procedures, and expanded transparency as part of FINRA Forward; implementation timeline undisclosed
• Analysis documents the FTC-state AI law collision: state AI law compliance is not a defense to federal deception claims; the Great American AI Act proposes a three-year freeze on new state AI development laws with an undefined consumer-protection carve-out
• Trump administration imposed 25% tariffs on Brazilian imports citing Pix's government-operated payment system as a Section 301 trade barrier, with Visa and Mastercard identified as the protected interests
• Apple Intelligence received CAC registration conditioned on Alibaba Qwen and Baidu integration, ending a two-year regulatory standoff; commercial launch date not announced
• New York imposed a one-year moratorium on hyperscale data centers over 50 megawatts, affecting over 20 proposed projects; similar measures advancing in Georgia, Maryland, Vermont, and Virginia
• Australia announced a mandatory national framework requiring AI data centers to fund new power generation and water infrastructure, with legislation targeted for early 2027 and a net-electricity-generation requirement
• Pillsbury launched a Technology – Emerging Laws & Litigation practice, hiring TikTok's former Head of North American Regulatory Katie Sluss to co-lead, signaling sustained law firm demand for in-house tech regulatory experience

Active questions and open splits.

• Great American AI Act preemption scope: what survives the three-year freeze? The proposed carve-out for consumer protection, civil rights, privacy, and deployment rules is undefined—whether existing state AI laws like Colorado SB24-205 are grandfathered, and how broadly "deployment rules" is read, will determine whether the freeze has real teeth or leaves most state authority intact .
• FTC-state AI law conflict: does federal compliance require exceeding state standards? The FTC's position that state AI law compliance is not a defense to federal deception claims means companies must independently satisfy both regimes—the practical question is whether any compliance program can be designed to satisfy both simultaneously or whether federal exposure is unavoidable .
• Trump EO Section 4 enforcement perimeter: what AI agent conduct triggers criminal priority? The AG's criminal enforcement priority for AI agents illegally accessing computers or data eliminates the "wait and see" option, but the boundary between authorized and unauthorized AI agent activity in enterprise deployments is undefined; no agency has published guidance .
• Federal AI enforcement vacuum: will the political split produce regulatory action? The bipartisan criticism of the administration's muted response to AI security incidents has not yet produced a concrete enforcement or rulemaking response; whether the political pressure translates into mandatory testing requirements or accelerates the Great American AI Act is the operative question .
• Data center moratorium durability: federal preemption and constitutional challenges. New York's moratorium blocks environmental permits for hyperscale facilities—affected developers face a choice between litigation challenging the order on preemption or commerce clause grounds and waiting for the regulatory standards New York develops during the one-year pause .
• Pix tariff precedent: which other government-operated payment systems are exposed? The Section 301 framing of Pix as a trade barrier sets a template for challenging India's UPI, the EU's SEPA Instant, and other government-operated instant-payment networks; the scope of the precedent is unresolved .
• FINRA enforcement reform: what does earlier engagement actually require of firms? The external review's recommendation for earlier engagement with firms under investigation could materially shift how firms respond to referrals—but until FINRA publishes revised procedures, the practical implications for investigation strategy and settlement posture are speculative .

What to watch.

• Great American AI Act progress—whether the three-year state freeze advances and how Congress defines the consumer-protection and deployment-rule carve-outs, which will determine the operative compliance architecture for AI companies in all US jurisdictions .
• Whether the bipartisan political pressure on the Trump administration's AI enforcement posture produces mandatory testing requirements, formal rulemaking, or concrete enforcement actions against OpenAI or Anthropic .
• New York's development of regulatory standards during the data center moratorium—the framework it produces will be the template other states follow, and any legal challenges from affected developers will test whether state infrastructure restrictions survive federal preemption arguments .
• Australia's data center legislation timeline targeting early 2027—whether the net-electricity-generation requirement survives the legislative process and whether other jurisdictions adopt the same model .
• FINRA's implementation of the external review recommendations—the first published procedural changes will define the new investigation engagement model and require firms to reassess response strategies for enforcement referrals .
• Brazil-US tariff escalation and Pix negotiations—whether Brazil modifies Pix's structure to relieve US pressure, and whether the Section 301 payment-system theory is applied to other jurisdictions' government-operated networks .