A 20-person firm does not need to predict how the fight between Washington and the states over AI regulation ends. It needs a one- or two-page rule that tells staff what they may put into an AI tool, which tools are approved, and who checks the output before it reaches a client. That rule is useful whichever way federal preemption goes, because almost everything in it is about your own data, contracts and customers.
Here is where the federal and state picture stands as of November 4, 2026, what we could and could not verify today, and what a small firm should write down now.
Where the rules stand
- December 11, 2025: the White House order. Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence,” sets a policy of “a minimally burdensome national policy framework for AI.” It directed the Attorney General to set up an AI Litigation Task Force within 30 days to challenge state AI laws it considers inconsistent with that policy, and directed the Secretary of Commerce to publish, within 90 days, an evaluation identifying “onerous” state AI laws. It also called for a legislative recommendation for a federal framework that preempts conflicting state laws, while saying that recommendation should not preempt state laws on child safety, AI data center infrastructure, or state government use of AI.
- The order is not a statute. It directs federal agencies. It does not itself repeal any state law. A state AI law stays in force unless a court strikes it down or Congress preempts it.
- States keep legislating. Several states have passed laws on AI disclosures and automated decisions in hiring and other areas. We did not cite any specific state law in this piece because we could not re-check the official text today. If you operate in a state with an AI law, read that state’s official text or ask counsel.
- FTC impersonation rule, comments close November 30. On October 1, 2026, the Federal Trade Commission published a proposed rule in the Federal Register that would address search engines, social media and other digital platforms that further government and business impersonation scams. It is a proposal, not a compliance date. Comments close November 30, 2026. It is relevant here because AI-generated voices and messages are now a common tool in impersonation fraud.
Why a small firm should write a policy anyway
The legal fight is about what AI developers and large deployers must disclose or test. The everyday risk at a small firm is simpler and already covered by rules you live with:
- Client confidentiality. Pasting a client contract into a consumer AI tool may breach your engagement terms or an NDA, regardless of any AI law.
- Personal data. Existing privacy and sector rules still apply to employee and customer records you put into a tool.
- Accuracy. If AI drafts a client deliverable, your firm is responsible for what it says.
- Impersonation and fraud. A cloned voice asking for a wire transfer is a payment-control problem, not an AI-policy problem. Your policy should still say how payment and password requests are confirmed.
- Insurers and clients ask. Security questionnaires increasingly ask whether you have an AI use policy and a list of approved tools.
What it means for CFOs and CISOs
- Do not wait for preemption. Even a broad federal standard would leave your contracts, confidentiality duties and existing privacy obligations in place.
- The tool list is the control. Most AI risk at a small firm comes from unapproved tools on personal accounts. An approved-tools list, with business accounts and the right data settings, does more than a long policy.
- Spending follows the list. Once you know which AI tools staff use, you can consolidate subscriptions. Duplicate AI seats are now a common line in software renewals.
- State exposure is a hiring question first. If you use AI to screen candidates or make employment decisions, that is where state laws most often bite. Ask counsel before you use it there.
What to put in the policy
Keep it to one or two pages. Our one-page AI use rule has a template. At minimum:
- Approved tools. Name them, with the account type (business, not personal) and the data setting (for example, model training off).
- Data you may not paste. Client confidential material unless the tool is approved for it, personal data about staff or customers, passwords and keys, and anything under NDA.
- Human review. Anything that goes to a client, a regulator or the public is read and approved by a named person before it leaves.
- No automated decisions about people in hiring, pay or discipline without sign-off from the owner and, where required, counsel.
- Payment and password confirmation. A voice, video or message is never approval for a payment, a bank change or a password reset. Confirm on a second channel using the number already on file. Our guide Stop using a voice as approval covers this.
- Accounts. AI tools are signed into with business accounts protected by MFA, and those logins are stored in the firm’s password manager, not in a browser or a spreadsheet.
- How to ask. One named person approves new tools. Give a turnaround time so staff do not route around the rule.
- Review date. Revisit every six months, or when a law that applies to you changes.
What to do this week
- Inventory. Send a two-question survey: which AI tools do you use for work, and on which account? Expect more answers than you think.
- Pick the approved list. Choose one or two tools, move people onto business accounts, and set data and retention settings.
- Write the page using the eight points above and circulate it for sign-off.
- Fix the payment rule if it is not already written down. This is the one with direct cash risk.
- Note the FTC comment date, November 30, if impersonation scams have touched your business and you want to comment.
If you would rather have it written for you, our AI Use Policy + AI Tool Inventory service delivers a policy and a tool inventory for $149 in 4 business days.
What to watch next
- Commerce’s evaluation of state AI laws and any lawsuits filed by the Justice Department’s AI Litigation Task Force. Those would be the first concrete signs of which state laws are under challenge.
- Federal legislation. The order asks for a legislative recommendation. Only Congress can preempt state law broadly.
- The FTC impersonation proposal after comments close on November 30.
- Your own state. Check your state legislature’s official site for AI laws with effective dates in 2026 and 2027.
Sources
- The White House, “Ensuring a National Policy Framework for Artificial Intelligence,” Executive Order 14365, December 11, 2025, checked November 4, 2026
- Federal Register, Federal Trade Commission, “Rule on Impersonation of Government and Businesses,” proposed rule, October 1, 2026, comments close November 30, 2026
- NIST AI 600-1, Generative AI Profile of the AI Risk Management Framework
Related: Board questions on generative AI and AI agent inventory.