The midterms change who asks the questions on US AI regulation

The United States has a new Congress in waiting, and AI was on the ballot. What it does not have yet is a single new piece of US AI regulation. For a European firm, the useful question is which of those two facts will matter first.

Democrats have won control of both the House and the Senate in the midterm elections of 3 November, as reported by NBC News and IAPP, with some races still being counted. The new majorities take over in January 2027. President Trump remains in office until January 2029. That combination shapes everything that follows for US AI regulation.

What changes first in US AI regulation

The first shift in US AI regulation is not a law. It is the gavel. Committee chairs decide which hearings happen, who is called to testify and which bills reach a vote. They also hold subpoena power. IAPP’s analysis of the result expects the new majorities to use that power to question technology executives on AI, social media and the effects of data centres.

The names give an early signal. Representative Frank Pallone of New Jersey is in line to lead the House Energy and Commerce Committee and has spoken of a “bold agenda” to “rein in Big Tech”. In the Senate, IAPP lists AI accountability, federal privacy legislation and children’s online safety as possible priorities for the Commerce Committee. The Judiciary Committee may take up surveillance and the meeting point of AI, competition and civil rights.

None of this binds a company. It does change the weather. Hearings produce documents, testimony and headlines. Those land in the inboxes of procurement teams on both sides of the Atlantic.

Why US AI regulation may still move slowly

Congress writes laws, but the president signs them. A bill the White House opposes needs a two-thirds majority in both chambers to survive a veto. Fortune’s election-day analysis judged a veto likely for Democratic AI rules and noted that only broad bipartisan support could override one.

Not everyone reads it that way. Shakeel Hashim, writing for Transformer, expects a frontier AI bill with “tough safety standards” and mandatory testing and approval of the most powerful models, possibly in the first months of 2027. He argues that the result makes a presidential signature more likely, while adding that “nothing is certain”. IAPP quotes David Stauss, who says AI regulation “has become a bipartisan issue”.

Both views can be true at once. Agreement on the problem is wider than it was a year ago. Agreement on the text of US AI regulation is a different matter, and the text is what binds.

The states will not wait

While Washington negotiates, the states keep legislating. IAPP quotes Omer Tene, who expects renewed momentum for rules on AI safety and automated decision-making, modelled on laws in California, Colorado, Illinois and New York. Stauss expects state privacy and AI bills that stalled before to get a fresh look.

For a firm with US clients, this is the practical layer of US AI regulation. It arrives state by state, with different definitions and different deadlines, long before any federal statute.

Will AI get safer?

Not this week, and not because of US AI regulation alone. Laws take time to draft, pass and enforce. A hearing changes no model. Tene told IAPP he does not “see the midterm election results significantly changing corporate behavior” in the short term. In his view, economic forces drive corporate AI and data decisions more than politics does.

What may change sooner is the cost of saying no. Hashim reports that Leading the Future, a political action committee backed by the AI industry, lost the one competitive race it played in, while safety-focused groups did well. If members of Congress fear industry money less, AI companies may oppose rules less loudly. That is a forecast, and it should be read as one.

What it means for a European firm

For a mid-market firm in the EU, the honest answer is that very little changes on Monday morning. US AI regulation is still mostly a set of state laws and a set of intentions. The EU AI Act and the GDPR still set the floor for what you do in Europe. The new Congress does not lower that floor or raise it.

Three things deserve a place on the agenda all the same. First, US clients and US suppliers will face more questions in public, and some of those questions will travel down the supply chain to you. Second, state rules on automated decision-making are where US obligations are most likely to appear first, so anyone selling AI-supported services into the United States should know which states they serve. Third, the gap between European and American expectations may narrow. A governance programme built for the EU is a reasonable starting point for both.

What to watch before the new Congress sits

The weeks until January are useful for preparation rather than action. Watch who takes the committee chairs, because their first hearings will show which parts of US AI regulation they mean to pursue. Watch the White House response, because a signal on vetoes or on deals will say more than any campaign speech. And watch the states with laws already in force, because that is where your US clients’ obligations sit today.

What the result does not justify is a redesign based on a forecast. Build governance around the obligations you actually face, keep an eye on the hearings and let the statutes arrive before you rewrite your policy for them.

This piece is the first of three on the midterms and AI. The next two look at what the result means for how organisations run AI day to day and for the question of dependence on US technology.

If you want a clear view of where your own governance stands today, the free AI Governance Readiness Assessment shows the weakest areas to address first.