By the Engine policy team

Midterm campaign season is in full swing, but that’s not stopping policymakers at all levels of government from putting forward proposals to regulate AI. Addressing safety risks arising from advanced AI has been top of mind for policymakers over the past months, especially following cyber incidents caused by AI agents and proselytizing from former researchers about human extinction. Development bans, slowdowns, and kill switches have all been debated as possible responses — but most recently, proposals around liability have been gaining steam. There are many actors in the AI space; how liability is assigned or divided among them will create incentives around how AI models are developed, shared, and deployed.

The first major case of AI agent hacking surfaced in July, when AI agents developed by OpenAI escaped their testing sandbox to access the Internet and breach the infrastructure of Hugging Face. The incident pushed labs to comb through their records, and found that it was far from an isolated case. OpenAI, Anthropic, Meta, and Google all found instances of their models breaking out of testing environments or breaching other companies’ internal systems or government websites.

Lawmakers have been increasingly reaching for liability-based proposals to respond to the numerous cyber incidents from AI agents. Presently, federal anti-hacking law, the Computer Fraud and Abuse Act (CFAA) requires that someone act with intent to unauthorizedly access a computer system to be found criminally liable. Rep. Lori Trahan (D-Mass.) recently put forward the Clear Liability for Artificial Intelligence Misconduct (CLAIM) Act, which would create liability for AI developers when their models cause harm through negligent conduct. It would presume AI agents acted with intent. Sens. Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) announced the AI Agent Accountability Act which would amend the CFAA to make developers criminally and civilly liable for AI agent hacking incidents. A recently released framework from Sen. Maria Cantwell (D-Wash.), who is in line to chair the commerce committee if Democrats win the Senate next month, outlines that developers remain liable under existing civil and criminal law for foreseeable harms caused by their systems, including when the way a model is designed, deployed, or modified contributes to that harm. Plenty of public commenters have called for strict liability for model developers as well. For their part, the Administration’s “SI Force” have outlined that existing product-liability laws could be used to hold developers responsible where necessary.

Creating new liability is generally not an ideal policy lever to pull from a startup perspective because startups thrive on clear, bright-line rules of the road that are easy to follow with few resources. Open-ended liability frameworks are generally antithetical to creating certainty because they inherently rely on litigation to motivate firm behavior. For startups with limited resources, even the threat of litigation can be an existential risk, making liability-based incentives more intense.

Since policymakers are looking to liability as an approach, it’s important to carefully consider to ensure their proposals will meet the desired aims without compromising benefits of AI, discouraging beneficial firm behavior, or undermining startup innovation. Principles for evaluating these proposals — such as accounting for the various actors in the ecosystem, balancing incentives, accounting for both risks and benefits, and considering policy alternatives — can help guide policymakers as they weigh liability-based responses to advanced AI.

Liability proposals need to be tailored to the right actor. These proposals may appear to only fall on the largest developers whose agents have made headlines for their misadventures on the open Internet. But there are many entities in the AI value chain — including startups — and where responsibility lands will shape the ecosystem. Most startups are building on models from the largest developers to create unique products for other businesses and consumers. Many are even leveraging agents to, e.g., pull in information useful for their products or end users.

Consider an AI startup that sells an AI-based data and intelligence tool to insurance claims adjusters and the number of entities at play in the following example. Say a claims adjuster (1) for a small insurance company (2) queries the service (3) for information about their states’ statutory requirements. The startup uses AI agents built by a large AI lab (4) that were independently tested during development (5) and hosted on a cloud computing service (6) to gather data from state insurance regulators websites (7), and the agent, not finding what was requested, instead locates and unauthorizedly uses a regulator’s (8) credentials to access non-public data.

Which entity is responsible for the intrusion? The answer must involve tailoring liability to the actor most responsible for and most capable of stopping harm. Sometimes that actor may even be the startup, sometimes the model developer, sometimes the end user — but contrary to many of the above proposals — intent and reasonableness will likely continue to matter. Said another way, parties should only be responsible for choices they control and have insight into.

Beyond getting the actor right, getting the incentives right is important. The underlying theory of turning to liability as a policy response is that it creates incentives for developers facing exposure for harms to test rigorously, even if no law spells out how or what counts as “reasonable” mitigating actions. On the flip side, too great of legal risk can disincent testing of models (remember, many of these notable incidents happened during testing), and it can disincent development of models — or sharing for others to build with, like startups. This is especially true for open-source models. If an open source developer can be held liable for what a downstream user — with whom they likely have no formal relationship or control — does with the model, they’re unlikely to release that model in the first place.

Regardless of how these liability proposals advance or not, policymakers should think holistically about the cybersecurity issue at hand and other tools available as part of a policy response. Most of these liability proposals are responding to unintentional incidents, but there will certainly be intentional incidents from bad actors as well. Those bad actors will clearly already be liable under existing law, but there are other practical, forward-looking steps policymakers should take in a world with highly-capable AI. If policymakers think agentic AI may compromise critical infrastructure like utilities or health systems, then part of the policy response should be shoring up those systems’ defenses — including by leveraging AI. Small businesses are already highly victimized by cyber attacks, and more resources to combat risks would be prudent. And once a business is a victim of a breach, they face a mosaic of breach-notification laws that compound the challenge they face. Congress could act to clarify and unify what is expected when a company is the victim of a breach.

Congress is out until after the election — and even then it is unlikely that any major AI legislation will be taken up before the year is out. But these sorts of proposals are only likely to gain traction into the new year when a new Congress is seated, with Democrats likely holding the gavels, and as state lawmakers return to their capitals. Liability-based proposals merit nuanced consideration to ensure they don’t foreclose startup innovation.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By Greta Norris, Engine Policy Fellow

As most state legislatures have adjourned for the year, they’re leaving behind an increasingly complicated patchwork of rules that are aimed at keeping young Internet users safe but create a variety of obligations, prohibitions, and compliance burdens for startups — especially for startups that don’t intend to, or knowingly interact, with young users.

Many of the proposals debated and, in some cases, passed at the state level this year focus on app store and operating system age verification mandates, outright bans for young users on Internet platforms, parental consent requirements for social media sites, chatbot regulations, and rules dictating the design of tech products. For startups, this could mean significant compliance costs, increased privacy and security risks, and potentially ruinous legal liability.

Age verification comes with tradeoffs

Age verification mandates, app store accountability acts, design requirements, outright bans, and parental consent are common tools policymakers reach for in an attempt to make the Internet safer for children. These online safety measures are first predicated upon knowing the age of a given Internet user. If they don’t require age verification specifically, many measures include definitions of what it means to “know” the age of a user in ways that will, in practice, lead Internet services to rely on age verification technologies.

These tools often come with tradeoffs: users have to hand over more — and likely more sensitive — data or risk limiting their ability to access information and express themselves online. That required disclosure carries an increased risk of harmful data breaches, and also risks pushing users who can’t or won’t comply to less-regulated, less safe corners of the Internet. For startups, they can create significant costs, erect operational hurdles, and dampen competitiveness. Policymakers must be honest about these unintended consequences, which can be much more burdensome to startups and small businesses, especially as a patchwork of state regulations pops up.

Shift to app stores and operating systems

Policymakers at the state level are passing app store accountability acts — laws that shift the responsibility of enforcing age verification onto app stores and require app developers to rely on age signals from the app stores.

Currently, four states have passed such acts. Last year, Texas passed SB 2420, which requires app stores to verify users’ ages and obtain parental consent before minors can download mobile apps or make in-app purchases. A federal judge found that the law likely violates the First Amendment and paused enforcement of the law, but the Fifth Circuit Court of Appeals later ruled that Texas is allowed to enforce the law until judges rule on the law’s validity. Alabama, Louisiana and Utah advanced similar bills: HB 161, HB 977, and HB 498, respectively. Utah’s act amended an earlier bill to allow app developers to voluntarily opt out or block a minor’s account from accessing their apps. The four app store accountability acts are structured similarly to federal legislation level that would eliminate state patchwork but still carries the same trade-offs.

These laws also create some provisions for family accounts, which help protect access to those of age and bar access for underage individuals in households with both adults and minors. However, app stores face technical compliance challenges of checking that a minor’s account is linked to a legitimate parent’s or guardian’s account, which may require intrusive, continuous re-authentication. Furthermore, most of the Internet is accessible through websites — not just apps — so users can easily bypass blocked content on a web browser.

Other states have taken a slightly different approach by shifting the burden of age verification from app stores onto operating systems (like Apple iOS for iPhones and Microsoft Windows for personal computers). California’s AB 1043 — which passed into law in 2025 — and Illinois’s HB 5511 hold operating systems accountable, meaning that device manufacturers are responsible for verifying age bracket signals and will be deemed to have actual knowledge of which users are minors. But operating system-level age verification fails to account for communal devices, like a family’s shared tablet or a smart television. A device configured by a parent would grant children unrestricted access to adult material; conversely, a minor’s profile would bar adults from features they should be able to use. Operating system age verification grants problematic access by assuming there is a user of only one age on a given device.

Both the app store and the operating system approaches potentially infringe on First Amendment rights by limiting access to lawful speech. The acts also carry privacy risks by forcing the collection of age data, which increases the possibility of data breaches by bad actors and raises costs that could be passed onto consumers.

Outright bans and parental consent for social media

Some states have attempted to enact outright bans on social media accounts for minors and restrictions that require parental consent to open social media accounts. The strictest proposal, Texas’s HB 186, proposed a full ban on social media use for children under 18 but failed to become law after intense public pushback. HB 3 in Florida is in effect but currently faces a lawsuit on First amendment grounds. Still active legislation that would create bans includes H 5295 in Massachusetts, which would ban social media accounts for children under the age of 16. H 5366 in Massachusetts would prohibit minors under 14 from making social media accounts.

Instead of outright bans, other states are seeking parental approval for social media accounts for minors. Mississippi passed HB 1126, and Tennessee passed HB1891, both requiring parental consent before a minor under 18 creates a social media account. Ohio passed a similar law, HB 33, that mandates parental approval for children under 16.

Similar comparable parental consent laws have faced legal scrutiny. Just five months after being passed, a federal judge permanently blocked SB 396 in Arkansas — which required parental consent for minors to create social media profiles — due to First Amendment violations. Louisiana’s SOCIAL Act was also blocked due to free speech concerns and overly broad language. That law required large social media companies to verify age and ensure parental permissions for users under 16 to create and maintain accounts.

States pivot from bans on access to dictating the structure of products

Some states are imposing design-side mandates on social platforms, including data minimization, privacy-by-default settings, and bans on aspects of algorithmic feeds such as infinite scroll and “streaks”; many of these bills also include parental consent directives. For startups, laws like these are very costly to implement, and they create incentives to over-moderate (taking down legal content in an attempt to avoid expensive litigation and fines).

California’s SB 976 and New York’s S 7694 are prime examples of a design-side mandate; they prohibit algorithmic feeds and instead mandate chronological feeds. While these laws are facing challenges in federal court, other states have attempted to follow the lead of California and New York. Pending legislation in Massachusetts under SB 3164 would disable algorithmic feeds, autoplay features, and infinite scrolling for minors; mandate usage reminders; and turn off push notifications at night.

In failed attempts to limit algorithmic feeds and impose other restrictions on social media for children, SB 611 in Arkansas and SB854 in Virginia were both blocked from taking effect due to legal challenges. Colorado’s HB 24–1136 and a Minnesota law require pop-up warnings on social media sites, but a federal judge blocked them from taking effect. Washington attempted to pass two bills, SB5708 and HB1834, both of which failed to advance.

[Chatbots and AI: State lawmakers have been quick to legislate around chat-based AI interfaces. In 2026, almost 100 bills regulating chatbots have been introduced across states and there are well over a dozen states with enacted rules. These are often aimed at safety for young users specifically and some necessitate determining the age of the user, meaning they carry tradeoffs discussed above. Engine earlier examined chatbot bills in a recent blog post on state AI legislation.]

What comes next

The magnitude of state-level action on kids’ safety bills shows the need for a unified, federal framework that takes unintended consequences — especially of both explicit and implicit age verification requirements — into account. Policymakers should address the growing state patchwork of legislation, which is especially harmful to startups, who have less resources than large tech incumbents to comply with complex regulations across borders.

At the federal level, Congress is considering several pieces of legislation that, unfortunately, largely fail to grapple with the tradeoffs in this space. In June, the House of Representatives passed a package called the KIDS Act, an omnibus composed of multiple bills, including legislation on kids’ safety, privacy updates, and AI chatbot rules. Some of the component bills differ starkly from the Senate versions, including the Kids Online Safety Act, where senators insist on including a “duty of care” provision that will push Internet platforms to remove legal (and in some cases important) user content out of an abundance of caution. All of the bills in both the House and Senate create incentives for companies to perform age verification by holding them liable if they “should have known” that a user was a minor. Without a uniform approach to online safety bills, startups will struggle to comply, wasting their limited resources instead of furthering American innovation.

In August, litigation over youth online safety involving most state attorneys general and Meta led to a settlement that includes many of the requirements in the above discussed state bills, and is likely to factor heavily in the debate moving forward. The company agreed to age verification and design measures limiting the availability of certain features, like beauty filters and like counts, creating the ability to opt out of algorithmic recommendations and autoplay, and restricting time of use and timing of notifications. Meta used the settlement structure to try to get its competitors to also adopt these terms. The settlement is likely to frame the debate going forward although it extends beyond changes that have enough support to become federal law — and likely what’s permissible under the First Amendment.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By Ben Olson, Policy Fellow, Engine Foundation

Headline-grabbing tariffs have startups paying attention as the administration takes steps to reconstruct the sweeping tariff regime struck down by the Supreme Court and ignites trade conflict with top trading partners. The Court’s February decision had led to something of a lull in new tariff pronouncements as the administration undertook procedural steps to impose tariffs with other — and potentially more durable — statutory authorities. With the administration imposing some tariffs under new authorities in July, still more potential tariffs to come, and tit-for-tat trade retaliation with Canada to perhaps stretch on for months, startups are bracing for the return of heights of uncertainty and the difficult trading environment that colored much of last year.

Upon entering office, the Trump administration quickly staked out a tariff-first trade approach, claiming emergency authorities to impose tariffs on goods from close trading partners — like Canada and Mexico — and set up a global tariff regime. The pronouncements rattled markets and the on-again, off-again tariffs made it difficult for businesses to plan for investments and growth. Startups described the policy as “chaotic” and “a distraction,” that led to steep cost spikes, unanticipated tariff bills, product delays, reduced research and development, changes to hiring plans, and a tougher time trading abroad.

After a winding legal battle, in February, the Supreme Court struck down tariffs the administration had imposed using a national emergency statute. Determined to resurrect their tariff regime, the administration invoked a different — and still legally dubious — authority to impose a new 10 percent global tariff via executive order. That never-before-used authority, Section 122 of the Trade Act of 1974, allows tariffs of up to 15 percent for 150 days — without needing congressional approval — to address a “large and serious” balance-of-payments deficit. Litigation over those tariffs outlived their 150-day lifetime. Hours before they expired, the administration imposed a new round of tariffs under section 301 of the Trade Act of 1974 with the pretense of discouraging forced labor. The varied efforts to maintain a global tariff regime continue to foster unease from startups, especially in light of continued tariff threats.

The uncertainty is here to stay. Similar to the 301 tariffs imposed on grounds of pursuing the elimination of forced labor, an additional investigation into U.S. trade partners’ ‘excess structural capacity’ hangs as potential–and probable–justification for future tariffs that will likely stack on the ‘forced labor’ tariffs. Additionally, negotiations over the United States-Mexico-Canada Agreement (USMCA) — the United States’ trade agreement with its two largest trading partners — could eventually see it lapse if the U.S. does not agree to extend it. Trump called the deal “not important” and said “I don’t care” when asked if it should be renewed last month.

Far from unimportant, the trilateral trade relationship represents nearly $2 trillion, and fostered significant growth in digital trade. But it was cast even further into doubt when 50 percent tariffs on billions of dollars worth of Canadian goods were allowed to go into effect in August. Those tariffs — imposed using a depression-era law — were nearly avoided, and even delayed, with a reported deal announced, but negotiations fell apart at the last moment. Canada, for its part, has vowed retaliation, which Trump has promised to meet. The threat of a spiraling trade conflict, with limited off ramps (the Canadian’s retaliation is set out a few weeks, presumably to give space for a landing zone) further compound the sense of unease around an important market for startups.

The tariffs and tariff threats have yielded some beneficial results, even if it’s unclear how much staying power they will have. Last June, Canada repealed its discriminatory digital services tax following earlier threats from Trump. The administration has also reached a handful of executive agreements they call Agreements on Reciprocal Trade (ART), which include key digital trade provisions, including around ensuring the free flow of data across borders. They also used tariff-underpinned deals to build support for making permanent the World Trade Organization’s (WTO) Moratorium on customs duties on electronic transmissions. Yet that effort ultimately was derailed by Brazil, a frequent tariff target.

Plenty of countries have reached for retaliation instead of cooperation. China’s response to U.S. tariffs was to restrict access to critical tech inputs, like critical minerals. Politically significant products and leading industries are top targets for retaliation, meaning U.S. tech could find itself in the crosshairs of retaliatory measures, even if those measures aren’t tariffs. Overall, the administration’s approach has weakened goodwill with the U.S.’ trading partners and led to efforts by other countries to make deals without the U.S., further risking U.S. startups’ long-term international success.

Stable and predictable trade policy is essential for startups to confidently enter foreign markets, price products, hire workers, and attract investment. To ensure the prosperity of technological innovation and the growth of U.S. startups, trade policy must shift from tariff-first, negotiate-later to a trade policy focused on bolstering global opportunities for the startups driving the country’s innovation.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By Taimur Rehman, Policy Fellow, Engine Foundation

This blog continues our series called “AI Essentials,” which aims to bridge the knowledge gap surrounding AI-related topics. A widely-used industry practice, distillation has recently become a topic of policy debate. What is distillation and what does it mean for startups and the broader AI ecosystem?

It’s often easier to learn from an expert than start yourself from scratch. When it comes to AI model training, the practice of one model learning from a more developed or expert model is called distillation, and it’s one used by industry leaders and startups alike.

Think of a master chef. The chef knows unique recipes, how to tell when a steak is exactly medium rare, make a perfect créme sauce, and time a dinner so the food doesn’t get cold. The master chef is akin to a large AI model: enormously capable, but expensive to have on staff, and rightfully so, due to its depth of training.

Now imagine the master chef begins to train an apprentice. The apprentice chef could follow the same playbook as the master chef: spend years in kitchens across the globe, pore over lessons on technique and obscure cookbooks, or he could watch the master chef cook. As the chef prepares each dish, he doesn’t just say “now, add a pinch of salt” he shows the apprentice his reasoning: “Now, I’m adding salt to balance the acidity of the tomatoes, and I’m doing it at this point so it has time to dissolve.” In doing so, the apprentice learns both the answer and the master’s judgment. The same ritual occurs as hundreds of dishes are prepared, and each time, the apprentice continues to learn.

After this training, the apprentice can’t fully rival the master’s expertise. He can’t invent a complex new dish or explain the deep inner workings of a particular technique. But for the dishes that he’s been trained on, he cooks them almost as well, and he does it faster, without years of training and at a lower cost, since he’s an apprentice chef.

That’s essentially distillation, when a smaller “student” AI model is trained on not just the outputs, but the reasoning of a larger “teacher” AI model. This works by training the smaller student model to match the probability distributions of the larger teacher model. If, for example, a larger teacher model was asked to predict the next likely word, and it wagers that there is a 50 percent chance of it being “flower,” a 40 percent chance of it being “tree,” and a 10 percent chance of it being “house,” that distribution reveals how the model thinks. “Tree” had a higher percentage chance than the house and was closer to the percentage chance of “flower,” so that must mean the teacher model believes flowers and trees are similar. After millions of similar examples across varying domains and tasks, the student begins to understand how the teacher thinks. The resulting smaller model is then faster, cheaper, and oftentimes just as capable as the larger model.

Distillation has long been held as a common method for advancing AI research. Many of the largest AI research labs use distillation for their own internal model development — rather than starting from scratch every time. Startups use distillation to make their own more efficient models suited to their needs. A startup without massive amounts of compute could, for instance, distill a large, general model into a smaller one fine-tuned for a specific task, like analyzing medical records or dissecting legal contracts, without having to gather the vast amount of data and compute needed to train a larger model.

But unauthorized, coordinated distillation at scale, carried out in order to copy a competitor’s models and undercut the R&D costs behind its training, is a different kind of act. The recent release of Chinese model Kimi K3 — which was nearly as capable and reportedly far cheaper than leading models from OpenAI and Anthropic — renewed focus on the technique of model distillation. Top White House tech advisor Michael Kratsios accused the Chinese AI company Moonshot of covertly distilling Anthropic’s Fable model to help build its open-weight Kimi K3 model.

(Distillation is also often conflated with open source AI, and that has raised the specter of a ban on open models. But both open and closed developers use distillation. Distillation is a model training technique, whereas open source is a distribution method — and generally beneficial for startups and innovation, as we wrote about in an earlier post in this series.)

The Kimi controversy was about unauthorized, coordinated, industrial-scale distillation — extracting a competitor’s model to sidestep the costs behind it — and that warrants scrutiny. The government’s response should recognize distillation itself isn’t an offense. It’s the same technique used by major labs, and the same one that lets a small startup build something innovative that would otherwise be out of reach. Rather than treating all manner of distillation as suspect, policymakers should target covert, coordinated distillation at scale by reaching for other policy levers, like legislation that could clear the way for AI labs to share information and coordinate responses to suspected foul play. Policymakers shouldn’t be considering blanket bans on distillation itself, but rather, seeking to address the harmful conduct of a few bad actors, while preserving the benefits of the method for startups, labs, and individuals.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By Nathan Lindfors, Policy Director, Engine Advocacy

Startups need to be able to know that the AI tools they invest their limited time and resources in as they build their companies will remain available as they scale. Recent abrupt and high-profile policy decisions that limit — or threaten to limit — access to some of those tools illustrate the need for a comprehensive and consistent federal approach to regulating AI, rather than a discordant, ad hoc approach.

In early June, Anthropic released two new frontier models. Later that week, the Trump administration responded to allegations about security risks by issuing export control directives that in practice led the company to take them offline. Like most frontier model developers, the company had worked with the government ahead of releasing them to the public. The process to arrive at imposing export controls was less than smooth or straightforward, and regarded by some observers as an overreaction given the concerns could be found with others’ models also on the market. The models were offline for almost three weeks, disrupting organizations that were using them.

Just a month later, Chinese tech firm Moonshot released a model called Kimi K3 that reignited debate about banning Chinese open source. The model comes close to the performance of leading U.S. labs, and the company released the model weights on an open license in late July, generally meaning anyone is free to download, modify and innovate with it. The high performance and supposed low cost of developing the model led some in the administration to assert that the model was the result of coordinated, illegitimate distillation to extract capabilities from Anthropic’s most powerful model.

[Rhetoric around allegations of distillation by Chinese labs can sometimes miss that distillation itself is a legitimate, widely-used technique by conflating the kind of small scale distillation a developer might do to train a smaller, more efficient model with large-scale, coordinated attempts to replicate an entire model. Distillation is also often conflated with open source AI, and that has raised the specter of a ban on open models. But both open and closed developers use distillation. Distillation is a model training technique, whereas open source is a distribution method.]

The releases added fuel to the fire for some in the administration who have been pushing to use various tools at their disposal to limit access to Chinese models, including open source models, which invited pushback from industry. The industry response included the launch of a new coalition and letters from hundreds of the largest companies in the AI space, as well as startups alike. Leaders of key companies in the space also penned op-eds extolling the virtues of openness in AI and the importance of consistent government policy around AI. As we’ve long detailed, open-source AI is especially important for startups because it can give smaller companies more flexibility, lower costs, and more control as they build, fine-tune, and deploy AI tools.

While the safety and national security concerns animating policymakers in these instances have merit, the scattershot, inconsistent responses create the appearance of discord and threaten startups’ abilities to plan for growth. For example, preventing theft of U.S. intellectual property by adversaries is good, but responses aimed at doing so should be borne from widely-accepted evidence and tailored to the problem at hand. The levers the administration is likely to reach for in these instances, like export controls, sanctions, and import restrictions could be valid tools to use, but all stakeholders in the AI space should have clarity about what decisionmaking framework policymakers are following when novel problems occur. That framework should rely on a predictable, transparent (to the extent possible, given the often sensitive information involved), and accountable process and lead to outcomes that are proportionate to the risk or concern. This is essential to inspire the certainty that stakeholders, especially startups, need, so that they can know what tools they can build with and to avoid disruption to innovation.

At the beginning of June, Trump signed an executive order aimed at outlining a voluntary process for addressing national security issues that might arise with advanced AI. Granted some of the deadlines for agencies corresponding actions have yet to arrive, the intervening events have been well short of a smooth process. AI startups need a framework that creates consistent policy across the many issues that determine what tools they can use, how they can build, and where they can bring new products to market. The federal government has a long way to go on that framework.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By Natalia Estela Velez and the Engine Policy Team

As policymakers return to the question of how best to support U.S. territories and their lagging economies, they should include a focus on a critical but often under-recognized engine for economic development: the local startup ecosystems. Despite the odds, entrepreneurs in U.S. territories are launching startups, and policymakers should put in place the supports these ecosystems need to grow.

Last month, the Senate Committee on Energy and Natural Resources convened a hearing to examine the state of the U.S. territories, bringing much needed attention to the unique economic and policy challenges that affect nearly four million Americans. The territories of Puerto Rico, U.S. Virgin Islands, Northern Mariana Islands, American Samoa, and Guam are frequently overlooked by policymakers. These territories have endured years of minimal or stagnant economic growth, driven by trade barriers, persistent flight of skilled workers, and structural inequalities that restrict access to modern infrastructure. As a result, local economies struggle to attract investment or develop industries that can compete in the modern tech age. As innovation and entrepreneurship are increasingly recognized as vital drivers of economic development, the territories remain among the more difficult places in the U.S. to start and scale a business.

A thriving startup economy can emerge when four core pillars are strong: a healthy funding ecosystem, access to skilled talent, reliable infrastructure, and trade policies that keep costs manageable. When these factors are all in place, founders can hire workers, access capital, and bring new ideas to market.

Talent

Innovation depends on high-skilled, entrepreneurial talent, but the territories are losing skilled workers at alarming rates. From 2010 to 2020, the U.S. Virgin Islands lost 18 percent of their population, Puerto Rico and the Northern Mariana Islands each lost 12 percent, American Samoa lost 11 percent, and Guam lost 4 percent. Unlike most U.S. states, these jurisdictions have faced sustained loss of college-educated and working-age residents.

The comparison becomes even more staggering when you observe the U.S. mainland in the same time frame, only two states had a decrease in population and it was less than 1 percent in both instances. This brain drain is comparable to trends faced in rural communities across the U.S., where declining birthrates and flight to urban centers are tied to declining manufacturing and job opportunities, and good school districts.

Recent federal cuts to minority-serving institutions — institutions that include every college and university in the territories — exacerbate the talent problem. Puerto Rico’s Secretary of Education, César Rey, has warned of the impact losing tutoring programs and remedial courses would have on Puerto Rico’s students. Guam is facing mass layoffs and the potential closure of at least 10 schools due to an insufficient FY 2026 education budget. In the U.S. Virgin Islands, the Trump administration cut $2.5 million intended to support climate-change agriculture training and doctoral education. In American Samoa, approximately 20 percent of total education funds are being withheld, negatively impacting the education system. Similarly, roughly a quarter of the education funds allocated to the Northern Mariana Islands remains unaccounted.

Without a stable or growing workforce, it becomes nearly impossible to build an innovation-driven economy.

Funding environment and debt

The second pillar, funding, is equally fragile. Founders in the territories operate in an environment with few private investors and limited access to capital, making it difficult to launch and scale new ventures. As Jonathan Gonzalez, co-founder of Raincoat, a startup in Puerto Rico, recently explained: “One of the biggest hurdles is the limited local investment ecosystem. There aren’t many venture investors on the island, so by default, we’ve had to raise capital in the U.S. and internationally.”

Long-standing economic stagnation, combined with population loss, has also eroded tax revenues across the territories. This has forced local governments to borrow heavily, leaving them debt-ridden and reliant on federal assistance. The Government Office of Accountability has expressed concern; a recent 2025 study on the economic development of U.S. territories acknowledged that they “face challenges to economic growth, which can make it harder for them to secure or repay debt.” These challenges include the high cost of importing goods and energy, population loss, and extreme weather events that have hurt key industries like tourism. This combination of factors leads territories to take on greater debt. For startups, this environment matters because when governments are trapped by debt and austerity, there is little funding left to support innovation, broadband expansion, research, or entrepreneurial development.

Infrastructure

The third pillar, reliable infrastructure, remains inconsistent and fragile. Affordable, high-speed broadband is still out of reach for hundreds of thousands of residents. In Puerto Rico, over 620,000 households lack broadband access. There are no places in the U.S.Virgin Islands that have three or more competing high-speed providers, and 23,000 people there have no high-speed Internet at all. Guam, American Samoa, and the Northern Mariana Islands have proposed expansions under the federal Broadband Equity, Access and Deployment program because 80–100 percent of the territories remain underserved.

Without reliable, affordable broadband, startups in the territories are locked out of the modern economy. High-speed internet is not a luxury for innovation-driven firms, it is the backbone of remote work, digital services, online markets, and access to investors and customers beyond local borders. As long as broadband remains unreliable or inaccessible, the territories’ startup ecosystems will struggle to grow, scale, and compete on equal footing with the mainland.

Trade

U.S. territories are deeply shaped by federal shipping regulations, and market-access rules that they do not control. For island territories, shipping rules restrict the ability to import affordable goods, slows down supply chains, raises operational costs for businesses, and limits participation in regional trade networks in the Pacific and Caribbean. These trade constraints matter profoundly for startups and their local innovation ecosystems. Higher transport costs elevate the price of equipment and limited trade flexibility makes it harder for entrepreneurs to scale or export.

Critically, the Jones Act requires goods moving between U.S. ports to be carried on U.S.-built, U.S.-flagged, and U.S.-crewed vessels, making domestic transportation of goods significantly more expensive for territories that rely heavily on maritime trade. Requirements under the Jones Act mean that only a relatively small fleet of Jones Act-compliant vessels is available to serve domestic maritime routes, limiting competition and shipping capacity. Consequently, shipping goods between U.S. ports is often substantially more expensive than comparable international shipping routes. This drives up the cost of essentials for small-businesses and residents overall, including gas, diesel, and crude oil. For the territories, this means higher energy and operational costs for startups.

Political Power: Limited Voting Rights, Limited Policy Change

Even when territorial residents mobilize to demand change and improved conditions, they face another barrier: lack of voting representation. Citizens in the territories cannot vote for president and lack full voting members in Congress. This makes it difficult to reverse harmful policies, secure new funding, or advocate effectively for long-term investments.

Addressing the challenges of limited funding, inadequate broadband access, sustained brain drain, and insufficient education resources to create a talent pipeline requires targeted and informed policy action. First, Congress should pass legislation like the Territories Statistics Collection Equity Act to close critical data gaps. As the Government Accountability Office has highlighted, the territories are excluded from most federal statistical products, leaving policymakers with little information about their populations, economies, and infrastructure. Without these data, it is difficult to design effective programs, allocate resources equitably, or support innovation and entrepreneurship for roughly 4 million U.S. citizens living in the territories.

Policymakers should also make commonsense reforms to strengthen the four pillars of a healthy startup ecosystem. Expanding access to education, broadband, funding, and fair trade policies would directly support entrepreneurs, create jobs, and raise living standards. Without addressing each of these pillars these communities will be locked out of full and economically significant participation in the innovation economy.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By Alexander Wall, Policy Fellow, Engine Advocacy

As most state legislatures wrap up their work for the year, the focus on artificial intelligence across the country is unmistakable, creating new rules in several states for startups developing and deploying AI. Lawmakers in 45 states introduced more than 1,500 AI-related bills this session. The broad, cross-sector frameworks that once looked like the model for the country lost ground. In their place, lawmakers turned toward narrower rules aimed at specific products and uses. For startups, the central problem is not any single rule but the lack of consistency across them. A company with users in a dozen states can face a dozen different sets of obligations.

Broad frameworks pull back

The biggest story of the session is the widespread retreat from the comprehensive, high-risk model that Colorado pioneered, and Colorado itself led that retreat. After delaying its landmark AI Act the previous summer, the legislature did not amend the law so much as replace it. On May 14, Governor Jared Polis signed SB 189, which repealed and replaced the 2024 Colorado AI Act before its delayed June 30 effective date arrived. SB 189 is built around notice and disclosure rather than the risk management programs, impact assessments, and duty of care at the heart of the 2024 law. The new version takes effect in January 2027 and is enforced only by the Attorney General. The replacement came after sustained legal and political pressure, including a federal lawsuit challenging the original law’s constitutionality that the Department of Justice joined, and a court order pausing enforcement before the law ever took effect.

After two failed attempts in prior sessions, Connecticut moved a narrowed AI bill through the legislature. Instead of advancing the comprehensive developer-and-deployer model that had failed to pass in past sessions, Connecticut adopted SB 5, which regulates frontier model developers, sets up a regulatory sandbox, and adds rules for chatbots and youth safety.

But not every state has walked away from the broad model. New York pushed it hardest this session, with its Senate passing S 1169, the New York AI Act, a Colorado-style framework that targets algorithmic discrimination and requires independent audits of high-risk systems, before sending it to the Assembly in June. Virginia, which vetoed its own high-risk bill in 2025, returned with a different design in HB 797, signed into law in 2026. Rather than regulating high-risk systems directly, it directs the Joint Commission on Technology and Science to study the feasibility of a framework for independent verification organizations that would assess AI systems against best-practice standards.

Regulating AI in high-risk areas

As the broad frameworks faltered, lawmakers narrowed their aim to specific high-risk uses; health care and insurance coverage decisions drew the most attention. Even as Colorado scaled back its main AI law, the state adopted HB 1195 to restrict AI in mental health therapy and HB 1139, which bars health insurers from denying coverage based solely on AI-generated group data and requires a qualified person to make the final call on any AI-recommended denial. Alabama advanced SB 63, and Washington passed SB 5395 on the same subject. The same use-specific approach reached other domains, with California’s AB 1883 regulating AI workplace surveillance and the use of AI in employment decisions, which passed the Assembly in May, and the state’s SB 1011, which would have required human review of AI systems that make operational decisions about utility infrastructure and was considered by set aside. For startups building clinical, administrative, insurance, workforce, or infrastructure tools, the retreat from comprehensive regulation does not mean a retreat from regulation; instead, the obligations are migrating into a set of use-specific rules that vary by state and by industry.

Frontier model rules coalesce

New York resolved its own pending frontier bill when the governor signed an amended version of the RAISE Act, which closely aligned with California’s SB 53, which California passed in 2025. The result is that the states most central to AI development now share a template, which may suit the largest developers but should worry everyone else, because a standard built around the most resource-heavy models still impacts the startups that build on top of them.

If California and New York set the template in 2025, Illinois solidified the template by adopting it in 2026. Illinois passed SB 315, becoming the third state to enact frontier AI safety legislation aimed at catastrophic risks from the most advanced models. The bill tracks the California and New York transparency requirements but goes further by adding mandatory third-party audits beginning in 2028. The response from some in the industry demonstrates the widespread impact these state frontier model laws are having. While OpenAI had opposed similar earlier efforts, the company endorsed the Illinois bill and described it as a kind of reverse federalism, in which a few large states set a de facto national standard the rest of the market follows.

Chatbots become the center of gravity

Lawmakers introduced close to 100 chatbot bills across 34 states, and at least a dozen became law, far outpacing any other category of AI legislation. The volume matters less than the requirements and prohibitions in the bills, which have grown more aggressive. Oregon enacted the first chatbot law with a private right of action, SB 1546, which lets individuals sue and creates exactly the kind of litigation exposure that drives up costs and invites bad-faith claims against small companies. Tennessee enacted SB 1493, which makes it a Class A felony to knowingly train AI to do things as ordinary as simulate human conversation or provide emotional support, backs that criminal liability with a private right of action carrying $150,000 in damages, and lets courts order that offending models be shut down or retrained. For a company that builds conversational AI, treating core training decisions as a felony is the most aggressive line any legislature has drawn. The same session also produced the Curbing Harmful AI Technology Act, SB 1700, signed into law in 2026, which took the opposite approach and commissioned a state study of chatbot regulation rather than imposing rules directly.

Georgia’s SB 540 stands out for covering chatbots embedded in other platforms with no exemption, reaching products that earlier proposals left alone. Washington enacted HB 2225, requiring companion chatbots to identify themselves as non-human and to flag and respond to users who express thoughts of self-harm, joining California and Oregon as states with chatbot laws aimed at protecting minors. Michigan’s SB 760 (which requires chatbot providers to verify users’ ages and limits the features they can offer to children) passed the Senate in April, and Missouri has sent SB 1019, which includes an AI therapy chatbot ban, to the governor’s desk. Maine, which in 2025 required only that businesses disclose when a consumer is talking to AI, enacted a therapy chatbot ban, LD 2082, this session.

California’s most consequential chatbot fight moved off the legislative calendar entirely. After the governor vetoed the LEAD for Kids Act in 2025, its backers turned it into a ballot initiative, the Kids AI Safety Act, which is expected to qualify for the November 2026 ballot and would impose some of the strictest limits in the country on minors’ access to chatbots. For any startup with a conversational interface — a category that now includes tutors, translators, customer service tools, and productivity assistants — the practical effect is a thicket of overlapping disclosure, safety, age-verification, and liability rules that differ in every state.

Digital Replicas

States have had more success with narrowly targeted rules against synthetic media than with broad AI regulation, and that work continued this session on two tracks. On the first, states kept expanding protections for individuals. Washington enacted SB 5886, which establishes a property right in a person’s forged digital likeness, alongside SB 5105, which addresses sexually explicit deepfakes. These build on a 2025 wave in which several states passed digital replica laws and dozens addressed nonconsensual intimate imagery.

The second track is newer and matters more for startups, because liability would extend not just to the people creating deepfakes but to the services they use to create those deepfakes. California’s AB 621 extends liability to providers that keep supporting a deepfake pornography service after notice, with a presumption of liability and statutory damages. The next round of state bills is expected to reach further up the stack, including to generative AI tools, payment processors, hosting platforms, and cloud providers. For startups that offer image, audio, or video generation, the extension of liability to AI developers will place responsibility for misuse on the tool and its creator rather than the user.

Transparency & Content provenance

Transparency and provenance rules advanced on two tracks this session. The first concerns what goes into a model. California’s training data transparency law took effect in January, requiring developers of generative AI systems to publish high-level information about the training data used to train their models, and it survived an early test when a federal court declined to block it in a challenge brought by a major developer. New York is advancing a nearly identical training data transparency bill. At the same time, California is looking to push transparency requirements further with AB 412, which would require developers to create and maintain databases of all copyrighted content that is included in vast training data sets. As Engine has explained in letters to California lawmakers, the requirements in the bill are not technically or financially feasible for startups, given the broad scope and diverse nature of training data sets.

The second track concerns what comes out of a model. A growing number of states, including Washington, Arizona, California, Illinois, and New York, moved bills requiring providers to attach provenance metadata to AI-generated or AI-modified content so that consumers and platforms can tell what was synthetic. California’s broader AI transparency law, which mandates disclosure tools and watermarking for large platforms, had its effective date pushed to later in 2026.

Proposals to support AI innovation

Not every state moved toward new restrictions. A parallel set of efforts aimed to support AI development and adoption rather than constrain it. Connecticut’s new law includes a regulatory sandbox that lets companies test AI products under relaxed requirements, an approach Texas adopted in 2025 and that several states continued to pursue. Arizona became the first state to convene a dedicated House committee on AI and innovation, and advanced a measure directing state agencies to find opportunities to deploy AI and to remove regulations that stand in the way of adoption. Other states funded pilot programs and AI literacy efforts, and the right-to-compute laws that began in 2025 continued to frame access to computational resources as a protected activity. These proposals are the most startup-friendly category of the session, and they offer a template for states that want to encourage innovation rather than only constrain it.

The federal landscape

Given the number of states that moved a wide array of AI proposals in the last year, the pressure is increasing on Congress to create an overarching AI framework. But while the Congress did pass narrow AI-adjacent legislation in 2025 — the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks (TAKE IT DOWN) Act, which, as of May 2026, requires platforms to remove nonconsensual intimate content, including deepfakes, within 48 hours — it has yet to consider a broader AI framework to replace the state patchwork.

After the proposed federal moratorium collapsed in 2025, supporters tried again to attach preemption language to the annual defense bill, and that effort failed too amid bipartisan opposition. With Congress unwilling to act, the administration turned to executive power. In December, the President signed an executive order directing the Attorney General to lead a litigation task force to challenge state AI laws and pressing federal agencies to withhold certain broadband funds from states with rules the administration considers onerous. In March of this year, the White House laid out its wishlist for a federal AI framework, which started to entangle some of the more straightforward AI policies with complex and contentious online kids safety issues. More recently, lawmakers unveiled the Great American AI Act, a discussion draft from Reps. Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.) that would codify parts of the administration’s AI agenda. Whichever path Congress takes, it’s crucial that they find a bipartisan way forward on a framework that creates consistent protections for consumers and obligations for the companies developing and deploying AI, no matter where they are in the country.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By: Jad Meouchy, Bad VR

I’ve spent my career starting businesses, taking risks on new ideas, and building innovative technologies. Over the past 15 years, I’ve founded multiple startups and successfully exited several of them. These experiences have shaped my approach to building and scaling my current company, BadVR. However, policymakers in California are considering changes to state law that would make it harder for me to continue to create, build, and innovate by making it harder to “exit” or sell businesses. Selling businesses, or “getting acquired,” is an essential part of the startup ecosystem. Any changes that jeopardize the acquisition process threaten the entire entrepreneurial landscape, and, consequently, American innovation and success.

Earlier in my career, I built companies focused on data analytics and emerging technologies. Those companies were ultimately acquired, allowing the technology to scale within larger organizations and reach more users. That experience directly informs how I approach developing products and bringing them to market. Today, as Co-founder and CTO of BadVR, I’m working on building immersive analytics technology that uses virtual and augmented reality to make finding insights within complex datasets more accessible to everyone. For example, my company produces an application called “SeeSignal” that allows telecom companies to put on a pair of glasses to see their telecom networks. I know it sounds like science fiction, but the product takes live RF signal data (from telecom networks) and visualizes it, allowing network technicians to easily find and fix coverage issues. SeeSignal is also used to help plan, deploy, and troubleshoot 5G networks, as well as in-home WiFi set-ups. It’s saved telecoms around the world time, money, and resources, allowing them to better serve their customers by providing faster, stronger coverage, even in difficult areas.

When startups exit through acquisitions, talent and capital are cycled back into the ecosystem. Investors reinvest their returns into new companies. Founders launch new startups, empowered with more resources. Going through this process myself, multiple times, has helped establish greater credibility with investors and potential partners, while the capital I’ve gained with each exit makes it possible for me to move faster with each new business. For example, I exited a company I co-founded, Remine, in 2016. By the end of 2017, I had founded my current company, BadVR. I provided the initial funding for this business with money I made exiting my prior company. This scenario is extremely common for technology entrepreneurs, and this cycle, where capital, knowledge, and experience carry forward, is essential to the growth of startup ecosystems. Acquisitions don’t end innovation; they strengthen and enable it.

For decades, the United States has had a consistent and transparent federal framework for reviewing large proposed mergers and acquisitions, searching for potential competition problems. Deal values subject to that process were typically in the nine figures, so most startup acquisitions weren’t called into question. Since the vast majority of transactions benefit consumers and businesses and eventually move forward, this system supported a dynamic startup economy where companies grew, innovated, delivered, and exited.

However, changes in policy could easily disrupt this process. One proposed idea in California would set a new state M&A standard that could create considerable barriers and uncertainty for startups. The most concerning idea, however, proposes that any merger or acquisition would be assessed on its “appreciable risk of lessening competition more than a de minimis amount”. This is a clear departure from the federal standard as set by the Clayton Act and would create a vague, unpredictable legal environment for potential acquirers and startups alike and would negatively impact companies of all sizes — not just the “tech giants” of Meta, Google, and the like. Any new M&A standards in California risk having far-reaching and unintended impacts, as most potential acquirers and most startups are located in California. Creating a separate state legal standard for mergers and acquisitions introduces conflicting requirements, increases costs, and delays or forgoes transactions that are critical to the innovation and growth cycles of startups across the country. Any reduction in an entrepreneur’s ability to sell their startup, and any reduction in the demand to acquire startups, will harm startups across the country. Acquisitions help scale and distribute valuable innovations, while providing returns for founders, investors, and employees. They stimulate the economy and create new jobs. They provide incentive for small businesses to be founded and a path to wealth for many. In short — the process is a win-win for everyone. Why do we want to change it?

Policymakers should be careful not to disrupt the mechanisms that allow startup ecosystems to thrive. Acquisitions help recycle talent, knowledge, and capital into new companies and create jobs and innovation. If we want to continue building an economy defined by entrepreneurship, we need policies that support the startup cycle, not proposals that make the entire process harder for everyone.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By Alexander Wall, Policy Fellow, Engine Advocacy

Policymakers are looking at rewriting the rules around how companies get approval for mergers and acquisitions, which would impact the most common avenue for startups to exit. The Federal Trade Commission (FTC) and Department of Justice (DOJ) has been asking for input on the premerger notification process, the federal rules that govern how mergers and acquisitions get reviewed before they close. As Engine explained in comments we filed with the agencies, rewriting the rules could change the way founders, investors, and employees think about participating in the startup ecosystem.

The Hart-Scott-Rodino (HSR) Act requires parties to large mergers and acquisitions to notify the FTC and DOJ before closing and observe a waiting period, usually 30 days, while the agencies assess whether the deal raises competition concerns. Whether a deal requires a filing depends on its size and the size of the parties involved, with thresholds that adjust periodically. For 2026, the FTC set the minimum transaction value that triggers reporting at $133.9 million.

This process matters to startups because mergers and acquisitions are the primary form of exit for most startups. An analysis of roughly 12,000 startup exits between 2002 and 2020 found that 35 percent of startups failed, 61 percent were acquired, and only 4 percent underwent an initial public offering (IPO). For the vast majority of founders, early employees, and investors, an acquisition is how the company’s value gets realized, how capital gets recycled back into the next generation of startups, and how talent moves through the ecosystem in ways that spark innovation. When filing rules get more expensive and burdensome, they raise costs for founders and investors. This discourages acquirers from pursuing smaller deals altogether, narrowing the exit landscape for startups.

In February 2025, the FTC put into effect a dramatically expanded HSR filing form. It transformed what had been a relatively straightforward notification into something closer to a white paper: detailed written narratives of the deal’s strategic rationale, exhaustive descriptions of competitive overlaps and supply chain relationships, identification of top customers, expanded document production from a newly defined “supervisory deal team lead,” and disclosures about foreign government subsidies. The FTC estimated that the average filing would take 68 additional hours to prepare, with complex transactions requiring over 120 hours total.

The business community challenged the change. A federal judge vacated the rule in its entirety in February 2026, finding that the FTC had failed to justify the added burden with a reasoned cost-benefit analysis, and the agency went back to using the pre-2025 process. Now the agencies are going back to the drawing board. They have said explicitly that the 50-year-old form is “insufficient to review modern mergers,” and that they intend to pursue a new rulemaking regardless of how the appeal plays out.

As this takes shape, it’s important to understand the proposals in play and their potential impact on startups. A new form will most likely land somewhere in between the bare-bones old form and the kitchen-sink 2025 version. If the new form retains heavy narrative and document requirements, the filing costs will remain high and make acquisitions via exit more time consuming and expensive.

The agencies also ask if they should start reviewing “license and hire” transactions, which pair talent hires with intellectual property licenses rather than a traditional acquisition, allowing a larger company to bring on a startup’s key people and license its technology without buying the business. The agencies need to be careful not to sweep in ordinary hiring and licensing activity that startups engage in every day as part of normal market dynamics. An overbroad definition risks chilling routine talent mobility and technology licensing in ways that hurt startups more than incumbents. The agencies must also consider that increasing uncertainty around competition policy and enforcement actually encourages new types of transactions like “license and hire”; when traditional acquisitions become more costly and uncertain to complete, startups will instead pursue the exits that remain available.

On top of this, the agencies are exploring whether to require filers to disclose information related to foreign investment review and sovereign wealth fund ownership as part of the HSR form. The Committee on Foreign Investment in the United States (CFIUS) already handles national security review of transactions under its own separate statutory framework, with its own filing requirements and timelines. Layering those disclosures into the antitrust process risks conflating two distinct regimes and adding cost without clear antitrust benefit. The HSR form should stay focused on what the antitrust agencies actually need to evaluate competition. For startups with diverse investor bases, additional foreign ownership requirements would add compliance complexity to every filing regardless of whether the deal raises any national security concern.

The federal rewrite is not happening in a vacuum. Over the past year, Washington, Colorado, and now California have enacted state-level “mini-HSR” laws that require parties to HSR-reportable transactions to file copies of their federal submissions with the state attorney general (AG). Indiana is close behind, and bills are pending in several other states, including D.C., Hawaii, and New York. These state laws are “notice only” for now, meaning they do not impose separate waiting periods or approval requirements. However, they do impose tight filing deadlines (one business day in California) and real penalties for non-compliance ($25,000 per day in California, $10,000 in Washington and Colorado).

The emergence of state mini-HSR laws reflects a growing sense that federal merger oversight has left gaps. Some state AGs, particularly Democratic ones, view the current federal administration as insufficiently aggressive on merger enforcement. The more unsatisfied states are with the federal approach, the more likely this patchwork expands. That outcome would be particularly detrimental for startups and their acquirers, who lack the legal infrastructure to manage multi-jurisdictional compliance. A well-designed federal rulemaking that credibly modernizes the HSR form would help contain the fragmentation and reduce the momentum of these efforts.

The FTC and DOJ will almost certainly write a new rule while Republicans hold the pen. It will be stepped up from the old form, which both agencies have called inadequate, but likely less expansive than the 2025 Biden-era rule that the courts struck down. How the agencies calibrate the new rule will directly shape the cost and feasibility of startup exits. It will also determine whether the historically uniform federal system for M&A filings holds together, or whether states continue building out their own patchwork of laws, each with different thresholds, timelines, and penalties. For startups and the investors and acquirers they depend on, getting this right is not an abstract regulatory question. It is the difference between an exit environment that works and one that does not.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.

By Emma Kortebein, Policy Manager, Engine Advocacy

For years, Qualified Small Business Stock (QSBS) has been one of the most important federal policies supporting startup growth and early-stage investment. While recent changes at the federal level have made it easier for more startup founders, early employees, and investors to benefit from this tax treatment, many states are trying to limit those benefits, inadvertently curtailing startup activity, investment, and economic growth in their states.

Thanks to QSBS, found in Section 1202 of the tax code, eligible investors, founders, and early stage employees can exclude certain gains from the sale of qualified startup stock, helping offset the considerable risk that comes with investing funds as well as time and energy in early-stage companies. Startups leverage the favorable treatment of QSBS to attract investors and create more competitive compensation offers for vital talent. Startups can offer stock in their company to both investors and early employees, and as long as the investor or employee holds that stock for a certain amount of time, they can avoid being taxed when selling the stock. The One Big Beautiful Bill Act (OBBBA), passed in 2025, makes the QSBS exclusions permanent and allows the exclusions to kick in after three years (50 percent), four years (75 percent), or five years (100 percent). The cap on qualifying stock value was raised from $10 million to $15 million, boosting an already valuable tool startups use to attract top talent and potential investors.

But over the last two years, rather than creating additional startup incentives, some state lawmakers are instead working to tax the gains excluded under federal QSBS at the state level. If this trend gains more traction, founders and investors could face a growing patchwork of state tax treatment that weakens one of the country’s most effective startup incentives.

States already decoupled from federal QSBS treatment: California, Mississippi, Alabama, and Pennsylvania

To begin with, not every state currently conforms to the federal treatment of QSBS. California, Alabama, Mississippi, and Pennsylvania tax gains that are excluded under federal QSBS rules, meaning founders, employees, and investors in those states may still face state-level capital gains taxes on otherwise federally exempt QSBS earnings.

California is perhaps the most notable example given its outsized role in the startup ecosystem. In 1993, California enacted legislation preventing the state from conforming with Section 1202 of the federal tax code (QSBS). For a period of time, the state did allow a partial QSBS exclusion, but that treatment was ultimately struck down by the California Supreme Court. Today, QSBS gains remain fully taxable at the state level in California, where the top capital gains rate reaches 13.3 percent. California’s posture is likely balanced out by the state’s existing advantages: access to venture capital, deep talent networks, established startup infrastructure, and home to major tech companies. However, smaller and emerging startup ecosystems may not be similarly positioned to offset the impact of less favorable tax treatment. For states still trying to attract early-stage investors and companies, conforming to QSBS may become increasingly important in the interstate competition for innovators.

States considering QSBS decoupling

Following the federal expansion of QSBS through OBBBA, several states reconsidered whether they should continue conforming to the federal exclusion. In many cases, the state lawmakers championing decoupling have the incomplete view that it is merely a tax break for the wealthy and the expansion will result in lost state tax revenue, particularly as many states face growing budget pressures.

Oregon recently became the clearest proponent of this trend. In 2026, the state enacted SB 1507, requiring taxpayers to add back gains excluded under federal QSBS rules when calculating Oregon taxable income. Supporters saw the bill as a tax revenue preservation measure while critics warned that in the long term this move would weaken incentives for startup investment and entrepreneurship within the state.

New York and Washington have also explored similar proposals. Legislation introduced in New York would require taxpayers to add federally excluded QSBS gains back into state taxable income, signaling growing interest in treating QSBS less as a startup incentive and more as a forgone source of state revenue. Washington lawmakers similarly considered legislation that would subject QSBS gains to the state’s capital gains tax structure. While neither proposal has been enacted, both demonstrate that state-level QSBS conformity is becoming an increasing debate in state legislatures.

Notably, this debate is also playing out in D.C., where the Council passed temporary QSBS decoupling legislation in December 2025, Congress moved to block it and now the issue will be considered again by the D.C. Council as part of their FY2027 budget.

States strengthening or benefiting from QSBS-friendly tax environments

The majority of states fully conform with Section 1202, meaning states directly follow the federal QSBS rules for state tax treatment. Other states have conformed by effectively creating even more favorable environments for startup investment. Nine states currently have no state income tax or capital gains tax which means qualifying QSBS gains in those states avoid both federal and state taxation, while creating a comparatively favorable tax environment for startup investors and founders.

New Jersey recently moved even further in the pro-startup direction by enacting a state-level QSBS benefit. Legislation signed into law in 2025 allows certain QSBS gains to receive favorable treatment beginning January 1, 2025. The legislation reflects the state’s broader economic development strategy centered on attracting high-growth startups through tax policy rather than increasing taxes on startup investors and stakeholders. As states increasingly compete for innovation-driven growth, New Jersey may offer a preview of how some states may seek to distinguish themselves from states moving toward decoupling.

States can use QSBS to compete for startup activity

QSBS may increasingly become a platform for interstate competition for startups; some states may view innovation incentives as worth preserving to encourage company formation and attract capital. Others, especially those facing budget pressure, may increasingly see QSBS as an untapped source of revenue. For the startup founders, state treatment of QSBS could become part of the calculation when deciding to build a company in one state or another.

As evidenced by the debates happening in state legislatures and the pushback to the federal QSBS expansion, this tax treatment is often incorrectly perceived as merely a benefit for wealthy investors. But startup founders and early employees rely on the tax treatment to de-risk the inherently risky move of launching or joining a new, innovative company — often at the expense of a higher-paying job at an established company. If anything, the policy should be modernized so it works better for startup employees, not just those with capital. Most startup employees receive stock options rather than direct stock grants, yet QSBS generally only applies once options are exercised, which means the holding period clock starts later and employees cannot take advantage of the exemption as easily. During their tenure, employees can also lose eligibility if the company exceeds QSBS size limits before the time they exercise their options. Policymakers could improve the benefits of QSBS by starting the holding period at vesting or grant, and by applying company-size tests at the time equity is granted. Reforms like these would help expand QSBS to be a more effective tool for startup workers and may help signal to states that this is not intended as just a tax break for investors but rather the broader startup ecosystem.

Policymakers should be careful in taking tax incentives for granted

QSBS was created to reward those who take on the risk and reward of building and investing in startup innovations. The recent state-level efforts to curb the impact of the QSBS exemption serve as a reminder that the impact of startup tax incentives can easily be taken for granted.

The United Kingdom offers a useful example. The Seed Enterprise Investment Scheme (SEIS) and Enterprise Investment Scheme (EIS) were specifically designed to encourage investment into early-stage companies through targeted tax relief. Both programs are widely credited with helping expand startup investment and strengthening London’s position as a global startup hub. Following the expansion of SEIS investment limits in 2023, fundraising under the program increased by more than 50 percent year-over-year. Startup tax incentives do matter, and policies supporting those incentives can meaningfully influence where capital flows and where startup ecosystems grow.

The same principle applies in the United States. As Congress has strengthened and expanded QSBS through OBBBA, states now face a choice about whether to align themselves with policies that encourage startup formation and long-term investment, or move in the opposite direction. States worried about their budgets should carefully consider the downstream effects that decoupling may have on their appeal to new businesses in innovation. In the long term, the initial savings may not ultimately be worth it.

Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.