Key Takeaways
- FDA pathway established: FDA granted Breakthrough Device Designation to RecovryAI's LLM-powered Virtual Care Assistants, creating the first formal Class II SaMD regulatory pathway for clinical AI—offering certainty that FTC cannot provide.
- FTC federal preemption failed: March 11 deadline arrived with 0 DOJ lawsuits filed by the AI Litigation Task Force (operational since January 10). Legal scholars assess FTC preemption authority as 'limited' under Supreme Court precedent.
- Four state AI laws active: California, Texas, Colorado, Illinois have AI-specific legislation. 17 additional states have pending legislation, creating compliance fragmentation that horizontal AI companies must navigate.
- Civil society $500M commitment: Mozilla Humanity AI coalition mobilized funding from MacArthur, Ford, Mellon, and other foundations for 5-year accountability infrastructure investment—operating outside regulatory frameworks entirely.
- The arbitrage: Vertical AI companies (healthcare, finance, defense) can pursue domain-specific regulator approval and gain first-mover protection. Horizontal AI companies face 50-state regulatory chaos, making vertical positioning strategically advantageous.
The Governance Gap: Three Tracks Instead of One
U.S. AI governance has fragmented into three parallel, uncoordinated systems:
Track 1: Vertical Domain Regulators (FDA, SEC, FINRA, DoD acquisition)
These agencies have 50+ years of domain expertise and statutory authority. FDA just proved it can regulate AI: RecovryAI's Virtual Care Assistants received Breakthrough Device Designation and are on track for Class II SaMD classification by late 2026. This is not regulatory capture—it is regulatory clarity. A healthcare AI company knows exactly what approval path to follow.
Track 2: Horizontal FTC + State Patchwork (Paralyzed)
The FTC has explicit authority to regulate "unfair or deceptive practices" but lacks statutory AI-specific power. Its March 11 federal preemption attempt—designed to block state AI laws—has produced zero enforcement. The DOJ AI Litigation Task Force, operational since January 10, has filed 0 lawsuits. Legal scholars note that the Supreme Court's "presumption against preemption" doctrine limits FTC authority to preempt state laws. The result: 4 states have AI laws active, 17 have pending legislation, and zero enforcement clarity.
Track 3: Civil Society Infrastructure (Outside Government)
Mozilla's Humanity AI coalition committed $500M over 5 years to build accountability tools that operate outside regulatory frameworks—open-source misinformation detection, algorithmic transparency audits, election integrity monitoring. This is not a substitute for regulation. It is an acknowledgment that government is too slow, so civil society is building accountability infrastructure in parallel.
Evidence: Why Vertical Is Winning
1. FDA's pathway is surprisingly clear
RecovryAI's Breakthrough Device Designation for SaMD (Software as a Medical Device) governance followed a predictable path: clinical validation, safety documentation, predetermined change control plans (TPLC oversight). The timeline is long (12-18 months to Class II SaMD approval), but the approval criteria are explicit. Compare this to the FTC's approach: vague guidance, unclear legal authority, zero enforcement. Healthcare AI companies prefer the FDA path because certainty beats speed.
2. FINRA and SEC are moving faster than FTC
While the FTC debates whether it has preemption authority, FINRA and the SEC have already started approving algorithmic trading and robo-advisor systems. Financial AI companies face state-by-state patchwork less than healthcare because the SEC/FINRA frameworks are already mature. Vertical jurisdiction offers regulatory arbitrage.
3. Horizontal AI faces 50-state compliance costs
A chatbot company selling HR automation to mid-market enterprises must navigate:
- California's AI transparency law (model documentation, bias testing)
- Colorado's AI algorithmic bias law (bias impact assessments)
- Illinois's BIPA rules (biometric data)
- Texas's AI transparency rules (disclosure requirements)
- 17 pending state laws (compliance burden increasing quarterly)
Compliance cost: $50K-$500K/year across 50 jurisdictions. This is not legally complex compared to healthcare or finance, but it is expensive and ever-changing. Vertical regulation avoids this fragmentation.
4. The Claude Opus Firefox case shows the governance gap
Claude Opus discovered 22 Firefox vulnerabilities (14 high-severity) in 2 weeks for $4,000. No regulatory framework governed this. AI-assisted vulnerability discovery is not regulated by FDA, FTC, FINRA, or any federal agency. This is precisely where horizontal regulation fails: new capabilities emerge faster than governance frameworks can adapt. By the time the FTC drafts guidance, the technology has evolved.
Implications: A Three-Phase Regulatory Future
Phase 1 (0-6 months): Vertical Companies Move First
Healthcare AI startups that apply for FDA pathways gain competitive advantage. They can market to enterprises and hospitals with credible regulatory clearance while horizontal AI competitors face state-by-state uncertainty. RecovryAI's template becomes a roadmap. Fintech AI companies similarly accelerate toward SEC/FINRA approval.
First-mover advantage accrues to vertical companies that de-risk their regulatory path. Insurance, medical devices, financial services, defense—all move faster than generalist AI applications.
Phase 2 (6-18 months): The Regulatory Forum Shopping Pattern
AI companies begin restructuring products to fall under favorable vertical regulators rather than FTC/state patchwork. A customer service chatbot gets rebranded as a "patient engagement tool" to pursue FDA approval. A hiring automation tool targets finance/HR compliance buckets to avoid state AI laws. This is not dishonest—it is rational strategic positioning.
The competitive advantage shifts to companies with vertical domain expertise. Anthropic's healthcare partnerships. OpenAI's enterprise / fintech focus. Google DeepMind's regulatory strategy.
Phase 3 (18+ months): Three-Track Stabilization
The U.S. AI governance structure settles into three permanent tracks:
- Vertical AI (healthcare, finance, defense): Fast regulatory approval, first-mover advantage, high margin
- Horizontal AI (general enterprise tools): Slow 50-state compliance, regulatory fragmentation, commoditized pricing
- Civil society accountability: Open-source auditing, misinformation detection, election monitoring—operating in parallel to government and corporate frameworks
Federal comprehensive AI legislation remains unlikely given congressional gridlock. States continue writing AI laws. Companies adapt to permanent fragmentation as the baseline.
Counterarguments Worth Taking Seriously
FDA may be too slow for AI iteration: The TPLC oversight and Predetermined Change Control Plans add regulatory burden that AI companies optimizing for speed may find intolerable. If FDA approval adds 12 months to product cycles, the advantage erodes.
FTC may succeed through indirect coercion: The $42B BEAD broadband funding threat gives the Commerce Department real leverage over states. If enough states back down from AI law enforcement under federal pressure, the compliance landscape simplifies without litigation.
Civil society is underfunded versus industry: Mozilla's $500M over 5 years ($100M/year) is dwarfed by OpenAI's $110B investment. Civil society tools may lack the computational power to constrain frontier AI at scale.
What To Watch
FDA SaMD approval rate for AI: How many LLM-powered medical devices get Class II SaMD approval by end of 2026? If the rate exceeds 10/month, the FDA pathway has become a clear competitive advantage. If it stays below 2/month, FDA approval may be too slow for enterprise adoption.
Horizontal AI company compliance costs: Monitor public disclosures from Anthropic, OpenAI, and others about legal/compliance spending. If it exceeds 10% of revenue, the horizontal fragmentation hypothesis is validated.
State AI law enforcement actions: Watch for the first AG lawsuit under California or Colorado AI law. This signals whether states will actually enforce their rules or if they remain symbolic legislation.
Civil society tool adoption: Mozilla's Humanity AI projects (misinformation detection, algorithmic auditing) are measuring impact via adoption metrics. Monitor whether enterprises actually use these tools or if they remain academic exercises.
What This Means for Practitioners
For AI founders building healthcare, financial services, or defense applications: Start planning your regulatory pathway now. Engage with FDA, SEC, or FINRA early. The companies that treat vertical regulation as a moat (not a burden) will move faster than competitors who wait for horizontal regulation to clarify.
For enterprise AI platform builders: If your product is horizontal (general automation, content generation, code tools), budget $50-100K/year for state-by-state compliance. Hire a regulatory affairs person. Monitor California, Colorado, and Texas legislation closely—these states are setting the template.
For compliance teams at large enterprises: The 50-state patchwork is your reality. Implement bias testing, model documentation, and transparency controls now. By late 2026, these will be standard contractual requirements from procurement teams buying AI tools.
For policy advocates: Vertical regulation is moving faster than horizontal. If you believe comprehensive federal AI law is important, focus on supporting FDA, SEC, and FINRA efforts. They have statutory authority and are using it. Federal-level horizontal legislation is unlikely; optimization happens at the agency level.