As of November 6, Democrats will control both chambers when the new Congress convenes in January, although several races, final seat totals, and official certifications remain pending. The projected Senate majority will fall short of the 60 votes needed to end a filibuster, and both chambers fall well short of the two-thirds required to override a presidential veto.

The new Congressional arithmetic will define the next two years. Congress can investigate, fund, delay, and decline; but it is unlikely to be able to enact a different AI policy without the President's signature. The Administration, meanwhile, retains the AI instruments it had before the election. That includes Executive Order 14365 and the DOJ's Artificial Intelligence Litigation Task Force. It also includes OMB's AI acquisition memorandum, as well as its "unbiased AI" procurement memorandum, GSA's acquisition clause addressing large language model procurements, and the FTC's recent policy statements. And it includes the June executive order directing development of a voluntary framework with frontier model developers. Those executive and agency actions did not require Congress to enact new legislation, and the election does not itself rescind them. What we have, therefore, is not a replacement of the federal AI policy system, but rather the introduction of likely institutional opposition within it.

The Hearing Angle 

The most immediate change will come through oversight. Committee chairs control hearing agendas, investigative letters, document requests, subpoenas, staff reports, and referrals to the Government Accountability Office ("GAO") and agency inspectors general. New majorities typically use those tools early.

The subjects are likely to be the instruments the executive branch built on its own authority:

• Procurement requirements governing AI vendor vetting and model outputs;
• The high-impact AI determinations and assessments recorded in agencies' AI use case inventories;
• Voluntary pre-release review of frontier models;
• National security AI deployment; and
• The federal retreat from disparate impact enforcement.

Companies that sell AI to the government, deploy it in consequential decisions, or make public safety commitments could ultimately fall within the scope of some of those inquiries.

To be sure, most organizations will never receive a congressional subpoena. The subpoena is the extreme case. But the same records answer the more likely questioners: state attorneys general, plaintiffs, regulators, enterprise customers conducting diligence, and boards asking what management knew.

For significant systems, a useful test is whether the organization could explain the deployment coherently to a congressional committee that already has the internal documents. This is distinct from whether the organization could survive an audit. 

Appropriations and Confirmations 

A Congress that likely cannot override a veto is not toothless. By leveraging the power of the purse, it can still decide what agencies receive money to do. For example, appropriations language could fund or restrict:

• Technical staff at NIST and its AI standards center;
• Enforcement capacity at the FTC and EEOC;
• Litigation against state AI laws;
• Procurement implementation; and
• Cybersecurity programs.

It can also require reports, testing, and GAO reviews as conditions of funding. Those fights can matter precisely because they become part of negotiations over funding that Congress and the White House eventually have to resolve. Current government funding expires December 11, making appropriations an immediate lame duck issue as well as a longer term tool of divided government. We recommend paying particular attention to which institutions receive money to test, enforce, procure, standardize, or challenge AI.

Senate control matters in a quieter way. Agencies such as the FTC depend on presidential nominations and Senate confirmations to fill multimember commissions. In August 2026, a two-member Commission adopted the FTC's statement that it would no longer pursue disparate impact or "unfair discrimination" theories under its authorities. The Commission said it would continue to pursue disparate treatment claims under the Equal Credit Opportunity Act. A Democratic Senate would not reverse that policy by itself; it could, however, affect who is confirmed to make the next one, how quickly vacancies are filled, and whether future initiatives command a Commission majority.

In divided government, some of the most consequential federal AI policy often appears in appropriations language, agency budgets, and confirmation votes rather than in a statute labeled the Artificial Intelligence Act.

Preemption Considerations 

Resistance to displacing state AI laws has not been strictly partisan. On July 1, 2025, the Senate voted 99–1 to strike a proposed moratorium on state AI enforcement from the budget reconciliation bill. That vote occurred under unified Republican control. Ninety-nine senators did not suddenly agree on AI policy, but they did agree that suppressing state law was not, at least at that point, the answer.

A Democratic Congress makes broad preemption considerably less likely. The White House's own March framework would preserve state enforcement of generally applicable laws protecting children, preventing fraud, and protecting consumers. Any national standard capable of attracting substantial bipartisan support may therefore need more, potentially including substantive floors, preserved state enforcement authority, or carveouts for areas such as employment, privacy, and civil rights. Even observers who favor a lighter federal approach expect comprehensive federal AI legislation to stall while states continue building their own rules. 

A largely underreported piece to watch is the lame duck session. The current Congress returns November 9 (read: before the new majority is seated). Earlier efforts show why that window matters; preemption language can reappear in must pass legislation after standalone proposals fail. The 2025 effort was ultimately omitted from the FY2026 National Defense Authorization Act after substantial bipartisan resistance.

Not to be outdone, the state layer is also changing on its own. New attorneys general will take office in several states, including Colorado and Texas, whose AI statutes are enforced by the state AG. While they bring shifting enforcement priorities, they do not shift the underlying statutes. The practical conclusion is the one we reached after Colorado repealed and replaced its AI Act, which is to build to the binding layer. Governance programs for 2027 should not assume that Washington will replace the state patchwork with one light touch federal rule.

Congressional Attention

Narrower AI measures may still advance in the upcoming Congress, particularly in areas with existing statutory or operational vocabulary. Data center energy costs, permitting, and siting are also likely to draw attention. The White House's March framework already pairs ratepayer protection with faster permitting. 

Employment: The shift in federal enforcement priorities away from disparate impact theories is clear. But Title VII, the ADA, and the ADEA haven't changed, and employers remain subject to them. Within those frameworks, automated screening, ranking, performance scoring, and termination decisions are natural subjects for potential hearings. Colorado's new statute and its proposed rules frame this question well: when AI contributes materially to an employment decision, can someone explain the system's role, identify the information it used, review the outcome independently, and change it? This raises questions of operational authority that extend beyond documenting policies.

Agentic Security: This may be the most legislatively tractable AI issue in a divided Congress. The outgoing Congress already provides a bipartisan marker. The Stop Rogue AI Act, introduced by Representatives Josh Gottheimer and Mike Lawler, would direct NIST to develop standards for discovering, inventorying, verifying, and controlling AI agents. That includes agents acquired from vendors or operated through external services. Unless enacted in the current Congress, the bill would need to be reintroduced. Its structure still shows why the subject may advance. The bill translates agent governance into familiar cybersecurity concepts: continuous inventory, verified identity, access control, runtime monitoring, provenance, tamper-evident logging, and organizational authority to constrain agent activity. As we noted recently, however, naming a sponsor does not automatically give that person sufficient authority to intervene, nor does it resolve what intervention means when an agent's actions may already have propagated through other systems.

The philosophy of safe intelligence can remain unsettled while Congress still acts on inventory, access controls, action logs, provenance, and organizational authority to constrain or stop an agent.

What Companies Should Do Now

• Keep the governance architecture you have. Inventories, ownership, risk classification, vendor diligence, testing, human review, correction and recourse, logging, incident response, and board reporting have survived markedly different federal AI philosophies. They survived because they solve operating problems rather than political ones. The political rationale, to be sure, changes far faster than the controls.
• Add explainability and reconstructability to the threat model. For each significant system, ask whether current records could reconstruct the deployment for a regulator, plaintiff, customer, board, or committee. Where that story cannot be reconstructed, the gap is a records problem before it is a legal one.
• Plan for state obligations (not federal relief). Build modular processes for notices, adverse outcome disclosures, human review, and correction rights that can absorb new state requirements without rebuilding the program.
• Inventory agents as agents. An agent inventory necessarily includes what the system is, but it should also include what it can do and who can stop it.
• Test whether human authority is real. As we have noted previously, a reviewer who cannot reject, modify, or reverse a recommendation is a description of oversight, not oversight itself. The distinction is no different from a cybersecurity policy describing controls the organization has not actually implemented.

Govern the System You Have

The coming Congressional argument will likely focus on how much AI should be accelerated and how it should be governed. The more useful analysis focuses on accountability, recordkeeping, recourse, authority and, practically, how, when and under what circumstances AI can be overridden.  

The election did not settle federal AI policy. It did, however, change which institution gets to ask questions, demand records, fund agencies, and challenge the answers. Companies should prepare for that friction without rebuilding their governance programs around a two-year political cycle. In short: govern the system you have, not the administration you expect.

For questions about AI governance, state AI compliance, or preparing for regulatory and congressional scrutiny, please contact the Jones Walker Privacy, Data Strategy and Artificial Intelligence team. Stay tuned and subscribe for continued insights from the AI Law and Policy Navigator.