Two regulatory clocks are ticking at different speeds, and the gap between them is now the most underpriced risk in the stack. On October 20, the SEC's "Regulation Crypto Assets" proposal closed its comment window. On January 18, 2027, the GENIUS Act compliance framework goes live. Those are fixed coordinates. Meanwhile the federal AI bill โ 269 pages, circulated as a discussion draft โ has no bill number, no committee referral, no hearing, no markup. A companion measure, S.5051, has sat for 91 days. This is not a story about Washington moving slowly. It is a story about a draft that copies a state law's requirements while preempting that same state's enforcement โ a structural bug that will set the terms for how capital allocates over the next fifteen months.
To read it correctly you have to separate three rule producers, because they are not competing on ideology. They are competing on latency.
Federal agencies are the fast lane โ but only for crypto. The SEC proposal and the GENIUS Act framework are on irreversible procedural rails. The comment window is closed; the effective date is fixed. Whatever the final text says about reserve composition, custody, and disclosure, stablecoin issuers will be modeling it within the year. The uncertainty is no longer "if." It is "how strict."
State legislatures are faster still. California's SB 53 was signed September 29, 2025, and took effect January 1, 2026. It is the country's first frontier-AI safety statute: a $500 million revenue threshold, a mandatory framework and transparency report at deployment, 15-day incident reporting (24 hours when life is at risk), a California Office of Emergency Services filing target, mandatory independent third-party audits from 2030, civil penalties up to $1 million per violation, and enforcement vested solely in the Attorney General โ no private right of action.
The private sector is fastest. Schwab and JPMorgan are not waiting on either branch. They are blocking unauthorized agent-initiated transactions today, through contract and technical control, because the liability of letting an autonomous agent move client money is unresolved. That is not adoption. It is defense.
Here is the part that should stop you. The federal discussion draft's Section 111 mirrors SB 53 almost line for line โ same $500 million threshold, same framework-plus-transparency-report obligation, same 15-day/24-hour clocks. Then Section 121 preempts, for three years, "any state or local law specifically directed at AI model development."
Read the two sections together. The federal draft adopts California's substance and suppresses California's enforcement. And it does so without supplying its own enforcement machinery: penalties undefined, executing authority undefined, third-party audit obligations unstated. If Section 121 takes effect as written, you get a double vacuum โ a federal rule with no teeth standing on top of a state rule that has been legally muted. That is not deregulation. It is the absence of a rule where a rule used to be.
I have seen this failure mode before. In 2020 I mapped twelve liquidation cascades in the MakerDAOโCompound dependency graph and quantified $150 million of exposure that no single protocol team could see. The lesson was not that composability is dangerous. It was that a system inherits the failure modes of its weakest interface, not its strongest component. The regulatory stack is money legos too. Section 111 and Section 121 are two blocks that do not snap together. Whoever assembles them will find the gap at runtime.
The second interface is worse, because it is technical, not legislative. The AI-agent authorization layer โ the thing that decides what an autonomous agent may do โ is being built on OAuth session authorization and signed, encrypted authorization warrants. Poppy and Proof x401 are the two named players, and their pitch is right in spirit: replace the binary of zero-access versus full-access with a continuous spectrum of limited access. That is the correct primitive. It is also the wrong substrate.
OAuth was designed for a human granting a third-party app scoped access to an account. Its threat model does not cover an agent making autonomous decisions across a chain of tools. Carry AI-agent permissions on OAuth and you inherit every historical weakness of the parent protocol: token leakage, scope creep, consent fatigue. Then you add one. The authorization issuer becomes a single point of failure. If the signed warrant is minted by a centralized service, the attack surface migrates from the user's password to the issuer's key custody โ and a single compromise can forge agent permissions at batch scale. Permission scopes are money legos, composable by design and dangerous when composed without a type-checker. OAuth never shipped one. Neither Poppy nor Proof x401 has published an audit, a user count, or a production status. Based on my audit experience โ the 2026 engagement where a prompt-injection flaw in an agent's contract interaction layer could have let an external actor rewrite transaction parameters on a $50 million treasury โ an authorization layer with an undisclosed custody model is not a security boundary. It is a liability transfer.
The third gap is the reporting interface, and it is the clearest demand-supply hole in the whole picture. Federally, incidents route to CAISI. In California, they route to the Office of Emergency Services. But the reporting format, the API, the field standard, and even the clock's start point โ discovery versus occurrence โ are all undefined. A 24-hour clock for life-threatening events makes root-cause analysis technically impossible; the only thing filable in that window is the declaration that an event exists. The regulator's data feed will be declarative, not analytical. Someone has to build the pipe. Nobody has been named.
The consensus read is that the preemption fight is the whole story โ red states versus blue states, industry versus civil society, the BSA backing the preemption clause while labor and civil-society groups call it a weakening of safety standards. That framing is comfortable and mostly wrong.
The real blind spot is the authorization layer's trust model, and the real clock is the sunset. Section 121's preemption is time-boxed to three years. That duration only makes sense if the drafters expect a federal AI statute to land inside it. Weigh the evidence against that expectation: a 269-page draft with no number, S.5051 stalled for 91 days, a HawleyโMurphy framework never introduced. If federal law does not arrive, the preemption sunsets and SB 53 snaps back into force โ retroactively, on systems architected for a rule that no longer applies. That is a compliance cliff, not a compliance bridge.
And notice what the private sector is actually doing. Schwab and JPMorgan are not adopting agent payments; they are blocking them. Wurster's reasoning is textbook: the firm cannot control it, the client cannot control it, and when it breaks, no one can allocate fault. The product the authorization layer has to sell is not convenience. It is attributability. That is a security property, not a UX feature, and it is the one thing the OAuth-based stack does not deliver. The compliance stack is money legos too, and the base plate is missing.
Watch three things over the next fifteen months, and none of them is a price chart. Watch whether the CAISI reporting interface gets a defined schema โ that is where RegTech money will be made. Watch the key custody model of the first authorization-warrant issuer that publishes an audit. And watch the sunset date, because the most dangerous regulatory event of 2029 is a rule quietly coming back to life.
The question is not whether Washington can preempt Sacramento. It is whether a system with no enforcement mechanism and no interface standard can govern anything at all. A rule is only real once someone builds the pipe that enforces it. Right now, nobody has.
