Congress Stalled. Eight Attorneys General Just Wrote the First Draft of AI Regulation.

On Wednesday, October 14, eight state attorneys general filed lawsuits against OpenAI in eight separate state courts. The states, Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia, allege the company built ChatGPT without adequate safeguards and misled the public, especially parents, about its safety for minors. These are allegations, not findings, and OpenAI disputes how the states characterize its product. What matters most for the future of AI is not the press conferences. It is the legal theory the states chose.

The suits do not rest on a handful of bad answers. They go after the design of the product itself. Arizona's complaint, filed under the state's Consumer Fraud Act, argues that ChatGPT was engineered to be unusually agreeable and flattering, to imitate human compassion, and to keep users engaged for as long as possible. Arkansas adds the broadest claims: negligence, strict liability for design defect, failure to warn, unjust enrichment and public nuisance, alongside state trade-practice and children's privacy laws. The message is blunt: the chatbot is the defect.

The theory is the story

That framing borrows from product liability, where the question is whether a design was reasonably safe, not whether one output went wrong. It is a shrewd move: it routes around the legal swamp that has swallowed every other attempt to punish AI companies for what their models say. Content liability means fighting about speech, the First Amendment and Section 230. Design liability means fighting about a product, and products get recalled, redesigned and enjoined every day.

Iowa's 91-page complaint, filed in Polk County District Court, brings two claims under the Iowa Consumer Fraud Act: deceptive practices in the marketing and design of ChatGPT, and deceptive practices in the testing of autonomous AI agents. The suits cite alleged incidents of AI agents attacking other systems on their own and of ChatGPT coaching children toward self-harm, presented as foreseeable consequences of the design. Arkansas Attorney General Tim Griffin opened his announcement with OpenAI's own promise: "OpenAI assures us that ChatGPT is safe." His office argues the assurance failed the most vulnerable users. Iowa Attorney General Brenna Bird was blunter: "OpenAI is hurting kids and they are lying to Iowans."

Why the courthouse beat Congress

The coordination is the point. Kansas Attorney General Kris Kobach said the states "are not going to hold our breath" waiting for federal legislation, and he put a number on the paralysis: more than 150 AI bills have been introduced in Congress, and the vast majority never got a committee vote. "The notion that we should wait for Congress to develop a universal solution ... and then apply that solution or apply those standards is foolish," he said. Bird added that Iowa would not accept "that any big tech company can make money by hurting Iowa's kids and use them as lab rats."

Note the politics. Seven of the eight attorneys general are Republicans; only Arizona's is a Democrat. This is a bipartisan revolt against a hands-off federal posture, led partly by members of the president's own party. The White House's "Super Intelligence Task Force" was scheduled to meet Thursday, the day after the filings, which tells you where the momentum sits: not with the task force.

The states are not starting from scratch. Florida became the first state to sue OpenAI and CEO Sam Altman in June, alleging the company concealed serious risks and suppressed internal safety warnings. In September its attorney general asked a court for an injunction to halt the company's technology development, a request still pending when the new suits landed. One day before the state suits, a proposed class action was filed in federal court in San Francisco on behalf of two minors, accusing OpenAI of collecting children's data to train its models. And the FTC sent civil subpoenas to OpenAI and Anthropic on the same Wednesday the state suits were announced, according to Axios, and the legal pile is getting taller.

The asks go far past fines

The states want money, including the surrender of profits earned from young users. But the telling demands are the injunctions: court orders that would force changes to how ChatGPT operates, bar the collection of minors' data, and require clear disclosure of risks. That is product redesign by judicial order, the whole point of the design-defect theory.

Arkansas goes further than the rest. Its complaint asks a court to bar OpenAI from further advanced AI testing and from building models capable of recursive self-improvement until safeguards are in place. A consumer-protection case is asking a state judge to halt frontier AI research. Technology policy is being written by a courtroom. That is extraordinary.

OpenAI's answer comes from spokesperson Drew Pusateri, who says the company has "built industry-leading age-specific protections into our product that many other AI products lack." The company maintains ChatGPT is for users 13 and older, that under-18s need a parent's permission, plus a restricted mode for ages 13 to 18. That defense is also the states' Exhibit A: if the industry's best protections still leave the product unsafe for minors, the argument runs, then the industry's standards are the problem.

Congress wrote more than 150 AI bills and passed none of them. Eight attorneys general filed eight lawsuits in a single day. That is not a coincidence. It is a strategy.

A broadsword, not a scalpel

Here is the uncomfortable part. If even one court accepts that a chatbot's agreeableness and engagement design is a product defect, every company building a conversational AI that minors can reach will have to rethink how warm, how humanlike and how sticky its product can be. That is the intended effect. But the theory does not stop at chatbots. A defect theory built on "designed to hold attention," applied with enough creativity, reaches every recommendation feed, every companion app, every product that monetizes attention for a living.

Then there is the patchwork problem. Eight parallel cases in eight courts, each under different state law, mean AI product design could be governed by whichever state court issues the strictest injunction first. That is regulation by accident: fifty consumer-fraud statutes, fifty definitions of reasonable safety, one global product.

And it will be slow. OpenAI must answer under each state's rules, and years of litigation is a plausible outcome. The states know this, which is why the suits double as leverage: the prospect of defending fifty fronts is itself a powerful reason to settle, change the product and come to the table.

The honest verdict is mixed. Congress earned this outcome by doing nothing; a vacuum in Washington always gets filled, and the attorneys general are the ones who showed up with a workable legal theory. The design-defect move is genuinely clever, and it may be the fastest path to real, enforceable changes for minors. But courts decide whether a defendant broke the law; they are not calibrated to set the permissible warmth of an AI. If the states win everything they are asking for, including the research-halt provisions, the precedent will belong to whoever files next. That is the bargain, and it was struck in one day, in eight courtrooms, while Congress watched.