Florida did not write an AI law. It wrote a criminal liability doctrine with an AI-shaped hole in it.
The proposal surfaced on September 8, 2026. It creates no technical standard. It establishes no new agency. It contains no safe harbor for compliant builders. What it does is simple and brutal: it targets any company that retains actual control over the design, training, deployment, or safety configuration of an AI agent, and it treats anyone who advises, assists, or abets an AI-enabled crime as a principal. Retroactivity is on the table. The State Attorney General's office has already run the preceding steps — a criminal investigation, then a civil suit against OpenAI and Sam Altman.
Read that list again. No new institutions. No standard to meet. Just existing criminal law, stretched over autonomous systems.
I spent two months in 2020 reverse-engineering the Curve stableswap invariant because the whitepaper under-specified it. The lesson was never about slippage. It was that documentation and implementation diverge, and the divergence is where liability lives. Florida has just written a statute whose entire surface is that divergence.
Context: a federal vacuum and a state that decided not to wait.
The federal track has three competing bills. The Stop Rogue AI Act leads with infrastructure — continuous action verification and a dedicated regulator. The Ban ASI Act leads with prohibition. The AI AGENT Act leads with fiduciary duty, a non-waivable duty of care. All three build new agencies. All three include safe harbors. All three take years to operationalize.
That is the vacuum the Congressional Research Service documented in IF13151, and Florida walked into it. Its design is a fourth governance theory: reuse the criminal code, skip the standard-setting fight entirely.
Understand why this is strategically cheap. Technical definitions are where lobbyists live. Whoever writes "autonomous" into a statute decides which products exist. Florida refused to define the term at all. It anchors on human control instead. That sidesteps the lobbying war and hands discretion to prosecutors.
For builders, this changes the cost structure. Compliance used to mean passing an audit. Now it means carrying criminal defense reserves and liability insurance that probably will not pay out — criminal acts sit in the standard exclusion of every D&O policy I have read. You cannot architect your way out of an uninsurable tail. That is the real regulatory product here: risk that cannot be hedged.
Core: four control surfaces, and the ledger that proves which one you held.
Here is where my structural background matters. "Actual control" is not one thing. It is at least four, and in most crypto-adjacent deployments they sit with four different parties.
Design control belongs to core developers. Training control belongs to whoever runs or fine-tunes the model. Deployment control belongs to the entity that signs the transaction. Runtime safety control belongs to whoever holds the pause key.
The Florida language does not distinguish between them. A single "actual control" standard flattens four distinct accountabilities into one indictment.
Now the technically interesting part. Most systems marketed as "autonomous agents" are not autonomous. Strip the branding and you find a tool-calling loop wrapped around a hot wallet. The autonomy is a narrative layer over a keypair. On-chain, "who has actual control" is not a philosophical question — it is a query. Who can call the upgrade function. Who holds the admin key. Who can pause. Who signs the transfer.
Smart contracts execute truth, not intent. And here the truth is prosecutorial evidence. Every deployment transaction is timestamped. Every admin call is immutable. Every parameter change is on the record. A blockchain is the most complete audit log ever handed to a criminal investigator. Immutability cuts both ways: it protects the user, and it memorializes the operator.
I audited the void and found a backdoor. Here, the backdoor is the deployer's own key.
There is a second technical gap. Criminal law needs mens rea. It needs intent. But an agent's behavior is a probability distribution over actions, not a fixed decision path. The help-and-abet framework presumes a principal offender with clear intent. In an AI-harm scenario, there is often no such principal. The theory imports a common-law concept into a system that does not share its grammar.
I have written enough audit reports to know what happens when a specification assumes a property the implementation lacks. It fails at the boundary. The boundary here is the word "intent."
Then the open-source question, which is existential. If you publish weights, do you retain actual control? If the answer is yes, open-source AI dies in Florida. If the answer is no, every foundation has an incentive to publish and absolve itself. The doctrine has not resolved it.
Contrarian: the industry's own slogan, turned into a noose.
The reflexive crypto take is predictable: this regime punishes builders, kills open source, drives capital offshore. Most of that is correct. It is also incomplete.
The blind spot is the slogan itself. We spent a decade chanting "code is law." We never meant it. It was a marketing line, not a governance philosophy. Now a prosecutor takes it literally and finishes the syllogism: if code is law, then whoever writes the code is the legislator. Legislators are accountable for what they legislate. The author of an agent is the author of its actions. Immutability does not shield the author. It advertises them.
So the real asymmetry is not builder versus regulator. It is bounded versus unbounded. A verifiable agent with a narrow action space, an auditable decision log, and a hard-coded kill switch lives comfortably inside a no-safe-harbor regime. An unbounded agent with emergent behavior does not.
Floor sweeps are just data points in motion. Same pattern here. The market repriced toward low-autonomy, high-auditability products the moment the risk became criminal rather than civil. That is not regulation killing innovation. That is regulation selecting a shape.
The insurance vacuum makes it worse. No coverage means the only risk absorber is the balance sheet, and small teams do not have one. Capital concentration follows mechanically.
Takeaway.
Three signals matter. Watch the Florida legislative session in March 2027 for whether the retroactivity clause survives — if it does, expect an Ex Post Facto challenge that becomes the case itself. Watch the first criminal precedent and the evidentiary standard it sets for "control." Watch whether federal preemption arrives before the state framework hardens.
The open question is not whether autonomy will be regulated. It is why anyone still holds the deployer key if holding it is the entire crime.
