Is there a federal law with supremacy over the state law? My layperson’s understanding is that there would need to be something in existing federal law that forces retention. Not just some executive order, government contract, or executive policy.

A company could defy state law but they wouldn’t be protected from state level civil and criminal charges. There’s not much of a mechanism for the federal government to do anything about that.