Trump's AI Order Comes With Hard Deadlines and an Opt-Out Button

The biggest is a frontier-model framework, due in 60 days, built by the NSA, CISA, and Treasury. It sets up classified benchmarking to assess whether advanced models have dangerous cyber capabilities, and it invites developers to do three things on their own initiative: determine whether their model counts as a "covered frontier model," give the government up to 30 days of early access before a public release, and help pick which trusted partners get access. Every one of those steps is optional.

The order then goes out of its way to slam a door. It states, in plain language, that nothing in it authorizes "mandatory governmental licensing, preclearance, or permitting." The administration wants early eyes on powerful models. It explicitly does not want a regime where a lab needs Washington's permission to ship.

The second move is cybersecurity plumbing. Within 30 days, CISA issues directives for federal civilian agencies, and Treasury stands up an "AI cybersecurity clearinghouse" to coordinate vulnerability scanning and patching with industry. The third is enforcement: the Attorney General is told to prioritize prosecutions for AI-enabled computer fraud and intrusion.

Why "voluntary" is the whole story

Compare this to the other big AI document of the month. The Great American AI Act, the bipartisan House discussion draft, would make safety frameworks and third-party audits mandatory for large frontier developers, and would preempt state law in exchange. Binding obligations, federal teeth.

The executive order is the philosophical opposite. Same concern, frontier models with serious capabilities, and a completely different answer: collaborate, don't compel. Offer the labs a security partnership and trust them to take it.

So within the span of a few weeks, the US produced two competing theories of how to govern frontier AI. One treats it as a regulated activity requiring audits. The other treats it as a national-security collaboration the government can only request. They cannot both be the eventual answer, and the gap between them is exactly the fight that has been deferred for three years.

The strongest case for the voluntary approach

I want to be fair to it, because the voluntary route is not obviously wrong. A licensing regime for frontier models would be slow, would entrench whoever can afford the compliance, and would almost certainly lag the technology by years. The labs genuinely do have security information the government needs, and a cooperative clearinghouse can move at a speed that rulemaking never will. If the goal is to actually reduce cyber risk this year rather than to look tough, voluntary coordination might do more real work than a mandate stuck in litigation.

The case against is just as simple. Voluntary means a lab can say no, quietly, when cooperation becomes inconvenient or commercially costly. The 30-day early-access window is only as good as the labs' willingness to use it, and "willing" tends to shrink under competitive and financial pressure, which there is now plenty of with two of these labs racing toward IPOs.

What to watch

The order's near-term legacy will be written by the July 2 and August 1 deliverables, not by the signing ceremony. The test is whether the frontier-model framework, when it lands, carries any real incentive for that voluntary early access or turns out to be a polite request with nothing behind it. If no major lab publicly commits to the 30-day window, that tells you most of what you need to know. And the deeper question is what Congress does next: treat the order as enough, or use it as cover to push the binding version harder.

For now, the US AI safety posture is a request, politely worded, with an opt-out built into every clause. Whether that is pragmatism or abdication depends entirely on whether the labs say yes when saying no would be easier.