AI Federal Framework

State of play.

• A bipartisan fault line over AI enforcement has opened inside the Trump coalition, with critics including Steve Bannon and Senator Ron Wyden arguing that $300M+ in industry campaign contributions have dampened federal action following AI security incidents involving OpenAI and Anthropic .
• The White House has finalized a pre-release review framework that exempts open-weight models, targeting only closed frontier systems — primarily OpenAI, Anthropic, and Google — for voluntary 30-day NSA-led benchmarking, while leaving the "frontier" trigger criteria undefined .
• The Anthropic-DOD dispute has produced a preliminary injunction blocking the supply-chain risk designation, restoring Anthropic to federal contracts — but the underlying question of whether the government can impose unrestricted weapons and surveillance use as a contract condition remains unresolved .
• The EU Digital Omnibus has materially reset the compliance calendar, deferring high-risk AI obligations to December 2027 (stand-alone systems) and August 2028 (embedded products) while preserving August 2026 transparency requirements — a direct reprieve for multinationals that had been building toward the original deadline .
• For counsel advising frontier AI developers or multinationals with EU exposure, the practical baseline is a three-track compliance picture: a voluntary but politically loaded US federal framework, an FTC preemption posture that treats state-law compliance as no defense to federal deception claims, and a reset EU timeline that still has live August 2026 transparency obligations.

Where things stand.

• The June 2 EO is the administration's primary federal AI governance instrument. It establishes a voluntary 30-day pre-release review framework, an AI cybersecurity clearinghouse, and a classified NSA benchmarking process for covered frontier models — with no binding compliance obligations and no government veto authority over model releases .
• The open-weight carve-out narrows the EO's practical scope. The White House has confirmed that U.S. open-weight models are exempt from pre-release review, concentrating compliance exposure on closed-model developers; the benchmarking criteria that determine which closed models qualify remain unpublished .
• Export controls have emerged as a direct operational lever over frontier AI deployment. The Commerce Department's nationality-based access order forced Anthropic to take Fable 5 and Mythos 5 fully offline for roughly three weeks — a precedent for government control of frontier AI distribution outside any published statutory framework .
• The Anthropic-DOD supply-chain designation is under preliminary injunction. The designation — the first application of foreign-adversary supply-chain risk frameworks to a domestic AI company — is blocked pending litigation; the White House is separately drafting guidance to allow agencies to bypass the designation .
• The FTC is asserting a federal floor for AI accuracy that preempts state law. The FTC's proposed policy statement frames ideological manipulation of AI outputs as a Section 5 violation and explicitly challenges state regulations like Colorado's AI Act as preempted — state-law compliance is not a defense to federal deception enforcement .
• The Great American AI Act would impose a three-year freeze on new state AI development laws. The bipartisan proposal preserves existing state authority over consumer protection, civil rights, and privacy, but the scope of those carve-outs is undefined — creating uncertainty about which state AI rules survive .
• The EU Digital Omnibus has reset the compliance calendar for high-risk AI. Regulation (EU) 2026/1744 defers major high-risk obligations to December 2027 (stand-alone systems) and August 2028 (embedded products); August 2026 transparency requirements remain in force .
• The UN has launched a multilateral AI governance dialogue targeting regulatory interoperability. The Global Dialogue on AI Governance — convening at the 2026 AI for Good Global Summit in Geneva — addresses safe development, capacity gaps, and interoperability of national frameworks; binding obligations remain undisclosed .
• Frontier AI developers are building executive-level policy infrastructure. Anthropic's appointment of former California Supreme Court Justice Cuéllar as chief global affairs officer signals that sustained engagement with multiple regulatory regimes is now a board-level priority at major AI labs .

Latest developments.

• Bipartisan criticism of Trump's AI enforcement posture — MAGA allies and Democratic senators arguing industry campaign contributions have dampened federal action following AI security incidents
• White House finalizes open-weight model exemption from pre-release government review, narrowing the June 2 EO's scope to closed frontier systems; benchmarking trigger criteria remain unpublished
• EU Digital Omnibus enters into force, deferring high-risk AI compliance to December 2027 and August 2028 while preserving August 2026 transparency obligations
• Anthropic appoints former California Supreme Court Justice Cuéllar as first chief global affairs officer, expanding its formal policy operation at the executive level amid ongoing DOD litigation
• UN launches Global Dialogue on AI Governance, institutionalizing multilateral engagement on regulatory interoperability and safe AI development
• Commerce Department export-control order forces Anthropic to take Fable 5 and Mythos 5 offline for roughly three weeks; access restored after Anthropic strengthened safety guardrails
• Federal judge issues preliminary injunction blocking Anthropic's supply-chain risk designation, restoring the company to federal contracts pending litigation
• FTC proposes policy statement asserting Section 5 authority over AI output manipulation, explicitly challenging state AI accuracy regulations as preempted
• Great American AI Act introduced, proposing a three-year freeze on new state AI development laws alongside a federal framework
• June 2 EO "Promoting Advanced Artificial Intelligence Innovation and Security" signed, establishing voluntary 30-day pre-release review and directing AG to prioritize criminal enforcement against AI-enabled computer intrusions

Active questions and open splits.

• Whether export controls have become a standing enforcement vector for frontier AI deployment. The Anthropic Fable 5/Mythos 5 episode established that the Commerce Department can impose nationality-based access restrictions outside any published statutory framework — whether this becomes standard practice for other frontier models, and what compliance architecture it requires, is unresolved .
• Whether the supply-chain risk designation authority extends to domestic AI companies. The preliminary injunction blocking Anthropic's designation signals judicial skepticism of applying foreign-adversary frameworks to U.S. firms — but the merits remain unresolved, and the administration is simultaneously drafting bypass guidance that would render the designation practically moot .
• "Covered frontier model" definition is unpublished and the benchmarking process is classified. Developers cannot assess whether they are subject to the pre-release review framework until NSA produces guidance; the open-weight carve-out narrows the universe but the closed-model trigger remains undefined .
• Whether state-law compliance shields AI companies from FTC Section 5 enforcement. The FTC's proposed policy statement says no — full compliance with Colorado's AI Act or other state frameworks does not foreclose federal deception claims — creating a scenario where companies must exceed state requirements or accept federal risk .
• Whether the Great American AI Act's three-year state freeze survives its own carve-outs. The proposal preserves existing state authority over consumer protection, civil rights, privacy, and deployment — but the scope of those carve-outs is undefined, leaving open whether the freeze has any practical bite against the most active state AI enforcement regimes .
• Whether the bipartisan enforcement pressure shifts the administration's posture toward mandatory federal AI safety requirements. The fault line between MAGA allies demanding mandatory testing and tech-sector figures favoring lighter regulation and state preemption is the political variable that will determine whether the voluntary EO framework hardens into binding obligations .
• EU-US compliance architecture divergence. The Digital Omnibus has reset the EU timeline, but August 2026 transparency requirements remain live — multinationals must maintain parallel compliance architectures for obligations that are now on different schedules in the two largest regulatory regimes .

What to watch.

• Publication of NSA's benchmarking criteria defining "covered frontier models" — the document that determines which closed-model developers are subject to the pre-release review framework and what the compliance timeline looks like.
• Merits ruling in the Anthropic-DOD supply-chain designation litigation — whether courts will sustain or invalidate the application of foreign-adversary procurement frameworks to domestic AI companies.
• FTC finalization of its AI accuracy policy statement following the July 31 comment deadline — whether the final version maintains the preemption theory and what enforcement mechanisms it specifies.
• Congressional action on the Great American AI Act — specifically whether the carve-outs for existing state consumer protection and civil rights authority are defined narrowly enough to give the three-year freeze practical effect.
• Whether additional Commerce Department export-control orders follow the Anthropic template for other frontier models, and whether the administration identifies the statutory authority underlying those restrictions.
• Outcomes from the UN Global Dialogue on AI Governance's Geneva summit — whether the interoperability focus produces recommendations that governments begin incorporating into domestic law, adding a third compliance layer for multinationals.