Image credit: Image via Source article. Used under fair use for news commentary. · source
President Trump signed an executive order Tuesday creating a voluntary framework for AI companies to share their frontier models with the federal government before release. If that sounds familiar, you're not imagining things.
Let me back up. In January, Trump revoked Biden's AI executive order, which had required companies to notify the government about powerful AI systems and share safety test results. The move was framed as cutting red tape, letting American AI innovation flourish without bureaucratic interference. Industry cheered. Critics worried.
Now, four months later, we have a new order that directs federal agencies to build a framework to assess the advanced cyber capabilities of AI models before they're released. The stated goal: "to promote secure innovation and strengthen the cybersecurity of critical infrastructure."
I initially thought this was just regulatory whiplash. Kill the old rules, announce the same rules with different branding. But after reading through the coverage and the order itself, I think something weirder is happening.
The 'voluntary' question. The key word in all of this is voluntary. The Verge reports the framework will ask companies to share models before release, but there's no mandate. No penalty for refusing. No requirement to participate at all.
The administration is threading a needle here. The order explicitly states the US AI industry has succeeded "because we refuse to stifle this innovation with overly burdensome regulation." But it also acknowledges that new AI capabilities come with security risks. So the solution is... asking nicely?
Related coverage
More in Policy
Google's promising to replenish more water than it uses by 2030. I've heard promises like this before.
Mark Kowalski · 9 hours ago · 6 min
Seven Chinese military-linked universities are trying to buy Nvidia's most powerful chips legally allowed in China, and I'm not sure anyone in Washington thought this through.
Robert "Bob" Macintosh · Yesterday · 4 min
The company published two governance documents this week. They're fine. They're also exactly what you'd expect from a company trying to stay ahead of regulators.
Mark Kowalski · 4 days ago · 6 min
The same features that make prediction markets useful for forecasting also make them nearly impossible to police for information asymmetry.
Honestly, I'm not sure this holds up. Voluntary frameworks work when companies have incentives to participate. What's the incentive here? Goodwill with regulators? A seat at the table when mandatory rules eventually come? Or is this just security theater, a way to look like you're doing something without actually doing anything?
The internal contradictions.WIRED's reporting paints a picture of an administration that can't quite decide what it wants. On one side, you have the deregulation crowd, the people who pushed to kill Biden's order in the first place. On the other, national security officials who genuinely worry about AI systems being used to attack critical infrastructure, develop bioweapons, or compromise government networks.
These aren't abstract concerns. The cyber capabilities of frontier AI models are advancing faster than most people realize. We're talking about systems that could potentially discover zero-day vulnerabilities, automate sophisticated phishing campaigns, or help adversaries analyze stolen data at scale. The national security types aren't being paranoid. They're being realistic.
But the deregulation crowd has a point too. Heavy-handed rules could push AI development overseas, or concentrate it among a few companies big enough to handle compliance costs. There's a real tension here, and the voluntary framework feels like a compromise that might satisfy nobody.
What companies will actually do. You might be wondering: will anyone participate? My guess is yes, but selectively.
The big players, OpenAI, Anthropic, Google, Microsoft, already have relationships with government agencies. They're already doing some version of this informally. A voluntary framework gives them a structured way to demonstrate responsibility without accepting binding obligations. It's good PR. It's relationship-building. And if mandatory rules come later, they'll have helped shape them.
Smaller companies and startups? Probably not. They don't have the legal teams to navigate government frameworks. They don't have the relationships. And they have every incentive to move fast and ship products before larger competitors catch up. A voluntary program creates a two-tier system where the big get bigger and the small get ignored.
Tbh, I'm not sure that's a bug rather than a feature. The administration might prefer dealing with a handful of large, cooperative companies rather than a sprawling ecosystem of startups.
The missing pieces. Here's what we don't know yet, and it's a lot.
How will "advanced cyber capabilities" be defined? The order doesn't say. What counts as a frontier model? Unclear. Who decides if a model passes or fails assessment? Not specified. What happens if a company shares a model and the government finds problems? The order is silent.
These details matter enormously. A framework that defines "frontier" narrowly might only cover a handful of models. One that defines it broadly could sweep in open-source projects and academic research. The same ambiguity applies to what counts as a cyber capability worth assessing.
I should know this better, but I couldn't find any timeline for when these details will be worked out. The order directs agencies to develop the framework, but doesn't set deadlines. We could be waiting months. Or years.
The bigger picture. Step back and this order starts to look less like policy and more like positioning. The administration wants to appear serious about AI security without imposing costs on industry. It wants to maintain relationships with AI companies without giving them binding commitments. It wants to address national security concerns without empowering the agencies that would actually enforce rules.
Is that cynical? Maybe. But look at the pattern. Kill mandatory rules. Replace them with voluntary guidelines. Claim you've addressed the problem. Move on.
I think the real story here isn't the order itself. It's what happens next. Will companies actually share models? Will agencies develop meaningful assessment criteria? Will anyone face consequences for not participating? The answers will tell us whether this is real policy or just performance.
For now, we have a voluntary framework that asks AI companies to do something they might or might not do, assessed by criteria that don't exist yet, with consequences that remain undefined. If that sounds like progress to you, I have some questions.
What I'm watching. A few things will signal whether this goes anywhere. First, which companies announce participation in the next few months. If OpenAI and Anthropic sign on publicly, the framework has a chance. If they stay quiet, it's probably dead.
Second, whether agencies actually staff up to do assessments. You can't evaluate frontier AI models with existing personnel. The technical expertise required is rare and expensive. Budget allocations will tell us if this is serious.
Third, what happens the first time a company releases a model without participating. If there's no response, everyone will know the framework is toothless. If there's pushback (even informal), it might have teeth after all.
I'll be honest: I'm skeptical this amounts to much. But I've been wrong before. The administration might surprise me. The companies might take it seriously. The agencies might actually build something useful.
We'll see. For now, we're in that awkward phase where nobody knows what the rules are, including the people writing them.
