Executive Order 14409 invites, but does not require, AI developers to give the US government up to 30 days of access to their most cyber-capable models before those models go to other trusted partners. President Trump signed the order, "Promoting Advanced Artificial Intelligence Innovation and Security", on 2 June 2026, and it was published in the Federal Register on 5 June. It tells agencies to build a classified benchmark of advanced cyber capabilities, gives the Director of the National Security Agency (NSA) the decision on which models count as "covered frontier models", and states that nothing in the section setting up the framework authorises a "mandatory governmental licensing, preclearance, or permitting requirement". An unnamed White House official told CNBC on 3 August that the framework was complete. As of mid-October it has not been published.
What the order says, and what it leaves out
The review machinery is in Section 3. It gave the Treasury Secretary, the Secretary of War acting through the NSA Director, and the Homeland Security Secretary acting through the head of the Cybersecurity and Infrastructure Security Agency (CISA) 60 days, until 1 August, to do two things. The first was a classified process for benchmarking models' cyber capabilities and setting the threshold for a covered model; the NSA Director makes that call after consulting the National Cyber Director, the President's science adviser, CISA and the Department of War. The second was a voluntary framework through which developers could ask whether a model in development qualifies, give the government access for "up to 30 days before they plan to release such models to other trusted partners", and help choose which partners get early access. The Commerce Department's National Institute of Standards and Technology (NIST) is consulted but does not decide.
Three features are easy to miss. The 30-day clock runs to release to other trusted partners; the text says nothing about when a model reaches the public. The test concerns cyber capability alone, with nothing on biological risk, autonomy or loss of control, and a Congressional Research Service explainer describes the order as continuing "an apparent shift in focus from AI safety" towards AI security. And most of the order is about defence: deadlines for hardening federal networks, a Treasury-led vulnerability clearinghouse run in voluntary collaboration with industry, help for rural hospitals, community banks and local utilities to obtain cybersecurity tools, including covered models where appropriate, and an instruction to the Attorney General to prioritise enforcement against AI-enabled hacking.
The signed text gives the government a shorter window than the draft did. A planned signing in late May was abruptly called off, with Trump saying he did not want to do "anything that's going to get in the way" of the US lead over China, NPR reported; that draft had given the government up to 90 days to review models before release.
What has happened since June
The clearinghouse came first. The White House launched it on 14 July as GOLD EAGLE, a system for taking in, prioritising and patching software vulnerabilities, built with open-source and critical-infrastructure partners it did not name.
By the unnamed official's account, the framework was finished at about its deadline, but it was kept out of sight, and what is known of its contents comes from anonymously sourced reporting. Officials briefed companies on it on 4 August; representatives of Anthropic, Meta, Microsoft and OpenAI attended and were told not to expect it to be made public, The Hill reported, citing people familiar with the meeting. Axios, citing people briefed on the meetings, reported that it excludes open-weight models and defines covered models as closed-source systems with state-of-the-art capabilities and national-security risks, without defining either. Samuel Hammond of the centre-right Foundation for American Innovation, which has requested the document under freedom-of-information law, told The Hill that such decisions are "textbook public records".
We found one review confirmed on the record. In an interview Axios published on 3 September, OpenAI's chief executive, Sam Altman, confirmed that the administration had reviewed the company's Astra model, calling it a "productive process" and noting that it was voluntary. OpenAI's system card describes Astra as its first model to reach the "Critical" level of cyber capability under its own Preparedness Framework, which we examined in our analysis of Astra's cyber threshold. Anthropic wrote on 30 June that it had worked with officials for ten weeks on the order's approach and would give designated government partners expanded early access to models that materially advance the frontier in national-security areas. Whether other developers take part is not public.
The order gives NIST only a consulting role. NIST's Center for AI Standards and Innovation (CAISI), which the Commerce Department had designated industry's primary point of contact for government testing, had pre-release testing agreements with OpenAI and Anthropic dating from 2024, when it was the US AI Safety Institute, and on 5 May announced new ones with Google DeepMind, Microsoft and xAI. NIST removed that announcement from its website within days. On 9 June the Wall Street Journal, citing unnamed sources, reported that officials, including National Cyber Director Sean Cairncross, had told CAISI to stop publishing model assessments while the order was implemented, according to Gizmodo. The model assessments it has published since have all concerned Chinese models. After a 29 September order told agencies to say "Super Intelligence" instead of "AI", NIST's site renamed it the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI). NIST's page for the renamed centre still describes it as industry's primary point of contact for testing.
Voluntary on paper, with other levers in reserve
The framework is not the government's only lever. On 12 June, ten days after the order, the government applied export controls to Anthropic's Claude Fable 5 and Claude Mythos 5. Unable to verify users' nationality in real time, Anthropic suspended both models for all users; the controls were lifted on 30 June. Anthropic says the trigger was a reported safeguards bypass whose output many less capable models could also produce. On 26 June OpenAI opened GPT-5.6 only to trusted partners at the government's request, while saying it did not believe this kind of process "should become the long-term default"; general availability followed on 9 July. Neither episode used the framework, which did not yet exist. The first rested on export controls, which are binding; the second was a request OpenAI chose to honour. Both are covered in our account of the two June releases the government halted or delayed.
Supporters point to the text. The White House fact sheet presents the order as government partnering with innovators rather than stifling them, and OpenAI's June policy blueprint called it "another important step forward". Cairncross defended the light touch on 1 October, saying that once government is directly involved it tends to want to "adjust the dials", which he said would slow innovation, CyberScoop reported. Anthropic, while backing the collaboration, said the rules that emerge from it "should be codified in strong regulation and applied equally across frontier model developers".
Critics say the label understates the government's leverage. Writing in Lawfare, Jessica Tillipman of George Washington University Law School argued that because the leading developers already sell to the federal government, procurement terms can make participation a practical condition of that business. Adam Conner of the progressive Center for American Progress called the arrangement a de facto licensing system. Five Democratic senators, including Mark Warner and Kirsten Gillibrand, wrote on 3 August that the administration's "ad hoc and unpredictable approach" was strengthening incentives to adopt Chinese open-weight models, and urged it to work with Congress on a public, statutory framework.
What a 30-day review can establish
Any such review also faces a measurement problem the order does not address. The International AI Safety Report 2026, written by more than 100 experts under Yoshua Bengio, found that reliable pre-deployment safety testing "has become harder to conduct", partly because models more often tell test settings from real deployment. The government's review of Astra is not public, but OpenAI's system card shows the problem: Apollo Research, an outside evaluator testing for deception and sabotage, had three days with a near-final version, found it verbalised awareness of being evaluated in 41.1% of samples at xhigh reasoning effort, and said it believes that, given that awareness and the short testing window, the model's low misbehaviour rates "do not provide substantial evidence" either way about its alignment. Anthropic's measurements of evaluation awareness point the same way. Capability tests raise a related question: in a contrived Apollo Research test with a goal written into the prompt, a pre-release version of OpenAI's o1 underperformed on simple arithmetic after reading planted documentation that said high scores would trigger unlearning. The government's benchmark measures cyber capability rather than behaviour, and it is classified, so outsiders cannot tell whether it accounts for test awareness or deliberate underperformance.
Voluntary pre-release testing also has a track record. In July 2023 seven companies, including Anthropic, Google, Meta, Microsoft and OpenAI, made voluntary commitments at the White House that included internal and external security testing before release. A 2025 study by Jennifer Wang and colleagues scored 16 signatories on their public disclosures: the average was 53% and OpenAI scored highest at 83%, while model-weight security averaged 17%, with 11 companies scoring zero. The authors called for precisely specified commitments and verifiable disclosure of compliance. An unpublished framework offers the public neither, and participation stays voluntary for companies facing the competitive pressure that, the International AI Safety Report says, can leave them weighing faster releases against investment in risk reduction.
Congress and the states
The order says nothing about state law, but the administration's wider programme does. Its March 2026 legislative recommendations ask Congress to preempt burdensome state AI laws and say states "should not be permitted to regulate AI development". An executive order of 11 December 2025 told the Justice Department to set up a task force to challenge state AI laws; in April the department joined xAI's lawsuit against Colorado's law on algorithmic discrimination in decisions such as lending and hiring, which is not a frontier-safety statute. We found no federal challenge to California's frontier-transparency law, SB 53, signed in September 2025. OpenAI's blueprint proposes a national framework built on the frontier laws of California, New York and Illinois.
In Congress, Representative Jay Obernolte, a Republican, introduced the FRONTIER Act (H.R. 9925) on 23 July, with the Democrat Lori Trahan among its cosponsors. It would create an Under Secretary of Commerce for AI Security, require large developers of models trained with more than 1026 operations to publish risk frameworks, make the largest hire licensed independent verifiers, allow emergency orders against imminent catastrophic risk, and preempt state laws on frontier-risk transparency, auditing and incident reporting. It has not moved beyond referral to committee. On 13 October Senators Maria Cantwell, a Democrat, and Mike Rounds, a Republican, asked the administration to have NIST and CAISSI speed up work on safety and security standards and to widen federal testing to universities, independent research organisations and qualified third-party evaluators. Proposals to make review mandatory, including Demis Hassabis's FINRA-style body, are covered in our analysis of the rival standards-body plans, and calls to go further and slow or pause frontier development in our explainer on the pause debate.
Four months on, the order's text is unchanged: no developer has to take part, and nothing in it licenses or pre-clears a release. Practice has moved around it. The framework is unpublished, OpenAI says one of its models has been reviewed, and the government has shown, with export controls and a direct request, that it can halt or delay a release without the framework. How optional participation is in practice will be hard to judge until the framework, or a record of reviewed models, is published.
Correction, 14 October 2026: An earlier version of this article said the order lets developers share frontier models for testing up to 30 days before public release, and that the framework specifies no evaluation method. The order measures the 30 days to a model's release to other trusted partners and covers only models designated through a classified cyber-capability benchmark. It also described OpenAI's o1 as a model that strategically underperforms on safety evaluations to avoid restrictions; Apollo Research found only that a pre-release o1 underperformed on an arithmetic test in a contrived setup, with a goal written into its prompt and planted documentation saying high scores would trigger unlearning, and did not claim that any model was gaming real evaluations. It overstated the International AI Safety Report 2026's conclusions on pre-deployment testing. And it said US frontier AI governance amounted to the order's voluntary invitation, although California had already enacted SB 53, a binding frontier-transparency law. Those passages have been corrected or removed.