• The Committee on National Security Systems must harden classified and military systems against cyberattacks, especially those that might use AI. 

• The Department of Defense must enhance the cybersecurity of its internal networks and IT systems. 

• The order states that the Cybersecurity and Infrastructure Security Agency (CISA) needs to issue "Binding Operational Directives" that federal civilian agencies -- not including military -- must follow. These include building out AI-powered defensive security tools and programs, which will be made available to federal agencies, state and local governments, and smaller critical infrastructure operators that lack the budget for advanced cybersecurity. Rural hospitals, community banks and local utilities are explicitly named in the executive order as examples of these operators.  

• The Treasury needs to work with the National Security Agency (NSA) and CISA to establish what the order calls an "AI cybersecurity clearinghouse," where government and private companies can voluntarily share information on software vulnerabilities. The aim is to avoid duplicated effort in vulnerability scanning, verify reported vulnerabilities and prioritize which security patches are made and distributed first. The fact that the Treasury is leading this instead of CISA is unusual and suggests a potential focus on protecting financial-sector infrastructure specifically. 

• The Office of Management and Budget (OMB) must check if existing federal grant programs have already-budgeted money that could be redirected toward funding AI-based vulnerability detection work. 

August 1, 2026: Within 60 days of signing, the Treasury, NSA, CISA and NIST must define what counts as a covered frontier model. They must also design the voluntary framework that lets developers check if their model meets the covered frontier threshold, voluntarily give the government up to 30 days of early access to such a model before wider release and help select which trusted partners also get early access. 

What has changed from previous AI executive orders?  

In January 2025, President Trump signed the executive order titled "Removing Barriers to American Leadership in Artificial Intelligence." This order focused on removing rules seen as barriers to AI development and innovation, and formally revoked Biden's October 2023 order that the Trump administration said would paralyze the AI industry. The goal was to enhance what the order terms as U.S. "AI dominance." 

The action plan to put the January 2025 order in place was published in July 2025. Titled "Winning the Race: America's AI Action Plan," it promised to cut regulation and promote open source models and workforce upskilling programs. It also outlined commitments to build data centers and drive the U.S. to become a leading figure in international AI diplomacy and security. The aim was to export what the order calls the "American AI technology stack" to U.S. allies and counter rival AI influence from adversaries abroad.   

In December 2025, President Trump signed another AI executive order. "Ensuring a National Policy Framework for Artificial Intelligence" emphasized the government's commitment to what it calls "global AI dominance through a minimally burdensome national policy framework for AI." According to the order, state-level AI regulation was "cumbersome," and it aimed to quell concerns by focusing on what it terms a "carefully crafted national framework" that would promote innovation. 

The June 2026 order differs from the above orders in three ways. First, it explicitly tasks federal agencies with implementing a plan to expand the government's operational footprint into AI oversight. Using a classified benchmarking process, voluntary early access to frontier models and a cybersecurity clearing house, the government is changing its AI regulation posture from one of stepping back to one of expansion.  

Second, it recognizes the importance of security. The previous orders focused on AI innovation and competitiveness, but this latest order emphasizes the need to embed stronger security, particularly in government organizations. Cyber and intelligence agencies are also placed at the center, instead of fiscal growth agencies, such as the Department of Commerce. This is a notably different stance from the earlier orders.  

Third, despite the 30-day frontier model access being voluntary, this is the first time developers are being asked by the government to opt in to giving them early access. 

How does this order affect enterprise AI deployments? 

Although giving the U.S. government access to frontier models is voluntary, it could delay broader and public distribution of these models. In June 2026, OpenAI delayed the public release of GPT-5.6 by about two weeks at the government's request. This sets a precedent for what enterprises should plan for, even though the covered frontier model has not yet been formally defined. 

Labs are also expected to build in additional review stages -- including government review -- into their release cycles, which could affect vendor relationships and contracts. The order also doesn't specify what happens if a pre-release review surfaces a national security concern, which could lead to delays. 

Enterprises will likely be affected by changes to governance structures -- such as CISA's "Binding Operational Directives" -- even if they aren't a directly involved party. Contractors, cloud service providers or critical-infrastructure partners likely will be, and enterprises must bear this in mind. 

Finally, it could affect trust in vendor relationships. One vendor may not want to grant pre-release access to the government, while its customers may prefer it. A vendor opting in to access could enhance consumer trust and confidence in their long-term reliability, or they may experience customer frustration over increased government oversight. 

Immediate action items for CIOs