Trump AI order targets frontier model prerelease review

Inside the new frontier AI review framework

At a high level, the executive order establishes a framework for identifying and reviewing advanced AI models that federal agencies believe could pose significant cybersecurity risks.

It directs the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Treasury Department to develop criteria for determining which AI systems fall into a new category called "covered frontier models." This category hasn't been defined yet, but it's expected to include highly capable AI systems that might require closer attention. The agencies have 60 days to establish the covered frontier model criteria.

Once the category is defined, AI developers can voluntarily work with the government to determine whether their models fall within the framework. If they do, companies could choose to provide the government with access to those models for a review period of up to 30 days before release.

The order also includes the creation of an AI cybersecurity clearinghouse to help identify and address AI-related software vulnerabilities. In addition, it directs the Justice Department to prioritize enforcement against cybercrime that uses AI tools.

Importantly, the order states that the framework can't be used to create mandatory licensing, preclearance or permitting requirements for AI model releases.

According to George Ng, co-founder and CTO of GGWP, an AI-powered content moderation platform, the framework appears designed to give federal agencies earlier visibility into serious cybersecurity risks without creating an AI approval regime. "As these newer frontier models emerge, some have capabilities that could accelerate adversarial activity, including vulnerability discovery," he said.

Reaction from frontier model makers has been relatively muted.

A voluntary process allows the government to engage with industry, gather intelligence on emerging capabilities and establish baseline expectations without slowing down innovation.

Victoria Espinel, CEO of the Business Software Alliance, which represents major software and AI developers, said in a press release that she welcomed the approach. "The executive order appropriately constructs a voluntary and phased approach to introducing and evaluating frontier AI security models that would prioritize strengthening critical infrastructure and proactively remediating vulnerabilities," she said in the statement.

How voluntary is the framework, really?

The voluntary nature of the framework is one of the most notable aspects of the order. According to reports, an earlier draft of the executive order would have allowed the government up to 90 days to review advanced AI models before release. The final version reduced that window to 30 days and clarified that participation can't be tied to mandatory licensing or approval requirements.

That change reflects the balance policymakers are trying to strike, in which they gain greater visibility into increasingly powerful AI systems while avoiding rules that could slow development and stymie innovation.

"A voluntary process allows the government to engage with industry, gather intelligence on emerging capabilities and establish baseline expectations without slowing down innovation," said Tyler Saltsman, CEO of EdgeRunner AI, a cybersecurity firm focused on AI threat detection and vulnerability analysis.

If a vendor can say its frontier model went through a federal review process, even a voluntary one, that could become a meaningful trust signal in procurement.

Still, the line between voluntary and consequential might not be so clear in practice. For companies that work closely with federal agencies or rely on government contracts, participation could be seen as a signal of transparency and cooperation.

"What starts as voluntary often becomes a market expectation, particularly for organizations serving government agencies, critical infrastructure or highly regulated industries," Saltsman said.

Trevor Horwitz, chief information security officer at TrustNet, a cybersecurity compliance firm, echoed that concern, noting that market expectations can be just as influential as formal requirements. "Participation can become an unofficial requirement even when it's not legally mandated," he said.

That dynamic is becoming a factor in enterprise AI procurement behavior. As organizations move from experimentation to production, trust will increasingly matter.

"If a vendor can say its frontier model went through a federal review process, even a voluntary one, that could become a meaningful trust signal in procurement," said Lisa Falzone, president and co-founder of Athena Security, a unified AI security-screening platform.

In that context, participation in voluntary review programs might become one of several factors enterprises use to evaluate vendors. Companies that opt out could face more scrutiny from customers as to why they aren't participating and how they assess and manage risk in advanced AI systems.

What a 30-day review window could mean for AI developers

For companies developing advanced AI models, a 30-day review period would add another step before a model reaches the market. AI launches are planned months in advance and coordinated around product releases, customer deployments and competitive pressures, so even a voluntary review process could affect those timelines.

Frontier AI developers are already building additional evaluation stages into release plans for their most capable systems. On the same day President Trump signed the executive order, Anthropic expanded access to its restricted Claude Mythos Preview model through Project Glasswing. It extended the program to roughly 150 additional organizations across more than 15 countries while continuing to limit broader public availability. Anthropic has said it's withholding wider release of Mythos-class models until stronger safeguards are in place, highlighting how additional review and testing is affecting when advanced models reach the market.

However, any review process raises questions about how unreleased models and sensitive information would be handled. Trump's executive order does include protections for confidential information. It states that any government access to unreleased models must be subject to safeguards for cybersecurity, intellectual property and nondisclosure. The details about how those protections would work have yet to be defined.

Horwitz cautioned against viewing any government review process as a guarantee of safety. "Cybersecurity is about risk management, not risk elimination," he said. "The value comes from identifying issues earlier and creating accountability around remediation."

This is all very new. It gives stakeholders flexibility to determine what should actually be reviewed and how the process should work.

A review process capable of identifying cybersecurity risks, misuse scenarios or security weaknesses before public release has the potential to improve outcomes, even if it can't eliminate risk entirely, he added.

Developers are also waiting for clarity on the scope of the order. It applies only to covered frontier models, but the government hasn't defined which systems fall into that category, leaving uncertainty about which future models could be subject to the framework.

Ng said one advantage of the voluntary approach is that it gives policymakers and developers time to determine which capabilities warrant additional scrutiny. "This is all very new," he said. "It gives stakeholders flexibility to determine what should actually be reviewed and how the process should work."

Horwitz also noted that the framework could be easier for larger AI companies to navigate. Established developers generally have more resources, more mature security programs and a greater ability to absorb review timelines than smaller competitors, he said.

What it could mean for enterprises waiting on the models

For enterprise technology leaders, AI policy matters most in practical terms -- mainly how it affects when new tools are available and ready to use.

A short review period that improves security or reliability is often worth the tradeoff for enterprise customers.

In the near term, the effect is likely limited, but the 30-day window is still important. If the covered frontier model definition is broad, it could include major releases from leading AI providers and add an extra step before launch. For enterprises, that could shift timelines for AI projects and deployments that depend on access to those models.

Still, many businesses might view a modest delay as an acceptable tradeoff if it leads to stronger security and reliability. "A short review period that improves security or reliability is often worth the tradeoff for enterprise customers," Saltsman said.

Ng said he expects the practical effect on most enterprise users to be limited. For common business applications such as document review, content generation and workplace productivity, companies are already working with highly capable models, he said. "More advanced use cases, particularly in cybersecurity and defense, might be more sensitive to delays in accessing the newest frontier capabilities."

Beyond model releases, the other potential concern is the cybersecurity clearinghouse. The order establishes a mechanism for identifying and addressing security vulnerabilities in AI systems, including those used by critical infrastructure operators, such as hospitals, banks and utilities.

According to Saltsman, businesses are increasingly evaluating AI through a security and resilience lens, not just a productivity lens. As companies move from experimentation to production deployments, they're assessing vendors on security, compliance, risk management and transparency as well as productivity considerations.

In that environment, whether a vendor participates in a voluntary review process could become one of several factors enterprises use to evaluate trust, governance practices and long-term reliability.

An early step toward broader AI governance?

The significance of this executive order might be less about its immediate requirements and more about what it signals for the future of AI oversight.

This executive order is less about regulation and more about creating a governance framework around the most advanced AI models.

"This executive order is less about regulation and more about creating a governance framework around the most advanced AI models," Horwitz said.

The Trump administration has favored a more hands-off approach to AI regulation. Previous executive orders from Trump have emphasized accelerating innovation, reducing regulatory barriers and strengthening U.S. AI competitiveness. This latest order continues that trajectory. Participation is voluntary, and companies aren't required to obtain government approval before releasing models.

Still, the order creates new ways for the government to gain visibility into advanced AI systems, including the model review process and the AI cybersecurity clearinghouse.

Falzone views the framework as an early step in a broader evolution of AI governance. "Governments typically begin with voluntary frameworks, establish norms and then decide whether more formal oversight is needed," she said.

There is precedent for that approach. Many cybersecurity and compliance frameworks began as voluntary initiatives before evolving into widely adopted benchmarks. For example, FedRAMP and SOC 2, weren't initially mandatory but have become important factors in technology procurement decision-making.

Whether AI follows a similar path remains to be seen. However, the order suggests policymakers want to understand the capabilities and risks of powerful AI systems before they reach the market.

"We're moving beyond discussions about AI capabilities and beginning to focus more seriously on AI accountability, governance, trust and security," Horwitz said.

For now, the effect on developers and enterprise buyers is likely to be limited. But the order offers an early indication of how policymakers might approach AI oversight in the future -- not by directly regulating model development, but by building frameworks that encourage transparency, cooperation and risk management.

Kinza Yasar is a technical writer for TechTarget's AI & Emerging Tech group and has a background in computer networking.