The Many Open Questions About the Trump Administration’s New De Facto AI Model Licensing System
In June, the Trump administration issued Executive Order 14409 on Promoting Advanced Artificial Intelligence Innovation and Security (June AI EO). This was the culmination of a frenzy of activity kicked off by Anthropic’s April announcement of the advanced cybersecurity capabilities of its latest artificial intelligence (AI) model, Mythos, which it made available only to selected partners in cooperation with the U.S. government.
The June AI EO ordered the creation by August of a “voluntary framework” (AI framework) for “Secure Frontier Model Deployment” to include a threshold for “covered frontier models” (covered models), for the government to be provided access to those models up to 30 days before public release, and to collaborate with the government to select the “trusted partners” allowed to have early pre-release access to covered models for cybersecurity defense. It also stated that nothing “shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement.”
A few weeks after the June AI EO was issued and before the finalization of the AI framework, the administration took two unprecedented actions: It forced Anthropic to withdraw its two most advanced frontier models from the public and then requested that OpenAI limit the release of its GPT-5.6 model, a request OpenAI ultimately agreed to. The ordered follow-up AI framework was completed in August, but its text was withheld from the public and reportedly even from the companies subject to it, for reasons that were never made clear.
The Trump administration’s AI framework secretly defines the covered models, obtains them before release for a purpose that is not defined in the June AI EO, and restricts their first recipients. The Trump administration has also shown its willingness to stretch existing authorities to control or reverse distribution of frontier AI models until its concerns are satisfied. While no formal procedures have publicly been released, the Trump administration’s actions and secrecy have nonetheless resulted in a licensing regime by pairing so-called voluntary standards with clear threats of unprecedented enforcement action, creating an expectation of preclearance. Most fundamentally, by keeping the voluntary AI framework secret, the public does not know what “voluntary” means. It could mean an AI developer can agree to the AI framework voluntarily but then is required to explicitly implement the government’s requests. It could mean an AI developer has the ability to agree to or refuse any requests from the government to change the developer’s covered frontier models. Or it could mean an AI developer can choose to opt a specific model into the framework if the developer feels the model meets the covered model definition (or it could withhold the model from the framework, if the model does not meet the definition).
In other words, President Trump and his administration have assumed sole discretion over the release of U.S. frontier AI models, without any specific existing statutory authority or authorization from Congress. This matters because frontier AI models could soon be the world’s most powerful national security and economic tools, if they are not already, and their release or restriction can now make or break companies and soon possibly even countries. Keeping the AI framework secret is possibly the worst scenario for AI safety and transparency.
It has been almost two months since the reported finalization of the Trump administration’s AI framework, and despite requests and demands from Democrats in Congress (which have been ignored), calls from civil society, Freedom of Information Act (FOIA) requests, and two lawsuits, the public still has no knowledge of the AI framework’s text, legal authority, terms of participation, or participants. On Sept. 14, Protect Democracy and the U.S. government filed a Joint Status Report according to which the U.S. government agreed to release the “text of the voluntary frontier AI disclosure and pre-release review framework” by Oct. 30.
This matters because right now AI models are being developed that are more advanced than the Mythos/Fable and GPT-5.6 models the government restricted over the summer. At the same time, researchers are quitting AI companies over safety concerns, and new rogue AI agent incidents are being uncovered regularly.
In September, OpenAI launched its latest model, GPT-6 Astra, and the company president made the momentous claim that he considers it to be artificial general intelligence (AGI), one of the critical goals in the AI race. There was no official comment from the White House about the safety or security of the new OpenAI model under its AI framework, only passing comments from OpenAI’s CEO and president that the model was examined under the framework. An AI framework should provide some reassurance to a public increasingly concerned about AI. A secret AI framework is incapable of doing so.
In the face of a secret AI framework, it is difficult to even understand what concerns to express. With reporting from Wired that the Trump administration might expand the AI framework and/or the covered models apparently impacted by it, it is more important than ever to get answers to the numerous fundamental open questions about the secret voluntary AI framework.
What AI Models Are Covered by the EO and AI Framework?
The June AI EO took aim at covered frontier models, but what products count as covered models—and are therefore beholden to frameworks set out in the EO—is not self-defining. Instead, the EO required the government, led by the National Security Agency (NSA), to measure the advanced cyber capabilities of AI models and decide when such models reach a classified threshold that would fall under the EO’s purview.
The EO does not require that this benchmark be shared with the companies whose frontier models qualify, though it allows for “sharing such assessments with AI developers and researchers as appropriate.” The June AI EO requires that developers be able to “engage the Federal Government to determine whether model(s) under development meet the designation of ‘covered frontier model.’” The EO does not mention the release of an unclassified benchmark to the public, and to date no classified or unclassified definitions or evaluation results have been released publicly.
This opacity forces the public to rely on news reports that indicate that the AI framework would apply only to U.S. closed-weight frontier AI models whose developers theoretically agree to the voluntary framework. In September, Axios quoted an anonymous source who stated that “[t]he definition is basically the government saying to industry ‘you know when you’re making a new a new [sic] frontier model, you know what I mean’—that’s basically how it works.”
This covered model definition and/or AI framework also reportedly applies only to closed-weight, or proprietary black box, AI models. It would therefore currently exclude open-weight or open-source AI models, or models that publish their numerical values (open-weight) or the weights plus source code and training data (open-source). The reasons for this exclusion are entirely unclear, as open-source or open-weight models are capable of all the same threats as closed models and will likely soon meet or exceed the capacities of today’s closed-weight frontier models. If this reporting is accurate, it means that U.S. closed-weight frontier AI models face far more stringent requirements in this country than do Chinese AI models.
How Does an AI Developer Join the AI Framework?
The June AI EO orders the government to “design a voluntary framework with AI developers,” but nothing has been released publicly on how developers are supposed to join or voluntarily commit to that AI framework. The EO also does not mention, nor does any subsequent information that has been released, whether an AI developer can determine if its model under development qualifies as a covered model without agreeing to the AI framework. There is no public list of companies that have agreed to that AI framework or frontier AI models that have been subjected to it.
Somewhat confusingly, most frontier AI developers—including OpenAI, Anthropic, Google DeepMind, Microsoft, and xAI—already have preexisting agreements with Anthropic and OpenAI for predeployment testing with the federal government through the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) at the National Institute of Standards and Technology (NIST) (though new agreements with Google DeepMind, Microsoft, and xAI were announced and then scrubbed from the CAISSI website in May). It is unclear from this EO if the administration is leveraging those existing CAISSI agreements, has modified or superseded the CAISSI agreements, or is demanding new agreements for the voluntary framework.
The likely answer is that the government is relying on an interlocking and incredibly confusing mix of obligations: a continuation testing under the existing CAISSI agreements, additional involvement of the NSA ordered by the June AI EO, voluntary adherence to the AI framework without any sort of additional formal agreement, and all of the companies’ nonvoluntary obligations imposed by existing or updated federal procurement or contracting requirements.
Unfortunately, the public may not get the answer even with the government’s release of the AI framework by Oct. 30, as their agreement covers only records of companies that are participating in the GOLD EAGLE cybersecurity clearinghouse and the list of “trusted partners” but not any other voluntary agreements from CAISSI or additional new agreements under the AI framework.
Will New Companies Be Forced to Sign a CAISSI Agreement? Some Other AI Framework? Both? Neither?
While the June AI EO states that nothing in the AI framework is mandatory, in June the New York Times reported that the administration is pressuring Meta to join the CAISSI evaluations program, which may be separate from the AI EO’s AI framework. Meta issued a statement saying it is in negotiation with the government. There have been no further public announcements of new CAISSI agreements from other frontier AI developers or near-frontier AI developers like Thinking Machines or Nvidia. It is possible they are separately agreeing to theagreeing to the AI framework and their participation is being kept secret.
As Meta continues to invest in catching up with the other frontier AI labs and maintains a more robust open-source strategy, a lack of a voluntary agreement with the U.S. government could challenge the Trump administration's de facto licensing system if Meta releases an open or closed model that would qualify as a covered frontier model.
Do Developers Subject to the AI Framework Have Access to It?
In September, Axios reported that “the White House then presented the framework in an early-August meeting but did not allow attendees to scan or take pictures of the document” and that “the select industry players looped into the process also are essentially relying on memory.” This reporting implies not only that the voluntary agreement is being withheld from the public, but even those who agree to it or are subject to it are not allowed to keep a copy for reference. If so, that would be a stunning fact and the opposite of a system based on the rule of law.
The government has agreed only to release “the text of the voluntary frontier AI disclosure and pre-release review framework that …was completed by August 1, 2026.” That means that any changes to the framework, such as expanding it to include open-source or open-weight models, could once again be kept secret and force another FOIA and litigation cycle.
What Happens to a Pre-release Frontier Model Submission to the Government?
On June 30, before the AI framework had been finalized, White House Chief of Staff Susan Wiles posted that implementation of the June EO “includes excellent work around advanced model access and guardrail testing and security.” In September, OpenAI’s CEO and president both confirmed that their new model release, GPT-6 Astra, had been tested under the White House framework. It is unclear if that testing took place under the AI framework or existing CAISSI testing agreements.
Under the EO, covered AI developers must give access to the federal government for a period of up to 30 days before the model’s release to trusted partners. But it is unclear what the government plans to do with the models during those 30 days. The most substantive reporting describes that during that month the covered frontier models would be stored securely, developer’s employees would have limited access to them, and the review process will include various administration officials rather than a single office or agency. Those are remarkably sparse details and have generated concern that the government would have access to the unreleased models, which could allow them unrestricted use for national security or other purposes.
Who Gets to Name the “Trusted Partners”?
The June AI EO requires the AI framework to select trusted partners “to promote secure innovation and strengthen the cybersecurity of critical infrastructure.” In theory, this is to ensure that critical partners in the public and private sectors have access to these advanced models in order to find and patch cyber vulnerabilities before these models, or models of their equivalent capability, are widely available, what OpenAI calls “the defender’s window.”
Though the June AI EO describes that picking trusted partners will be a collaborative process between developers and the government, the power balance in such an arrangement seems uneven as the models are reliant on government approval for release. Indeed, there is evidence that the government influences or controls that list of trusted partners quite closely. For example, reports indicate that Treasury Secretary Scott Bessent arranged access to Anthropic’s Mythos model for Japanese banks after a visit to Tokyo. Similarly, the U.S. government ordered a South Korean telecom company to have its access to Mythos revoked after accusations it was allowing Chinese users to access the model.
The imbalance in this process has been commented on by the AI companies themselves. In response to the restricted GPT-5.6 rollout, OpenAI CEO Sam Altman tweeted, “i just dont [sic] like the idea of the government picking the customers.” In September, the Information reported that access to the trusted partner program was a hot commodity but that “no one outside of the Trump administration has a clear idea how to get on that list.” The government controlling access to this nonpublic trusted partners list is an avenue for potential corruption.
Unfortunately, even after the names of the trusted partners are made public, it does not mean the process for choosing them will be clear. After all, the Trump administration has a long documented history of rewarding its friends and punishing its enemies in public, and this new framework offers an avenue to do so by granting unrestricted access to the most state-of-the-art AI models.
Does the AI Framework Restrict Sharing Models With Foreign Governments?
In early September, the Financial Times reported that Anthropic’s latest model was withheld from pre-release testing by the U.K. AI Safety Institute (AISI). In late September, Politico confirmed that the U.S. government had requested that frontier models not be shared with AISI until after the U.S. government’s testing was complete. Given the 30-day pre-release window to share solely with the U.S. government, U.S. companies will have a harder time justifying additional delays for public release while another country tests their model, meaning that more frontier models will be released without AISI review. This is a tremendous loss for the public, as AISI is perhaps the most sophisticated government AI safety organization. While Anthropic has reportedly not provided its latest models to AISI, there is no confirmation from OpenAI either way. On Sept. 28, AISI’s report on GPT-6 Astra’s unsanctioned supply-chain attacks notes that it tested the model before its public release, but it is unclear if AISI tested the later GPT-6.1 Sol.
Given the Trump administration’s decision to keep allied governments from accessing the Mythos model before its public release, and those governments that did have access losing it when the government applied export controls to Anthropic, the question should be asked whether this is a requirement in the AI framework. More broadly, what benefit does the U.S. government gain from restricting companies from sharing covered frontier models with the U.S.’s closest ally before public release?
When a Model Is Reviewed Under the AI Framework, Will the Government Say Anything?
In June, the Wall Street Journal reported the White House had asked CAISSI to stop issuing public reports of its evaluations of AI models and they have not resumed for U.S. AI models. This is despite releases of numerous new frontier AI models that would seemingly meet the covered model definition and from developers who had previously signed voluntary testing agreements with CAISSI.
For example, the Aug. 12 release of Grok 4.6 by xAI raises questions about how the AI framework works in execution. xAI claims that the model has parity with Fable on certain benchmarks, which could indicate it would meet the threshold established by Mythos and Fable originally. xAI has an existing agreement with CAISSI to do pre-release evaluation. But neither the Grok 4.6 announcement nor the model card mention any testing by the U.S. government, and the Trump administration has issued no statements about this model. Maybe Grok 4.6 does not meet the threshold for a covered frontier model, but the public may never know given the classified threshold ordered by the AI EO. (They may also wonder if Elon Musk’s closeness with the Trump administration had any impact.)
Meanwhile, when OpenAI released its latest frontier model, GPT-6 Astra, in early September, company president Greg Brockman told reporters that the model was tested by the government and that “there was nothing that they came back saying ‘you need to change this.’” There was no mention of the government’s AI framework in its release materials or any comment from the White House. By contrast, Google announced its new frontier model, Gemini 4 Argon, on Sept. 30 with a note saying, “We are actively engaged in the U.S. government’s voluntary process for pre-release model access while we gradually expand access.”
Will Compliance With the AI Framework Save an AI Model From the Fate of Mythos?
After its initial Mythos announcement, Anthropic spent many months coordinating with the U.S. government and on June 9 released its new models to the public “in consultation with the US government.” On June 12, the Commerce Department imposed export controls on those Mythos and Fable models, forcing the company to withdraw them from use for reasons that have been disputed by both sides.
Frontier AI companies appeared to understand the message from the Trump administration. On June 26, 14 days after the Commerce Department imposed export controls on Anthropic, OpenAI previewed GPT-5.6 and noted, “At [the government’s] request, we are starting with a limited preview for a small group of trusted partners whose participation has been shared with the government.”
On July 8, Axios reported that “[t]he Trump administration has given OpenAI the green light for a broad launch of its advanced GPT-5.6 model,” though the Trump administration disputed this. Anthropic negotiated with the U.S. government until June 26, when the government restored limited access to the company’s models. On June 30, the export controls were fully lifted, and the models were restored on July 1.
Conclusion
There are many many open questions about the AI framework ordered by the June AI EO, which the White House has decided to keep from the public. At a time of critical AI development, there is no reason for the Trump administration to wait until Oct. 30 to release its AI framework.
The secrecy of the AI framework matters because the public cannot understand the world AI models are currently operating in, nor can Congress exercise effective oversight or craft legislation to permanently respond to AI risks, without this information.
But it is worth stepping back and asking, What is the intent of the administration’s actions? The June AI EO was entitled “Promoting Advanced Artificial Intelligence Innovation and Security.” A secret de facto licensing regime is possibly the worst way to promote AI innovation and security. The secrecy is counterproductive because it undermines any ability to assure the public of the safety or security of new AI models at a time of growing concern, particularly as the government appears to have the opportunity to misuse unreleased models for its own purpose. Keeping this framework secret does nothing to reassure the public, other AI developers, Congress, U.S. allies, or even the nation’s enemies.
Even when the Trump administration releases the AI framework, it would still be operating as a de facto licensing system. But at least it will be a de facto licensing system that the public can analyze and understand.
