A new executive order from President Trump directs frontier AI labs like OpenAI and Anthropic to submit their most advanced models to the government for security assessments—covering cybersecurity, confidentiality, insider risk, and IP protections. But the fine print makes clear that participation is entirely voluntary.
The order mandates the creation of a vetting process requiring submission 30 days before release, then immediately adds a caveat: “Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement.” In other words, companies can simply opt out.
Frontier models—such as Anthropic’s Mythos, which was withheld due to cybersecurity risks—are the primary target. The rapid release cycle, driven by competition with Chinese firms, has sparked concerns about insufficient testing before deployment. Yet the order offers no enforcement mechanism for the government to block a release if a serious flaw is found.
Agencies like the Pentagon and Treasury are instructed to bolster their own cyber defenses within 30 days. Over the next 60 days, DHS and NSA must develop an evaluation framework—again, with no requirement that companies actually use it.
The Future of Life Institute’s Anthony Aguirre called the approach insufficient: “Voluntary frameworks are not enough. We need mandatory pre-deployment review with the power to block unacceptable national security risks.” Cornell’s John Thickstun echoed the sentiment, noting the order “creates some appearance of oversight while largely continuing the administration’s hands-off approach to AI governance.”
Notably, the original draft reportedly required a 90-day review window, but AI companies—including Anthropic—lobbied for the shorter 30-day period that made it into the final text. A related NIST announcement about model sharing has also been pulled from the agency’s site, raising questions about the administration’s commitment to transparency.
For data and ML engineers, the takeaway is clear: the regulatory environment remains advisory, not prescriptive. Until mandatory requirements materialize, engineering teams should treat these guidelines as a baseline for internal risk management—not a compliance ceiling.
Source: CNET