In This Article
Key Takeaways
- The June 2, 2026 executive order sets up a voluntary pre-release review of frontier models and a cybersecurity clearinghouse — and states expressly that it does not create any mandatory licensing or preclearance requirement.
- OMB M-25-21 is the binding operational document for agencies: align policies by May 6, 2026, and publicly inventory AI use cases annually starting in 2026.
- The Great American AI Act is a bipartisan discussion draft, not law — but it signals where a federal statute might land, including third-party audits for large developers and limited state preemption.
- Everything below is attributed to the order, memorandum, or draft itself. Treat this as a status check, not legal advice.
For government AI teams, the first half of 2026 brought three developments worth separating carefully: an executive order, an operational memorandum with a real deadline, and a legislative draft. They are easy to blur together and they carry very different weight. This is a neutral, sourced rundown of each — what it says, what it requires, and what it does not. Where a document's own text settles a question, we quote it.
The shape of the shift
The through-line across all three is an emphasis on innovation with security rather than broad mandatory regulation. The administration's approach favors voluntary industry engagement and cyber defense over licensing regimes; the operational memorandum tells agencies to adopt AI faster while inventorying and governing it; and the legislative draft, which is bipartisan, would go further into binding obligations but has not been enacted. Knowing which is which matters, because only one of the three currently binds anyone — and it is the least-covered one.
The June 2 executive order
On June 2, 2026, President Trump signed an executive order titled "Promoting Advanced Artificial Intelligence Innovation and Security." Two features define it.
A voluntary pre-release review. The order directs agencies to establish a voluntary process through which developers of "covered frontier" models can engage with the federal government — for example, giving agencies access to a model for up to 30 days before a wider release to collaborate on cybersecurity testing and secure deployment. Participation is optional.
No mandatory licensing. The order states expressly that nothing in it authorizes a mandatory governmental licensing, permitting, or preclearance requirement for AI model development, publication, release, or distribution. That sentence is the one to hold onto, because the order's short name ("...Innovation and Security") led to some early reporting that overstated its reach. It is, by its own text, a voluntary framework.
The order also directs agencies to strengthen federal cyber defenses within 30 days and tasks the Treasury Department, the National Security Agency, and CISA with standing up an AI cybersecurity clearinghouse — a voluntary channel to coordinate vulnerability discovery, testing, and disclosure with industry and critical-infrastructure operators. NPR's coverage summarized the core as a "voluntary review of new models," which matches the text.
Voluntary vs. binding — why the distinction matters
An executive order directs the executive branch; a voluntary program it creates does not, by itself, impose obligations on private developers. That is different from a statute (which Congress must pass) and different from an OMB memorandum (which binds federal agencies). When you read "the new AI order requires...", check whether the requirement falls on agencies or on companies, and whether it is voluntary. In this order, the company-facing parts are voluntary and the agency-facing parts (cyber defense, the clearinghouse) are directives to government.
OMB M-25-21 and the compliance clock
The document that actually governs day-to-day federal AI work is not the new order but the Office of Management and Budget memorandum M-25-21, "Accelerating Federal Use of AI through Innovation, Governance, and Public Trust," issued April 3, 2025 to implement Executive Order 14179. It organizes agency AI work around three priorities — innovation, governance, and public trust — and, unlike the June order, it carries concrete deadlines.
Two are worth putting on a calendar. Agencies were directed to align their policies, cybersecurity, and privacy practices with M-25-21 by May 6, 2026, and to annually inventory and publicly report all AI use cases and associated risk determinations, beginning in 2026. Multiple agencies — among them the Federal Reserve, the U.S. AbilityOne Commission, and the Office of Special Counsel — have already published compliance plans, which are a useful model for any team still drafting one. A companion OMB memorandum addresses AI acquisition and procurement, so contractors selling AI to the government are inside this framework too.
If your team supports a federal customer, M-25-21 is the document to read first. Our AI for government employees guide walks through what responsible adoption looks like in practice, and the free federal AI compliance checker and federal AI readiness tools help you map your own posture against the memo's expectations before an inventory deadline arrives.
The Great American AI Act draft
The legislative piece is the Great American Artificial Intelligence Act of 2026 (GAAIA), a bipartisan discussion draft released June 4, 2026 by Representatives Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.). A discussion draft is not an introduced bill — it is a document circulated for feedback (the sponsors invited comments to a House email address) and has not been voted on. Its provisions could change or go nowhere. But it signals where a federal AI statute might land, so it's worth knowing.
As drafted, the bill is organized into four titles — Frontier AI Governance, Workforce, Cybersecurity, and Research, Development, and International Cooperation — and would create binding federal obligations for "large frontier developers," defined as companies with $500 million or more in annual revenue that have trained a frontier model. Those obligations would include disclosing information about such models, obtaining third-party audits through designated Independent Verification Organizations, and refraining from retaliation against whistleblowers. The draft would authorize $100 million per fiscal year for a Center for AI Standards and Innovation.
One provision drawing particular attention is preemption: the draft would bar states from issuing their own laws regulating the development of frontier models, while still allowing state laws of "general applicability" and state regulation of models after deployment. That is a live policy debate, and we present it here as what the draft proposes — not as settled law. For the broader standards-versus-regulation backdrop, see our companion piece on AI standards versus the model race.
What to do now
For agencies and the contractors that serve them, the practical priorities are unglamorous and well-defined:
- Treat M-25-21 as the operative document, not the headlines. It is the one with deadlines that already passed (May 6, 2026 alignment) and recurring obligations (annual public AI-use inventories).
- Stand up or refresh your AI use-case inventory and risk determinations, and look at peer agencies' published compliance plans for structure.
- Read the June order for what it is: a voluntary engagement and cyber-coordination framework, plus agency cyber-defense directives — not a licensing regime and not a mandate on private developers.
- Track the GAAIA draft, but don't build to it yet. It is not law. Monitor whether it is formally introduced and how the preemption and audit provisions evolve.
- Separate voluntary from binding in every briefing. The single most common error in mid-2026 federal-AI conversations is treating a voluntary program or a discussion draft as an active requirement.
None of this is legal advice, and the picture will keep moving — a draft can be introduced, an order amended, a deadline extended. The durable habit is to read the primary document, note who it actually binds, and check the date. Do that and mid-2026's three developments sort themselves into one clear obligation, one voluntary framework, and one thing to watch.
Sources: The White House, "Promoting Advanced Artificial Intelligence Innovation and Security" (June 2, 2026); NPR coverage of the order; OMB Memorandum M-25-21 (April 3, 2025) and agency compliance plans; Rep. Obernolte's release of the GAAIA discussion draft and analyses by FedScoop, DLA Piper, and TechPolicy.Press. Descriptions reflect each document's own text; consult counsel for compliance decisions.
Common questions
Does the June 2026 executive order require AI companies to get a license? No. The order states expressly that nothing in it authorizes a mandatory licensing, permitting, or preclearance requirement for AI model development, publication, release, or distribution. The pre-release review it establishes is voluntary.
What does OMB M-25-21 require of federal agencies? It directs agencies to accelerate responsible AI adoption under three priorities — innovation, governance, and public trust — to align policies with it by May 6, 2026, and to annually inventory and publicly report AI use cases and risk determinations starting in 2026.
Is the Great American AI Act law? No. As of mid-2026 it is a bipartisan discussion draft released June 4, 2026, not an introduced or enacted bill. It proposes binding obligations for large frontier developers, but it has not been voted on and its provisions may change.