Five Questions the US Government Should Answer About Its Secretive Frontier AI Framework

Michelle De Mooy is an AI governance and policy consultant and researcher. She is a member of the Board of Advisors for the Ethical Tech Project.

In June, President Donald Trump issued Executive Order 14409, “Promoting Artificial Intelligence Innovation and Security.” Among its directions was a provision instructing a National Security Agency-led group within the government to develop a framework under which AI developers give the government access to their models for up to thirty days before release. There is no requirement for public disclosure of what the group does to assess models, and in fact the White House now says it will keep the framework a secret.

The framework was due to be complete this week. It appears that in the last eight weeks, the process for its development has operated informally, without published criteria, defined timelines, or any legal basis beyond the government applying pressure and labs likely calculating that resisting costs more than complying. This period also included a nineteen-day shutdown of Anthropic's frontier models via an export control order, a two-week gated rollout of OpenAI's GPT-5.6, and a limited set of approved access organizations whose selection criteria remain unpublished.

This opacity has already been critiqued and analyzed, in these pages and elsewhere. Rather than revisit it, I want to propose a set of standards against which whatever emerges should be judged. Without public disclosure, there is a serious risk that a process built on White House discretion will harden into the permanent structure of frontier AI governance without input from developers, researchers, civil society, or the public.

Start by conceding the premise

Pre-release security review of frontier models is reasonable in principle. Models with advanced cyber capabilities are dual-use technologies, and governments have reviewed dual-use technologies before release for decades.

The question at the heart of this EO is whether the review will operate as a governance process or as a reservation of discretion, and the distinction is largely procedural. A governance process has published thresholds, bounded timelines, legible outcomes, and accountability, while discretion rests on relationships—and too often, on politics.

Historically, the US government has tried to balance the tension between secrecy and transparency for dual-use technologies. For decades, export-control rules have published unclassified thresholds, such as bit lengths for encryption or performance parameters for computing hardware, so that companies could determine their obligations while the government's assessment methods stayed classified.

The government can likewise be transparent with regard to aspects of the process for frontier AI review and benchmarking without exposing highly sensitive national security details. It can, for example, publicly provide the bit-length equivalent for AI, listing the operational thresholds (e.g. automated cyber-capabilities) that trigger a review. Hardware export control rules are also relevant here. Currently, the government applies clear, public metrics (e.g. processor speed) as screening tools. For frontier AI review, officials could maintain classified red-teaming benchmarks while keeping a public, evolving computing or capability screen to let developers know if they are being reviewed.

The Great American Artificial Intelligence Act of 2026 (GAAIA) attempts to address the accountability vacuum left by Executive Order 14409 through transparency mandates, independent audits, and security testing for frontier systems. Other bills, like the AI Incident Reporting Act, would require the Commerce Department to notify congressional leadership and relevant committees after receiving a report on a serious incident.

The five questions

Even without a published process, we can assess the framework against a simple test. Can a developer, an enterprise customer, or a member of Congress answer the following:

First: what makes a model covered? The benchmarking process will be classified, and some technical detail should be. But the categories of capability that trigger designation, the evidentiary standard applied, and the process by which the NSA Director makes the determination should all be stated in unclassified form. A developer should be able to predict, before a training run completes, whether its model will be subject to review.

Here the design choice matters as much as the secrecy. The previous federal threshold, and the one in the GAAIA and in California's SB 1047, was a training compute figure (10²⁶ floating-point operations) with the EU AI Act using 10²⁵. Compute is attractive because it is measurable, knowable before training, and tied to expensive hardware. But it is a screen, not a definition of risk, as compute can be structured under a threshold, eroded by algorithmic efficiency, and bypassed entirely by low-compute post-training steps (like fine-tuning, reinforcement learning, and chain-of-thought) that change what a model can do without crossing the line.

Whether the trigger is a published number or a classified capability assessment, it should function as an administrative screen, paired with dangerous-capability evaluations, detection of material post-training changes, analysis of release mode (including open weights), deployment reach, incident reporting, and an authority to update the criteria as the technology moves. Anything less is a line drawn for the comfort of the regulator, not for the safety of the public.

Second: how long can review last, and what happens when time runs out? The executive order specifies "up to thirty days," but the GPT-5.6 situation showed that the clock's start, the grounds for extension, and the consequences of expiration are all undefined. A legitimate framework would set a maximum period and, critically, a default to release at expiration. If the government believes continued restriction is warranted, it should have to invoke a defined legal authority and state its basis. Review should conclude in one of a closed set of determinations: proceed, proceed with conditions, limited deployment, bounded delay pending additional evidence, or restriction under an identified legal authority, with each outcome requiring a written rationale tied to published standards.

Third: who decides who gets access, and by what criteria? The approved-organization list is the least examined and potentially the most consequential feature of the process. Right now, roughly 100 organizations have access but there are no published eligibility criteria. This is in essence an industrial policy without accountability, and it will mean that researchers, smaller firms, and civil society organizations will never have the standing to negotiate.

Fourth: what can a developer do if it believes a determination is wrong? A developer cannot meaningfully challenge a determination it does not understand. Notice should therefore include both the decision and a written explanation of the evidence, reasoning, and applicable review standard, subject only to narrowly tailored national security redactions, a specified path out of restriction, and appeal to another government authority. These are the minimum procedural rights extended to regulated parties in every other domain, including pharmaceuticals, aviation, and export controls themselves.

Fifth: what will the public be told, and when? Days after the order was signed, the administration reportedly directed the Center for AI Standards and Innovation to stop issuing public reports of its model assessments. It’s highly unlikely the public will get very much information from the interagency group directly.

However, because participation in Executive Order 14409’s framework is voluntary for companies, the government does not have the statutory authority to force companies to hand over their models (a federal executive order can’t create new mandatory regulations, penalties, or licensing regimes unless it is enforcing powers already granted through a passed law). Short of invoking the Defense Production Act to force companies to comply, the government can create an incentive structure that allows companies to say that their models successfully completed the 30-day security review.

The public should be able to access, at a minimum, annual unclassified statistics on models reviewed, durations, and outcomes; unclassified summary reporting to Congress; and prompt public notice when review results in restriction, with a stated basis. Classification should protect specific technical findings, not the existence, duration, or outcome of the process itself.

A transparency obligation that carries no consequence is a suggestion. The framework should specify what happens when the reviewing authority fails to report: a duty to notify an inspector general or Congress (the established route under the Inspector General Act); a public log of any waivers or extensions granted in lieu of reporting, consistent with existing OMB practice on AI-use waivers; and, if reporting lapses persist, a sunset or reauthorization trigger that returns the question to the legislature. A regime that reports nothing cannot be evaluated, corrected, or trusted.

A structural blind spot

Every organization building on frontier models, like universities, health systems, and banks, now holds an uncertain dependency. The temporary shutdown of Anthropic's models this summer was felt by every downstream customer that discovered, without warning, that a critical vendor could be switched off by a government decision without published criteria or a defined path for reinstatement.

There is also a structural point that individual-model review, however well-designed, will eventually have to address. The capabilities that matter increasingly emerge from systems of interacting models: agents coordinating across services, sharing context and memory, invoking tools, composing outputs, and, most importantly, shaping the data and environments in which the next generation of models will be trained. Risk at this layer is not captured by a FLOP count or a single model's cyber benchmark, but is embedded in which models call which others, what tools and data they can reach, what permissions propagate, how failures cascade, and how an agent's actions in the world feed back into training pipelines.

None of today’s policies and laws sufficiently review for this layer, attaching obligations to the individual model. A serious framework would have to extend designation beyond the base model to the agentic system: an assessment at the orchestration level, scrutiny of tool and data access boundaries, evaluation of composition and cascade risk, and accountability for whoever assembles and deploys the system, not only whoever trained the underlying weights. The frontier AI review process doesn’t have to solve this, but it should acknowledge it otherwise it will be regulating yesterday's frontier.

The window

The executive order's own text, which disclaims any "mandatory governmental licensing, preclearance, or permitting requirement," supplies the standard it should be held to. If the public is able to see a framework with published thresholds, bounded timelines, disclosed access criteria, due process, public reporting, and at least a stated commitment to system-level review, it will give the review both certainty and legitimacy.

If it does not, the questions raised by a recent Congressional Research Service report come into play, including whether frontier model review should be required by statute rather than left to voluntary arrangements.

Legitimate regulation is not defined by how much authority the government possesses. It is defined by how transparently that authority is exercised. If a process emerges (or is leaked) now or later that cannot answer these five questions, it will not have established a governance framework. It will simply have documented unfettered discretion in the hands of the executive branch.