The White House Office of the National Cyber Director briefed leading AI developers on Tuesday on a planned executive order that would establish a voluntary framework for pre-release government review of frontier models, with US President Donald Trump potentially signing the order as early as May 21, according to The Information.
The move signals that the US is edging toward formal pre-deployment oversight of advanced AI — yet the framework remains voluntary and stops well short of the mandatory filing, security assessment, and risk-tier regimes already in force in China and the EU. For US-headquartered labs, the order would introduce a structured government touchpoint before launch without exposing them to the licensing requirements or fines that govern competitors operating in Beijing and Brussels.
The Information reported that on May 20, the Office of the National Cyber Director hosted a briefing for OpenAI, Anthropic, Reflection AI, and representatives of cloud providers, semiconductor companies, cybersecurity firms, and banks. Under the proposed framework, AI labs would voluntarily share frontier models with the government up to 90 days before public release, though labs reportedly aim to share them around 14 days before release.
The National Security Agency, ONCD, Office of Science and Technology Policy, Cybersecurity and Infrastructure Security Agency, and Department of Defense would define what constitutes a "frontier model" and design a classified evaluation process, according to The Information. The order's release would end weeks of speculation that the administration was preparing a mandatory licensing regime similar to FDA approval — an idea floated by National Economic Council director Kevin Hassett and walked back by chief of staff Susie Wiles. The push toward government review accelerated after Anthropic in early April withheld its Mythos model from public release, citing its ability to identify cybersecurity vulnerabilities, and instead shared it with select tech, financial, and intelligence partners.
A light touch on oversight
If signed, the executive order would establish a voluntary, security-focused review mechanism for the most advanced models. Existing Commerce Department agreements already provide voluntary testing arrangements with Anthropic, OpenAI, Microsoft, xAI, and Google. The new framework would add classified evaluation by national security agencies, but labs would retain control over launch timing and would not need government approval to release a model. At a Tuesday briefing, US Vice President JD Vance said the administration is working with tech companies to "balance safety and innovation," while declining to "get ahead of the executive order."
China's iron grip on AI deployment
China operates the most comprehensive pre-deployment regime of the three jurisdictions. The Interim Measures for the Management of Generative AI Services, effective August 15, 2023, require any service offering text, image, audio, or video generation to the Chinese public to register algorithms and conduct security assessments, particularly for services with "public-opinion attributes or social-mobilization capabilities." Providers must verify users' real identities, label synthetic content under the Deep Synthesis Management Provisions, effective January 10, 2023, use legally sourced training data, and prevent content that endangers national security, undermines socialist core values, or generates discriminatory or false information.
The 2022 Cybersecurity Review Measures also require network platform operators that hold more than one million users' personal information to undergo a cybersecurity review before listing abroad. For Chinese AI companies seeking either A-share or overseas listings, completed model filings and security assessments have effectively become preconditions, with the China Securities Regulatory Commission scrutinizing the legality of training data, content-safety mechanisms, and technology ownership.
Europe's risk-tiered rulebook
The EU's AI Act, which entered into force in 2024 and is being phased in through 2025–2026, takes a rights-based, risk-tiered approach. Four categories apply: prohibited uses such as social scoring and subliminal manipulation; high-risk uses in domains including medical, education, hiring, and critical infrastructure, which require compliance and conformity assessment; general-purpose AI models such as GPT and Claude, which require registration and transparency reporting; and systemic-risk models, which must undergo mandatory pre-deployment safety evaluation and report to the EU AI Office. High-risk and GPAI providers must obtain CE certification and disclose technical documentation covering training data sources, copyright, bias, and safety mechanisms. Penalties for non-compliance reach 3–7% of global revenue. The General-Purpose AI Code of Practice, released in July 2025, complements the Act.
Washington narrows the gap — but not all the way
Compared with China's content-and-ideology-driven mandatory filings and the EU's rights-based statutory regime, the US approach, as described by The Information, is narrower in scope — covering national security and cybersecurity — softer in legal force, voluntary rather than mandatory, and less prescriptive on training data, content moderation, or transparency.
It does, however, introduce a structured government touchpoint before public release, a feature absent from prior US policy and one that aligns Washington's procedural posture more closely with Beijing and Brussels, even as it preserves the lighter-touch philosophy the Trump administration has publicly emphasized. The unresolved question raised by The Information's reporting is the 90-day-versus-14-day disclosure window, which will determine how much of a slowdown the framework imposes on US model releases compared with competitors'.
Article edited by Jerry Chen
