Voluntary AI regulation: Trump’s order builds a frontier-model review it cannot require

The 2-June-signed, privately-issued Trump AI order asks frontier labs to show the government their models before release, then writes into the same page that the government may never turn that request into licensing, preclearance, permitting, or mandatory review. That is the document in miniature. Inward, it binds the federal machine: CISA directives, Treasury coordination, deadlines, cyber-defence plumbing. Outward, where the frontier labs sit, it becomes an invitation. The state hardens its own systems, then approaches the systems most likely to matter next and asks politely to look.

What the order actually requires

The split is structural, and it is the whole story. The federal-systems half is binding: within 30 days, the order directs CISA to issue Binding Operational Directives hardening civilian government networks, and the Treasury to stand up an AI cybersecurity clearinghouse, with the Committee on National Security Systems and the Secretary of War instructed to prioritise their own defences Verified (White House, 2 Jun 2026). Binding Operational Directives are mandatory on agencies. That half has force.

The half that governs the labs does not. Section 3 directs agencies to design a voluntary framework under which a developer may give the government access to a “covered frontier model” for up to 30 days before releasing it to trusted partners — not before public release Verified (CFR, 2 Jun 2026; NBC, 2 Jun 2026). What counts as “covered” is decided by the NSA Director through a classified benchmarking process whose criteria stay secret Verified. The one developer-facing clause with teeth points elsewhere: Section 4 tells the Attorney General to prioritise prosecuting people who use AI to break into computer systems under existing statutes Verified — misuse by criminals, not conduct by labs.

This is the narrowed order, not the one first drafted. The version Trump shelved on 21 May carried a 90-day window and mandatory pre-release evaluation; the AI and crypto adviser David Sacks pushed it down to 30 days and made the mechanism voluntary Probable (Axios, 20 May 2026; The Next Web, 2 Jun 2026). The trigger sitting behind all of it was Anthropic’s Claude Mythos and its capacity to find software vulnerabilities on its own Probable — the same company the Defense Department had already labelled a supply-chain risk, a designation Anthropic is suing to reverse Verified (CNBC, 2 Jun 2026; see BC-001).

Where the review stops being a control

That is not oversight. It is a staged approximation of oversight, built around a control the government defines but the lab chooses whether to enter. The sharpest tell is the classified threshold. A “covered frontier model” is whatever the NSA Director’s secret benchmarking process says it is, but the consequence of crossing that line is not compulsory review. It is the option to participate. So the government keeps the definition, the lab keeps the decision, and the public gets neither the benchmark nor the guarantee that the model was seen.

The Council on Foreign Relations reaches the same floor from the other direction: its analysts expect the leading labs to participate anyway, “if only to forestall more invasive regulation later” Unverified (CFR, 2 Jun 2026). Read plainly, that is the regulated party setting the terms of its own inspection — cooperation offered to pre-empt the binding version, on the lab’s schedule, for the labs that choose it.

A voluntary review can be useful. It can produce warnings, relationships, technical familiarity, maybe even restraint. But it is not a gate. It does not decide whether a model may be released. It does not reach open-weight systems that have no reason to volunteer. It does not survive the sentence that says, in plain legal English, this section authorises no mandatory licensing, preclearance, or permitting regime. The loop is broken on the page.

The open-weight gap is not hypothetical. The CFR analysis notes that Mythos-style vulnerability reasoning has already been reproduced with open-weight models — systems with no release process for the government to ask about, and no incentive to answer Unverified (CFR, 2 Jun 2026). A regime that binds the cooperative and misses the rest is not a perimeter.

Voluntary AI regulation, by the order’s own words

The break is not inferred from later conduct. It is written into Section 3:

The same clause is being read as its opposite. Gary Marcus, who told the Senate in 2023 that his first recommendation for AI law was FDA-style pre-flight review, called the order a dream realised Unverified (Marcus on AI, 2 Jun 2026). A pre-flight check is a gate an aircraft cannot skip. Section 3(c) is the clause that guarantees the aircraft never has to taxi past it. The distance between those two readings is the distance this case documents.

This is policy versus enforcement — the pattern F04 exists to name. Most instances surface in hindsight, when a commitment turns out to have no mechanism behind it. This one arrives with the mechanism and the foreclosure in the same section, signed the same morning.