Trump’s New AI Frontier: The Executive Order Regulating Frontier AI Models

On June 2, 2026, President Trump signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security.” This is the administration's most significant step toward federal oversight of AI, framed almost entirely around cybersecurity. See Exec. Order, "Promoting Advanced Artificial Intelligence Innovation and Security" (June 2, 2026).

I. Key Takeaways

• The order is voluntary, not mandatory. It does not create a licensing regime or a preclearance requirement for AI development. See Exec. Order § 3(c) (“Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement for the development, publication, release, or distribution of new AI models, including frontier models.”)
• The order establishes three key institutional frameworks: (1) an AI cybersecurity clearinghouse led by Treasury, (2) a classified benchmarking process to designate "covered frontier models," and (3) a voluntary 30-day prerelease review window for frontier AI models. See Exec. Order §§ 2(d), 3(a)–(b).
• The order does not mention privacy, data protection, or data subject rights.
• For organizations outside the AI development space, the more immediate question is whether and how these changes will affect your data privacy posture, your vendors, and your regulatory exposure.

II. Key Definitions

The order creates a new label called the “covered frontier model” for the most powerful AI systems. See Exec. Order § 3(a). The EO does not itself define the term substantively; rather, it directs officials to develop a classified benchmarking process to “assess the advanced cyber capabilities of AI models and determine the threshold at which an AI model should be designated a 'covered frontier model.” It seems though that a covered frontier model is an AI system that is so capable it could pose serious cybersecurity risks, such as finding and exploiting weaknesses in software on its own. The NSA will run a classified process to decide which models qualify, in consultation with the National Cyber Director, the Assistant to the President for Science and Technology (APST), the Director of CISA, and other representatives of the Department of War, as appropriate. Exec. Order § 3(a). If a model gets that designation, its developer can voluntarily submit it for government review before releasing it.

III. What the Order Actually Does

The order moves fast, as nearly every directive has a 30- or 60-day deadline. It does four main things.

• Directs CISA to strengthen federal cyber defenses and share AI-powered security tools with state and local governments and critical infrastructure operators. See Exec. Order §§ 2(c)(i)–(iii);
• Tasks Treasury with creating an "AI cybersecurity clearinghouse" to coordinate finding and patching software vulnerabilities in partnership with AI companies and infrastructure operators. See Exec. Order § 2(d); 
• Establishes a voluntary 30-day window for AI developers to submit their most powerful models for government cybersecurity review before release. See Exec. Order § 3(b)(ii);
• Directs the Attorney General to prioritize criminal enforcement against anyone who uses AI to hack into systems or steal data. See Exec. Order § 4.

IV. Why This Matters for Data Privacy Even Though it Does not Say “Privacy”

The Executive Order does not mention algorithmic bias, AI's impact on jobs, transparency, or data subject rights. This order focuses only on national and cyber security. The Trump Administration appears to have changed direction on AI after Anthropic's Claude Mythos Preview model, announced in April, demonstrated that it could autonomously identify and exploit hidden vulnerabilities in widely used software. [Note: The causal link between the Mythos announcement and this EO is an inference based on timing; no official source has confirmed this connection.

These “covered frontier models” which are systems that can find security holes in software can also reach the personal data that software is supposed to protect. Every vulnerability is a potential doorway to personal information. When the order talks about “hardening systems” and “patching vulnerabilities,” it is really talking about protecting the personal data inside those systems, too. 

V. What Isn’t Changing. Well, at Least Not Yet. 

Right now, it does not create any new privacy rights, data protection rules, or consent requirements for AI. Questions about training data, opt-out rights, and disclosure obligations remain governed by the existing patchwork of state privacy laws, HIPAA, the GLBA, and FTC enforcement. The order is also entirely voluntary, meaning that open-source and open-weight models, which researchers have shown can replicate frontier-level hacking capabilities, are not captured, and may end up in your supply chain without any government review. And while the clearinghouse will help find vulnerabilities faster, the hard part has always been getting organizations to actually patch them — a challenge that is especially acute for data-rich organizations without well-resourced security teams. Finally, the order is silent on AI-specific privacy threats like prompt injection, model inversion, and data poisoning — attacks where a security flaw directly exposes personal data.

VI. What You Should Do Now

Even though this order is voluntary and does not directly regulate privacy, it signals where federal attention is heading. Organizations — especially those that handle significant volumes of personal data — should take the following steps now:

• Audit your AI vendor contracts. Determine whether any of your vendors develop or deploy models that could be designated “covered frontier models.” Update your vendor agreements to require notification if a model receives that designation and to specify whether the vendor will participate in the voluntary government review process.
• Pressure-test your patch management program. The new clearinghouse will accelerate vulnerability discovery, which means more patches, faster. If your organization already struggles with patching cadence, now is the time to close that gap — before the clearinghouse starts producing findings that affect your systems.
• Map your exposure to open-source and open-weight AI models. The Executive Order’s voluntary framework does not cover open-source or open-weight models, even when they replicate frontier-level capabilities. Review your software supply chain to identify where these models appear and assess the associated risk — particularly if they interact with systems that store or process personal data.
• Evaluate your defenses against AI-specific privacy attacks. The Executive Order is silent on prompt injection, model inversion, and data poisoning. Do not wait for federal guidance. If you use AI systems that process personal data, assess whether your current security controls address these threat vectors and whether your incident response plans account for them.
• Monitor the 30- and 60-day deadlines. The Executive Order’s implementation timeline is aggressive. Key deliverables — including the clearinghouse framework and the classified benchmarking criteria — are due within one to two months. These outputs will shape what “covered frontier model” actually means in practice and could affect procurement decisions, vendor relationships, and compliance planning.

To view Foley Hoag's Security, Privacy and The Law Blog please click here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.