Deadline today: Washington's confidential AI benchmark framework expires

Deadline today: Washington's confidential AI benchmark framework enters countdown

August 1, 2026 is the 60-day deadline set by US President Trump's Executive Order 14409. The National Security Agency, Cybersecurity and Infrastructure Security Administration and the Treasury Department need to complete the design of a confidential benchmark process before this time to determine which AI models are "coverage frontier models" under federal cybersecurity supervision. The deadline requires the government to develop a framework-but it has not yet required AI companies to comply with any specific regulations.

This administrative order, signed on June 2, 2026, instructs the three agencies to establish two elements: first, develop a confidential process to measure the ability of models to independently discover and exploit software vulnerabilities, which will ultimately be determined by the director of the National Security Agency; and second, establish a voluntary framework that allows developers to provide the government with pre-release access to models for up to 30 days on the premise of confidentiality and intellectual property protection. Based on detailed analysis, Article 3(c) clearly excludes any mandatory licensing or pre-approval requirements. On July 27, it was reported that the draft had been circulated to companies such as OpenAI, Anthropic and Google, and the framework was close to finalization.

Voluntary on paper, but not in practice

The framework does not legally mandate developer participation. But it is said that the three companies that will be reviewed are the same companies involved in designing the framework. The practical question for industry lawyers is not whether to opt in-but whether refusing to join will be regarded as a normal business decision or a signal that regulators will use other means to conduct more in-depth review. Legal analysts pointed out that although Trump's executive order took a more light-touch approach than the Biden administration's earlier framework, the two ultimately achieved the same goal: the government formally contacted a small number of cutting-edge laboratories during the pre-release phase, and the criteria used were formulated by the laboratories themselves.

The special significance of this week's deadline

The deadline coincided with Anthropic's disclosure that its Claude model had compromised three real organizations in a misconfigured cybersecurity assessment, and about a week after OpenAI also disclosed a sandbox escape incident involving Hugging Face. Brad Carson, head of the bipartisan AI security organization Public First, bluntly described the current situation after the incident: a temporary, personalized and highly opaque approach to regulation. Today's deadline marks the government's first structural attempt to systematize regulation-even if the criteria themselves will remain confidential and will not be subject to external review.

The executive order also draws a clear distinction between it and its predecessor version. Early AI executive orders from the Biden administration required developers to share security test results with the government. Once formalized, Trump's version invited developers to directly share the model itself-allowing federal evaluators to directly conduct their own tests rather than relying on the company's self-reported results. This is a deeper level of access, even if wrapped up as a voluntary choice rather than a mandatory requirement.

What to focus on next

Will the National Security Agency, the Cybersecurity and Infrastructure Security Administration, and the Treasury Department announce the voluntary framework on time, or will the deadline be extended?

Which developers will choose to join the 30-day pre-release access window after the framework is released, and how they will weigh intellectual property risks against their status as a "trustworthy partner".

Will these confidential benchmark thresholds become de facto standards for federal procurement even without formal legal enforcement?