Promoting Advanced Artificial Intelligence Innovation and Security

The order directs a cluster of agencies to act within 30 days: the Committee on National Security Systems must prioritize cyber defense of national security systems; the Secretary of War must do the same for Department of War information systems; DHS, through CISA, must release Binding Operational Directives to speed cyber defense of civilian federal systems, expand AI-enabled defensive tools, and facilitate access to cybersecurity services for agencies, state and local governments, and critical-infrastructure operators. Also within 30 days, Treasury, NSA, and CISA must form a voluntary AI cybersecurity clearinghouse with industry to coordinate vulnerability scanning and patching, and OMB must assess whether federal grants can fund AI vulnerability detection. Within 60 days, OPM must expand cybersecurity hiring pathways, and Treasury, NSA, and CISA must build a classified AI model benchmarking process and design a voluntary pre-release access framework with AI developers.

Section 3 explicitly states that nothing in the order authorizes mandatory licensing, preclearance, or permitting for AI model development or release. The Attorney General is directed to prioritize enforcement of existing federal computer-crime statutes against anyone using AI to illegally access or damage computer systems, with no deadline attached.

Federal civilian agencies, national security system operators, state and local governments, and critical-infrastructure operators — including rural hospitals, community banks, and local utilities — who may gain access to new federal cybersecurity tools. AI developers building advanced frontier models are asked to participate voluntarily in the pre-release access framework and vulnerability clearinghouse.

Federal agencies face firm 30- and 60-day deadlines to deploy new AI-assisted cybersecurity defenses. Advanced AI developers may be asked to hand the government a 30-day pre-release window on their most capable models under a voluntary arrangement. Critical-infrastructure operators such as community hospitals and local utilities could gain new access to federally facilitated cybersecurity services.

The order runs on two tracks. A 30-day track covers immediate cyber hardening: CISA issues binding directives to civilian agencies, the War Department secures its own systems, and Treasury leads formation of an industry-collaborative vulnerability clearinghouse. A 60-day track covers the more complex frontier model work: NSA, CISA, and Treasury jointly build a classified benchmarking process to define "covered frontier models" and design a voluntary pre-release framework. The frontier model framework is opt-in for industry, and no mandatory licensing mechanism is created. The Attorney General's enforcement directive carries no deadline.