Free to Build
Washington’s emerging AI governance framework draws a sharp line between building models and deploying them.
In the first two weeks of June, a White House executive order, a bipartisan congressional draft, and a state-level legislative rewrite each addressed AI governance independently. Each arrived at the same structural answer: regulate how AI is used, and leave how AI is built to the builders.
Shielded development
Representatives Jay Obernolte and Lori Trahan released a 269-page bipartisan discussion draft last week titled the Great American Artificial Intelligence Act of 2026. The bill draws a line through the center of the AI governance debate. For three years, states would lose the power to enact or enforce laws that specifically regulate the development of AI models, while retaining full authority over how AI systems are deployed within their borders. The binding requirements apply to “large frontier developers” with more than $500 million in annual revenue, and the bill would codify the Center for AI Standards and Innovation with $100 million in annual funding to oversee evaluations of frontier models.
Public Citizen condemned the draft as stripping states of authority to protect consumers, workers, and children. The reaction identifies the development side as the terrain where meaningful safety obligations would operate, because the deployment side — where states keep their authority — governs how AI systems are applied in hiring, lending, and healthcare, while the development side governs how models are trained, evaluated, and released. Employment law firms have focused on the bill’s workforce provisions, which include layoff notification requirements and whistleblower protections for employees who raise AI concerns, but those provisions regulate employer conduct in deploying AI rather than lab conduct in building it.
Oversight sans authority
Two days before the GAAIA draft appeared, Trump signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security” that asks frontier labs to voluntarily provide the government with early access to models for up to 30 days before wider release. The order represents a reversal from the administration’s prior hands-off stance, reportedly prompted in part by Anthropic’s Mythos model and its demonstrated ability to identify and exploit cybersecurity vulnerabilities. The mechanism is voluntary, and the order places no binding constraints on development practices; the government gets a review window, but the labs retain full control over what they build and when they ship.
An earlier draft of the order reportedly included 90-day pre-release review windows and was shelved in May after lobbying from Musk and Zuckerberg. The gap between the two versions traces the same line that runs through the GAAIA. The administration proved willing to assert oversight over releases, which sit closer to the deployment side of the ledger, but proved unwilling to impose constraints on the development process itself. Three days later, a separate national security presidential memorandum established procurement and use frameworks for defense and intelligence applications of AI, reinforcing the pattern: the federal government is building governance infrastructure around how AI is used, not around how it is made.
Colorado backs down
Colorado enacted the nation’s first comprehensive state AI law in 2024, imposing risk management programs, impact assessments, and algorithmic discrimination protections on both developers and deployers of high-risk AI systems. Governor Polis signed SB 189 on May 14, repealing that law and replacing it with a narrower framework focused on deployment-side obligations: disclosure requirements, a right to human review of consequential decisions, and enforcement exclusively through the attorney general. The replacement takes effect on January 1, 2027.