“30 days of pre-public access” — that is the single, sharp numerical change at the center of a White House directive signed Tuesday that recalibrates federal oversight of advanced artificial intelligence toward a narrower, cybersecurity-first posture.
30 days of pre-public access, down from 90
The executive order asks companies developing cutting-edge AI systems to provide the federal government 30 days of pre-public access to those models, a substantial reduction from a prior outline that sought 90 days. The earlier, longer window was part of a draft scuttled two weeks ago after industry complaints about overregulation. The administration framed the revised timeline as an attempt to balance innovation with concern over AI-enabled cyber threats.
No licensing or preclearance for AI products
The order also contains a clear prohibition: federal agencies are forbidden from imposing licensing or preclearance requirements on AI products. That restriction marks an explicit limit on the regulatory tools agencies may use as the White House moves to create a federal framework for managing advanced systems.
30-day cybersecurity directives for Defense Department, federal civilian networks, and critical infrastructure
The directive directs agencies to secure Defense Department and other national-security networks within 30 days. It further includes a binding operational directive requiring agencies to secure federal civilian networks and to “facilitate access to frontier AI models across critical infrastructure sectors,” a set that the order explicitly lists: hospitals, banks, utilities and state and local governments. The binding operational directive, like the Defense Department requirement, must be issued within 30 days.
Classified benchmarking and the NSA’s evaluation role
The order calls for a government framework to oversee advanced AI systems that starts with a classified benchmarking process to determine which models qualify as “covered frontier models.” The White House Office of Science and Technology Policy, the National Institute of Standards and Technology, CISA and other agencies have 60 days to establish that classified evaluation process. The National Security Agency, in consultation with the listed agencies, is then tasked with formally determining which AI systems meet the threshold. The NSA’s involvement was previously reported in May by Nextgov/FCW.
Treasury clearinghouse, OMB grant hunt, and U.S. Tech Force hiring
The order directs the Treasury Department — supported by the Office of the National Cyber Director, the National Security Agency, the Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency — to establish a voluntary coordination clearinghouse for the government, AI companies, and critical infrastructure operators. Separately, the Office of Management and Budget is ordered to identify federal grant funding that could support AI vulnerability-detection efforts within 30 days.
The Office of Personnel Management is tasked with increasing cyber hiring via the U.S. Tech Force within 60 days. The order notes that the Tech Force, launched in December to recruit cyber talent, had onboarded just 10 employees “as of late Mau.”
What this means for the Defense Department, hospitals, banks, and AI companies
- Defense Department: The department must have its national-security networks secured within 30 days, a deadline that puts immediate operational pressure on defense cyber teams to implement the new directives.
- Hospitals, banks, utilities and state and local governments: Those critical infrastructure operators are explicitly named as recipients of facilitated access to “frontier AI models,” and they are part of the voluntary clearinghouse the Treasury is asked to stand up — signalling an expectation that these sectors will be early adopters of government-assisted model access tied to security reviews.
- AI companies: Developers face a shorter, 30-day pre-public access window and an emerging, classified benchmarking regime run through OSTP, NIST and the NSA. The order also forbids agency-imposed licensing or preclearance, leaving companies with a mix of voluntary coordination and classified evaluation to navigate.
The directive frames its moves explicitly as an effort to “foster innovation while addressing fears of AI-enabled cyber attacks.” Recent model releases cited in the order — Anthropic’s Mythos and OpenAI’s GPT-5.5-Cyber — are named as drivers of the shift in Washington, described as having demonstrated sophisticated cyber capabilities that have “heightened concerns” about how quickly these systems can uncover vulnerabilities or reshape defensive and offensive operations.
The administration has set a dense tempo: 30-day requirements for network hardening and grant identification, 60 days for classified benchmarking and Tech Force expansion. Whether the shorter pre-public window, the ban on licensing, and the combination of voluntary and classified measures will satisfy both companies worried about overregulation and officials worried about rapidly advancing cyber-capable models is the central unresolved tension embedded in the order.
