“Domestic Autonomy, External Control”: US Moves to Govern Access to Frontier AI, but Can It Unify the Patchwork of State Regulations?

US government formalizing intervention in access to frontier AI models
Policy focused on controlling foreign access rather than restraining domestic development
Growing need for a unified federal standard to replace divergent state-level rules

The administration of US President Donald Trump is increasing its involvement in determining who may access the most advanced artificial intelligence models. Its emerging policy seeks to preserve the freedom of American companies to develop and release their own models while allowing the government to intervene when those technologies are transferred abroad or made available to foreign nationals in circumstances that could affect national security.

The establishment of a federal regulatory framework could also help consolidate the increasingly fragmented collection of state-level AI rules and reduce some of the administrative burden imposed on companies operating across multiple jurisdictions.

Trump Administration Expands Its Role in the AI Market

Citing multiple sources, CNBC reported on July 17 that the White House was considering a system under which the government could intervene in the release of frontier AI models and limit access to selected companies and institutions. Three days earlier, White House National Cyber Director Sean Cairncross announced during a media briefing that the Department of the Treasury, Department of Homeland Security, and Department of Defense had reached an agreement with AI companies to launch a new information-sharing center known as Gold Eagle earlier in July. The initiative is designed to function as a government-led coordination center through which cybersecurity vulnerabilities discovered by AI systems can be shared in real time, reducing duplicated analysis and testing while enabling authorities and companies to respond rapidly according to the severity of each threat.

Some market observers have interpreted the initiative as possible groundwork for greater federal involvement in the release of privately developed AI models. Until now, AI companies have generally selected for themselves which businesses and institutions would be permitted to access their most advanced systems. Anthropic, for example, operates Project Glasswing, under which it provides a cybersecurity-specialized model to a limited group of partners, while OpenAI offers its Daybreak cyber-defense platform only to entities it considers trustworthy. That industry convention has recently begun to change, however, as the US government increasingly treats advanced AI models themselves as strategic technologies with direct national-security implications. A prominent example of this shift was the recent dispute surrounding Anthropic’s Claude Fable 5 and Claude Mythos 5 models.

Anthropic released Fable 5 and Mythos 5 on June 9. Three days later, the US Department of Commerce ordered the company to suspend access to both models for all foreign nationals, whether located inside or outside the United States, citing national-security authority and export-control regulations. The intervention followed the discovery by Amazon researchers of a possible jailbreak vulnerability in Fable 5, referring to the use of carefully constructed prompts to bypass safety restrictions established by a model’s developer and force the system to provide answers to dangerous or prohibited questions. Anthropic disputed the government’s assessment, arguing that officials had exaggerated the severity of the problem, but the confrontation was gradually eased through negotiations between the two sides.

The restrictions were ultimately lifted after Anthropic agreed to strengthen its ability to identify and mitigate jailbreak risks in advance and to expand government evaluation and information sharing before releasing new models. In a June 30 letter to the company, US Commerce Secretary Howard Lutnick informed Anthropic that separate authorization would no longer be required for the export, re-export, or transfer of Fable 5 and Mythos 5 to foreign nationals. Anthropic subsequently resumed worldwide access to Fable 5 on July 1.

Private-Sector Autonomy Remains Protected

Despite the Anthropic dispute, the White House continues to maintain that it does not intend to introduce a prior-authorization system under which the government would directly decide whether an American AI company may release a new model. The administration’s stated approach is to preserve as much private-sector autonomy as possible in domestic development and deployment while intervening only when models with potential national-security implications are transferred overseas or provided to foreign nationals. This policy direction was previously outlined in an executive order on “Advancing Frontier AI Innovation and Security,” which Trump signed in June.

The executive order, which provided the institutional basis for Gold Eagle, establishes a cooperative framework under which federal agencies such as the National Security Agency and the Cybersecurity and Infrastructure Security Agency may, with the consent of private companies, review selected frontier AI models for cybersecurity risks and national-security implications for up to 30 days before their release. Companies retain the final authority to decide whether to launch their models, and the process applies only to a limited category of advanced systems meeting separate national-security criteria. The administration had initially considered a significantly more restrictive framework, with US intelligence agencies and some national-security officials reportedly arguing that the government should be required to evaluate frontier models and should possess direct influence over whether they could be released.

The Department of Commerce and representatives of the AI industry opposed such an approach, warning that excessive government intervention could become a strategic disadvantage in the technological rivalry with China. Their argument reflected the unusually rapid development cycle of the AI industry, in which models are replaced and released at a pace that would make lengthy government reviews particularly costly. After several months of internal debate, Trump stated in May that excessive regulation should not be allowed to undermine America’s technological advantage, and the final executive order was consequently structured to preserve corporate autonomy. “The current US approach is less a model of comprehensive government control over the domestic AI industry than a dual structure of ‘domestic autonomy and external control,’” one market expert said. “American companies are encouraged to participate in voluntary pre-release testing and public-private cooperation, but they retain the authority to decide whether to release their models, allowing the industry to maintain its speed of growth. When foreign nationals seek access or a model is transferred overseas, however, the government relies on national-security and export-control powers to prevent the leakage of strategic technology.”

US AI Regulation Remains Fragmented

The Trump administration’s recent actions can also be understood as part of a broader effort to consolidate the rapidly expanding and often inconsistent collection of AI regulations introduced by individual states. As comprehensive federal legislation has remained delayed in Congress, state governments have moved ahead with their own regulatory proposals. According to the National Conference of State Legislatures, AI-related bills were introduced in all 50 states, Washington, DC, and other US jurisdictions in 2025, with 38 states enacting or adopting approximately 100 related measures. Colorado is generally regarded as having established one of the most extensive frameworks. Its AI law classifies systems used to make decisions with substantial effects on individual rights and opportunities—including employment, lending, housing, education, healthcare, and insurance—as “high-risk systems.” Developers of such systems must disclose information concerning algorithmic discrimination risks and the methods used to manage them, while companies deploying the systems are required to establish risk-management frameworks, conduct impact assessments, and perform periodic reviews.

California, by contrast, has focused less on the consequences of specific AI applications and more on the development process followed by large companies building advanced models. The state’s Frontier AI Transparency Act, which took effect in 2026, requires large AI developers using computing resources above a designated threshold to disclose their safety-management systems and the results of risk assessments. Developers must also notify the state government when their models may be associated with catastrophic risks capable of causing multiple deaths or economic losses exceeding $1 billion, while retaliation against employees who report safety risks or regulatory violations is restricted. New York has adopted a similar approach. Its Responsible AI Safety and Education Act, signed in December 2025, requires developers of frontier models exceeding specified thresholds for computing capacity and development expenditure to assess whether their systems could be misused in the development of biological or chemical weapons, large-scale cyberattacks, or other severe threats, and to document procedures intended to prevent external intrusion and unauthorized use.

Texas has pursued a different model through its Responsible AI Governance Act, seeking to encourage innovation while restricting only clearly dangerous uses. The legislation prohibits the deliberate use of AI to encourage self-harm, criminal activity, or violence, while also establishing a regulatory sandbox in which companies may test new AI services in controlled environments, together with an advisory body responsible for examining emerging policy issues. As these regulatory frameworks diverge, however, AI companies face substantial administrative costs arising from the need to analyze state-specific laws, modify systems for different jurisdictions, conduct multiple impact assessments, and satisfy separate reporting obligations.

In response to this growing fragmentation, Trump issued an executive order in December 2025 instructing the Department of Justice to identify state AI laws that conflict with federal policy or place excessive restrictions on interstate commerce and to consider possible legal challenges. In policy recommendations subsequently submitted to Congress, the White House argued that federal legislation should pre-empt state laws imposing disproportionate burdens on companies and establish a minimally restrictive national standard in place of 50 separate regulatory regimes. The administration’s emerging framework therefore serves two related purposes: protecting strategically important AI technologies from foreign access while preserving domestic innovation, and replacing a complex state-by-state regulatory environment with a more consistent federal structure.