Does Trump's June 2026 AI executive order apply to private companies?

Directly, no. The order's mandatory provisions apply to federal agencies. Private companies face voluntary asks. Agencies must design a framework through which developers could give the government access to covered frontier models for up to 30 days before release to other trusted partners. Industry collaboration with the clearinghouse is also voluntary.

What is the AI cybersecurity clearinghouse created by the June 2026 EO?

A Treasury-led clearinghouse, formed within 30 days of the order with NSA and CISA, in voluntary collaboration with the AI industry and critical infrastructure operators. It coordinates scanning for software vulnerabilities, validates them, and prioritizes patching and remediation. The order doesn't make participation mandatory for anyone outside the named agencies.

How does Trump's June 2026 AI order differ from Biden's October 2023 AI executive order?

Biden's order emphasized safety testing, civil rights guardrails, and mandatory reporting by developers of powerful models. Trump's order focuses on cybersecurity and national security, and offers a voluntary early-access framework instead. It says nothing in that section authorizes a mandatory licensing, preclearance, or permitting requirement for AI models.

Trump's June 2026 AI Executive Order: What Teams Must Do

TL;DR: Trump signed an AI executive order on June 2, 2026. Most mandatory requirements fall on federal agencies, not private companies. The order sets up a voluntary early-access framework for covered frontier models (up to 30 days before release to other trusted partners) and an AI cybersecurity clearinghouse. Federal contractors and frontier AI developers have the most to act on. For most compliance teams, the immediate task is reviewing your AI acceptable-use policy and confirming whether any of your contracts have AI-related federal nexus.

On June 2, 2026, President Trump signed an executive order titled "Promoting Advanced Artificial Intelligence Innovation and Security." It was published in the Federal Register on June 5, 2026 as Executive Order 14409.

This piece covers what the order actually says, what is mandatory versus voluntary, who is affected, and what compliance teams should do in response.

What the order says

Three provisions make up the operational core of the June 2026 AI executive order.

Provision 1: Voluntary early-access framework for covered frontier models

Within 60 days, Treasury, the Department of War (through NSA) and DHS (through CISA), consulting the Commerce Department through NIST and others, must design a voluntary framework with AI developers. Under it, developers could check whether a model counts as a "covered frontier model" and give the government access to it for up to 30 days before releasing it to other trusted partners. The order says nothing in this section authorizes a mandatory licensing, preclearance, or permitting requirement.

Developers would also work with the government to select "trusted partners" that get early access to covered frontier models to strengthen critical infrastructure cybersecurity. The framing is collaborative rather than regulatory: companies participate to stay ahead of security risks, not to satisfy a compliance gate.

Provision 2: AI cybersecurity clearinghouse

Within 30 days of the order, the Secretary of the Treasury, in consultation with the National Cyber Director, NSA and CISA, must form an AI cybersecurity clearinghouse "in voluntary collaboration with the AI industry and operators of critical infrastructure." It coordinates and deconflicts scanning for software vulnerabilities, validates what it finds, and prioritizes remediation and patch distribution.

The order doesn't describe a participation mandate for other federal agencies or for private companies.

Provision 3: AI cybersecurity benchmarks

The same agencies must develop and maintain a classified benchmarking process to assess the advanced cyber capabilities of AI models and set the threshold for a "covered frontier model." The Director of NSA makes that designation, and assessments may be shared with AI developers and researchers as appropriate.

What is mandatory versus voluntary

The single most important thing to understand about this order is the mandatory/voluntary split.

Requirement	Applies to	Mandatory or voluntary
Up-to-30-day early government access to covered frontier models	Frontier AI developers	Voluntary
AI cybersecurity clearinghouse formation	Treasury, with NSA and CISA	Mandatory (within 30 days)
AI cybersecurity clearinghouse collaboration	AI industry and critical infrastructure operators	Voluntary
AI cybersecurity benchmarks	Federal agencies	Mandatory
Trusted partner designation	AI companies that opt in	Voluntary
CFAA enforcement against AI-enabled attacks	All - this is existing law	Statutory (not new)

Most of the order's mandatory provisions apply to the federal government itself, not to private companies. This is a deliberate choice that distinguishes it from the Biden 2023 order, which imposed mandatory reporting and testing requirements on AI developers above certain compute thresholds.

For a typical compliance team at a mid-size company, the order creates no new mandatory obligations - unless that company develops frontier AI models or holds federal contracts that involve AI.

Who is actually affected

Federal agencies: Facing the most immediate obligations. The 30-day clocks on the clearinghouse and CISA's Binding Operational Directives for civilian federal systems started June 2.

Frontier AI developers (OpenAI, Anthropic, Google, xAI, Meta AI): Facing voluntary asks with real incentives. Companies that participate in the trusted partner program gain early intelligence on how the government views their models' security risk profile - useful both commercially and for positioning in future procurement. Companies that decline to participate risk being outside the conversation when the government does start buying.

Federal contractors working on AI projects: Indirect but real exposure. Agency contracting officers will incorporate the new benchmarks and clearinghouse requirements into AI-related contract requirements. If your company provides AI tools, services, or AI-assisted work products to a federal agency, expect updated contract language around cybersecurity benchmarks within the next 6-12 months.

All other private companies: No direct obligations. The order does not impose reporting requirements, registration, or compliance gates on companies that are not federal contractors and do not develop frontier AI.

The US Capitol facade against a bright blue sky, representing compliance team action items

How this compares to Biden's 2023 AI executive order

Biden's October 2023 order required developers of frontier AI above certain compute thresholds to report safety test results to the government before public release, share red-team results with the government, and adhere to civil rights guidance across specific use cases including employment and housing.

The June 2026 order offers a voluntary early-access framework instead of mandatory reporting. It sets its threshold through a classified cyber benchmarking process rather than a published compute trigger. It does not include civil rights guardrails or sector-specific provisions on employment or housing AI. The safety-first framing is gone; the innovation-first framing is explicit.

What both orders share: a belief that the federal government should have early visibility into the most capable AI systems, and that national security is the primary lens for federal AI oversight.

The net change for compliance teams: fewer federal requirements to track, but the remaining ones - especially around cybersecurity - are more operationally specific than the broad principles in the 2023 order.

The CFAA provision: what it does and does not mean

The order references the Computer Fraud and Abuse Act (CFAA) and directs enforcement against AI-enabled cyberattacks. This is worth noting carefully: the CFAA is existing federal law, not a new requirement created by the order. The EO directs the Department of Justice to prioritize AI-assisted attack prosecutions under the CFAA, but it does not change what the CFAA prohibits or who it covers.

For most compliance teams, this means: if your organization was already managing CFAA-relevant risk (protecting computer systems from unauthorized access), the order changes enforcement priority, not legal exposure. Companies that build or deploy AI tools used in offensive security testing should review their authorized-use guardrails.

What compliance teams should do

If you are a frontier AI developer: The voluntary early-access framework is a real decision. Participating builds a relationship with government security teams and positions you as a trusted partner. Not participating is also a choice - the order does not penalize non-participation - but it keeps you outside the intelligence-sharing loop. Your legal and policy team should assess the tradeoffs now, before the framework and clearinghouse terms harden.

If you hold federal contracts involving AI: Request updated AI security requirements from your contracting officer or anticipate them in your next contract renewal. Start documenting your AI tool inventory, the cybersecurity benchmarks you apply internally, and any existing threat-sharing practices. Contracts awarded after the clearinghouse is operational (by July 2, 2026) are more likely to include new AI security language.

If you are a compliance team at a non-government company: The immediate action is narrow: confirm you do not develop frontier AI and do not have federal contracts with AI components. If both are true, your direct exposure to this order is zero today. The second-order effect to watch: if the clearinghouse surfaces new AI vulnerability categories, that intelligence may eventually flow into NIST guidance and voluntary frameworks that indirectly shape industry standards.

For all companies: review your AI acceptable-use policy for language around AI-assisted cyberattacks. Most policies do not explicitly prohibit using AI tools to probe systems without authorization. Given the DOJ's new enforcement priority, making that prohibition explicit is low-cost and directly relevant.

Six-item compliance checklist

Determine frontier AI status: Could your models meet the "covered frontier model" threshold? The government sets it through a classified cyber benchmarking process, and the framework lets developers ask whether a model in development qualifies.
Audit federal contract exposure: List all active and pending federal contracts. Flag any with AI components or AI-adjacent scopes of work.
Update AI acceptable-use policy: Add explicit prohibition on using company AI tools for unauthorized system access or AI-assisted cyberattacks.
Review CFAA authorization documentation: If you run internal red-team or penetration testing using AI tools, confirm all authorization is documented in writing.
Monitor clearinghouse terms: Treasury had to form the clearinghouse by July 2, 2026. Assign someone to track its terms and evaluate voluntary collaboration.
Brief leadership on mandatory vs. voluntary split: The most common misread of this order will be treating the voluntary early-access framework as a compliance requirement. Make sure your leadership team understands what is actually required of your company.

Reading executive orders in context: what to watch next

Executive orders direct federal agencies to take action, but the actual compliance impact on private organizations depends on what those agencies publish next. For this order, the Treasury-led clearinghouse and the voluntary frontier model framework are the two mechanisms most likely to have downstream effects on private sector compliance. Track the following:

Treasury clearinghouse terms. When Treasury publishes the terms for voluntary collaboration, read them carefully. Voluntary frameworks often have indirect compliance effects, for example, some federal contracts may require participation, or industry associations may treat participation as a de facto standard. Evaluate before deciding whether to participate.

The voluntary frontier model framework. Due within 60 days of the order, it defines how developers engage the government and pick trusted partners. The order doesn't direct NIST to update the AI Risk Management Framework.

CISA Binding Operational Directives. The order has CISA issue directives and guidance within 30 days to prioritize cyber defense of civilian federal systems and expand AI-enabled defensive tools. If you have federal contracts with civilian agencies, their implementing guidance will have more specific compliance implications than the executive order itself.

Correction (October 13, 2026): An earlier version described a "30-day pre-release model review," said an earlier draft allowed 90 days, said federal agencies must join the clearinghouse, and said the order directs NIST to update its AI framework. The order sets up a voluntary early-access framework of up to 30 days, makes industry collaboration voluntary, and contains no NIST framework directive.

For the broader federal AI policy picture and how this order fits alongside other legislative activity, see FTC AI enforcement actions 2026 and One Big Beautiful Bill AI preemption provisions.