What Was About to Happen — and Why It Didn’t
On the morning of May 21, 2026, White House staff had prepared a signing ceremony for a major AI executive order. The framework had been months in the making, with major AI firms including OpenAI and Anthropic negotiating directly with the administration over its provisions.
The order’s centrepiece was a voluntary pre-release review mechanism: AI developers would submit advanced frontier models to federal agencies for up to 90 days of security evaluation before public deployment. The order also included provisions to secure Pentagon systems, protect federal civilian infrastructure from AI-enabled attacks, and give the Treasury Department an expanded role in identifying AI-related security vulnerabilities — a responsibility historically handled by CISA and NIST.
Then, at the last moment, the plan collapsed. David Sacks, Trump’s designated AI and crypto adviser, called Trump directly on the morning of May 21 and derailed the signing “unbeknownst to anybody,” according to a White House official cited by Politico. Elon Musk and Mark Zuckerberg had also spoken with Trump in the days before the planned event, making the case that any government review mechanism — even a voluntary one — would slow American AI development against China.
Trump’s own words confirmed the outcome: “I didn’t like certain aspects of it. I postponed it.” When pressed, he added that the order “gets in the way” of US AI leadership.
Three Signals Hidden in the Structure of the Pullback
The manner in which the EO was killed reveals more about US AI policy direction than any official statement would have.
Signal 1: The deregulation instinct now governs even voluntary frameworks
The scrapped order’s pre-release review mechanism was explicitly described as voluntary. AI companies were not required to submit models — they could opt in for the security review. Yet even this non-binding structure was enough to trigger industry opposition and a White House reversal. The signal for enterprise AI buyers is direct: the current US administration will not impose any obligation on AI developers, even procedural ones. Firms that assumed a US federal AI safety standard was coming in 2026 should remove that assumption from their planning.
This matters beyond US borders. Multinational enterprises designing global AI governance frameworks often anchor one policy tier on the US federal standard. With that anchor missing, companies face the choice of defaulting to the EU AI Act, building proprietary internal standards, or deferring governance investment — each carrying distinct risk profiles.
Signal 2: Industry self-regulation won a battle, but the war continues at state level
Musk, Zuckerberg, and Sacks prevailed at the federal level. But Colorado Governor Jared Polis signed SB 26-189 into law on May 14, 2026 — one week before the EO implosion — requiring employers using AI for consequential employment decisions to provide written notice and human review pathways effective January 1, 2027. Connecticut’s SB5, passed May 1, 2026, imposes anti-discrimination testing obligations on AI hiring tools from October 2026. The federal vacuum does not eliminate AI compliance complexity; it redistributes it across a patchwork of state laws that vary by jurisdiction and decision category.
Enterprise compliance teams now face a more complex environment than a single federal standard would have created. A uniform federal rule — even a light one — would have simplified the landscape. Its absence forces companies operating in multiple US states to maintain jurisdiction-specific compliance matrices.
Signal 3: Treasury’s AI security role signals a new policy axis
The scrapped order assigned the Treasury Department a leading role in AI security vulnerability identification — a function traditionally held by CISA (for civilian agencies) and NIST (for standards). Axios reporting notes this unusual attribution was one of the provisions that drew criticism from technical experts who questioned why a financial agency would own AI cybersecurity. The fact that this provision survived internal review before the EO was killed suggests that the White House’s AI security architecture is still being negotiated across competing agencies. Enterprises building AI systems for federal procurement need to monitor which agency emerges with primary oversight authority — CISA, NIST, NSC, or Treasury — as that determination will define certification and audit requirements.
Advertisement
What Enterprise CTOs Should Do About the Regulatory Vacuum
1. Freeze any US federal compliance timeline assumptions from your 2026 AI roadmap
If your AI governance framework included a milestone like “align with federal AI safety standard by Q3 2026,” that milestone no longer exists. Delete it from the roadmap. Replace it with two alternative tracks: (a) EU AI Act compliance, which does have enforceable deadlines for high-risk systems starting in August 2026, and (b) state-level AI law mapping for any US operations touching employment, lending, housing, healthcare, or education decisions. Both tracks require active investment now — the EU Act track is particularly urgent for any system classified as high-risk under Annex III of the regulation.
Do not substitute voluntary frameworks (NIST AI RMF, ISO/IEC 42001) as placeholders for binding regulation. They are useful for internal governance structure, but they do not satisfy regulatory obligations in jurisdictions that have enacted law.
2. Map your AI vendor exposure to the state-law patchwork, not the federal vacuum
The absence of a federal AI law does not mean regulatory risk is absent — it means the risk is fragmented. Colorado SB 26-189 (effective January 1, 2027) applies to any AI-assisted employment decision affecting a Colorado resident, regardless of where your company is headquartered. Connecticut SB5 (October 2027 deployer obligations) applies similarly across employment decisions touching Connecticut residents. Texas, Illinois, and California each have pending or enacted AI-related disclosure or bias-testing requirements.
Build a jurisdiction matrix that maps each AI system in your stack to the decision category it influences (employment, credit, healthcare, education), the states where affected individuals reside, and the compliance deadline for each applicable law. This matrix does not exist by default in any vendor contract — it requires internal legal and technical collaboration.
3. Use the vacuum window to build internal AI governance infrastructure before external mandates force it
Regulatory windows are tactical assets. The current absence of a US federal AI framework means your competitors are also operating without external pressure to build governance infrastructure. Companies that build audit trails, explainability documentation, and human-oversight mechanisms now will have a compliance head-start when federal regulation eventually arrives — and it will arrive, either through a revised executive order, a future Congress, or international treaty pressure. The White House’s Office of the National Cyber Director is reportedly developing additional AI security initiatives beyond the cancelled EO. This is not the end of US AI regulation — it is a delay.
The specific infrastructure investments worth prioritising now: model cards for every AI system in production (who trained it, on what data, with what exclusions), decision logs for any AI output that influences an action affecting individuals, and vendor audit rights clauses in AI procurement contracts requiring access to system-level information on demand.
The Bigger Picture: A Fragmented Global AI Regulatory Map
The EO pullback is one data point in a larger pattern. The US has retreated from multilateral AI governance (opposing the UN Global Dialogue on AI Governance at the September 2025 Security Council debate). The EU AI Act is now the only comprehensive binding framework with global reach. The UN Global Digital Compact, adopted September 2024, created an Independent International Scientific Panel on AI and a Global Dialogue process — but both are advisory, not binding. China’s AI governance framework applies within its jurisdiction but does not set global norms.
The result is a world where the most consequential AI regulation is either the EU AI Act (for companies with EU nexus), or a mosaic of US state laws (for companies operating in the US), or nothing at all (for companies in jurisdictions without national AI frameworks). For global enterprises, the practical answer is to use EU AI Act compliance as the governance floor globally — it is the strictest enforceable standard and alignment with it will typically satisfy lower-bar requirements elsewhere.
The Trump EO’s postponement does not simplify this landscape. It confirms that enterprise AI compliance in 2026 requires a geographic stack of policies rather than a single global anchor.
Frequently Asked Questions
What was Trump’s AI executive order supposed to do before it was pulled?
The order would have established a voluntary pre-release review process: AI developers could submit advanced models to federal agencies for up to 90 days of security evaluation before public deployment. It also included provisions to secure federal civilian and Pentagon systems, and controversially assigned the Treasury Department a leading role in AI security vulnerability identification — a function critics argued belonged with CISA and NIST.
How does the US regulatory vacuum affect companies building AI outside the United States?
The absence of a US federal AI law means multinationals cannot use a uniform US standard as a global governance floor. In practice, this pushes the EU AI Act into the default position for any company with EU customers or investors. State-level laws (Colorado, Connecticut, Texas, Illinois) still apply for AI systems touching US residents in covered decision categories. Companies with no US or EU nexus face a genuine governance void — the UN Global Digital Compact’s AI provisions are advisory, not binding.
Is a US federal AI executive order still coming in 2026?
The timeline is uncertain. The White House’s Office of the National Cyber Director is developing additional AI security initiatives, and the administration could revive a revised EO at any point. However, the political dynamics — with Musk, Zuckerberg, and Sacks now having successfully killed one version — suggest any future order will be significantly lighter on developer obligations. Enterprise planning should assume no binding US federal AI standard before 2027 at the earliest.
Sources & Further Reading
- Trump postpones AI executive order signing: ‘I didn’t like certain aspects’ — CNBC
- Why Trump’s AI executive order was pulled — Axios
- Elon Musk, Mark Zuckerberg derail Trump AI order — Semafor
- White House postpones executive order on AI — CNN Business
- Colorado SB 26-189: Revamped Colorado AI law targets consequential HR decisions — HR Dive
- Connecticut SB5: Poised to enact one of the nation’s most comprehensive AI laws — Freshfields
