The Great American AI Act: Inside the US’s First Bipartisan Federal AI Framework

America’s Patchwork AI Problem and Why a Federal Framework Matters

For years, companies operating in the United States have navigated AI regulation through a fragmented maze of state-level laws. California, Texas, Illinois, and dozens of other states have each moved at their own pace — creating a compliance burden that disproportionately affects companies with operations across multiple jurisdictions. The federal government’s posture has, until recently, leaned toward voluntary frameworks and executive guidance rather than binding legislation.

That changed on June 4, 2026, when Representatives Jay Obernolte (R-CA) and Lori Trahan (D-MA) released the discussion draft of the Great American AI Act (GAAIA). The bill’s bipartisan authorship is itself significant: AI regulation has long been a fault line between innovation-friendly Republicans and consumer-protection-oriented Democrats. A joint framework signals that Congress is inching toward a legislative compromise that neither side has managed to produce before. For context, Built In’s 2026 tech law tracker documents that more than 40 US states had enacted or proposed AI-related legislation by June 2026 — a proliferation that underscores why a federal preemption mechanism became politically attractive.

The GAAIA is still in the feedback phase prior to formal introduction — meaning it has not yet been formally introduced as a bill, let alone voted upon. But its contours are clear enough to demand attention from legal, compliance, and technology leaders worldwide.

Separately, on June 2, 2026, the White House signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security”, which established a voluntary framework for frontier model assessments, gave National Security Systems a 30-day deadline to strengthen cyber defenses, and directed key agencies — including CISA and the Treasury Department — to stand up AI cybersecurity infrastructure. The executive order and the GAAIA draft are parallel tracks: the former is administrative action; the latter is a legislative proposal. Together, they signal a coordinated federal push to govern AI at scale in the second half of 2026.

The Four Pillars: What GAAIA Actually Proposes

The GAAIA organizes its provisions under four major sections, each targeting a distinct aspect of the AI ecosystem.

1. Frontier Model Governance

The first and most consequential pillar covers AI systems that operate at the capability frontier. Under GAAIA, developers of frontier AI models would be required to disclose information about those models, submit to third-party audits through newly designated Independent Verification Organizations (IVOs), and refrain from retaliating against whistleblowers who raise safety concerns.

This represents a departure from purely voluntary disclosure norms. Currently, leading AI labs share safety information primarily through self-published system cards or optional government briefings. GAAIA would make third-party audits mandatory for qualifying frontier models, establishing IVOs as a new category of regulated entity in the US AI ecosystem.

Parallel to this, the White House’s June 2 executive order created a process by which AI developers can engage with federal agencies to determine whether their models qualify as “covered frontier models,” with a voluntary 30-day early-access window before public release — providing classified benchmarking in exchange for early government insight.

2. Workforce Protections

The second pillar addresses AI’s impact on employment, though the precise mechanisms remain in the discussion draft stage. This section reflects political pressure from labor-aligned Democrats like Rep. Trahan to ensure that the legislation’s benefits extend to workers, not only to technology companies. The workforce provisions position GAAIA as a more socially balanced framework than a pure industry-friendly bill.

3. Cybersecurity

GAAIA’s cybersecurity provisions extend the Cybersecurity Information Sharing Act (CISA Act) through 2035, creating a longer legislative runway for public-private threat intelligence sharing. This is significant because the existing CISA Act framework was set to face renewal uncertainty; the GAAIA extension would lock in the information sharing infrastructure that companies and federal agencies have built over the past decade.

This pillar dovetails with the White House executive order, which directed CISA to issue binding operational directives within 30 days, established an AI Cybersecurity Clearinghouse under the Treasury Department, and tasked the Attorney General with prioritizing enforcement against illegal AI-enabled computer intrusions.

4. Research, Development, and International Cooperation

The fourth pillar addresses the competitive and diplomatic dimensions of AI. It formally authorizes the Center for AI Standards and Innovation (CAISI) within the Commerce Department with $100 million per fiscal year for fiscal years 2027 through 2029. CAISI’s mandate is to develop voluntary AI guidelines and standards — an important counterweight to the mandatory audit requirements in Pillar 1.

International cooperation provisions acknowledge that AI governance cannot be solved unilaterally. As the EU AI Act enters full enforcement and other major economies — including China, the UK, and Japan — develop their own frameworks, the US risks a standards fragmentation that could create compliance barriers for American companies abroad and foreign companies operating in the US.

GAAIA vs. the EU AI Act: A Transatlantic Divergence

The contrast between GAAIA and the EU AI Act — now in full enforcement as tracked by Reed Smith’s 2026 EU regulatory update — is instructive. The EU AI Act, which entered full enforcement in 2025, takes a risk-classification approach: AI systems are tiered by use-case risk level (unacceptable, high, limited, minimal), with the most stringent requirements falling on high-risk applications in healthcare, education, critical infrastructure, and law enforcement.

GAAIA, by contrast, organizes primarily around capability thresholds (frontier models) rather than use-case risk categories. This reflects a distinctly American legislative instinct — regulating the most powerful tools at the source rather than managing outcomes across every downstream application.

There are also structural differences in enforcement and preemption. GAAIA includes a three-year preemption clause that would restrict states from enacting laws “specifically regulating the development of” AI models — though critically, the preemption does not affect post-deployment regulation or state laws of general applicability like the California Consumer Privacy Act (CCPA). The EU framework, by contrast, creates uniform supranational rules with no equivalent of US-style state-federal tension.

For multinational companies, this divergence creates a dual compliance burden. A company deploying a large-scale AI model in the US and the EU would need to satisfy frontier-model audit requirements under GAAIA’s IVO regime while simultaneously navigating use-case risk classifications under the EU AI Act. These frameworks are not harmonized, and there is currently no mutual recognition mechanism between them.

What Enterprise Compliance and Legal Teams Should Do Now

GAAIA is a discussion draft, not enacted law. But the time between a legislative draft and final passage — or between a draft and the compliance deadlines it sets — can move faster than enterprise procurement and audit cycles. The appropriate response is not to wait for final text, but to begin building the organizational capacity that any serious federal AI framework will require.

1. Audit your frontier model exposure and document it now

If your organization develops, fine-tunes, or deploys models that could qualify as frontier-tier, begin cataloging them before the IVO audit regime exists. This means documenting training data provenance, capability benchmarks, safety evaluations performed, and any internal red-teaming results. Creating this documentation now serves two purposes: it prepares you for a potential mandatory audit regime, and it surfaces internal risks you may not have formally assessed.

2. Map your state-level compliance obligations before preemption kicks in

GAAIA’s three-year preemption clause — if enacted — would restrict new state-level AI development laws. But it would not eliminate existing state obligations, and it would not touch post-deployment regulation or general-purpose state laws. Legal teams should map the full spectrum of current state AI obligations (Colorado, California, Texas, Illinois, and growing) and determine which would survive a federal preemption, which would be superseded, and which gaps remain. This exercise is valuable whether or not GAAIA passes, because the state-level landscape will continue to evolve regardless.

3. Engage with the CAISI voluntary standards process early

The $100 million per year authorized for CAISI through 2027–2029 will fund voluntary guidelines that could eventually underpin mandatory standards. Companies that engage early in the standards development process — through public comment periods, working groups, and pilot programs — shape the outcome. Companies that wait for the final standard and then retrofit their systems pay a much higher compliance cost. Designate a policy affairs point of contact to monitor CAISI outputs and participate in public comment windows as they open.

The Bigger Picture: A Fragmented Global AI Regulatory Map

The Great American AI Act arrives at a moment when the global AI governance map looks less like a coherent international regime and more like a patchwork of competing national frameworks. The EU AI Act is in enforcement. China has its own generative AI and algorithm governance regulations. The UK has opted for a sector-regulator approach rather than horizontal legislation. India is developing its own framework.

What GAAIA adds to this picture is the possibility — not yet the reality — of a US federal floor that companies can plan around. The bill’s bipartisan authorship gives it more legislative credibility than previous unilateral proposals. But credibility is not certainty: US Congress has a long history of major technology legislation stalling in committee, and GAAIA faces opposition from industry groups concerned about compliance costs and from state governments resistant to preemption.

For compliance and technology leaders outside the United States — including those in Algeria and across the MENA region — the regulatory divergence between the US and EU creates a practical decision point. Companies building AI products for global markets now face a choice: design to the strictest standard (EU AI Act), build modular compliance stacks that can be adapted per jurisdiction, or wait for regulatory convergence that may not arrive before their product ships. The evidence from GAAIA suggests the US is moving toward greater federal oversight, but at a pace and with a structure that differs enough from the EU that a unified global compliance framework remains distant.

The immediate task for enterprise teams is not to predict which framework will win, but to build the internal governance infrastructure — documentation, audit trails, risk assessments, and policy engagement capacity — that any serious regulatory environment will require.

Frequently Asked Questions

Sources & Further Reading

• Further Reading
• The Great American AI Act: What Businesses Need to Know — McDonald Hopkins
• Promoting Advanced Artificial Intelligence Innovation and Security — White House
• Tech Laws 2026: Federal and State AI Legislation Tracker — Built In
• 2026 Update: EU Regulations for Tech and Online Businesses — Reed Smith