Is the Voluntary AI Safety Era Over? Five Steps From CAISI Commitments to Mandatory Pre-Release Vetting

The governance conversation in AI has a short memory. Each new policy development gets treated as a standalone event, a new program here, a new executive order there. That framing obscures something more important. The movement from voluntary to mandatory AI governance has been deliberate, sequential, and accelerating since January 2026. Five distinct steps mark the arc.

Step 1: The Voluntary Baseline

The voluntary AI safety framework that existed entering 2026 rested on company commitments made under the Biden administration’s executive order framework, red-teaming pledges, safety reporting, and voluntary pre-deployment review for the most powerful systems. The commitments were real. They were also unenforceable. No legal mechanism tied compliance to consequence. Labs could exit the framework without legal penalty.

CAISI, the Controlled AI System Integration program, was the first structural move that changed this calculus. Not because it was mandatory, but because participation was tied to federal contracting access. By May 6, all five major frontier labs had enrolled, giving the government its first formal, documented pre-deployment access to frontier models.

Step 2: Enrollment Becomes the Standard

CAISI’s enrollment milestone mattered beyond headcount. When all five labs are in the same voluntary program, “voluntary” loses its meaning as a differentiator. Non-participation would have required a lab to explicitly opt out of a framework its competitors joined. The reputational and contracting cost of that choice is prohibitive. What reads as voluntary at the individual-company level functions as de facto mandatory at the industry level.

Step 3: Executive Order 14365 and Financial Mechanisms

EO 14365 introduced financial consequences for AI companies operating in certain regulated sectors without documented safety protocols. The brief on EO 14365’s financial enforcement mechanisms established that the administration was willing to attach monetary consequences to compliance gaps, not through traditional rulemaking, but through executive authority over federal procurement and financial sector access.

Step 4: GPAI Compliance Deadlines

For companies with EU market exposure, the General Purpose AI compliance deadlines created a parallel mandatory track. The GPAI deadlines aren’t voluntary. They have enforcement teeth through the EU AI Act’s penalty structure. Labs operating in both the US and EU markets now face two simultaneous compliance tracks, one still partially voluntary in the US, one fully mandatory in the EU.

Step 5: The Reported Mandatory Pre-Release Vetting EO

The May 7 reporting describes a structure that, if implemented, would complete the arc. According to multi-outlet reporting, though the White House characterized it as “speculation”, the administration is drafting an executive order that would require frontier labs to submit models to a government working group for security review before release. The framing in press coverage has used an “FDA-style” characterization, suggesting a pre-approval process rather than post-release monitoring.

Four companies are reportedly named as early-access participants: Anthropic, Google, Microsoft, and xAI. That list is not coincidental. Those are the same labs in CAISI. The reported structure doesn’t require recruiting new participants, it would convert existing CAISI early-access relationships into a legal obligation. Voluntary program → EO mandate. The infrastructure was already built.

Reporting has also linked the policy discussions to concerns about Anthropic’s restricted Mythos model and its implications for governance cycles that couldn’t keep pace with capability development. The Mythos access and breach coverage established why restricted frontier models create policy pressure, not because they’re deployed broadly, but because their existence outside normal release frameworks creates oversight gaps. Whether Mythos specifically catalyzed this EO discussion has not been confirmed. But the logic is straightforward: if a restricted model can outpace a voluntary governance structure’s patch cycle, the argument for mandatory review before release is easy to make.

What a Mandatory Pre-Release Regime Would Actually Require

If the reported EO takes its described form, compliance implications break into three areas.

*Early-access protocols.* Labs would need documented procedures for providing government reviewers access to pre-release models, including model weights, system cards, and red-team results. Companies already in CAISI have something like this. Companies not in CAISI do not.

*Review timeline integration.* A mandatory pre-release review creates a government dependency in the release pipeline. Labs would need to factor government review cycles into deployment timelines. The FDA analogy in press coverage suggests reviews could run weeks to months. That’s a material change to how frontier labs currently operate.

*Documentation standards.* Government security probing generates records. Those records create discovery exposure in future litigation. How labs document pre-release capabilities, and what they disclose or withhold during government review, becomes a legal question, not just an operational one.

What Compliance Teams Should Do Now

The White House’s “speculation” characterization means the EO isn’t final. Acting as though it is would be premature. But the five-step pattern above suggests the direction is set even if the timeline is uncertain.

Three actions are worth taking now regardless of EO status. First, audit existing CAISI participation documentation. If your organization is enrolled, confirm that your early-access procedures are formalized and defensible, not just operational. Second, map your release pipeline for a hypothetical 30-60 day government review window. What breaks? What would need to change? That exercise has value whether or not the EO materializes. Third, watch the CAISI agreement language. If participation agreements are quietly revised to include pre-release access requirements, that revision is the signal that the voluntary era is ending, with or without an executive order.

The broader implication is this: the frontier lab that built its compliance posture around voluntary commitments in 2024 may have the right infrastructure but the wrong legal assumptions. Building for a patchwork landscape meant assuming fragmentation. What’s emerging looks more like convergence, toward mandatory review, mandatory documentation, and mandatory government access, on a timeline that moved faster than most compliance planning cycles anticipated.