From Voluntary to Binding: What One Week of US AI Policy Signals About Where Compliance Must Head

The voluntary framework arrived first.

On approximately June 2, the Trump administration signed an Executive Order establishing voluntary federal access to frontier AI models. The framing was deliberate: federal agencies could request access, labs could provide it, and no binding requirements attached to either side. That’s consistent with the administration’s general posture on AI governance, enable, don’t mandate. According to the White House announcement, the order positioned the federal government as a participant in frontier AI development, not its gatekeeper.

Three days later, NSPM-11 changed the register for one audience.

The June 5 National Security Presidential Memorandum addressed military AI adoption. Where the EO was voluntary, NSPM-11 moved toward mandate, specifically for DoD contexts, with a 90-day review of Directive 3000.09, the Pentagon’s existing framework for autonomous weapons and AI-enabled systems. Defense contractors and frontier labs with government contracts woke up to a different compliance calendar than commercial operators. The EO and NSPM-11 weren’t contradictory. They were segmented: voluntary for commercial, mandatory trajectory for defense. That segmentation matters for how compliance teams should be structuring their government affairs programs.

Then the discussion draft arrived.

Section 1: The Voluntary-to-Binding Sequence

The Great American AI Act of 2026 is, as of this writing, a discussion draft. No bill number. No committee referral. No CBO score. Described as bipartisan in press coverage from June 4 through June 7, though the sponsor list hasn’t been confirmed against primary sources. That’s a meaningful distinction. “Bipartisan” in press characterizations of discussion drafts often means two or three members from each party, not a whip-count majority. Don’t treat bipartisan labeling as a vote projection.

What the draft would add, if enacted, is binding infrastructure the EO doesn’t create. The EO establishes access. The GAAIA would establish authority, a federal standards body with an annual appropriation of $100 million, the mandate to set binding AI standards, and the institutional standing to enforce them. Those are qualitatively different functions. Access frameworks produce relationships. Standards bodies produce obligations.

The sequence, voluntary EO, then binding legislative draft in the same two-week window, isn’t coincidental. It reflects a pattern visible across four or more prior cycles in the registry: the Trump administration establishes a voluntary baseline, and legislative actors use that baseline as a floor, not a ceiling. The EO’s voluntary framework doesn’t preclude the GAAIA. It may have created the political conditions for it.

Section 2: Three Provisions, Three Compliance Audiences

The draft’s three major provisions address distinct constituencies, and the compliance implications don’t overlap.

*Provision 1: Federal AI Standards Body ($100M/year)*

Frontier labs are the primary audience here. A federal standards body with $100 million in annual appropriations would have the institutional capacity to set documentation requirements, conformity assessment standards, and reporting obligations that don’t currently exist at the federal level. That’s not a marginal change. The EU AI Act’s high-risk classification system works because it’s backed by institutional infrastructure, notified bodies, harmonized standards, enforcement budgets. The GAAIA’s standards body provision is an attempt to build that infrastructure in the US context.

What labs should be scoping now: what documentation and conformity frameworks they could adapt from EU AI Act compliance programs. If the GAAIA’s standards body eventually adopts standards aligned with ISO/IEC 42001 or the NIST AI Risk Management Framework – both of which are already in the regulatory vocabulary, labs with existing EU compliance programs will have a structural head start.

*Provision 2: Three-Year State AI Rule Freeze*

Multi-state operators are the primary audience here. The preemption provision would freeze new state AI development rules for approximately three years, the duration is reported, not verified against draft text. Colorado’s SB 205, Connecticut’s AI Bill of Rights framework, Illinois’s emerging AI employment rules, and New York City’s Local Law 144 (automated employment decision tools) all sit in the landscape this provision would affect.

The real question is what “freeze” means in legislative text. A federal preemption clause can freeze new state laws while leaving existing ones intact, or it can supersede both new and existing frameworks, or it can create a carve-out for state laws that predated federal action. Each reading produces a radically different compliance posture for multi-state operators. Until the text is verified against the draft, compliance programs shouldn’t collapse existing state obligations. They should maintain current frameworks while building a monitoring system that flags the preemption provision’s exact scope when the text becomes available.

State AGs in Colorado, Illinois, and New York have opposed federal preemption in prior public statements. That opposition doesn’t defeat a preemption clause, but it does generate litigation risk, which means the three-year freeze, if enacted, might not produce three years of compliance certainty.

*Provision 3: WARN Act Trigger for AI-Driven Layoffs*

Employers with AI deployment programs are the primary audience here. The Worker Adjustment and Retraining Notification Act currently requires 60 days’ advance notice for plant closings and mass layoffs above certain thresholds. The GAAIA’s provision would extend that obligation to AI-driven workforce reductions. Specific headcount thresholds and notice timelines aren’t confirmed in available material. Don’t build policy around unconfirmed figures.

What’s confirmed: the provision exists and would create a new category of WARN Act trigger, not just economic downturns or business decisions, but AI-system-driven decisions. The compliance implication is structural. Employers would need to document that a layoff was or wasn’t AI-driven, which requires the kind of HR-system audit trail that most organizations haven’t built. Start building it.

Section 3: The Stakeholder Map

Five named positions are visible in the current landscape. They’re not equally weighted.

The White House prefers voluntary frameworks for commercial AI – the June 2 EO is the clearest expression of that preference. NSPM-11 shows the administration is willing to mandate in defense contexts. That segmentation is a policy choice with commercial implications: voluntary frameworks create less lobbying resistance, voluntary frameworks are harder to litigate, and voluntary frameworks can be rescinded without legislative action.

The GAAIA authors, bipartisan, unconfirmed sponsor list, prefer binding authority at the federal level. Their draft creates the institutional infrastructure the EO doesn’t. They’re not opposing the EO; they’re supplementing it.

State AGs opposing preemption have the most to lose from Provision 2. Their position is legally defensible, federal preemption of state police powers requires constitutional grounding that isn’t automatic. Expect litigation within 60 days of any preemption clause taking effect.

Frontier labs have mixed positions. The $100M standards body creates obligations, but it also creates predictability. A single federal standard is easier to comply with than 50 state frameworks. Labs with mature EU AI Act programs may quietly support the GAAIA’s standards body while opposing specific provisions.

The employer community’s WARN Act exposure is the most politically actionable objection. Business associations will oppose specific thresholds. The provision’s survival through markup will depend on where those thresholds land.

Section 4: The Federal Preemption Fight

A three-year state freeze is a significant ask. The states that have moved fastest on AI regulation, Colorado with its high-risk AI system requirements, Illinois with employment AI rules, New York with Local Law 144, built those frameworks specifically because federal action was absent. Preempting them now means telling those states that their legislative work was a placeholder, not policy.

The constitutional mechanism matters. Congress can preempt state law expressly (stating it in the statute), implicitly (occupying the field), or through conflict (making compliance with both impossible). Express preemption is the cleanest mechanism. It’s also the easiest to litigate. If the GAAIA’s preemption clause doesn’t include a savings provision for state laws already in effect, state AGs will argue the clause is overbroad, and courts will have to sort it out. That process could take three years by itself.

The practical implication: even if the GAAIA passes with a preemption clause, multi-state compliance programs shouldn’t assume regulatory clarity. They should assume litigation and plan accordingly.

Section 5: What Compliance Teams Should Track

Don’t predict. Monitor. Here’s what to watch, specifically:

The preemption clause’s exact scope, when draft text becomes available, the key language is what it does or doesn’t save for existing state laws. That one clause determines whether multi-state operators can simplify their compliance programs or must maintain parallel federal and state frameworks.

The WARN Act thresholds, the specific headcount and timeline figures will tell employers whether their current AI deployment programs trigger the provision or fall below it. Build the audit infrastructure now, before the thresholds are set.

The standards body’s relationship to NIST, if the GAAIA’s $100M body is required to align with or incorporate the NIST AI Risk Management Framework, organizations that have already mapped to NIST RMF will be structurally ahead of those that haven’t.

The timeline to markup, discussion drafts that don’t reach committee markup within a session typically don’t advance. Track whether the GAAIA gets committee referral and a markup date. That’s the signal that separates a negotiating document from a legislative vehicle.

The real question isn’t whether binding US federal AI regulation is coming. The EO, NSPM-11, and the GAAIA together make clear that the direction of travel is toward more obligation, not less. The real question is which provisions of the GAAIA survive the process intact. The standards body is the most likely to survive, it has industry support, EU precedent, and bipartisan logic. The preemption clause is the most likely to be modified, state resistance is organized and legally grounded. The WARN Act provision is the most likely to be narrowed through threshold negotiation.

Build toward the standards body. Maintain state compliance frameworks through the preemption fight. Start building AI-decision audit trails before the WARN Act thresholds are set. Organizations that treat the GAAIA as a prediction problem will build the wrong thing. Treat it as a monitoring problem, and build the infrastructure that serves you across the range of outcomes.