Two Regulators, One AI Stack: Governing When Federal and State Pull in Opposite Directions

This morning, President Trump signed a new executive order (Promoting Advanced Artificial Intelligence Innovation and Security) focused on federal cybersecurity hardening and a voluntary framework for government pre-release access to frontier AI models. 

Five days ago, Illinois passed SB 315: mandatory annual third-party audits of frontier AI safety practices, effective January 1, 2027. 

These two developments, arriving within a week of each other, define the environment AI governance teams are now operating in. Federal policy says: voluntary, minimal friction, innovation-first. State policy says: audit annually, document continuously, prove your oversight is real. For organizations deploying AI at scale, these aren’t alternative frameworks to choose between. They’re simultaneous obligations. 

What the White House EO Actually Does 

Today’s order is narrower than the AI regulation debate it enters. It has four operational components: 

Federal systems hardening. NSS, DoD, and CISA have 30 days to prioritize AI-enabled cyber defense of government information systems. CISA will issue Binding Operational Directives covering civilian federal systems. The EO explicitly extends access to AI-enabled cybersecurity tools to state and local authorities, community banks, rural hospitals, and critical infrastructure operators. 

AI cybersecurity clearinghouse. Treasury, NSA, and CISA will stand up a voluntary industry clearinghouse to coordinate vulnerability scanning, validation, and patch distribution across government and the private sector. 

Voluntary frontier model pre-release access. NSA leads a classified benchmarking process to designate “covered frontier models” by cyber capability threshold. Developers can voluntarily share models with the federal government up to 30 days before release. The order explicitly bars any mandatory licensing, permitting, or preclearance requirement. 

Criminal enforcement. DOJ is directed to prioritize prosecution of AI-assisted cybercrime under existing federal statutes. 

What today’s EO does not do: create new compliance mandates for enterprise AI deployers, preempt state AI laws, or establish a safety audit regime. That’s a different executive order(December 11, 2025) which established an AI Litigation Task Force to challenge state laws the administration considers “onerous.” That task force is still active. Illinois SB 315 will almost certainly be reviewed by it. 

The Tension Your Governance Program Now Has to Navigate 

The federal and state regulatory tracks are not converging. They are diverging. 

The federal track rewards voluntary documented safety practices. The EO’s voluntary framework for frontier model review, the cybersecurity clearinghouse, CISA’s expanded services are all structured as opt-in, collaborative, industry-led.  

The state track is mandatory and enforcement-backed. Illinois SB 315 requires annual third-party audits with $3 million penalties for non-compliance. California’s SB 53 and New York’s RAISE Act add transparency and reporting requirements. Illinois HB 3773 (already in force since January 1, 2026) imposes strict liability on any employer using AI in employment decisions without proper disclosure and non-discrimination controls. 

What the “Covered Frontier Model” Designation Means for Your Risk Framework 

The EO’s most consequential long-term provision for enterprise deployers isn’t the cybersecurity hardening, it’s the classified benchmarking process. 

NSA, CISA, and Treasury have 60 days to develop and maintain a framework that designates AI models as “covered frontier models” based on their cyber capability threshold. Even though the designation process is classified, its output won’t be: AI developers will be informed whether their models qualify. That information will flow downstream. 

When your AI model provider learns that a model you’re deploying has been designated a covered frontier model under federal criteria, that designation will reshape your risk calculus regardless of whether SB 315 directly covers you. Expect it to appear in enterprise API agreements, insurance assessments, and board-level AI risk reviews within 12 to 18 months. 

If your AI inventory and risk classification infrastructure can’t track which models you’re running against emerging federal designations, you’ll be managing that risk blind. 

What to Watch 

Three developments in the next 60 days will define how this regulatory landscape settles: 

CISA’s Binding Operational Directives (30 days). These will set specific requirements for federal civilian systems and establish the scope of AI-enabled cybersecurity tools being extended to hospitals, banks, and utilities. If your organization is in critical infrastructure, these directives will create direct compliance touchpoints. 

NSA’s covered frontier model benchmarking framework (60 days). The threshold determination for what qualifies as a covered frontier model will establish the federal risk classification baseline. Watch for informal signals from frontier model providers about whether their models are in or out of scope. 

DOJ AI Litigation Task Force vs. Illinois SB 315. The December 2025 preemption EO established a task force to challenge state AI laws. SB 315 — with its mandatory audit requirement — is precisely the kind of law the task force was created to review. Whether the administration challenges SB 315, and how Illinois responds, will determine whether the state compliance track remains mandatory or gets tied up in litigation. Compliance programs should be built for the current law, not a legal outcome that hasn’t happened. 

Ready to operationalize responsible AI? Navigating diverging federal and state AI requirements demands more than policy tracking—it requires governance infrastructure. If your enterprise needs to move responsible AI from principles to production, request a demo to see how Airia provides automated guardrails, output verification, data protection, and audit trails—so compliance with today’s regulations and tomorrow’s is built into how your AI agents operate by default.

Source 

Today’s Executive Order — Full Text → whitehouse.gov