US AI order gives model reporting and government use separate clocks

President Joe Biden’s October 30 AI executive order sets several implementation tracks in motion: reporting on powerful models and computing infrastructure, proposed rules for some cloud customers, and new safeguards for the government’s own use of AI. The deadlines and legal mechanisms differ, even where the same company could be affected by more than one.

File photo: US Flag Backlit, ©2009 Joshua Nathanson (Jnn13), via Wikimedia Commons. CC BY-SA 3.0. Cropped/resized; responsive adaptations carry the same licence. Photographed March 12, 2009, not at the AI announcement.

The White House fact sheet emphasises sharing safety-test results before public release. The original order, now published in the Federal Register, shows how that policy is to be implemented. Its agency instructions shouldn’t be collapsed into a universal launch-approval process.

Reporting has a narrower scope than the AI market

Section 4.2 gives the Commerce Secretary 90 days to require ongoing information from companies developing, or demonstrating an intent to develop, potential dual-use foundation models. The reports cover training and development, security protections, ownership and possession of model weights, and relevant red-team test results and mitigations. A separate requirement concerns entities acquiring, developing or possessing potential large-scale computing clusters.

Commerce is to define and update the technical conditions. Until then, the order specifies a general model threshold above 10²⁶ integer or floating-point operations used in training, with a separate lower threshold for models trained primarily on biological sequence data. The cluster test instead combines machines physically located in one datacentre, transitively connected by data-centre networking above 100 Gbit/s, and a theoretical maximum capacity of 10²⁰ integer or floating-point operations per second for AI training.

That units distinction matters: accumulated training work and a cluster’s potential processing rate measure different things. The text also doesn’t identify particular commercial models as covered. Public product names alone don’t establish whether the technical conditions are met.

The reporting timetable runs ahead of the 270-day deadline for NIST’s red-team guidelines. The order bridges that gap by specifying categories of testing results to report before those guidelines exist. Waiting for a future testing standard therefore isn’t presented as a prerequisite for Commerce to establish the reporting requirements.

Cloud proposals and content guidance follow separate clocks

Section 4.2(c) separately directs Commerce, within 90 days, to propose regulations requiring US infrastructure-as-a-service providers to report certain foreign customers’ training runs with potential malicious cyber capabilities. Related foreign-reseller identity-verification proposals have a 180-day deadline. Those are instructions to propose regulations, distinct from the model and cluster reporting route under the Defense Production Act.

Content labelling follows another sequence. Commerce has 240 days to report on authentication, provenance and synthetic-content techniques, then 180 days after submitting that report to develop guidance. OMB subsequently has 180 days after that guidance to issue directions for authenticating and labelling federal digital content. The order sets up this work rather than imposing an immediate universal watermark format on every AI output.

Government deployment brings its own responsibilities

For federal use, section 10.1 directs OMB to issue guidance within 150 days. It calls for risk-management practices for uses affecting rights or safety, alongside measures to remove barriers to responsible adoption. Agencies are discouraged from broad generative-AI bans and encouraged to use specific risk assessments and safeguards.

OMB has already released a draft policy for comment, with submissions open until December 5. The proposed memorandum addresses agency governance, evaluations and monitoring. Its wording remains a proposal. The order ties chief-AI-officer appointments to 60 days after issuance of the guidance, rather than simply 60 days after the President’s signature.

National-security systems take a separate path: a proposed national-security memorandum is due within 270 days. Consumer protection also extends beyond foundation models. The order encourages independent regulators to use existing authorities and consider rulemaking, while directing sector-specific work such as a healthcare AI safety programme within 365 days.

Implementation remains subject to applicable law and available appropriations, and the order preserves existing agency authorities.