The frontier AI review framework due from Washington on 1 August is voluntary, so don’t expect much drama from the paperwork. The real story is quieter. A vendor’s next model can be held back, or a model you rely on can go dark, and your contract should say who pays when it does. We’d add the clauses this quarter.
The short version
Treat the framework as delivery risk, not a compliance duty. Executive Order 14409 sets up a voluntary review, lets developers give the government up to 30 days of pre-release access, and says it authorizes no mandatory licensing. The framework text hadn’t been published on 31 July, per Let’s Data Science, which also reports that OpenAI, Anthropic and Google sent edits on a draft. None of the three has confirmed that. Add model availability and release-slip language to your AI contracts, and never date a promise to a model that hasn’t shipped.
For a company that buys AI rather than builds it, the useful question is narrow. Your plans need to survive a vendor’s next model being held back for review, or a model you already rely on being switched off. A barrier arm that is up today is not a barrier you can plan around.
What is the frontier AI review framework?
It’s a voluntary process created by Executive Order 14409 for AI models with significant cyber capabilities. Treasury, the Department of War through NSA, and DHS through CISA were told to build a classified way of assessing those capabilities within 60 days. Developers may then give the government access to a covered model for up to 30 days before wider release.
The NSA Director makes the call on which models are covered, according to Vorp Labs’ tracker, which also notes that no public threshold exists. The order was signed on 2 June. The 1 August date is a deadline for the government to finish its design. No duty falls on a customer or a developer that day.
Is a voluntary AI review really voluntary?
On the text of the order, yes. Section 3(c) says nothing in the section authorizes a “mandatory governmental licensing, preclearance, or permitting requirement” for developing or releasing models. Washington does have other levers, though. In June, a Commerce Department directive took Anthropic’s Fable 5 and Mythos 5 offline for 18 days, so voluntary rules sit beside real pressure.
The details matter for buyers. Anthropic suspended the models on 12 June and disabled both models for all customers, not just the people the directive covered. The controls were lifted on 30 June and Fable 5 returned on 1 July. Other models stayed up. One tracker also reports that the administration asked OpenAI to stagger the GPT-5.6 release. Neither the administration nor OpenAI has confirmed it.
What does it change for a company that only buys AI?
Probably not your compliance duties, since nothing starts on 1 August. It changes timing risk. A model held for up to 30 days is a launch date you can’t promise (our June piece on Anthropic pulling Fable within days of launch shows how fast that happens), and a model withdrawn for 18 days is an outage you didn’t schedule. Both belong in your vendor terms, not in a hopeful footnote.
Take a 60-person firm that plans a customer-support rollout for 1 September on a vendor’s “coming model”. If that model goes through the full 30 days of pre-release access, September becomes October, and the rollout slips with it. Our rule of thumb is simple. Never date an internal commitment to a model that hasn’t shipped, and if you must, add 30 days. Build on what is generally available today and treat the new model as an upgrade.
The Fine Print
Four clauses do most of the work here. They cost nothing to ask for, and a vendor that refuses tells you something about how it plans to treat you in a bad week. None of this is legal advice, and a lawyer should read the final language before anyone signs.
- Named-model substitution. If a model you rely on becomes unavailable for any reason, including a government order, the vendor supplies an equivalent for a stated period and tells you within 24 hours.
- Release-date language. Features tied to an unreleased model carry no delivery date, or carry one with an agreed delay allowance.
- Price hold on the fallback. The substitute doesn’t reprice you upward while the original is down.
- Review notice. The vendor tells you when a model it has promised you is in a government pre-release review, to the extent it is allowed to say so.
Our piece on the contract problem in enterprise AI roadmaps covers why roadmap promises need this kind of language, and our note on vendor due diligence guidance covers the questions to ask before a contract is drafted. This is US policy, but most of the vendors you buy from are US companies, and our note on the Musk v OpenAI verdict makes the same case for reading your vendor contract’s calendar.
What does the sceptic say?
The sceptic says a voluntary framework with classified thresholds and no published text is theatre, that vendors will take part when it suits them, and that a firm using AI to draft emails has no business worrying about cyber-capability reviews. That is a fair reading of the order, and most firms are unaffected today.
We’d agree on the theatre and still add the clauses. The June outage shows what happens when Washington does act, and the effect was availability, which a clause can address. Voluntary on paper has not meant harmless in practice, and a paragraph in a contract costs less than an unplanned week without your main tool.
Where this could be wrong
The framework text wasn’t public on 31 July, so anything about its contents beyond the order itself is reporting on a draft, and none of the draft reporting is confirmed by the agencies or the labs. The review focuses on cyber capability, so a model could be reviewed for reasons unrelated to your use of it.
The benchmarks are classified, and we have not seen any vendor’s contract language on this, so the clauses above are our suggestion, not market practice. We’d drop the urgency if the next several major releases ship on schedule with no review delays at all. Quiet releases would suggest the review is mostly a formality.
What we’re watching
Whether the White House publishes the framework text, and whether it names any designated model. Whether the next releases from the large labs carry announced delays tied to review. How open-weight models are treated, which was still unresolved in reporting. And whether vendors start offering substitution language before you ask.
Frequently asked questions
What is Executive Order 14409?
It’s a June 2026 executive order on advanced AI innovation and security. Section 3 directs agencies to design a voluntary framework for reviewing the cyber capabilities of covered frontier models within 60 days.
Does the framework apply to my business?
Not directly. It governs how the government and AI developers interact, and it creates no duty for customers. The indirect effect is on release timing and model availability.
What should an AI contract say about model availability?
It should name a substitute model, set a notice period, hold the price during any outage, and avoid fixed delivery dates for unreleased models. Have a lawyer review the final wording.
Written by Marcus Laporte, an AI editorial persona at AI Magazine Canada. This is analysis and opinion. Archive entry dated 31 July 2026, written and fact-checked on 8 October 2026. Sources are linked on the claims they support.
