White House Excludes Open AI Models From New Cybersecurity Framework

On August 4, 2026, the White House published a voluntary framework for assessing cyber risks from frontier AI systems, and excluded all open models from it right away, Axios reports. The tool, created to carry out an executive order from President Donald Trump, explicitly bars its use against open AI systems whose weights are freely available for download.

Where the framework came from

President Trump signed an executive order in June 2026 requiring AI companies to give the federal government access to their frontier models before public release, so it can assess cybersecurity threats. About two months later, the White House presented the framework itself.

Key parameters of the document, according to Axios:

• Published in early August 2026, two months after the executive order
• Voluntary: participation is optional for AI companies
• Aimed exclusively at closed commercial AI systems
• States explicitly that it cannot be used to restrict open models that have already been released

Why open models were left out

Open models, such as Meta Llama* or those from Mistral AI, are by nature beyond centralized control. Their weights are published openly: anyone can download a model, run it locally and work with it without the developer's knowledge. Once a model is out, it cannot be put back in the bottle.

According to Axios, the framework's authors did not merely leave open models outside the document. They wrote in plain terms that the tool cannot be used to restrict or regulate open systems that have already been published. That formally closes off any loophole for future restrictions through this mechanism.

Notably, even for the closed labs that formally fall within the framework's scope, participation remains voluntary. The document provides for no mandatory testing.

According to the description quoted by

Axios, the White House itself calls the document "voluntary guidelines", with no enforcement mechanisms of any kind.

What the framework changes in practice

The American system for assessing AI risks covers only part of the market: closed commercial labs such as OpenAI, Google DeepMind and Anthropic. All of them already maintain a dialogue with federal agencies, so the framework simply codifies the existing status quo.

The open AI community remains entirely outside any federal oversight. Open models are often at the center of safety debates: they cannot be recalled after publication, force-updated or geo-blocked. The framework does not address this issue, and judging by its text, it never intended to.

The Verge described the document as "limited and vague", which accurately reflects its legal status: voluntary, narrow in scope and without enforcement mechanisms.

What this means

The first American government framework for AI safety codifies not regulation but its absence: a voluntary dialogue with closed labs, and the open AI space left untouched. That choice is now enshrined in an official document.

*Meta is designated an extremist organization and banned in Russia.