THE BILL AND WHAT IT ACTUALLY IS
A discussion draft is not a bill. That distinction matters more here than it does in most legislative contexts, because the Great American AI Act is a document of striking ambition — 269 pages covering frontier model governance, workforce transition, federal AI procurement standards, open-source security grants, and a new institutional architecture for AI oversight — and the gap between a discussion draft and a law enacted through both chambers of Congress is, under ordinary circumstances, measured in years and filled with compromises that routinely hollow out the most consequential provisions. What the June 4 release does represent is a credible signal that a bipartisan coalition of House members, led by Representative Jay Obernolte of California and Representative Lori Trahan of Massachusetts, has reached sufficient agreement on the shape of a federal AI framework to put 269 pages of legislative text into circulation. In a Congress where bipartisan agreement on technology policy has been close to nonexistent since the early hearings on social media regulation, that is itself a meaningful development.
The bill is structured in five titles. Title I addresses the federal preemption of state AI laws — the provision that has absorbed most of the initial press coverage and generated most of the immediate opposition. Title II establishes the obligations that would apply to large frontier AI developers, including the public frontier AI framework requirement and the mandatory incident reporting regime. Title III codifies and expands the Center for AI Standards and Innovation, a federal agency that currently exists in embryonic form at the Department of Commerce and that the bill would elevate into a standalone directorate with statutory authority and appropriated funding. Title IV creates the Independent Verification Organization system — a network of licensed private-sector auditors authorized to certify compliance with the frontier AI framework requirements. Title V addresses AI workforce transition, including retraining grants and a labour-market monitoring mandate that would require the Secretary of Labour to publish quarterly reports on AI-attributable employment displacement. The five titles add up to a regulatory architecture that, if enacted in its current form, would make the United States the first major AI-producing nation with a comprehensive federal framework — and would do so at a moment when the industry is spending aggressively to prevent exactly that outcome.
THE PREEMPTION PROVISION AND WHY IT HAS PRODUCED IMMEDIATE REVOLT
Title I of the bill would preempt, for a period of three years, any state law or regulation that specifically targets the development of an AI model. The definition of development matters: the bill defines it as "acts performed or directed by a developer prior to its deployment," which means the preemption applies to training, fine-tuning, safety evaluation, and pre-release testing — but not to deployment, use, or the downstream consequences of AI outputs. States would retain the authority to regulate how AI systems are used within their borders, and laws of "general applicability" — consumer protection statutes, anti-discrimination frameworks, privacy laws that happen to apply to AI systems — would not be preempted even if AI companies are subject to them. The three-year period is designed, in the bill's framing, to allow the federal framework time to mature before states are permitted to layer additional development-specific requirements on top of it.
The operational consequence of the preemption provision is more significant than the three-year sunset might suggest. California's AB 2013, which requires developers to publish high-level summaries of the training data used in their models, would be preempted from the moment the bill takes effect. California's SB 942, which mandates watermarking of AI-generated content, would be partially preempted — the provision requiring developers to embed watermarking capability in models during development falls within the preemption scope, even though deployment-phase watermarking requirements would survive. Colorado's AI accountability statute, which had been the most aggressive state-level algorithmic discrimination law in the country before the state legislature replaced it with a narrower substitute in spring 2026, would have been preempted had it remained on the books in its original form. The accompanying document released by Representative Trahan's office identifying specific state laws that would be preempted is, in practical terms, a map of how much regulatory ground the bill would reclaim from the states — and the map is extensive enough that attorneys general in 22 states and the District of Columbia issued a joint statement within forty-eight hours of the bill's release characterising the preemption provision as constitutionally suspect and politically unacceptable.
Brad Carson, president of Americans for Responsible Innovation, described the preemption provision as a "generational mistake" on the grounds that it converts the existing floor of state AI consumer protection into a federal ceiling, removing the ability of state legislatures to respond to AI-attributable harms that emerge during the three-year preemption window and that Congress has not yet contemplated. Colorado Attorney General Phil Weiser indicated his office was evaluating litigation options within days of the draft's release. The counterargument — that AI systems cross state lines, that fragmented state-level development regulations create compliance costs that disadvantage smaller developers relative to large frontier labs, and that a coherent federal framework is preferable to fifty inconsistent state regimes — is both technically correct and strategically convenient for exactly the companies most likely to benefit from it. The fact that the argument is made in good faith by Obernolte and Trahan does not reduce the political difficulty of enacting a provision that requires overriding the express preferences of more than half the state attorneys general in the country.
WHAT THE FRONTIER AI FRAMEWORK REQUIREMENTS ACTUALLY DEMAND
Title II of the bill targets a defined class of developers: companies with gross revenue exceeding $500 million in the preceding calendar year and that are engaged in the development of frontier AI models. The $500 million threshold is explicitly designed to exempt from the heaviest compliance obligations the long tail of smaller AI developers, research institutions, and open-source contributors — a design choice that has drawn its own set of criticisms, on the grounds that the threshold captures essentially every major AI company currently operating at frontier scale while exempting the open-source ecosystem that may in the near term produce models capable of comparable capability and risk. Within that threshold, covered developers would be required to publish a publicly available frontier AI framework: a document describing their methodology for identifying catastrophic risks — defined in the bill as risks of mass casualties, large-scale economic disruption, or fundamental disruption to critical infrastructure — and the specific technical and operational measures they have implemented to mitigate those risks.
The framework requirement is meaningfully different from the voluntary safety commitments that the major AI labs have already published, in that it carries legal force. A developer whose deployed model produces an outcome that the developer's own frontier AI framework identified as a risk it had mitigated would be exposed to regulatory action for the gap between the committed mitigation and the actual outcome — a form of accountability that the existing voluntary commitment system, by design, does not provide. The bill supplements the framework requirement with a mandatory incident reporting regime: covered developers must report any "critical safety incident" to the Director of CAISI within fifteen days of discovery, and must report any situation involving "imminent catastrophic risk" within twenty-four hours. The penalties for non-compliance are calibrated to make delay costly for companies of frontier scale: up to $1 million per day for each day a required report is not filed. For a company generating tens of billions in annual revenue, $1 million per day is not a deterrent — it is closer to a rounding error — but the reputational and legal exposure of a documented failure to report a known catastrophic risk is a qualitatively different kind of incentive from the financial penalty alone.
The bill also requires covered developers to publish annual transparency reports containing information about the model's training data, its evaluated capabilities across a defined set of benchmark categories, and the results of any external red-teaming exercises conducted in preparation for deployment. The transparency report requirement creates a new kind of public record for frontier AI systems: a standardised disclosure document that allows regulators, researchers, and the public to compare the safety profiles of competing models against a common template. Whether that standardisation is more valuable than the diversity of approaches the current voluntary disclosure ecosystem supports is a genuinely contested question among AI safety researchers, and the bill's text does not resolve it — it simply mandates the standardised format and leaves the definition of the required benchmark categories to CAISI rulemaking.
THE CAISI AND THE IVO AUDIT REGIME
The institutional architecture proposed in Titles III and IV is, in the medium term, likely to be more consequential than the specific substantive requirements, because institutions persist beyond the legislative sessions that create them and accumulate authority through rulemaking in ways that the founding statute rarely anticipates. The Center for AI Standards and Innovation exists today as a programme within the National Institute of Standards and Technology at the Department of Commerce, where it has operated since the Biden administration on a modest budget with a mandate limited to standards development and voluntary framework maintenance. The Great American AI Act would transform it into an independent directorate with a confirmed Director appointed by the Secretary of Commerce and Senate-confirmed, an annual appropriation of $100 million for the fiscal years 2027 through 2029, and statutory authority to issue binding regulations, license independent verification organizations, receive and act on mandatory incident reports, and refer matters involving imminent catastrophic risk to the Attorney General for enforcement action.
The Independent Verification Organization system established in Title IV is the mechanism through which the frontier AI framework requirements would be enforced in practice. IVOs would be private-sector entities — consultancies, audit firms, research organizations — licensed by CAISI to conduct compliance assessments of covered developers' frontier AI frameworks. The licensing regime is modelled on the structure used for financial auditors under the Sarbanes-Oxley framework and for cybersecurity assessors under the Cybersecurity Maturity Model Certification programme, both of which created new professional categories and new commercial markets around compliance functions that previously did not exist. Under the bill, covered developers would be required to retain an IVO to conduct a comprehensive assessment semi-annually, and CAISI's Director would have authority to direct an IVO to conduct an ad hoc assessment at any time if the Director has reason to believe a developer's frontier AI framework is materially inadequate. If an IVO's assessment identifies an imminent catastrophic risk, the bill requires the IVO to report that finding directly to CAISI's Director, who in turn must refer it to the Attorney General — a mandatory referral pathway that removes discretion from the agency on the most serious class of findings.
The structural effect of the IVO regime is to create a class of AI safety auditors with legal standing and commercial interest in the rigour of the assessments they conduct. That is a different kind of accountability mechanism from either the voluntary safety commitments the labs have made or the government-conducted evaluations that the UK's AI Safety Institute and similar national bodies have been building — it aligns commercial incentives with safety outcomes in a way that pure public-sector oversight does not, because an IVO that consistently produces assessments that miss material risks will face both regulatory sanction and reputational damage in a market where its clients are the most visible AI developers in the world. Whether the IVO market will develop in a way that produces genuinely rigorous assessments, or whether it will converge on the kind of checkbox compliance that characterised early iterations of cybersecurity assessment regimes, depends heavily on how CAISI structures the licensing standards and how it handles the first cases in which an IVO assessment is challenged as inadequate after a safety incident.
WHAT COMES NEXT AND WHAT IT MEANS FOR TEAMS BUILDING ON AI
A discussion draft released in the first week of June 2026 is, under any plausible scenario, months away from a committee vote and considerably further from enactment. The Great American AI Act will need to survive the House Energy and Commerce Committee, the House Judiciary Committee (which has concurrent jurisdiction over the preemption provisions), and the Senate — which has its own AI governance proposals in various stages of development and which has historically moved more slowly than the House on complex technology legislation. The preemption controversy alone is sufficient to consume a committee markup and produce amendments that could substantially alter the scope of Title I before the bill advances. The AI industry's lobbying apparatus, which has been intensively engaged in state capitals opposing state-level AI legislation for the past three years, will now shift a significant fraction of its Washington presence to shaping the federal bill — a transition that carries its own irony, given that the industry's success in blocking state legislation has partly created the political space for a federal bill that the industry does not uniformly prefer.
For teams building products on top of frontier AI APIs, the bill's most immediately relevant provisions are not the ones that generate the most controversy. The preemption debate is a political and constitutional question that will be resolved, if it is resolved at all, in a legislative process that has no predictable endpoint. What the bill proposes for frontier developers — mandatory transparency reports, standardised capability disclosures, incident reporting requirements — will, if enacted, produce a class of public documentation about the models that underlies most production AI applications that currently does not exist. The annual transparency report mandated by Title II would, for the first time, require OpenAI, Anthropic, Google, and Microsoft to publish comparable, standardised disclosures about the capabilities and limitations of their frontier models — creating a basis for comparison that developer teams currently have to construct from fragmented benchmark results, blog posts, and system card documents that use no common format.
The deeper strategic consequence of the bill is the precedent it establishes for what federal AI governance looks like in the United States. The EU AI Act, which entered its enforcement phase in August 2026, imposes a risk-tiered classification system in which the most consequential AI systems — those used in critical infrastructure, law enforcement, employment decisions, and credit — face conformity assessments and registration requirements before deployment. The Great American AI Act takes a different approach: rather than classifying AI systems by use case and imposing deployment-gate requirements, it focuses its heaviest obligations on the development phase of the largest frontier models, leaving deployment regulation to a combination of existing general-purpose law and the state frameworks that survive the preemption window. Whether that architecture is more or less protective of the interests the bill claims to serve — preventing catastrophic risks, ensuring public accountability for the most powerful AI systems — is a design question that the bill's text does not answer definitively, and that the multi-year rulemaking process at CAISI would eventually need to resolve in practice. What is certain is that the governance framework the United States adopts in the next legislative cycle will set the terms on which every major AI development decision is made for the following decade, and the Great American AI Act is, for the first time, a document serious enough to be the starting point for that conversation.