The White House is finalising voluntary AI model safety standards with OpenAI, Anthropic, Google, Microsoft, and Amazon, targeting an announcement for 1 August 2026. The package pairs a shared jailbreak severity scoring scale with a 30-day pre-release review window for "covered frontier models," giving federal agencies structured access before those models reach even trusted partners. It arrives one day before the EU AI Act becomes fully applicable on 2 August 2026, setting up a direct comparison between a US voluntary regime and a European statutory one.
TL;DR
- What: Voluntary AI model safety standards for OpenAI, Anthropic, Google, Microsoft, and Amazon.
- When: Announcement targeted for 1 August 2026; stems from the 2 June 2026 executive order.
- Core mechanisms: Cyber Jailbreak Severity (CJS) scale and 30-day pre-release government review for covered frontier models.
- Oversight: NIST and CISA, with NSA involvement on pre-release access. No new federal AI regulator.
- Tension: Critics call it a de facto licensing regime; the executive order disclaims that reading.
- Last verified: 5 July 2026.
What are the White House AI model safety standards?
They are a voluntary framework that five leading AI labs have agreed to adopt for releasing their most capable systems. It does two things: standardises how jailbreak severity is measured across companies, and inserts a fixed pre-release window during which national security agencies can evaluate a "covered frontier model" before it goes to any external partner.
The framework grew out of the executive order Promoting Advanced Artificial Intelligence Innovation and Security, signed on 2 June 2026, which gave federal agencies 60 days to co-design the pre-release process and tasked NIST with building a classified benchmarking pipeline. The 1 August target aligns with that deadline.
Which five labs are adopting the framework?
The initial signatories are OpenAI, Anthropic, Google, Microsoft, and Amazon — the firms running the largest domestic training clusters and the models most likely to be classified as "covered frontier models." The CJS scale itself was co-developed by Anthropic, Amazon, Microsoft, and Google, pushing OpenAI into a standard it did not lead on.
The trigger was the June suspension of Claude Fable 5 exports, where the Commerce Department cited a jailbreak in which the model identified exploitable flaws in a codebase. Without a shared severity framework, each lab reported the incident in its own terms. For context, see our Claude Fable 5 strategic maxing guide.
How does the Cyber Jailbreak Severity (CJS) scale work?
The CJS scale is a five-band, logarithmic scoring system modelled on CVSS (Common Vulnerability Scoring System). It runs from CJS-0 (Informational) through CJS-4 (Critical), with each step representing roughly an order-of-magnitude jump in impact. A score is built from four axes:
- Capability Gain (0-4): How much new offensive capability the jailbreak unlocks versus what a competent user could already obtain.
- Breadth (0-2): How widely the technique generalises across prompts, sessions, or models.
- Ease of Weaponisation (0-2): How much expertise is needed to convert the output into harm.
- Discoverability (0-2): How readily an ordinary user could stumble onto the technique.
A CJS-3 finding is not "one worse" than CJS-2; it is a different class of problem. CJS-3 and CJS-4 are the tiers that would trigger disclosure to NIST and CISA under the new framework.
What is the 30-day pre-release review window?
For any "covered frontier model," the participating labs commit to a 30-day window before external release during which the NSA and CISA get structured access to the model and its evaluation artefacts. The government can also influence which trusted partners receive early access. The 30-day period is a compromise from earlier drafts proposing 90 days; the "covered frontier" threshold is classified, determined by a NIST benchmarking process.
The framework has already been exercised once. OpenAI's GPT-5.6 Sol preview on 26 June was limited to trusted partners at the US government's request, posting 88.8% on Terminal-Bench 2.1 (91.9% in Sol Ultra mode) while matching Mythos Preview's cybersecurity scores on roughly a third of the output tokens.
How does this compare to the EU AI Act?
The scheduling is deliberate. The White House framework targets 1 August 2026; the EU AI Act reaches full applicability the next day. The same five labs will then operate under two regimes: a US voluntary standard enforced through reputation and export controls, and an EU statutory regime with fines tied to global turnover. Enterprise buyers should map vendor obligations against both and factor governance overhead into their AI cost-per-outcome framework before committing to multi-year deployments.
Why are critics uncomfortable with the framework?
The main objection: a voluntary framework with classified thresholds, mandatory pre-release access, and government influence over early partners looks like a licensing regime. Dean Ball, a co-author of the administration's own AI Action Plan, called it "increasingly draconian and opaque" and a "de facto involuntary licensing regime."
The executive order anticipates this, stating nothing in it authorises mandatory licensing, preclearance, or permitting. In practice, the five signatories account for most US frontier training, so a voluntary standard adopted by all functions as a market floor. No new federal AI regulator is created; oversight sits with NIST and CISA, with possible state AI law preemption if Congress acts.
The backdrop matters. Regulators worldwide are treating advanced AI as systemic infrastructure — the RBI flagging AI as a financial stability risk, and allied governments moving on capability access via the India-Japan ten-trillion-yen AI and defence pact. The White House framework is the US entry in a coordinated round of frontier-AI governance.
What should AI teams do before 1 August?
Three concrete steps:
- Adopt CJS internally. Scoring your red-team findings on the CJS axes gives you a common language with vendors and regulators.
- Map your dependency surface. Identify which production paths rely on models likely to be classified as "covered frontier." A 30-day vendor-side review window becomes lead time your roadmap must absorb.
- Reconcile US and EU obligations. Build one internal control set that satisfies the stricter regime rather than maintaining parallel processes.
Some labs have struggled to translate spending into shipped systems — see our analysis of Meta's stalled AI agents and the $145B admission. The new framework will apply most sharply to the labs actually shipping at the frontier.
Frequently asked questions
Q: Is the White House AI safety framework legally binding? A: No. It is voluntary. The executive order explicitly disclaims any mandatory licensing or preclearance requirement, and enforcement relies on reputational and export-control pressure.
Q: Which models count as "covered frontier models"? A: The threshold is classified. NIST is building a benchmarking process, expected within the 60-day window from the 2 June executive order, to define which releases trigger the 30-day review.
Q: How is CJS different from CVSS? A: CJS borrows CVSS's five-band structure and logarithmic scaling but replaces vulnerability-oriented axes with jailbreak-specific ones: Capability Gain, Breadth, Ease of Weaponisation, and Discoverability.
Q: Does the framework preempt state AI laws? A: Not on its own. Preemption would require congressional action. The framework operates through NIST and CISA oversight, with NSA involvement on pre-release access.
Q: How does this affect open-weight model releases? A: The framework centres on API and partner releases from the five signatories, all of which primarily ship closed or partially-open models. Its treatment of open-weight releases has not been detailed publicly.
Q: Will the EU accept US CJS scores? A: No formal reciprocity exists yet. The EU AI Act reaches full applicability on 2 August 2026 with its own conformity assessment regime, so vendors should expect to run both processes in parallel.
Discussion
0 comments