Your voluntary framework is now a liability.

In the United States, the executive order signed on June 2 stood up a review process for frontier AI models and made it optional. Developers can submit a model before they ship it, and none of them are required to. A few weeks later the Five Eyes agencies warned companies to move now, because the dangerous capabilities are arriving in months rather than years.

This is a U.S. shift, and only a U.S. shift. In the EU, the AI Act's high-risk obligations become enforceable in August, and other jurisdictions are tightening their own rules. Inside the U.S. market, the risk keeps climbing while the rulebook goes quiet.

Where the bar goes when Washington steps back.

When the government stops setting a floor, the floor does not disappear. It gets set by whoever has leverage in the deal. The cyber insurer. The auditor. The biggest customer, halfway through a vendor review. The board asking hard questions.

If you are buying.

You can no longer point to a federal rule and call the question closed. The safer move is to decide, on purpose, what standard you hold yourself to, and to write it down before a customer or an underwriter writes it for you. Ask any vendor how they help you defend that standard, not only how they check a box.

If you are selling.

Compliance language got weaker in June. The providers who win now help a customer form a defensible position and stand behind it, in words that survive a board meeting. Read your homepage and your deck, and find where the term compliance is doing the arguing. Put judgment there instead.

An optional review still leaves a floor. Whoever holds leverage over the deal is the one setting it now.

The rulebook went quiet even as expectations kept climbing. Both sides of the table feel it: buyers who need a reason to trust, and builders who need a reason to be trusted. Whoever names the new bar clearly, and early, gets to define what responsible looks like in the space the law left open.