The Artificial Intelligence Executive Order’s First Regulatory Actions: How Safety Assessments Affect AI Startups
Back in 2023, as an entrepreneur, I had the unfortunate experience of witnessing the dismay of a founder in a boardroom presentation, realising that their entire product vision would be obliterated by a simple government memo. As we created our generative model during that transitional period of time, it was apparent that in a short period of time the “move fast and break things” approach was a thing of the past. What had once been strictly programming had evolved into having to secure regulatory assurances regarding the safety of our products from regulators, who in many cases were still learning to differentiate between a neural network and a database.
The Problem: In order for AI start-ups to succeed they must comply with a significant number of federal regulatory requirements and if they are not positioned properly, it could jeopardise the ability to raise Series A financing.
The Constraints: Limited engineering hours (due to short runway), additional time required to satisfy federal regulatory requirements (either as part of their engineering efforts or prior to launching products), and the requirement for transparency in the regulatory authorities (without negatively impacting product innovation timelines).
The Solution: Compliance needs to be treated as a core part of the overall product development process vs a legal obligation and therefore companies should implement the following in their product development processes: embed the NIST AI Risk Framework into their product development processes.
Prerequisites and Context
Companies attempting to validate compliance with federal regulators must first have an understanding of and controls in place for their infrastructure. This starts with knowing how much compute you are using in FLOPS (floating-point operations), maintaining a complete inventory of your training datasets, and creating a version-controlled repository of your model weights. If you are using an external cloud provider (such as AWS or GCP), you should also ensure that you understand their AI compliance documentation so that your hardware does not inadvertently cause your application to trigger a reporting threshold that you are not already tracking.
Navigating the New Regulatory Landscape: The AI Executive Order’s First Regulatory Actions
Understanding the AI Executive Order Business Regulatory Impact 2026
Previously, organizations could request information about safety protocols using the phrase, “please exercise caution.” Effective immediately, those organizations will face criminal consequences if they do not provide evidence regarding their safety protocols. Therefore, if you do not have bills to audit or audits archived, you are no longer considered in compliance with federal regulations.
The Shift from Voluntary Guidelines to Mandatory Compliance
In the past, organizations thought of safety as an element of good business (i.e., “nice to have”), but now safety is considered part of the law. All organizations whose models reach a certain level of gross revenue must legally provide safety reports on their models to) The USA. This is mandatory for all organizations conducting business in the United States and therefore must adhere to this mandatory legal obligation.
Defining the Compute Threshold Reporting Requirements
The government determines which organizations are subject to the requirements for compute thresholds based on their ability to pay for training of their model using electricity (i.e., number of FLOPS); therefore, should your model exceed the number of FLOPS set by the federal government, then you must provide a report of your training session(s) or alphabetically as well.
Identifying Which Startups Fall Under the “Frontier Model” Classification
Organizations that have trained on sufficiently large clusters are considered “frontier models” regardless of company size or gross revenue. More importantly, if your model can perform at levels comparable to those of your competitors with gross revenue exceeding the threshold defined by federal regulations, your organization will be classified as a “frontier model.”
Operationalizing the NIST AI Risk Framework for Compliance
Integrating Risk Management into the Software Development Lifecycle (SDLC)
Do not wait until the end of the process to evaluate risk. Use the NIST AI risk framework to identify potential failure points during the design stage.
- Map: Find out where your AI system is intended to be used.
- Measure: Document the different benchmarks internally to determine the level of risk that each point poses.
- Manage: Use controls to mitigate risk based on previous measures.
Establishing Internal Governance for Model Training Data Disclosure
It is essential to have an accurate record of the source of your data. Without being able to clearly show where your data comes from, there is no way to pass the audit of model training data disclosure. Record every source, license, and cleaning step taken, along with the date of these actions, so that there is a record, or ledger, for every source.
[Compliance Dashboard Mapping Example]
- NIST Category: Governance -> Internal Milestone: Data Provenance Audit
- NIST Category: Mapping -> Internal Milestone: Model Architecture Review
- NIST Category: Measurement -> Internal Milestone: Red-Teaming Results
Mandatory Safety Protocols: Red-Teaming and Pre-Release Certification
Implementing the AI Red-Teaming Requirement for Vulnerability Assessment
The AI red-teaming requirement is a perfect opportunity for you to get assistance from professionals that are not related to your company. Pay them to try and break your model. If they can produce harmful content from the data provided to them, you will have access to a solution to correct your shortcomings before being detrimental to the public.
Navigating the Pre-Release Certification Process for High-Risk Models
Before any product developed by your organization can be launched, you must first complete the pre-release certification process. The pre-release certification process requires that you provide the relevant government regulatory agencies with copies of your safety compliance report before conducting your product launch. While this represents an additional check, once approved, all of the relevant governmental agencies will support your product and have the trust and respect of your clients.
[Pre-Release Audit Workflow]
- Internal Testing: As part of your internal testing procedures, you should run your model(s) through different types of stress tests.
- Red-Teaming: Have independent testers (‘red teamers’) stress test your model(s) in order to expose any edge cases that you may not have found on your own.
- Documentation: Create a formal report documenting the results of all testing procedures and any edge cases found by independent testers.
- Submission: Send the final testing report to the appropriate regulatory body for their review.
Technical Implementation of Deepfake Watermark Mandates
Embedding Cryptographic Provenance in Generative Outputs
You are required to prove that content has been generated via artificial intelligence (AI) using a cryptographic signature or watermark that will remain with the file after editing/compressing it under the new deepfake watermark mandate.
Managing Metadata Standards for Compliance with Federal Transparency Rules
Using standard metadata formatting will help ensure that your files remain readable in both web browsers and social media platforms that will collectively be required to comply with federal regulation regarding transparency.
[Media File Comparison]
- Standard File: No metadata associated with the media file. Can be easily manipulated and produces no evidence/provenance of its origin without relying on outside sources (e.g., creator).
- C2PA-Compliant File: Contains a cryptographically signed manifest, identifying the model version, training date, and creator.
Edge Case: Managing Export Controls and Cross-Border Compute Access
Navigating Restrictions on Frontier Models for International Clients
There are stringent export controls on frontier models. You cannot simply sell your model(s) to anyone or anywhere in the world; therefore it is imperative that you vet your international customers/clients to ensure they do not appear on any restricted lists.
Workarounds for Distributed Training Infrastructure in Regulated Environments
If you plan to utilize a distributed training infrastructure, you must ensure your computing nodes are all located within an approved jurisdiction. When using a service that offers the ability to store data in different jurisdictions, you should restrict yourself to the data centers in the jurisdictions you are based in to avoid unintentionally exporting your data outside of the geographical area you were expecting to.
Strategic Best Practices for AI Startups to Maintain Agility
Building a “Compliance-by-Design” Engineering Culture
When hiring an engineer, don’t simply hire a compliance officer and expect them to do their job. Make sure your engineers care about their ability to build safe products and that they hold themselves accountable for compliance with applicable regulations whenever they’re creating a new product/feature, for example: “Will this new product/feature comply with our safety standards?”
Leveraging Regulatory Sandboxes to De-Risk Innovation
When looking for funding for your startup, try finding government-backed regulatory sandboxes. They allow you to trial your models safely without worrying about regulators imposing harm on your startup, which allows you to remain innovative in the marketplace.
[Startup Compliance Checklist Template]
- Are you accurately tracking your use of compute against federal limits?
- Have you verified/documented your sources of data for training?
- Have you completed a report from a red-team on this version prior to releasing it into production?
- Do you have watermarking turned on for all generative outputs?
Lessons Learned the Hard Way
There was a time in my career when I built an amazing piece of technology in the form of a new product/feature that I couldn’t launch because I hadn’t consulted on the applicable compute threshold reporting requirements prior to beginning my training run on the data; therefore, I was required to discard my entire training run and start over with a different more efficient and technically sound training method. This taught me that, in this industry, the smartest engineer is not the engineer who writes the most intricate algorithms or builds the most complex products; instead, they are the engineers who understand the boundaries of the regulatory environment before writing code.
Frequently Asked Questions
How do compute threshold reporting requirements specifically impact early-stage startups that use cloud-based GPU clusters?
As a startup, you are charged for your computational workload, even if you don’t own any of the hardware. If you exceed your compute threshold during your model’s training process, the onus is on you—not the cloud service provider—to report that to the regulatory authority in order to comply with applicable guidelines.
What are the legal liabilities for founders if a model fails a mandatory safety assessment post-deployment?
If you release a product that has not undergone a mandatory safety assessment, you will have significant liability and may be subject to harsh penalties (possibly totaling millions of dollars in the case of large liabilities).
Does the deepfake watermark mandate apply to internal-use-only AI tools or only to public-facing products?
Generally, the requirements are only applicable to those products available to the general public. However, if your internal AI solutions create materials that will ultimately be exposed to the public, you should assume compliance with these rules.
