Executive Order 14409 on frontier AI cybersecurity

What the order says it is for

Executive Order 14409, titled "Promoting Advanced Artificial Intelligence Innovation and Security," is dated June 2, 2026. The Congressional Research Service (CRS) summarizes it this way: the order directs agencies to harden federal government infrastructure against AI-enabled risks and to work with the private sector to strengthen AI security.

The order's own policy statement is specific about method. It says it is the policy of the United States to work collaboratively with the private sector to modernize information systems and harden them against external threats.

CRS says the order frames AI as both a strategic asset and an emerging attack vector.

Tasks and deadlines

The order sets two sets of deadlines, 30 days and 60 days from June 2, 2026. CRS converts these to July 2, 2026 and August 1, 2026. Its task list opens with the Committee on National Security Systems, which must prioritize cybersecurity of National Security Systems within 30 days.

The order also tasks the Secretary of War with prioritizing the cyber defense of Department of War information systems on the same 30-day clock.

Several other 30-day tasks reach beyond the federal government:

• The Secretary of Homeland Security, through CISA and in consultation with OMB, the national security adviser and the National Cyber Director, must release Binding Operational Directives and other guidance as appropriate. One purpose is to facilitate access to cybersecurity tools and services, including covered frontier models where appropriate, for agencies, State and local authorities, and critical infrastructure operators such as rural hospitals, community banks and local utilities.
• The Secretary of the Treasury must form an AI cybersecurity clearinghouse, working in voluntary collaboration with the AI industry and critical infrastructure operators. The order says the clearinghouse coordinates and deconflicts scanning for software vulnerabilities.

The Treasury Secretary is to act in consultation with the National Cyber Director, NSA and CISA. The clearinghouse also discovers and validates vulnerabilities and coordinates remediation and patch distribution. The order adds two smaller items. OMB is to determine whether federal grant funding can be directed toward advanced AI vulnerability detection, and OPM has 60 days to expand U.S. Tech Force cybersecurity specialist hiring pathways.

Covered frontier models and the voluntary framework

Section 3 of the order covers frontier model deployment and has a 60-day deadline. The Treasury, War and Homeland Security secretaries, working through NSA and CISA, must develop and maintain a classified benchmarking process. The order says the process assesses the advanced cyber capabilities of AI models.

The same process sets the threshold at which a model is designated a "covered frontier model." The order puts that determination with the Director of NSA.

The same section requires a voluntary framework with AI developers. Under it, developers could ask the government whether a model under development qualifies as a covered frontier model. They could also give the government access to such models, subject to confidentiality, cybersecurity, insider-risk and intellectual-property protections, for up to 30 days before release to other trusted partners.

Developers and the government would also collaborate on selecting trusted partners with early access, in order to strengthen the cybersecurity of critical infrastructure.

The order limits the reach of this section. It states that nothing in the section authorizes a mandatory licensing, preclearance or permitting requirement for developing, publishing, releasing or distributing new AI models, including frontier models.

Criminal enforcement and legal limits

Section 4 turns to criminals who use AI. The Attorney General is to prioritize enforcement of 18 U.S.C. 1028, 1030 and 1343, along with other applicable federal criminal laws, against anyone who uses AI to illegally access or damage a computer without authorization.

CRS notes this task is ongoing and has no stated due date.

The general provisions set the order's limits. It is to be implemented consistent with applicable law and subject to the availability of appropriations.

The earlier step: EO 14144 and EO 14306

CRS describes the cybersecurity background in a June 2025 Insight. EO 14144, "Strengthening and Promoting Innovation in the Nation's Cybersecurity," was issued by the Biden Administration in January 2025.

According to CRS, many of its efforts did not start or were not taken up by the Trump Administration, because it came out in the final days of that administration.

EO 14306 did not revoke earlier cybersecurity orders. CRS says it kept the text of EO 14144 and EO 13694 in place and made line edits.

CRS says the effect was to reduce federal agencies' involvement in shaping national cybersecurity posture and to give the private sector more influence.

CRS gives one concrete example. EO 14144 had required contractors to attest to secure software development practices. EO 14306 removed that requirement and, CRS says, contractors are instead encouraged to voluntarily adopt NIST guidance.

CRS's list of what EO 14306 changed also includes limiting agency AI work to cybersecurity automation. The Insight closes by listing matters Congress might scrutinize, including how the nation shall employ AI technologies for cybersecurity.

How EO 14409 relates to that narrowing

CRS places EO 14409 in a sequence. It calls the order the latest in a series of executive orders addressing AI and cybersecurity.

The CRS explainer on EO 14409 does not describe the order as amending EO 14306 or EO 14144. What it describes is a different mode of action. Where CRS says EO 14306 reduced federal involvement, the CRS explainer on EO 14409 says the order directs federal entities to complete a list of tasks.

CRS also places the order within existing practice. It says EO 14409 broadly appears to continue an approach that has focused largely on voluntary benchmarks and evaluations of AI systems, public-private partnerships and agencies' existing authorities.

That fits the order's own text, which makes the frontier model framework voluntary and rules out a licensing requirement.

Gaps CRS flags

CRS's July 9, 2026 explainer lists several open points. First, it says implementation details are left open.

Second, it flags funding. It says the order relies on existing appropriations, which leaves unclear how new requirements such as the clearinghouse and expanded tools for states and local authorities would be funded.

Third, CRS says the voluntary design carries a risk of uneven coverage.

CRS also notes that concentrating sensitive model details and cyber-threat data in federal systems could itself create a target for malicious actors.

For security teams, the order's near-term dates are July 2, 2026 for the 30-day tasks and August 1, 2026 for the 60-day tasks, according to CRS. The framework for sharing frontier models ahead of release depends on a threshold that, per CRS, the order itself does not define.