Congress has not passed explicit regulation of AI foundation models, and an executive order from President Trump limited regulation at the state level. But do not think that laissez-faire reigns. In addition to existing (largely pre-AI) laws, which lay out general principles of liability, and laws from a few states, the United States is engaged in a kind of “off the books” soft regulation.

The major AI companies keep the national security establishment apprised of the progress they are making, as has been the case with Anthropic. There is a general sense within the AI industry that if the national security authorities saw anything in the new products that was very concerning or that might undermine the national interest, they would inform the president and Congress. That would likely lead to more formal and more restrictive kinds of regulation, so the major AI companies want to show relatively safe demos and products. An informal back and forth enforces implied safety standards, without the involvement of formal legislation.

That may sound like an unusual way to do regulation, but to date the system has worked relatively well. For one thing, I believe our national security establishment has a better and more sophisticated understanding of the issues than does Congress. Congress right now simply isn’t up to the job, as indeed the institution has been failing more generally. Most representatives seem to know little about the core issues behind AI regulation.

As it stands, AI progress has been allowed to proceed, and the United States has stayed ahead of China, without major catastrophes. The burden on the companies has been manageable, and the system, at least until last week, was flexible.

Another advantage of this system is that both Congress and the administrative state can be very slow to act. The AI landscape can change in just weeks, yet our federal government is used to taking years to issue laws and directives. Had we passed AI legislation in, say, 2024, today it would be badly out of date, no matter what your point of view on what such regulation should accomplish. For instance, in 2024 few outsiders were much concerned with the properties of, or risks from, autonomous AI “agents.” Today that is the number-one topic of concern.

Though it is not driven by legislation, the status quo AI regulatory system is not anti-democratic, as it operates well within the rules passed by Congress and the administrative state. It is more correct to say the current AI guardrails rely on the threat of regulation, rather than regulation itself, with the national security state as the watchdog. The system sticks to a kind of creative ambiguity. The national security state offers no official imprimatur for the new advances, but they proceed nonetheless. Nevertheless, the various components of the national security state reserve the right to object in the future.

It is also correct, however, to believe that such a system cannot last forever. At some point creative ambiguity collapses. Someone or some institution demands a more formal answer as to what is allowed or what is not allowed. At that point a more directly legalistic system of adjudication enters the picture, and Congress likely starts paying more attention.

With the recent dispute between Hegseth and Anthropic, we have taken a step away from the previous regulatory mode of quiet cooperation. Instead, the relationship between the military and the AI companies has become a matter of public concern. Now everyone has an opinion on Hegseth, Anthropic, and OpenAI, and social media is full of debate.