The Great American AI Act: Federal Frontier Model Oversight, a 3-Year State Law Freeze, and What It Means for Builders

On June 3–4, 2026, Representatives Jay Obernolte (R-CA) and Lori Trahan (D-MA) released a 269-page bipartisan discussion draft called the Great American AI Act (GAAIA). Roll Call and FedScoop both confirmed the June 4 release. It is not yet a formal bill — the sponsors are soliciting input before introducing it — but it signals where federal AI regulation is heading and what the compliance landscape could look like within the next twelve to twenty-four months.

The short version for most builders: if your company makes under $500 million a year in gross revenue, the core obligations do not apply to you. But the bill’s state law preemption provision would simplify — and in some cases eliminate — the patchwork of state AI development requirements you are currently tracking.

What the Bill Does

The GAAIA creates a federal framework for frontier AI developers built around four pillars: mandatory transparency, independent auditing, a new federal standards body, and a three-year freeze on state AI development laws.

Who Is a “Frontier Developer”

The substantive obligations target large frontier developers — defined in the discussion draft text (Sec. 101(15)) as companies with more than $500 million in gross revenue in the previous calendar year. That threshold explicitly exempts the vast majority of AI startups, independent developers, and open-source projects from the reporting and audit requirements.

If your company crosses that threshold, the following apply. If it does not, the federal preemption of state development laws is still relevant to you, but the compliance machinery is not.

The Four Core Obligations for Frontier Developers

1. Frontier AI Framework (Public Document)

Before or concurrent with deploying a new frontier model, large frontier developers must publish a Frontier AI Framework (Sec. 111) covering:

Risk thresholds and assessment procedures for catastrophic risk — defined in the draft text (Sec. 101(6)) as a foreseeable and material risk of death or serious injury to more than 50 people, or more than $1 billion in property damage or loss
Cybersecurity of nonpublic model weights
Internal and external deployment decision criteria
How the developer responds to critical safety incidents
How the developer manages catastrophic risk from the model’s internal use, including risk from the model circumventing an oversight mechanism

The framework is a public document. This is closer to a structured disclosure requirement than a licensing regime — you publish your risk posture, not ask permission to deploy.

2. Pre-Deployment Reporting

Before or simultaneously with any new frontier model deployment (Sec. 111), developers must publish a report disclosing:

Field	Required
Release date	Yes
Supported languages	Yes
Output modalities	Yes
Intended use	Yes
Use restrictions	Yes
Risk assessments	Yes
Mitigation steps taken	Yes

3. Incident Reporting

Developers must file a report with CAISI (Sec. 111):

Incident Type	Reporting Window
Critical safety incident	Within 15 days
Imminent risk of death or serious injury	Within 24 hours

The 24-hour window for imminent-risk incidents is aggressive. At frontier scale, this implies real-time safety monitoring infrastructure with defined escalation paths — not something that can be built after the fact.

4. Independent Verification Organizations (IVO Audits)

Frontier developers must retain an Independent Verification Organization — a third-party auditor licensed by the new Center for AI Standards and Innovation (CAISI) — to conduct semi-annual audits of compliance (Sec. 112(b): first audit within one year of enactment, then every six months). IVOs must have sufficient access to company materials and report findings to CAISI.

Non-compliance penalties: up to $1 million per day while the violation continues (Sec. 111). Material misrepresentations trigger the same ceiling.

The New Standards Body: CAISI

The bill codifies and expands the Center for AI Standards and Innovation within the Department of Commerce, currently housed at NIST. CAISI would be led by a Secretary-appointed Director and authorized at $100 million per year for fiscal years 2027–2029 — an order of magnitude above its current ~$15 million appropriation, per Rep. Trahan’s office.

CAISI’s responsibilities include:

Developing voluntary guidelines, best practices, and standards for adversarial robustness, interpretability, supply chain threats, and model tampering
Testing and evaluating frontier AI systems
Administering the IVO certification and auditing regime
Coordinating with federal agencies and international standards bodies
Running AI security testbeds (in partnership with DOE and federal labs), including a public hackathon component

This is not a new agency — it is an expansion and codification of existing NIST infrastructure. That distinction matters for implementation speed. Commerce does not need to stand up something from scratch.

State Law Preemption: The Three-Year Development Law Freeze

The most contested provision: the bill would preempt state laws “specifically targeting the development” of an AI model (Sec. 121), with a three-year sunset.

Key nuances matter here:

Preemption covers development laws only — not deployment or use laws
States retain full authority over AI employment discrimination, consumer protection, housing, and other use-focused legislation
Laws of “general applicability” that touch AI indirectly are not preempted
The three-year sunset means this reverts to the pre-bill state-by-state dynamic in 2029 unless Congress acts again

California-specific effects: Per Rep. Trahan’s office FAQ on the draft, AB 2013 (requiring model developers to publicly post training data summaries) and the development-stage watermarking portion of SB 942 would be preempted.

Colorado: Already substantially changed — Colorado SB 189, signed by Gov. Jared Polis on May 14, 2026, repealed and replaced the Colorado AI Act, removing the duty of care, risk management programs, and impact assessments in favor of a lighter, disclosure-based framework centered on automated decision-making technology. By the time GAAIA would take effect, Colorado’s landscape will already have shifted.

Context for the three-year duration: The Senate struck a 10-year AI moratorium from the budget reconciliation bill (the One Big Beautiful Bill Act) in July 2025 by a 99-1 vote. Obernolte and Trahan are proposing a narrower scope (development only, not deployment) and a shorter timeframe (three years, not ten) in the wake of that rejection. Whether that narrowing is enough to survive Senate scrutiny is an open question.

Open-Source Carve-Out and Funding

Open-source developers are explicitly outside the frontier developer obligations. The bill goes further (Sec. 311): CISA, in consultation with CAISI, would be authorized to award grants to eligible maintainers of widely used, critical open-source software for security work — patching, maintenance, security audits. Large frontier developers would also be required to provide those maintainers with AI model access for cybersecurity purposes.

This is a notable structural choice — federal funds flowing to open-source AI security maintainers, not just creating compliance burdens for them.

Current Status

The GAAIA is a discussion draft. It has not been formally introduced as a bill. There is no committee referral, no markup scheduled, and no stated timeline for formal introduction.

The sponsors are soliciting input at: GAAIA@mail.house.gov

This is not window dressing — the 99-1 Senate vote against the 10-year moratorium gave both parties reason to tread carefully on federal preemption. Obernolte and Trahan appear to be genuinely road-testing the proposal before committing it to the legislative process.

Opposition

The preemption provision drew immediate organized opposition:

Public Citizen called it “a disastrous proposal that Big Tech is celebrating,” with AI governance counsel J.B. Branch arguing the bill leaves algorithmic discrimination, housing and employment discrimination, consumer fraud, youth mental health harms, AI companions, and deepfakes unaddressed.
AFL-CIO issued a formal “hard no” statement opposing preemption of state authority to regulate AI development. American Federation of Teachers President Randi Weingarten, in a joint statement with AFA-CWA President Sara Nelson, called the bill “a giveaway to the AI industry and a handful of trillion-dollar companies, at the expense of American workers.”
A coalition of 40+ civil society organizations publicly urged Trahan not to co-sponsor the preemption provision before the draft was released.
Americans for Responsible Innovation ran paid advertising in Massachusetts specifically targeting Trahan.
A bipartisan group of more than 200 state lawmakers from 42 states signed a letter condemning federal preemption of state AI development laws.

Industry reception was more favorable in tone. ITI — via CEO Jason Oxman — welcomed the bill’s codification of the National AI Research Resource (NAIRR) and its international AI-standards leadership provisions. BSA called the draft “a credible and substantive effort” and said it “looks forward to sharing input on provisions related to model definitions, regulatory thresholds, and auditing and reporting requirements.”

Builder Checklist

If your company makes under $500M/year in gross revenue:

Monitor — you are not directly regulated, but the policy direction tells you where federal attention is focused.
If the state preemption passes, your compliance scope for AI development obligations narrows to federal-only for three years — watch which state development laws drop off your tracking list.
State deployment and use laws (employment discrimination, consumer protection, etc.) remain fully in effect regardless of GAAIA.
Open-source developers: watch for CISA/CAISI funding opportunities for AI security work.

If your company is approaching or exceeding $500M/year:

Map your current incident response times against the 24-hour imminent-risk reporting window. This requires infrastructure — not just policy.
Assess what your Frontier AI Framework would need to say. The catastrophic risk definition (50+ deaths or $1B+ property damage) is the key threshold for the most serious obligations.
Start identifying what a semi-annual IVO audit regime would look like for your model deployment pipeline. IVO certification doesn’t exist yet (CAISI has to build that program), but the structure is clear enough to begin planning.
The $1M/day non-compliance penalty is serious. Build compliance tracking now rather than retroactively.

For all builders:

The GAAIA’s passage is not guaranteed. The Senate’s 99-1 rejection of the broader moratorium and the organized opposition to the preemption provision make this a genuine legislative fight. But the bill’s framework — tiered obligations, independent audits, mandatory public disclosure — reflects where federal AI governance is converging. Even if GAAIA stalls, a successor bill will likely draw on the same architecture.