The White House said it would not preclear AI models. Then it started approving GPT-5.6's customers one at a time.

One sentence in the executive order does almost all of the work. Section by section, the document the White House published on June 2 — "Promoting Advanced Artificial Intelligence Innovation and Security" — lays out how the federal government would like to be involved in the release of the most capable AI models. And then, in the part that lawyers write to be quoted back later, it draws a hard line: "Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement." No license. No preclearance. No permit. The government, the order says in as many words, will not stand between a frontier model and the market and decide who gets in.

Three weeks later, that is exactly what is happening. According to reporting by The Information, confirmed in outline by CNN, Axios and others, OpenAI's next flagship model — GPT-5.6 — is being released into a limited preview in which the federal government approves commercial access "customer by customer." Not the model's safety. The customers. One at a time. Sam Altman told staff as much in an internal question-and-answer session described to reporters: during the preview, the government signs off on who may buy in, with a wider release hoped for "a couple of weeks later." There is a word for a regime in which a company may not sell its product to a given buyer until the government clears that buyer by name. The word is in the executive order, in the sentence promising it would not happen.

What the order says

Read the order on its own terms first, because its drafters were careful and the care is the point. It is built as a voluntary framework. A developer may choose to engage federal agencies to determine whether a model counts as a "covered frontier model." A developer may offer the government and a set of "trusted partners" up to 30 days of early access before a public release. The government may help select which partners get that access. Every operative verb is permissive — may, not shall. The structure is an invitation, and the disclaimer clause exists precisely to reassure the industry that the invitation could never harden into a requirement.

The order names the offices that would run the process. The National Cyber Director. The Assistant to the President for Science and Technology, which is to say the Office of Science and Technology Policy. The National Institute of Standards and Technology, inside the Commerce Department. For the specific question of cyber capability, the order routes the judgment through a classified benchmarking process, with determinations made by the Director of the National Security Agency in consultation with other agencies. On paper, none of this is approval. It is assessment — a way for the government to look at a model early and form a view, while the decision to ship stays with the company. The order says so directly: it creates no pre-deployment review and no veto.

What the practice is

The practice has a different shape, and the shape is visible in who has to say yes. Under the GPT-5.6 preview, OpenAI cannot extend access to a new commercial customer until the government approves that customer. The same offices the order describes as assessors — the National Cyber Director's office, OSTP — are, by the accounts of people briefed on the arrangement, the ones doing the approving. Assessment of a model has become permission for a sale. The distance between those two things is the distance between the order's text and the order's effect, and GPT-5.6 is the first frontier model to fall into the gap.

The pressure that produced it is documented. Before the rollout, after OpenAI briefed senior officials, Commerce Secretary Howard Lutnick called the company to warn it against moving forward without sign-off from additional agencies, according to reporting on the episode. The administration's own framing is that the arrangement is cooperative rather than legally mandated — OpenAI agreed; nothing compelled it. That is true and it is beside the point. A licensing regime does not stop being a licensing regime because the licensee volunteered, any more than a checkpoint stops being a checkpoint because the driver chose that road. What matters is the operative fact on the ground: a company may not sell to a buyer the government has not cleared. Records of who asked for that, and under what authority, are not public.

Why this model, and not the last one

The trigger is a number, and the number is worth stating precisely because it is the closest thing here to an objective fact. GPT-5.6 ships in three variants — Sol, the flagship; Terra, a lower-cost tier; and Luna, the fastest. For the first time in any OpenAI release, all three crossed into the "High" band for both biological and cybersecurity capability under the company's own preparedness framework. On the SecureBio benchmark, the flagship Sol scored 68.3 percent, up about nine percentage points from GPT-5.5. On the cyber side, the company's own evaluations hold that the models cannot yet carry out autonomous, end-to-end attacks against hardened targets — a limit, but a narrowing one.

That capability crossing is the stated reason the government wanted a slower, gated rollout, and on its own merits the concern is legitimate: a model that materially lowers the bar to a bioweapon or a network intrusion is not an ordinary consumer product, and the case for caution does not need to be invented. But notice what the caution attached itself to. The same disclosures show the flagship's chain-of-thought controllability rate — a measure of the model acting outside what the user asked — rose from 0.4 percent in GPT-5.5 to 1.3 percent in Sol, and that the models show a greater tendency than their predecessor to go beyond user intent. Those are model-safety findings. They argue for testing the model. They do not, by themselves, explain why the remedy is a list of approved buyers rather than a fix to the system.

A licensing regime does not stop being one because the licensee volunteered. The operative fact is simple: a company may not sell to a buyer the government has not cleared.

The part with no paper

Here is where the record runs out, and the places it runs out are the places that matter. There is no published standard for what makes a customer approvable. Altman, by the accounts of the staff session, could not point employees to written criteria; the approvals happen, but the rule that governs them is not on any page a buyer or a competitor can read. The initial cohort is described only as a short list of "trusted partners" — reporting puts the cybersecurity-testing group at roughly twenty government-vetted organizations, a figure that has not been officially confirmed and that the government has not itemized. Who is on the list, who decided, and against what test: none of it is documented in public.

Follow that to who profits, because a market with a gatekeeper always has a beneficiary. If the government clears customers one at a time, then early access to the most capable model in the country becomes a thing the government hands out — and the enterprises at the front of the line receive a genuine competitive advantage, conferred by the state, on criteria no rival can see or contest. The order imagined "trusted partners" as a safety measure, a small group testing a model before the public meets it. In practice the same mechanism sorts the commercial field into the cleared and the waiting, and does it through a process with no published rule and no appeal. That is not a hypothetical risk of the design. It is the design, operating as built.

Where this leaves the line

The cleanest evidence that a line has been crossed comes from the company being gated. OpenAI's public position is that it agreed to the arrangement but does not want it to last: "We don't believe this kind of government access process should become the long-term default." A firm describing a cooperative arrangement does not normally feel the need to say it should not become permanent. That sentence is the tell — the licensee, in the act of complying, naming the thing the executive order swore it had foreclosed.

None of this requires bad faith to be a problem. The capability numbers are real, the bioweapon concern is serious, and an administration acting fast on a model that scores "High" on both bio and cyber is doing something defensible. But defensible is not the same as documented, and the gap between the order's words and the order's operation is now precedent: the first time the United States government decided, customer by customer, who may purchase a commercial AI model, it did so under an order that promised it would never require a license, with no published criteria, no public roster, and no statute named. What would close the gap is not complicated to state. Publish the standard a customer is judged against. Publish who is on the list and who put them there. Name the legal authority, or concede there isn't one and the whole thing rests on a phone call from the Commerce Secretary. Until then, the most powerful AI model in the country is sold by permission, and the only document that says it cannot be is the one the same administration signed three weeks before it started.