Policy

The decision · If your AI products or services are accessible in the EU, audit your compliance status against Article 50 obligations within 30 days. The grace period closes December 2, 2026. The enforcement infrastructure is incomplete, but the regulation is active. Non-compliance carries fines up to 3% of global turnover, and the EU has a track record of enforcing technology regulations aggressively.

The decision · Inventory what your company is building with frontier models before Q4. If your stack depends on models that are accelerating beyond the capacity of your security team to audit, that gap gets wider every month. The people building these systems are telling the government they want a brake pedal. Assume the people downstream from those systems will eventually get one. Plan your infrastructure so switching costs do not trap you when the terms of access change.

The decision · If your security team uses a frontier model API for incident response, test whether it will analyze exploit logs within 48 hours. If guardrails block the analysis, stand up an open-weight model on your own infrastructure as a forensic fallback. The 50-company alliance is shipping tools this quarter. Your incident response pipeline either works under real attack artifacts or it does not. One loose thread: the alliance has no announced governance structure yet. Fifty-plus companies with competing interests and no chair, no working groups, no roadmap. The tools are real. The coalition's staying power is unproven.

The decision · If Anthropic or Amazon is your primary model provider, request their public policy position on open-weight model regulation in writing within 30 days. The open-weight letter now has 90-plus signatories across the full AI stack. The asymmetry between a signed public letter and public silence is the procurement leverage. If your provider cannot produce a policy position you can cite in a vendor review, start building the routing layer to an open-weight fallback. The compliance frameworks that govern model procurement in regulated industries update in Q4. Be on the right side of the paper trail before they do.

The decision · By August 1, inventory every model dependency in your production stack and label each: "coalition behind it" or "no coalition behind it." The 90-plus signatory list is now a de facto regulator. Models without a coalition face procurement risk in Q4 when compliance frameworks update. If Anthropic or Amazon is your primary provider, ask for their public policy position in writing. If they cannot produce one, start building the routing layer to an open-weight fallback. The asymmetry between a public letter and public silence is the procurement leverage. Use it.

The decision · Audit your open-weight exposure this week. Vector 1: are any of your workloads routing through a Chinese open-weight model (Kimi, Qwen, DeepSeek, GLM)? If yes, document the procurement and data residency posture before a sanctions decision lands. Vector 2: does your org fine-tune Llama or Mistral on-prem? If the open-weight carve-out collapses, that work moves to whatever model is still licensable, and the open question is whether that license is Chinese. Vector 3: build the routing layer now, not later. The decision is not "which model." The decision is "which model for which task." The policy fight in Washington is deciding which models are even available for that routing decision in six months.

The decision · If your organization develops or deploys models that interact with US-controlled APIs, harden your compliance documentation within 60 days. The White House is drawing a new line between authorized distillation and IP theft. Assume every model interaction with US frontier APIs will eventually require an audit trail. Build one now.

The decision · Map your organization's federal AI science opportunity within 30 days. With 278 projects funded and phase two awards coming later this year, the contractors, dataset providers, and infrastructure vendors who position now will own the supply chain for the first wave of federally funded AI-for-science deployment. The 342 participating institutions are already building their teams. The window to partner closes fast.

The decision · If your stack touches a Chinese open-weight model, run a 3-vector audit by July 31. Vector 1: procurement policy. Does your legal team have a position on Chinese-sourced inference, and what happens to your contracts if the lab hits the Entity List. Vector 2: liability. If you host open weights and a security advisory drops, is the liability yours or the upstream provider's. Vector 3: WAICO exposure. If your go-to-market includes Global South economies, does the Chinese governance framework create compliance obligations your current stack does not meet. The ban is not the trigger. The bifurcation is. The enterprises pausing integration already understand this.

The decision · If you build on top of a frontier model, your release calendar now inherits the lab's government-coordination timeline. Build a two-week buffer into any roadmap tied to a new model launch.