The White House Found 60 Pages on How It Vets Frontier AI. It Released None of Them

The federal government’s process for reviewing powerful AI models before release is now on paper, and a court-supervised search has found it. The public still cannot read a word of it. On Friday, October 30, the White House Office of the National Cyber Director (ONCD) told the watchdog group Protect Democracy Project that a search had turned up roughly 60 pages of records about the administration’s voluntary pre-release AI review framework, its GOLD EAGLE clearinghouse and the companies cleared as “trusted partners.” Every page was withheld in full.

The letter came on the date the government had agreed to in a federal lawsuit. Instead of documents, Protect Democracy received a Vaughn index, the list an agency must provide describing each record it withholds and the legal basis for doing so. That index is now the most detailed public account of how Washington vets frontier models, and it says more than the government probably intended.

What the government said on October 30

The production letter and Vaughn index, which Protect Democracy has posted with the recipient’s name redacted, were issued by ONCD’s FOIA team on behalf of all four defendants: ONCD, the Office of Science and Technology Policy, the Commerce Department’s Bureau of Industry and Security and the Treasury Department. The letter says the agencies searched their systems, found “approximately 60 pages of potentially responsive material,” and concluded that “all responsive materials are exempt from FOIA.” The summary line is blunt: “Withheld in full: 60 pages (30 records).” The letter also states that this “constitutes Defendants’ full production” under the parties’ agreement.

Four exemptions in the Freedom of Information Act are cited:

• Exemption 1 (national security). The letter says disclosure “reasonably could be expected to cause grave damage to national security.”
• Exemption 3 (withheld by statute). The agencies say some records are cyber threat indicators or defensive measures shared under the Cybersecurity Information Sharing Act of 2015, which bars their release.
• Exemption 4 (confidential commercial information). The records include “customer identities” that the private companies that submitted them treat as private.
• Exemption 5 (privileged internal material). The agencies claim the presidential communications privilege, the deliberative process privilege and, for one record, attorney-client privilege.

The letter says each record was reviewed line by line and that any non-exempt content is so “inextricably intertwined” with protected material that nothing can be separated out and released. FOIA normally requires agencies to release any reasonably segregable portion of a record, so this claim, applied to all 60 pages, is likely to be tested in court.

Ian Bassin, Protect Democracy’s executive director, told The Washington Post the group would keep fighting. “This is not how regulatory regimes are supposed to be enacted under the American constitutional system of government,” he said. “It’s done entirely in the dark.” The Post reported that the White House did not respond to a request for comment.

How the case got here

The framework traces back to Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” signed June 2, 2026. Section 3 told agencies to build a classified benchmarking process to decide which models count as “covered frontier models,” and to design a voluntary framework under which developers could give the government access to such models for up to 30 days before releasing them to other trusted partners, and work with the government to choose those partners. Section 3(c) says nothing in it authorizes “a mandatory governmental licensing, preclearance, or permitting requirement.” Section 2(d) separately called for an AI cybersecurity clearinghouse, which became GOLD EAGLE.

We covered the early reporting on this idea in our earlier piece on the White House weighing pre-release AI reviews. What followed, according to the court record, moved fast:

1. June 2, 2026: President Trump signs EO 14409.
2. June 12, 2026: According to Protect Democracy’s complaint, the Bureau of Industry and Security issues a directive that leads Anthropic to suspend worldwide public access to two of its models within ninety minutes. The complaint says BIS lifted those export controls on June 30. (Our coverage of the export restrictions on Anthropic’s models being lifted has the background.)
3. July 14, 2026: The White House announces GOLD EAGLE, according to the complaint.
4. August 3, 2026: A White House official tells reporters the framework was finished by the deadline but declines to describe it. The complaint quotes the official, as reported by Axios: “Just because things are unclassified that doesn’t mean we are going to broadcast them to everyone.”
5. August 7, 2026: Protect Democracy files FOIA requests with all four agencies and asks for expedited processing.
6. September 1, 2026: With no records produced, the group sues in the U.S. District Court for the District of Columbia (case 1:26-cv-03064) and moves for a preliminary injunction.
7. September 15, 2026: In a joint status report, Protect Democracy narrows its request to four items, the framework text, records given to AI companies on GOLD EAGLE participation terms, the documents naming “trusted partners,” and the legal authority for both programs, and withdraws the injunction motion. The government agrees to produce responsive records, and a Vaughn index for anything withheld, by October 30.
8. October 30, 2026: The government withholds all 60 pages.
9. November 13, 2026: The next joint status report is due before Judge Ana C. Reyes, where the parties are expected to propose a briefing schedule if needed.

The case documents, including the complaint and the joint status report, are collected on Protect Democracy’s case page.

What the Vaughn index reveals anyway

The index lists 30 records. Read row by row, it gives the clearest outline yet of how the program runs.

The framework is seven pages long

One record is a Word document titled “Voluntary AI Framework for Covered Models,” dated July 31, 2026, and stamped as seven pages (Bates NCD_FY26_F_142_046 to 052). That is the document most coverage has described as the seven pages on the vetting process. It is withheld under Exemptions 1, 3 and 5, with the Exemption 5 claim resting on the presidential communications privilege, described as information “shared for purposes of assisting policy formulation.” Another seven-page record is a May 24, 2026 draft of the AI security executive order with a discussion of legal authorities between ONCD and the Justice Department’s Office of Legal Counsel, withheld as attorney-client privileged.

Almost everything else is about who gets early access

The other 28 records are 27 emails and one Commerce Department letter, each identifying trusted partners cleared for pre-release access to a specific covered model. They run from June 25 to September 17, 2026. The earliest of them predate the July 31 framework document by more than a month, which suggests that decisions about who could see covered models early were being made and communicated before the written framework carried its final date. The index does not say whether those early clearances were later revisited under the framework.

The partner lists come from AI labs’ customer lists

Every trusted-partner record carries the same justification: the partners were “derived from confidential customer lists submitted to ONCD for national security purposes.” In other words, AI developers appear to have handed the government lists of their customers, and the government used those lists to decide which outside organizations could use frontier models before the general market. The Exemption 4 claim treats those customer lists as confidential commercial information, citing the Supreme Court’s 2019 decision in Food Marketing Institute v. Argus Leader Media.

The legal theory has some loose ends

A few details are likely to come up when the case is briefed. Exemption 1 in the statute covers records specifically authorized to be kept secret under an executive order and that are “in fact properly classified” under it. The complaint, quoting the August 3 statement, says the administration acknowledged the framework was not classified, and Section 3(b) of the executive order, unlike the benchmarking process in Section 3(a), is not described as classified. The letter does not say whether any of the 30 records have since been classified. The Exemption 3 citation also differs between documents: the cover letter cites 6 U.S.C. § 1504(d)(3), while the index entries cite § 1503(d). And Exemption 5 covers inter-agency or intra-agency memoranda, while the narrowed request itself describes the framework as having been shared with AI companies at a White House meeting in August. Whether a document given to private companies can still be withheld as internal deliberation is the kind of question Protect Democracy is likely to press.

None of this means the exemptions will fail. Courts give real weight to national security claims, and no judge has ruled on these. It does mean the government’s position, that not one sentence of 60 pages can be released, will have to be defended in detail.

Why a privacy and compliance team should care

It would be easy to file this under Washington transparency fights. That would miss three practical points for companies that build on, buy or sell around frontier AI.

Your company’s name may already be in these records. If the trusted-partner lists were built from AI developers’ customer lists, enterprise customers of those developers may have been identified to a White House office without being told. Most enterprise AI contracts allow disclosure to government where legally required, but a voluntary framework is not a legal requirement. Procurement and privacy teams should check what their AI vendor agreements say about sharing customer identity and usage information with government bodies, and whether the vendor must give notice. This is a commercial confidentiality question more than a personal data question, although contact names and account details often travel with customer lists.

Access to the best models is now partly a government decision. Companies outside the trusted-partner circle cannot see the criteria, and companies inside it cannot easily explain to their own boards why they were chosen. For risk registers, that is a dependency with no published rules. A model your product relies on could reach competitors earlier, or reach you later, for reasons you cannot inspect. Our guide to third-party vendor risk assessment covers how to document that kind of dependency.

“Voluntary” frameworks can still shape what you are expected to do. The executive order says the framework creates no licensing requirement, and that is legally true. But when the government decides which models are covered, which partners get early access and what security conditions apply, the voluntary label does not tell you much about practical expectations. We made a similar point about how voluntary AI standards in the U.S. are hardening into de facto rules, and about why audits promised in a White House accord do not become real guardrails on their own.

The information-sharing law underneath GOLD EAGLE

Part of the government’s secrecy argument rests on the Cybersecurity Information Sharing Act of 2015, which protects threat information that companies share with the government from disclosure. The Congressional Research Service reports that the act’s provisions, which were set to lapse, were extended to December 11, 2026 by the Continuing Appropriations and Extensions Act, 2027. Protect Democracy’s complaint argues that GOLD EAGLE’s information sharing depends on those protections. If Congress lets them lapse again, the program’s legal footing and the government’s Exemption 3 argument could both change.

The 2015 act also requires personally identifiable information to be removed from shared threat data. That safeguard is worth remembering here. If records about AI customers and partners are being routed through a cyber information-sharing channel, organizations should ask what personal information, such as named contacts at customer companies, travels with them.

What to do now

No one outside government and a handful of AI companies knows what the framework requires, so this is not a moment for new controls built on guesses. It is a moment to tidy up what you can see:

• Map your frontier-model dependencies. List which products and internal workflows rely on models that may count as “covered frontier models,” and who owns each relationship.
• Read the disclosure clauses in AI contracts. Look for terms on sharing customer identity, usage data or account details with government bodies, including under voluntary programs, and whether you get notice.
• Ask vendors directly. Add a due diligence question: has the vendor shared your organization’s identity with any government body under a pre-release review program, and on what basis?
• Record your access assumptions. If release timing or early access matters to your roadmap, write down the assumption and the fallback in your risk register.
• Watch the docket. The November 13 status report will show whether the case moves to summary judgment briefing, which is where the government would have to defend its exemptions in detail.

Captain Compliance’s AI governance and assessment tools can help keep an inventory of the AI systems you use, the vendors behind them and the decisions your team made about each, which is the starting point for knowing what your AI does, who approved it and what data it uses. Software cannot tell you what is in a withheld government document, and a completed vendor assessment is not proof that a vendor’s data sharing matches its contract.

Frequently asked questions

Did the White House release any documents at all?

No. According to the October 30 letter, all 60 pages (30 records) were withheld in full. What was made public is the Vaughn index describing them. Some early press accounts suggested certain documents had been released, but the government’s own letter says otherwise.

Is the AI pre-release review mandatory?

Not on paper. Executive Order 14409 describes a voluntary framework and states that it does not create a licensing, preclearance or permitting requirement. Its practical reach is hard to judge because its text has not been published.

Who decides whether an AI model is a “covered frontier model”?

Under Section 3(a) of the order, the Director of the National Security Agency makes the determination, in consultation with the National Cyber Director, the President’s science and technology adviser, the Director of CISA and others, using a classified benchmarking process.

What happens next in the lawsuit?

The parties owe the court a joint status report by November 13, 2026. If they cannot resolve the dispute, they are expected to propose a briefing schedule, typically for summary judgment, where the judge would decide whether the exemptions were properly applied.

Could my company’s information be in the withheld records?

Possibly, if you are a customer of an AI developer that took part. The index says trusted partners were drawn from customer lists that AI labs submitted to ONCD. The records do not name any company, so the only way to find out is to ask your vendor.

Seven pages and a judge

The administration has built a review system for the most powerful technology of the decade, told the companies it covers what the rules are, and told everyone else that the rules are too sensitive to share. The government chose not to release a redacted copy of a seven-page document that it reportedly showed to private companies. That choice now goes to a federal judge. If the court accepts that not one line can be separated and released, voluntary AI oversight in the United States will be something the public can see only through an index of what it is not allowed to read.