The Great American AI Act Is a Preemption Bill With a Safety Bill Stapled to It

The Obernolte-Trahan discussion draft is being read as America's first comprehensive frontier AI framework. I think that reading flatters the bill. The load-bearing provision is not the risk-management mandate or the safety institute; it is the three-year freeze on state AI law. Everything else is the price industry agreed to pay for it.

That trade may still be worth making. But it should be evaluated as the trade it is, not as the safety regime it is being marketed as.

The shape of the deal. The draft, released 4 June by Representatives Jay Obernolte (R-CA) and Lori Trahan (D-MA), runs to 269 pages. It codifies the Center for AI Standards and Innovation (CAISI), the renamed AI Safety Institute, inside the Department of Commerce, funds it at $100 million per year, requires frontier developers to publish risk-management frameworks, mandates critical safety incident reporting, and criminalises AI impersonation of government officials. It also preempts state laws regulating AI development for three years from enactment. The press releases describe the framework; the DLA Piper unpacking of 5 June fills in the structure.¹²³

Industry trade groups NetChoice and the Information Technology Industry Council backed the draft within hours. The AFL-CIO and the American Federation of Teachers issued a hard no. The House Democratic AI Commission, chaired by members of Trahan's own party, opposed it.² That is an unusual coalition map for a bill being described as bipartisan, and the unusual shape tells you where the actual deal sits.

The preemption is the deal

California's SB-53, the various Comprehensive AI Regulation and Transparency (CART) drafts circulating in state legislatures, the New York frontier-model bills — all of them get paused. For three years, the regulatory surface frontier developers face shrinks from fifty jurisdictions to one. That is not a small concession. It is the largest single deliverable in the bill.

The safety obligations the bill imposes in exchange are, for the labs it most affects, marginal. Anthropic already publishes a Responsible Scaling Policy. OpenAI already publishes a Frontier Governance Framework. Google DeepMind publishes a Frontier Safety Framework. The risk-management programmes the draft mandates map closely to documents these companies wrote themselves and update voluntarily. The incident reporting obligation is the only genuinely new operational cost, and even there, internal incident tracking already exists; the new work is the disclosure pipeline to CAISI.

This is what I mean by safety-as-market-position becoming law. The frameworks the labs built to differentiate themselves on responsibility, and to argue against harder regulation, are now the template for the federal floor. The marginal compliance cost for the four or five companies that actually operate at the frontier is low. The marginal cost for a hypothetical new entrant trying to reach frontier scale is meaningfully higher, because the new entrant has to build the compliance infrastructure from zero. That is not an accident of drafting. It is what an incumbent-friendly safety regime looks like.

The state laws being preempted are not hypothetical. SB-53 in California would require pre-deployment safety evaluations and public disclosure of frontier model capabilities. CART-style proposals would impose audit and liability regimes that go beyond the federal draft on transparency. Whether you think those state regimes are well-designed or overreaching, they are the specific policies the three-year freeze removes from the board. The bill's defenders should be willing to say that out loud, because it is the actual mechanism.

CAISI codification is the quietly consequential part

If the preemption is the headline, the statutory anchoring of CAISI is the provision most likely to outlast the political moment. The AI Safety Institute existed as an executive-branch body and survived the 2025 transition largely because no one moved fast enough to dissolve it. A statutory body inside Commerce does not have that vulnerability. A future administration that wanted to gut AI oversight would have to pass legislation to do it, and legislation to undo a statutory safety body is harder to pass than an executive order that ignores one.

This matters more than the substantive provisions because the substantive provisions can be hollowed out without anyone noticing. Risk thresholds can be relaxed. Enforcement can be defunded inside the appropriations process. Incident reporting can be interpreted narrowly. An institution, once codified, is harder to make disappear than a rulebook.

The substantive requirements can be rewritten by any administration that wants to. The institution, once statutory, has to be legislated away.

The counter-case is that a poorly funded statutory body can be worse than no body, because it creates the appearance of oversight without the capacity for it. $100 million per year is not obviously enough. The UK AI Safety Institute spent on the order of £100 million across multiple years for a narrower evaluation mandate over a smaller industry footprint. CAISI inherits a broader remit, more labs, more models, and a statutory obligation to receive incident reports it will need to triage. If the funding line does not grow with the industry, CAISI becomes a compliance checkbox, and the checkbox is what frontier labs are paying preemption-equivalent prices for.

I think the codification is still worth it. A weak statutory institute can be strengthened by appropriation; a non-existent one has to be rebuilt from scratch. But the funding number is the provision to watch in markup, not the framework requirements.

The bipartisan label is doing unearned work

Bipartisan, in Washington usage, has come to mean at least one member from each party signed it. By that standard, the draft qualifies. By any standard that requires coalition support to pass, it does not.

The House Democratic AI Commission opposing a bill co-authored by a Democratic member of the House is the more telling signal. It says the median House Democrat is not where Trahan is on this trade. The AFL-CIO and AFT positions reinforce the read: the organised base of Democratic politics has decided the preemption is a bigger problem than the safety provisions are a solution. That coalition does not produce a floor vote.

On the Republican side, the picture is different but not obviously better. NetChoice and ITI backing the bill is consistent with House Republican priorities on preemption, but the conference's freedom caucus has, in recent sessions, treated any new federal regulatory body as suspect regardless of what it preempts. CAISI codification is exactly the kind of provision that draws their opposition, and a $100 million annual appropriation needs to survive appropriations as well as authorisation.

The honest read is that the draft is a serious technical document released to invite a real conversation about what the trade should look like — not a bill on track to become law in its current form. Treating it as imminent legislation overstates where the politics actually are. Treating it as dead overstates how unusual the underlying trade is; some version of this trade is what a federal AI framework will look like when one passes, because the structural logic, incumbents accept federal floors in exchange for state preemption, is durable across drafts.

What the three-year clock actually buys

Three years is a short preemption window for an industry that thinks in capability-doubling cycles, and a long one for state legislatures that have been moving on AI law since 2023. The bet implicit in the draft is that Congress will use the three years to enact a permanent framework. The federal track record on this kind of follow-through is poor.

The cleanest precedent is the Children's Online Privacy Protection Act of 1998, which preempted state children's privacy law and then waited until 2024 for a substantive update. Twenty-six years. AI is not going to wait twenty-six years for an update, but it does not need to: it only needs the three-year clock to expire without a permanent framework in place, at which point states resume legislating with three years of accumulated frustration. The end state of a failed preemption is more state regulation, not less, and more aggressive state regulation at that.

This is the part of the bill I think its supporters under-weight. The preemption is presented as a clean three-year pause. The downside scenario is that it is a three-year delay before a worse outcome for the industry that lobbied for it.

Footnotes

¶