The White House today laid out the AI laws it wants Congress to write, and they could reshape defense contracting, compliance, and enterprise software strategy for years.
On March 20, 2026, the administration published "A National Policy Framework for Artificial Intelligence: Legislative Recommendations," a 7-pillar set of recommendations to Congress on how to legislate Artificial Intelligence. It is the administration's legislative blueprint for AI, and its implications for how you run compliance and screening operations are massive.
Before diving into the compliance specifics, here is a rapid summary of the 7 pillars the framework recommends:
This is a legislative recommendation, meaning Congress still has to act. But for businesses navigating CMMC, ITAR, or OFAC compliance, this document provides the strategic roadmap for where the puck is going.
Let’s look at the four recommendations most likely to reshape security and compliance operations.
If your organization operates across state lines, you have likely dreaded the prospect of navigating 50 different state-level AI regulations. The White House recognizes this threat to commerce.
"Congress should preempt state AI laws that impose undue burdens to ensure a minimally burdensome national standard... [AI development] is an inherently interstate phenomenon with key foreign policy and national security implications."
Under this recommendation, states would not be permitted to regulate AI development. However, states would keep their general laws protecting children, preventing fraud, and protecting consumers, along with zoning authority over AI infrastructure and rules for their own use of AI, such as procurement.
The Compliance Impact: If Congress follows this, AI-specific rules would come mainly from one national standard rather than fifty state laws, though general state laws on fraud, consumer protection, and children would still apply. That would simplify legal risk for enterprise software vendors and the defense industrial base.
The framework recommends that Congress create no new federal rulemaking body for AI, which rules out a central AI regulator if Congress follows it.
"Congress should not create any new federal rulemaking body to regulate AI, and should instead support development and deployment of sector-specific AI applications through existing regulatory bodies with subject matter expertise..."
The Compliance Impact: AI regulation will be handled by the agencies you already deal with. If you are a defense contractor, expect any AI rules to come from the DoD and DCSA, possibly through CMMC. If you handle financial screening, any AI guidance is likely to come from OFAC and FinCEN. Expect to see AI-specific guidance heavily integrated into existing regulatory frameworks over the next 18 months.
The framework also asks Congress to make sure national security agencies can understand what frontier AI models are capable of.
"Congress should ensure that the appropriate agencies within the national security enterprise possess sufficient technical capacity to understand frontier AI model capabilities and any associated national security considerations..."
The Compliance Impact: This signals a massive convergence between CMMC compliance and AI governance. Defense contractors should prepare for possible requirements to audit third-party AI tools used within their infrastructure. If your visitor management system uses a "black box" AI to scan passports, expect questions about how it was evaluated.
The framework heavily targets the malicious use of AI to spoof identities. "Congress should augment existing law enforcement efforts to combat AI-enabled impersonation scams and fraud..." For compliance officers, this means identity verification processes at the front desk or during digital onboarding can no longer rely on simple visual checks. As deepfakes and AI voice cloning accelerate, multi-layered digital identity verification is likely to become standard practice.
For operators in the trenches, it is equally important to notice what the White House explicitly left out. Noticeably absent is any mention of mandatory AI auditing across the entire private sector, or blanket transparency requirements for enterprise AI tools.
There is also no OFAC or sanctions-specific AI guidance yet. The framework creates the playing field, and any sanctions-specific AI guidance would come from OFAC.
The blueprint is a clear signal that the federal government considers AI an issue of national security and economic hegemony, but the burden of compliance will remain distributed across sector-specific agencies. Actionable takeaways include:
SecurePoint USA is specifically engineered to handle the convergence of shifting federal regulations, ITAR requirements, and complex compliance environments without the legacy technical debt.
See the Modern AlternativeOccasional notes on sanctions, export controls, and visitor compliance when we publish them.
Get occasional notes on sanctions, export controls, and visitor compliance when we publish them.
No spam. Unsubscribe anytime.
Related posts
More guidance on sanctions, export controls, and visitor management for regulated facilities.
As the United States celebrates its 250th anniversary, the battle to protect U.S. sovereignty has shifted from factory floors to digital and physical perimeters. Here is why securing the supply chain is the modern patriotic duty.
The Coast Guard's first mandatory maritime cybersecurity rule (33 CFR Part 101, effective July 16, 2025) bolts a documented, auditable security program onto the same Facility Security Plan that governs who enters the gate. Here's what the converged-security standard means for visitor and vendor access at ports, terminals, and the facilities in their supply chains.
The recent OFAC actions highlight the government's aggressive stance against proxies and evasion networks. For enterprises and higher-education institutions, treating visitor management or student screening as a basic administrative task is a massive liability.
