Five years ago, Executive Order 14028 set out to modernize federal cybersecurity, and in 2026 most of its hardest mandates remain unmet. This is a backdrop and cautionary tale for the recently signed AI Executive Order. Signed on June 2, the EO directs CISA to issue Binding Operational Directives on AI-enabled defensive tools within 30 days, establishes a voluntary clearinghouse to coordinate AI-assisted vulnerability discovery and remediation, and for the first time embeds the federal government in frontier model development cycles through classified benchmarking.
This looks like a bold step forward for the government to be more engaged in AI development and adoption, but whether it results in operational outcomes or just another paperwork cycle is uncertain.
In 2021, Executive Order 14028 was issued and required intelligence sharing, EDR deployment, standardized and mature event logging, and incident response playbooks. A 2023 GAO review showed that only 3 of 23 met the requirement for event logging maturity, and 20 of 23 missed the deadline. When requirements are concrete and realistic – such as deploying EDR coverage – compliance has a much higher success rate. Vague or complex requirements become impossible milestones.
While this may read as cynicism for bureaucracy, it’s an honest starting point on how we should evaluate whether this EO produces outcomes or more paperwork.
The Binding Operational Directive
The most consequential element in this AI EO is the Binding Operational Directive mechanism. CISA has 30 days to issue a BOD on AI-enabled defensive tools. We can look to BOD 22-01 on Known Exploited Vulnerabilities as proof of value: specific CVEs, remediation windows, and compliance pressure. The result was measurable change in federal patching posture.
The test for the resulting AI BOD is the same: is it that specific, or does it tell agencies to “prioritize” AI-enabled tools without defining what prioritization requires in practice, or defining something that’s even realistic by federal technology standards at all.
Notably, the 30-day clock is for issuance, not compliance. Agencies receive additional implementation windows after the directive ships. Based on the EO 14028 precedent, that sprint most likely produces agencies submitting remediation plans with FY2027 or later target dates, so this becomes a paperwork step one of a multi-year cycle, not an operational outcome.
The Authorization Gap
The BOD can direct agencies to deploy AI-enabled defensive tools, but FedRAMP determines whether they legally can. Those two things are not synchronized.
Any cloud-based security tool requires FedRAMP authorization, a process that currently averages 12-18 months. AI tools evolve much, much faster than that pipeline. The mandate and the authorization architecture are running on different clocks, and nothing in this EO changes that.
The Decision-Authority Problem
The compression of AI-assisted timelines isn’t primarily a technology problem for government defenders or enterprises. It’s more often a decision-authority problem.
In a security incident, every handoff between systems and decision points is latency. Against an adversary moving at machine speed, those handoffs become exploitable gaps.
The highest-leverage fix isn’t a new tool purchase. It’s pre-authorizing the decision logic for categories of reversible, testable containment actions. BOD 22-01 is already a standing pre-authorization to patch. An AI incident response BOD could extend that model to response, without new legislation.
The Coordination Model That Worked
CISA’s Pre-Ransomware Notification Initiative demonstrated what effective coordination at operational speed looks like. In 2023, the initiative sent more than 1200 notifications, including to 154 U.S. healthcare organizations. By the end of 2024, the cumulative total reached 3,368. CISA later estimated roughly $9 billion in damage prevented across more than 4,300 notifications through mid-2025. [CISA; SANS; Cybersecurity Dive]
The gap in cybersecurity coordination has never been access to intelligence. The gap is actionable guidance that travels with the intelligence and reaches organizations without an expert to interpret it. The clearinghouse will need to solve that operationalization problem and reach the smaller operators the EO names — those organizations have no staff to assign to a voluntary program.
The Test at 12 Months
This EO creates processes where none existed. Whether those processes produce posture change depends on criteria that haven’t been written, institutions under significant resource pressure, and voluntary participation with no enforcement backstop.
Is the BOD operationally prescriptive, or vague enough for agencies to defer without consequence? Are the organizations the EO names as priorities actually in the programs? Does CISA have a confirmed director issuing directives with real compliance windows?
The 30-day clock is real. What matters is what’s on the other end of it.
The author Melissa Bischoping is Head of Threat Research & Intelligence at Tanium.