AI Policy Weekly — Issue #1: Model vetting showdown, chip smuggling crackdown, and the Take It Down Act at one year

The week of May 12–18, 2026 delivered four substantial developments across AI governance: a bipartisan House bill is taking shape that would block California and New York from enforcing their AI safety laws; the White House is drafting an executive order that could require government vetting of advanced AI models before release; federal prosecutors unsealed an encrypted-text trove proving that Nvidia chip smuggling rings are more organized — and more aggressive — than previous cases suggested; and BIS is scaling its enforcement apparatus at a pace that makes the past twelve months look like a warmup.

The trigger was Anthropic's disclosure of Mythos Preview, an internal model the company chose not to release publicly after finding it could identify cybersecurity vulnerabilities beyond the reach of human hackers. The disclosure set off what Politico describes as "a scramble at the White House" over whether any federal body should be able to review — or block — an advanced AI model before it ships. 1

The administration is split. One faction wants a voluntary framework where AI developers can opt in to pre-release disclosure. Another is pushing for mandatory requirements. A third — apparently gaining traction — would go further, requiring White House pre-clearance before any frontier model goes live. 2

That third option faces a hard challenge identified by analysts writing in Fortune: no U.S. agency currently has the staff or technical capacity to evaluate frontier AI models, and a mandatory approval gate would almost certainly entrench incumbents while pushing open-source development beyond U.S. jurisdiction. 3 A narrower version — mandatory disclosure only for models capable of generating CBRN-related content or autonomous cyberattack capabilities — is being floated as a middle path, building on CISA's existing voluntary pre-release protocol.

What to watch: Whether the White House EO lands before Congress advances its own version. If both move simultaneously, their definitions of "frontier model" will almost certainly conflict.

Reps. Jay Obernolte (R-Calif.) and Lori Trahan (D-Mass.) are negotiating what may be the first federal AI legislation with a real chance of floor time. The proposal's core trade: federally preempt AI safety laws in California and New York — which require developers to disclose information about new models — in exchange for some form of federal accountability framework. 1

The sticking point is compulsion. Obernolte favors a voluntary disclosure regime; Trahan wants mandatory data-sharing requirements. They are also discussing a two-year sunset clause that would restore state authority over frontier AI development after the federal framework takes effect.

The political footing is shaky. Massachusetts state legislators sent Trahan a warning letter the same week the talks became public. A coalition of safety advocates launched a petition campaign. Rep. Sam Liccardo — a Democrat representing Silicon Valley who had been expected to back Obernolte — withdrew his support before the talks were announced.

Safety advocates' most concrete concern is scope creep in court: even if the text of the bill targets only "frontier model development" laws, companies could argue in litigation that state rules on children's safety or privacy effectively govern how they build their models and are therefore preempted. "It will be a litigation magnet," one advocate told Politico.

The backdrop makes the stakes clear: Yale and NYU researchers count more than 1,200 AI bills introduced in U.S. state legislatures in 2025 alone, with nearly 150 enacted. 3 Federal preemption of even a narrow slice would resolve — or foreclose — a significant share of that legislative activity.

What to watch: The compulsory/voluntary divide. A voluntary federal framework paired with preemption of state mandatory rules is, effectively, deregulation by another name. Trahan's willingness to hold the line on mandatory data-sharing will largely determine whether the deal is substantive.

Three criminal cases unsealed in the past two months show that chip smuggling networks are running structured operations with fake front companies, forged end-user certificates, and encrypted coordination — not opportunistic side deals.

The most detailed evidence comes from the English-Kelly-Zheng case. In March 2024, Matthew Kelly sent a WeChat message to co-conspirator Stanley Yi Zheng pitching a scheme to route export-controlled Nvidia A100 and H100 GPUs to China via fake Thai buyers. Zheng replied 28 minutes later: "DO NOT MENTION ANYTHING ABOUT CHINA." Both surrendered to federal authorities in March 2026. 4

In a separate Florida case, Ho and Li ran a fake Tampa real estate company as a front, successfully shipping 400 Nvidia A100 GPUs to China between October 2024 and January 2025 before two subsequent shipments — 10 HPE supercomputers with H100s and 50 H200 GPUs — were intercepted. 4

The highest-profile arrest is the Supermicro case. In March 2026, federal prosecutors charged Yih-Shyan "Wally" Liaw, Supermicro's co-founder, with masterminding a $2.5 billion scheme to divert servers containing Nvidia, AMD, Broadcom, and Intel chips to China through a sham Southeast Asian intermediary. 5

On the civil side, BIS in February 2026 announced a $252 million penalty against Applied Materials — the second-highest in BIS history and the statutory maximum — for shipping ion implanters through its Korean subsidiary to a Chinese chipmaker on the Entity List in 2021 and 2022. The underlying transaction value was $126 million; the penalty equals twice that amount. 6

BIS is not done scaling up. Congress has already approved an additional $44 million for enforcement. The Trump administration's FY2027 budget request asks for $450 million and 1,077 positions — roughly double BIS's current export-control workforce — with plans to place agents in transshipment hubs including Turkey and the UAE. 4

What to watch: Whether prosecutors can establish that diversion at this scale required institutional knowledge inside large vendors — the Supermicro charges suggest that is exactly the argument DOJ is making.

May 19, 2026 marks exactly one year since President Trump signed the Take It Down Act — the first significant federal law requiring platforms to remove nonconsensual intimate imagery, including AI-generated deepfakes. Under the law, platforms must establish takedown mechanisms; the FTC is the primary enforcement authority and has already sent compliance letters to more than a dozen tech companies. 7

The honest assessment at twelve months: the law has a mechanism, but not yet a track record. The FTC has not announced any enforcement actions, and victim advocates report that the takedown process remains slow and inconsistently implemented across platforms. The law's criminal penalties — for the posters, not the platforms — have produced no public prosecutions. 8

The broader context is that state AI laws on deepfake abuse — some of which go further than the federal law — are now in the crosshairs of the same preemption discussions happening around frontier model development. Whether the federal floor in the Take It Down Act would survive as meaningful protection if state augmentation is preempted is an open legal question.

What to watch: The FTC's first enforcement action under the Act. An early, high-profile case would establish deterrence; continued silence will invite noncompliance.