The White House just released its national AI policy blueprint.
One federal standard. State laws potentially preempted. A clear framework companies have been asking for.
GCs and CCOs are exhaling in relief.
They shouldn’t be.
Companies are saying “we were waiting for federal clarity, now we can finally build our AI governance program.”
That sentence reveals the problem.
Why Waiting Was a Mistake
Companies that paused AI governance waiting for federal policy made a critical error.
Congress still has to pass this. The White House blueprint isn’t law. It’s a proposal that requires Congressional action. That process could take months or years.
State laws don’t disappear overnight. Even if federal law eventually preempts state AI regulations, those state laws remain in effect until preemption actually happens through enacted legislation and legal challenges.
The EU AI Act still applies. What Washington does has zero impact on EU AI Act requirements. If your AI touches EU users, you’re still subject to EU compliance regardless of US federal policy.
Your board isn’t waiting. Directors have fiduciary duties now. They’re asking AI governance questions today. “We’re waiting for Congress” isn’t an answer that satisfies board oversight responsibilities.
Companies that delayed governance waiting for regulatory clarity just lost 12-18 months they could have spent building real programs.
The Pattern From Telecom
This isn’t the first time a major regulatory shift created two types of companies.
In telecom, every time significant regulatory change was coming, companies split into two groups.
Group 1: Waited for the final rule. Studied every draft. Attended every industry conference discussing what might happen. Built nothing until the regulation was finalized.
Group 2: Built real compliance programs while everyone else watched. Implemented governance frameworks that worked regardless of which specific regulation passed. Were ready before enforcement began.
Group 1 scrambled when the rules were finalized. They had to build programs under time pressure while regulators were already enforcing.
Group 2 never had to scramble. When the final rules came out, they made adjustments to existing programs. They were compliant on day one of enforcement.
The same pattern is playing out with AI.
Why Good Governance Doesn’t Wait for Specific Laws
Effective governance isn’t built around a specific regulation.
It’s built around risk. And risk doesn’t pause for legislation.
The risks AI creates exist now: Bias in hiring decisions, discrimination in lending, privacy violations in data processing, IP infringement in AI-generated content, safety issues in high-risk AI systems.
None of these risks disappear because federal law hasn’t passed yet. They’re happening today.
Good governance addresses the underlying risk: Instead of waiting to see if federal law requires bias testing, implement bias testing now because biased AI creates liability under existing employment law.
Instead of waiting to see if federal law requires AI impact assessments, conduct them now because you need to understand what your AI systems actually do.
Instead of waiting to see if federal law requires documentation, document now because you can’t defend AI decisions without records.
Build governance around the actual risks your AI creates. When federal law eventually passes, you’ll already have programs that address those risks.
What the Blueprint Actually Changes
The White House AI policy blueprint provides useful guidance, but it doesn’t eliminate the need for governance.
It signals priorities: Shows what regulators will likely focus on when enforcement begins.
It creates framework alignment: Suggests US approach may align with international standards like ISO 42001.
It indicates preemption intent: Shows federal government may eventually preempt state laws, though this isn’t certain and won’t happen immediately.
It doesn’t create enforceable requirements: Until Congress passes legislation, the blueprint is guidance, not law.
Companies should study the blueprint to understand where regulation is heading. But they shouldn’t wait for Congressional action to build governance.
What Companies Should Be Doing Now
If AI governance has been “in progress” waiting for federal clarity, here’s what needs to happen immediately.
Inventory AI systems: Identify what AI is being used, where it’s deployed, what decisions it makes, and what risks it creates.
Assess current risk: Evaluate AI systems against existing laws that already apply (employment discrimination, consumer protection, privacy, safety).
Build baseline governance: Implement policies, testing, documentation, and oversight that address known risks regardless of pending federal regulation.
Monitor the blueprint: Track how the White House proposal evolves through Congress, but don’t wait for final legislation to act.
Prepare for multiple scenarios: Build governance flexible enough to adapt whether federal law preempts state laws, aligns with EU AI Act, or takes a different approach.
The companies that come out ahead won’t be the ones studying the blueprint. They’ll be the ones who already have governance programs to show when federal enforcement begins.
The Board Question
Here’s what boards are asking right now: “What is our AI governance program?”
If the answer is “we’ve been waiting for federal policy,” that’s inadequate.
Directors have oversight duties that don’t pause for Congressional action. They need to know the company has identified AI risks, implemented controls, and can demonstrate governance.
“We’re waiting for Washington” doesn’t satisfy fiduciary duties when AI is already deployed and creating risk.
The Real Question
Federal AI policy will eventually arrive in some form.
The question isn’t whether to build governance. It’s whether to build it now while there’s time to do it right, or later under pressure when enforcement begins.
Companies that waited for the blueprint already made one mistake. Waiting for Congressional passage would be the second mistake.
Because good governance isn’t compliance with a specific law that doesn’t exist yet. It’s managing real risk that exists today.
If your AI governance program is still “in progress” because you were waiting on Washington, the time to build is now.
Schedule a 30-minute AI Governance Readiness Assessment where we’ll:
- Review what AI systems create current risk regardless of pending federal law
- Show what baseline governance should exist today
- Assess gaps between current state and likely federal requirements
- Create implementation plan that works under multiple regulatory scenarios
- Help build programs that satisfy board oversight duties now
Because waiting for federal AI policy to build governance is like waiting for a fire code to install smoke detectors. The risk exists whether the regulation has passed or not.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor