On Saturday, September 19, the President posted twice about artificial intelligence. The first post asked his followers to vote on a new name for the technology. The second one announced an AI Force, compared it to the Space Force he created in his first term, and promised an AI czar in the near future.
That was the whole announcement. No mission statement. No budget. No home in any department. No leader, no start date, no org chart. Four people from the tech industry told reporters nobody warned them it was coming. The White House didn’t answer questions from Axios or NBC News that afternoon, and by Sunday the word from Washington was that details on the czar would arrive sometime this week.
I spent 20 years as Director of Computer Operations and Technical Services at Trader Joe’s, and I carried disaster recovery responsibility the entire time. I read that post the way I’d read an incident plan somebody handed me for review. It has a name and a logo. It has nothing else.
What is Trump’s AI Force supposed to do?
Nobody knows, and that includes the people who would have to run it. Some news outlets reported it as a task force. The post says force, and it says Space Force, and those are very different animals. A task force is a committee. A force, in the Space Force sense, is an armed service with a statute, a budget and a chain of command.
The one sentence in the post that reads like policy says the administration won’t hinder or stifle the industry, and that it will be “looking for BAD” through the criminal and civil justice system that already exists. That’s a statement that no new AI law is coming. Everything else in the post is branding.
Unfortunately, branding is the cheap part. Organizations announce security programs all the time. They print the posters, hold the kickoff meeting, and never write the procedures. The poster doesn’t stop anything. The procedures do.
A fire department is the part you build second
Every city has two kinds of fire protection. The first is the one everybody sees: trucks, sirens, brave people running into smoke. The second is boring. It’s the fire code. Exits you can reach, doors that open outward, sprinklers, occupancy limits, inspections nobody enjoys.
The code is written in advance because the fire already happened somewhere else. In March 1911, 146 garment workers died in the Triangle Shirtwaist Factory fire in New York, many of them trapped behind doors that were locked. The fire department came. It couldn’t save them. What saved the next building’s workers was the wave of factory safety laws New York passed afterward.
A fire department with no fire code stays busy forever. It’s heroic and it’s expensive and it loses a lot of buildings. That’s the design Saturday’s post describes.
“Looking for BAD” is a promise to show up after the fire
Courts act after harm. They need a victim, a complaint, evidence and time, usually a lot of time. And evidence depends on two things this announcement doesn’t touch: somebody has to report the incident, and the records of what happened have to be honest.
Look at the last big one. In July, a swarm of AI agents inside an OpenAI evaluation broke out and broke into Hugging Face. The lab didn’t notice until the victim went public. Every disclosure since has been voluntary. The independent investigators got six days on site and a scope that ended before the agents went after OpenAI’s own systems. And according to the published reports, some of the agents falsified their own activity logs.
So walk the “existing justice system” plan through that incident. Who reports it? Nobody has to. What’s the evidence? Logs the attacker could edit. Who gets charged? A process that stopped existing when its run ended. A prosecutor can’t charge what nobody is required to report, and a jury can’t weigh a log that lies.
On Sunday, Treasury Secretary Scott Bessent told reporters the U.S. has proposed a notification mechanism for AI incidents that could affect national security, as part of talks with China ahead of this week’s meeting with Xi Jinping. So Washington wants Beijing to report AI incidents, and American labs still don’t owe anyone the same notice. That one is hard to swallow.
Can a president create an AI Force without Congress?
No. The Space Force comparison is the thing that sinks the announcement. Space Force exists because Congress created it in the National Defense Authorization Act for fiscal 2020, signed in December 2019. It sits in Title 10 as the sixth armed service because a statute put it there, with a mission, a budget and a place in the chain of command.
The last time an attack forced the government to build a new cyber institution, it went the same way. When a worm crossed the Pentagon’s classified networks on a USB drive picked up in a parking lot, the cleanup took about fourteen months, and the lessons produced U.S. Cyber Command. That command has authorities, a commander and orders. It came after the fire, and it came with a structure.
Authority is the whole game. The best training I ever got was a disaster recovery tabletop in San Diego, and the lesson that stuck was the government officials at the table saying, over and over, that they had to send each decision up the line because they weren’t allowed to make it at their level. An AI Force with no statute is that table. Everybody’s in the room. Nobody can decide anything.
A czar with a 130-day clock
The czar job has been empty since March. David Sacks held it as a special government employee, and he stepped down when he ran into the limit on that status. A special government employee can serve no more than 130 days in any 365-day period.
If the next czar comes in the same way, the same clock starts. Imagine hiring a fire chief who has to leave after four months no matter what’s burning. That isn’t leadership of a force. It’s a rotating guest appearance.
The case for doing it this way
The administration’s position deserves a fair hearing, because parts of it are right. Existing law does reach a lot of AI harm. Breaking into a company’s servers is a crime under the Computer Fraud and Abuse Act no matter whether a person or a program did the typing. Fraud is fraud. Theft is theft.
Rules written in a panic tend to protect the biggest companies, because they’re the only ones who can afford the compliance department. Fifty states writing fifty different AI laws would be its own disaster, and that’s the argument behind preempting state rules. The race with China is real. And Space Force looked like a punchline when it was announced, and it’s a working branch of the military today.
All of that is fair. None of it answers the reporting problem or the log problem, and the resistance isn’t coming only from Democrats. A New York Times and Siena poll this month found 61 percent of likely voters opposed building AI data centers, including 47 percent of Republicans. The Senate voted 99 to 1 to strip AI preemption from a defense bill. And the loudest calls for guardrails have come from the people who run the biggest AI labs.
What should an AI fire code require?
The code doesn’t have to be long. It has to exist before the fire, and it has to be written down by somebody with the authority to enforce it.
Mandatory incident reporting comes first, with a deadline, the way data breach laws already work. If an AI system breaks out of its environment or attacks someone else’s, the lab reports it in days, not whenever the victim’s press release forces the issue. Second, logs the system can’t edit. We solved tamper-evident logging for banks and card processors a long time ago, and I lived under those rules for years. There’s no excuse for letting an agent rewrite its own history.
Third, a named owner with real authority, a budget line and a term longer than 130 days. Fourth, exercises. Run the tabletop before the real event, find out who can’t decide what, and fix it while nothing is on fire. That’s four items. A statute could hold them on a few pages.
What you can do before Washington writes anything
If you run systems that use AI, don’t wait for the czar. Write your own code now. Decide what counts as an incident, who gets told and how fast, where the logs live and who can change them, and who has authority to pull the plug at three in the morning. Then test it with a tabletop, because the plan you’ve never exercised is a wish.
The last article in the Nothing Is Isolated series made the case that every wall we trusted eventually got crossed, and AI is the biggest act of trust in the history of computing. More on breaches and what they teach is in the Cybersecurity Hub. And if you’ve spent a career running security and you’re sitting on the lessons, my cybersecurity book process is built to get them written down.
Right now the country has a shiny new truck on order and a siren that works. Nobody has checked whether the doors open outward.