When will a government body first acquire binding legal authority to independently re-evaluate the capabilities of an already-deployed frontier AI model on a recurring schedule, as opposed to receiving the developer's own periodic risk filings?

rationale:

The Structural Gap in Current Regulation

To satisfy this outcome, an instrument must establish a demanding conjunction: (a) binding power for a government body to conduct or commission its own capability evaluation of an already-deployed model, and (b) a recurring cadence explicitly written into the law. Every existing and pending instrument fails exactly one of these two legs, and this failure is structural. Legislatures consistently choose between granting discretionary regulator powers or mandating developer-commissioned third-party audits. Both alternatives are significantly cheaper and less burdensome for the state than standing up a calendar-driven, public testing program for frontier models.

The EU's Ad Hoc Approach

The European Union currently possesses the closest analogue, yet it firmly falls short on the scheduling prong. Article 92 of the EU AI Act provides the world's only binding, independent post-deployment evaluation authority, but its text is permissive and trigger-based—the AI Office "may conduct evaluations" artificialintelligenceact.eu. The draft Implementing Regulation operationalizes access modalities and expert selection, but deliberately avoids creating a periodic or scheduled evaluation of deployed models, leaving the power strictly ad hoc eur-lex.europa.eu digital-strategy.ec.europa.eu. Converting Article 92 into a scheduled program would likely require a Level-1 amendment rather than a simple implementing act, realistically pushing any such development into the early 2030s following the AI Act's 2028 review cycle eur-lex.europa.eu.

Recurring Schedules Lacking Government Independence

Conversely, US jurisdictions are experimenting with recurring schedules but explicitly avoiding government-commissioned capability testing. California SB 53 mandates quarterly risk summaries, but this relies on developer self-reporting leginfo.legislature.ca.gov. Illinois Public Act 104-0538 (effective 2027-01-01) and proposed federal bills like the FRONTIER Act introduce annual or semi-annual independent third-party audits ilga.gov congress.gov crowell.com. However, under these frameworks, the developer retains and pays the auditor, and the focus remains on compliance and framework adequacy rather than independent capability evaluations commissioned by the state. Meanwhile, the broader US federal executive posture remains actively deregulatory, with EO 14409 (June 2026) creating a purely voluntary pre-release access framework and expressly disclaiming mandatory preclearance or licensing whitehouse.gov whitehouse.gov.

Pathways to Resolution

Precedents exist in other domains for supervisor-run recurring testing (e.g., bank stress tests, aviation inspections), and the necessary policy infrastructure—such as licensed evaluator ecosystems and periodic safety reports—is slowly accumulating. The most plausible routes to a qualifying instrument include an EU AI Act revision in the early-to-mid 2030s, a post-2028 US state ballot initiative or federal statute that conditions annual license renewal on a regulator-commissioned evaluation, or rapid, reactive legislation following a severe deployed-model incident.

Key Uncertainties and Tail Risks

Because recurring government-conducted capability testing of deployed models requires substantial state capacity, technical expertise, and funding, there is a strong possibility that governments will indefinitely prefer the cheaper alternatives of ad-hoc inspections or developer-retained audits. This structural headwind pushes the median expectation out to the mid-2030s and justifies a heavy right tail extending into the late 2040s, reflecting a significant chance that a regime meeting both strict statutory prongs is never established within a foreseeable horizon.