Each act page has a section map of the Version 2.2 text: VIDA, PDTA, GAAFA. A detailed section-by-section analysis prepared for the July 2026 drafts is available below; its section numbers do not match Version 2.2.
What does enacting the framework cost?
The acts are designed around procurement cycles states already run. The main cost difference lies in specifications, not new spending: the question is whether the next identity, benefits or case-management contract buys surveillance-capable architecture or constitutionally sound architecture. Identifiable fiscal items are the Data Trusteeship Authority, implementation and conformance assessment, and audit infrastructure. Funding sources and penalty amounts are bracketed for each legislature to specify. See the implementation note.
Does this interfere with law enforcement?
No. The acts require that access meet standards the Constitution already sets, and that systems enforce them. Specific information about specific people under specific authority remains available, as does emergency access that is bounded, expiring and reviewable (PDTA Section 8(g)). What the acts prohibit is standing, comprehensive, discretionary access to integrated records. VLPFA shows the pattern: every warrant alert, no movement database.
How does this interact with existing privacy law?
Consumer privacy statutes govern commercial practices and usually exempt government. The model acts govern government, on the authority of the government-citizen relationship. PDTA Section 24 coordinates the three acts and their relationship to other law. Commercial participants in a state identity ecosystem take on contractual duties under VIDA Sections 23 and 24; the government duty and the commercial duty are deliberately kept as separate layers.
What about federal preemption?
The acts regulate the state's own agencies and its own systems, grounded in the Fourth Amendment and in state constitutional provisions, not in general commercial regulation. That gives them a stronger footing against preemption than commerce-based privacy statutes. Congress has also not enacted comprehensive privacy legislation, and waiting for it is a decision not to act.
What changes for vendors?
Vendors must disclose what their products can actually do, including dormant and license-activatable capabilities; contracts must schedule the authority for each capability; and acceptance testing includes negative-capability tests. Government's duties are nondelegable. These requirements do not exclude vendors; they specify what vendors must deliver. See the model procurement specification.
How does this relate to Utah's SEDI program?
SEDI governs the identity verification layer. The framework adds the enforceable fiduciary relationship (PDTA) and algorithmic accountability (GAAFA). The relationship is successive, not competitive. More on Utah.
How does GAAFA govern AI without regulating technology by name?
It regulates capability, authority and consequence. Systems are classified by actual use and consequence (Section 7), must establish authority before deployment (Section 9), and must provide explanation, contestability and correction where decisions are legally material (Sections 15 to 18). AI agents are instruments of the deploying agency, not fiduciaries in their own right; the agency remains responsible (Section 5).
How are architectural requirements enforced without mandating products?
The acts specify required capabilities and prohibited capabilities, not vendors. The FCGIAS architecture standard and its conformance tests translate those requirements into testable criteria, and conformance is assessed on the deployed configuration. Courts can order structural relief that removes or constrains an unlawful capability (PDTA Section 22).
Can it pass?
Utah's SB 275 passed both chambers without a dissenting vote. The framework's principles, limited government and individual liberty on one hand and enforceable civil rights and accountability on the other, draw support across the spectrum. It also offers officials a path to compliance without accusation: the surveillance architecture came from procurement incentives, not bad intent.
Earlier analysis
- Section-by-section analysis and committee Q&A, July 19, 2026 draftsPDF