Can anyone understand how they can make all these regulations without an act of congress?
If Congress were responsible for exactly how every law was implemented, which inevitably runs headlong into very tactical and operational details, the Congress would effectively become the Executive.
Of course, if a department in the executive branch oversteps the powers granted to it by the legislative, affected parties have recourse via the judicial branch. It's imperfect but not a bad system overall.
In this case, they are framing AI as a homeland security threat, among other things possibly, to give themselves the latitude to create new regulations.
We could complain about this being out of scope, but that ultimately needs to be decided by the judicial system after folks with standing sue or, ideally, the legislative branch could pass more guidance on to what extent this falls within the delegated authority.