Google, OpenAI and Anthropic are reportedly moving towards a joint body to set safety standards for frontier AI, tentatively called the Standards Authority for Frontier AI, or SAFA (September 24 reporting carried by Yahoo News). As of September 26, 2026, the reporting reviewed for this article describes a proposed organisation, not an operating regulator with a settled public charter (CNBC, Yahoo News).
There are good reasons for competitors to share safety research. We would rather they exchange evidence of dangerous behaviour than keep it secret until a rival suffers the first catastrophe. But cooperation does not confer the authority to decide what risks the rest of us must accept.
The concern is not that the companies are talking. It is that their technical expertise, money and proximity to the technology could allow them to become its default lawmakers. A standard adopted early by enough buyers could eventually influence what insurers demand, regulators require and courts regard as reasonable care. That is a strategic advantage whether or not anyone involved has cynical intentions.
As the old proverb goes, “the road to hell is paved with good intentions.” We’re on that path now, along with all the other frontier models; the light at the end of the tunnel does not exactly look very inviting at the moment.
Our position is straightforward. Industry should help develop the evidence and test the engineering. An independent international institution should set the minimum conditions for access to participating markets, with governments giving those conditions legal force. The separation should be as deliberate as the separation of church and state: expertise deserves a hearing, not sovereignty.
Cooperation is useful. Control is the problem.
This is not the first attempt at joint safety work: these three companies and Microsoft launched the Frontier Model Forum in July 2023, with objectives including safety research, common evaluations and information sharing (Microsoft’s founding announcement). The question for any new body is what authority it would add, and who would hold that authority accountable.
Shared testing could reduce duplicated work, help smaller developers use credible evaluation methods and give customers something more useful than competing marketing claims. A confidential incident channel could let researchers discuss failures before disclosure creates an immediate security risk. Companies also have a legitimate interest in preventing an accident that destroys public confidence in everyone’s products.
The same arrangements could protect incumbents. A certification process built around the staffing and computing budgets of the largest laboratories could price smaller competitors out of the market. A closed testing methodology could favour the architectures its authors already sell. If those authors also decide who qualifies as an evaluator, independence would become a label issued by the companies being evaluated.
None of that proves a conspiracy. It does explain why we should judge the proposed institution by its charter rather than its assurances. Who appoints its board? Can it publish a finding over a member’s objection? Can it fail a founding company’s model without losing its budget?
History offers more than one answer to the self-regulation question. The useful distinction is between cooperation that improves safety and cooperation that substitutes for public accountability.
After Three Mile Island, the nuclear industry developed an extensive peer-review system through the Institute of Nuclear Power Operations; published research describes improvements associated with peer assessment, shared learning and external validation (BMJ Quality & Safety). Crucially, INPO’s own account describes its role as complementary to, and separate from, the Nuclear Regulatory Commission’s statutory oversight (INPO report hosted by the NRC). This supports industry cooperation alongside regulation. It does not establish that voluntary oversight can replace it.
Tobacco supplies the grimmer example: a federal court found that major cigarette manufacturers had deceived the public about smoking’s health effects and addictiveness, and ordered corrective statements (US Department of Justice). The analogy is not that AI companies have committed the same misconduct. It is that commercial expertise and polished public assurances are poor substitutes for the power to obtain evidence and compel a remedy.
The internet offers a closer comparison. In its 2024 investigation of major social-media and video services, the Federal Trade Commission found extensive surveillance, inadequate data controls and little or no ability for users and non-users to opt out of how their information fed automated systems (FTC findings). Its report identified a conflict between business incentives and privacy and recommended baseline federal privacy legislation (FTC findings). A company can sincerely value privacy while making more money when people have less of it.
Guns are a less tidy comparison, but they expose a different limit. The firearms industry’s SAAMI standards address matters including reliability, interchangeability and technical performance, while firearms and ammunition are excluded from the Consumer Product Safety Commission’s ordinary jurisdiction (SAAMI, CPSC commissioner’s account). A weapon functioning as designed does not settle who should possess it or where it may be used. Likewise, a model passing an industry benchmark cannot settle whether it should control a hospital system.
Self-regulation can protect the public and the industry at the same time. Without an enforceable external check, it can also protect the industry from the public.
Trump’s “Hoax”, the AI Force, and a New Groupchat emerging.
Some have suggested that the proposed AI consortium between OpenAI, Google, Anthropic and others is predicated on Trump’s refusal to take action. On September 14, Donald Trump dismissed calls for AI regulation as a “hoax” and argued that existing powers were sufficient (Reuters). In fairness to all of this, AI company discussions date back to July, so it would be wrong to describe the consortium as something invented in response to that statement (CNBC).
Trump’s position DOES make the gap between voluntary action and enforceable oversight harder to ignore. The later announcement of an “AI Force” did not resolve it: the September 19 reporting left the proposed organization’s remit unclear, while Trump continued to reject the case for additional regulation (ABC News). An announcement is not an inspection regime.
Fairness matters here. OpenAI’s Chris Lehane has said industry-led standards should complement, rather than replace, mandatory federal safeguards and democratic oversight (CNBC). The companies should be held to that position, not accused of having publicly rejected it.
The original proposal also invoked a FINRA-style arrangement, a comparison that carries an important qualification: FINRA operates under Securities and Exchange Commission supervision (CNBC, FINRA). Borrowing the language of supervised self-regulation while omitting the supervisor would be a materially different proposition.
Personally, the actions and declarations by the current US Administration seem contradictory, which is unfortunate. Right now, the world really needs leadership and this could have been a guiding star moment for the US Government akin to the earlier “Build a Wall” campaign – but applicable to a world stage. Instead, world leaders which include Canada, Norway, and France are building an emerging alliance through coordinated group chat, as reported recently by the WSJ. (Note the absence here of American participation …)
A nuclear-scale intervention in needed, without nuclear theatre
AI should be subject to nuclear-level seriousness where its capabilities or deployment could produce catastrophic harm. That does not mean treating a transcription tool as though it’s a warhead; response needs to be tempered against the threat. (Sidebar: what is DOES mean is that we need a much stronger safety case before granting systems the ability to act across essential infrastructure. Right now, the options are very limited. This is the reason why Ethosure was created. It’s a tool for any corporate or government entity to protect themselves from rogue agentic behaviour. Because we can’t rely on the Frontier models to “do the right thing, all the time”. Our open source model also means anyone can take preventative measures with a bit of grit and willpower.)
Let’s be real for a minute, too! Power grids, municipal water supplies, airports, hospitals, and financial networks belong inside that assessment. The relevant scenario is an attacker using AI to exploit an operation, or an authorized agent causing damage through incomplete or compromised instructions, excessive permissions, or a failed control. We should examine those pathways rather than assume intelligence alone gives a model magical access. As the old proverb goes, “The road to hell is paved with good intentions.” We’re on that path now, along with all the other frontier models; the light at the end of the tunnel does not exactly look very inviting at the moment.
The underlying infrastructure exposure is documented: CISA and partner agencies reported Chinese state-sponsored actors maintaining access across communications, energy, transportation, and water and wastewater organisations in preparation for potentially disruptive attacks (CISA advisory). That advisory does not attribute the activity to AI (CISA advisory). The distinction matters because an argument for AI oversight should not relabel conventional cyberattacks to make its case sound more dramatic.
The February 2026 International AI Safety Report documented advancing cyber capabilities and significant limits in the evidence for safeguards, while distinguishing observed behaviour from uncertain loss-of-control scenarios (International AI Safety Report). Its assessment is a reason to test and constrain dangerous capabilities, not a licence to claim that every feared catastrophe has already become technically achievable.
Geoffrey Hinton put the institutional concern plainly in his December 2024 Nobel banquet speech: “But we now have evidence that if they are created by companies motivated by short-term profits, our safety will not be the top priority” (NobelPrize.org). Think of the competitive pressure as a form of addiction. Corporations reach for another dose of AI to keep pace with their rivals, while the laboratories supplying it feel compelled to deliver more powerful systems before a competitor does. Demand rewards acceleration, and acceleration makes yesterday’s capabilities feel inadequate. Even participants who recognize the danger have a reason to keep going: nobody wants to be the first to stop while everyone else presses ahead. The result is a self-reinforcing cycle that good intentions alone are unlikely to break. It needs an intervention, an independent authority able to impose limits across the market so that restraint does not become a competitive disadvantage.
The nuclear analogy is strongest when it concerns verification and consequences. A sufficiently serious infrastructure failure could cause deaths or lasting environmental damage; turning off the software afterwards would not undo either. Ethosure’s argument is precautionary: where the plausible consequences are irreversible, the operator should have to produce evidence of control before deployment.
Nor should “AI safety” end at the model’s output. Erin Brockovich’s data-centre reporting initiative collects locations and community concerns about the physical buildout, including water, electricity and noise; its community-reported entries are leads for investigation, not adjudicated findings of harm (Brockovich Data Center Reporting). The IEA’s July 2026 outlook separately projects that global data-centre electricity demand will roughly double by 2030, while stressing uncertainty in adoption, efficiency and capabilities (IEA).
A safety certificate should not override a community’s water protections or local environmental review. People living beside the infrastructure should not have to prove a frontier model is dangerous before anyone listens to their concerns about the infrastructure itself.
An international agency, with something to enforce
We favour a treaty-backed International AI Safety Agency. “A UN for AI” is a useful starting point, provided we mean broad participation and public legitimacy rather than another forum whose declarations companies can politely ignore.
There is already an institutional base to build upon: the UN has established an Independent International Scientific Panel on AI and a Global Dialogue on AI Governance, while national governments retain their own regulatory decisions (UN News). Canada’s AI Safety Institute contributes research, testing and international coordination, rather than operating as a global licensing authority (Government of Canada). These efforts should inform a stronger regime, not be erased by a claim that nothing exists.
The agency we propose would translate evidence into minimum requirements for high-consequence models and deployments. Participating governments would legislate those requirements and enforce certification conditions at home. No government would be compelled to join by wishful thinking, but a company seeking access to a participating market would have to comply, wherever it was headquartered.
The EU already demonstrates the basic jurisdictional principle: its general-purpose AI obligations apply to providers placing models on the Union market regardless of where they are established (European Commission). An international agreement could make compliance more consistent across countries. It would still need domestic legislation, workable appeal procedures and careful treatment of trade obligations.
Independence would have to be designed into appointments and funding. Neither regulated companies nor a single powerful government should control the board, dismiss investigators or veto findings about their own systems. Stable public contributions and pooled industry levies would be preferable to an evaluator negotiating its next contract with the laboratory it has just criticized.
The technical demands are already being articulated. A September 18 letter signed by Hinton and other researchers calls for evaluators free from frontier-company ownership and governance, with editorial control, meaningful access and protection against retaliation (AI Evaluator Forum). Those are practical conditions for doing the work, not decorative statements about ethics.
Ethosure’s proposal follows that accredited evaluators would need access sufficient to test dangerous capabilities and examine relevant records. Secure handling of personal data and genuine security secrets would need to be hedged in policy to protect those who might fall victim where their interests are otherwise unprotected. (For example, an AI agent is instructed to secure data sources for research. It inadvertently secures content from an unauthorized source; the content would be subsequently be blocked because the ethics of the source material was deemed questionable.) Material findings should reach regulators without company permission. Public reports could redact information that would enable attacks, but secrecy should not become a permanent hiding place for an unfavourable result.
Approval should expire, with reassessment after material changes and mandatory reporting of serious incidents. Certification should establish that a specified system met specified requirements under stated conditions, not guarantee that it can never cause harm. It should not grant immunity from civil liability or displace sector-specific duties.
The governing process should include rights holders, smaller developers, affected communities and countries that use AI without hosting a frontier laboratory. The AI Safety Foundation’s research and public-education mission offers one example of civil-society participation beyond corporate policy teams (AI Safety Foundation). Consultation would not make every participant a technical expert. It would help prevent technical experts from quietly deciding questions that belong to the public.
This agency would itself need constraints. Its mandate should be specific, its decisions reasoned and appealable, and its standards regularly reviewed. It should not become a global content censor or hand one government a universal shutdown credential. Military and intelligence deployments would require difficult, separate verification arrangements; a blanket national-security exemption would leave some of the most consequential uses outside the scheme.
Costs deserve equal scrutiny. Certification should scale with capability and deployment risk, with affordable testing routes for smaller firms and public-interest researchers. Reciprocal recognition of sound assessments could reduce duplicate compliance costs. Competition authorities should remain able to examine whether “safety coordination” is being used to restrict entry, allocate markets or suppress legitimate research.
The nuclear precedent is helpful but incomplete: IAEA safeguards provide international verification of states’ commitments concerning nuclear material under agreements those states accept (IAEA). AI would need its own inspection and enforcement model. We cannot simply rename an existing institution and assume software will behave like controlled nuclear material.
A safety badge cannot settle copyright
Self-regulation will not, by itself, ensure lawful use of training content. A promise means little if nobody outside the developer can inspect how material was obtained or challenge its use. A safety body must not become a convenient venue for the largest buyers of creative work to agree how little accountability they owe its owners.
The law also needs to be described accurately. Unlicensed does not automatically mean unlawful: in June 2025, a US district judge found the training use at issue in Bartz v. Anthropic to be fair use, while separately rejecting a fair-use defense for pirated books acquired and stored in a central library (Reuters). The litigation subsequently reached a settlement granted final approval on July 20, 2026 (court-authorized settlement website). That history does not give every developer blanket permission to use every work.
Ethosure’s proposed access bargain would require an auditable legal basis for training material: permission where required, or a documented basis such as public-domain status or an applicable legal exception. Developers should maintain provenance and acquisition records, honour enforceable rights reservations, and offer a usable complaints process. Independent auditors should be able to examine records that cannot reasonably be published in full.
The EU’s training-summary requirements provide a starting point, though a summary is not a work-by-work licence register or proof of compliance (European Commission’s training-content guidance). The international agency should assess the adequacy of a developer’s controls, while courts and competent authorities retain responsibility for contested rights.
Access to participating public-data programs and voluntary commercial licensing pools could be conditional on certification. Broader market access could also depend on compliance with the regime’s content obligations. Neither condition should allow the agency to transfer a creator’s rights without consent, override existing exceptions or organize a buyers’ cartel.
There is a practical limit. Governments cannot reliably retrieve every copy of publicly accessible material already downloaded abroad. The enforceable objective is lawful acquisition, traceable use and meaningful consequences within reach of participating jurisdictions, not a promise to put a border around the internet.
The kill switch is a requirement, not a complete policy
The US proposal needs a precise description. Representatives Ted Lieu and Nathaniel Moran introduced H.R. 9917, the AI Kill Switch Act, on July 23, 2026; Congress.gov lists it as introduced, not enacted (Congress.gov). It is a bipartisan legislative proposal, not evidence that the US government has adopted a unified shutdown policy. We wrote about how to make this possible, here. A few others continue the fight to introduce legislation like Bernie Sanders and Elizabeth Warren; their messaging however advances “ban” language which probably won’t get a lot of enthusiasm from all the other politicians being lobbied by the Frontier companies. The optics of approving an “AI ban bill” when OpenAI just handed you a cheque for a hundreds of thousands of dollars (or more) probably won’t sit well.
For covered entities and technology, a bill requires shutdown-related capabilities, establish incident reporting and permit emergency orders with review procedures; it also must contemplate graduated interventions and the risk of disrupting critical infrastructure (bill text). Those details are more useful than the image of a giant red button.
Any serious certification regime should require operators to demonstrate that they can revoke an agent’s credentials, isolate affected systems and transfer essential operations to a safe fallback. It should test those mechanisms under adversarial conditions. A shutdown that takes a hospital offline without a functioning alternative could compound the emergency it was supposed to contain.
Our work developing Ethosure gives us a commercial interest in this question. Its published approach puts policy enforcement and evidence at the boundary where an agent takes an action, rather than relying solely on what the model says it intends to do. That is a useful architectural distinction, not proof that any one vendor can contain every model or substitute for independent evaluation. The same scrutiny should apply to oversight vendors as to the laboratories.
A provider’s ability to stop its hosted service also cannot be assumed to stop copies running elsewhere. We would therefore require layered controls, secure recovery plans and evidence-preservation procedures, while limiting emergency powers through prompt review. Oversight should reduce the concentration of unchecked power, not relocate all of it to whoever holds the shutdown key (which can ALSO include things like – hmmm, lemme think on this – funding to a regulatory agency or a politician, perhaps?)
China is a hard case, not an excuse
Calling China a “rogue” and assuming it follows no AI rules makes the argument less accurate. China joined the Bletchley Declaration on frontier-AI risks and has its own rules for public-facing generative-AI services, including security assessments for specified services (Bletchley Declaration, Library of Congress). Participation in a declaration is not proof of compliance, nor does domestic regulation establish agreement on democratic rights.
The latest diplomacy illustrates the distance between discussion and a binding regime: reporting after the September 2026 Trump–Xi summit described continued AI dialogue, but no substantial agreement to slow the race or establish the proposed joint framework (CNBC, The Guardian). That is a reason to insist on verification. It is not a reason to abandon the attempt.
China should be invited to participate on the same terms as the United States, Europe and everyone else. No country should receive a permanent exemption for its national champions. A Chinese provider that met independently verified requirements should be eligible for access; an American provider that failed them should face restrictions.
If a state or developer refused, participating countries could restrict commercial distribution, procurement and covered deployment within their jurisdictions. Those restrictions would need evidence, proportionality and appeal rights. Otherwise an international safety regime could deteriorate into protectionism with a technical vocabulary.
Would refusal render the agency impotent? It would limit its reach, particularly over clandestine military work and systems operating entirely outside participating jurisdictions. Market access is leverage over sellers, not a defense against every hostile actor. Cybersecurity, intelligence cooperation and infrastructure resilience would still be necessary.
But incomplete coverage is not the same as no value. A coalition could establish a defensible baseline for a substantial share of legitimate deployment, improve incident visibility and reduce opportunities to sell unsafe systems across its markets. Agreements among strategic rivals could begin with narrower shared interests, such as incident notification and preventing uncontrolled escalation, without pretending that geopolitical competition had disappeared.
There is an uncomfortable symmetry here. If Washington can dismiss safeguards because China might gain an advantage, Beijing can make the same argument about Washington. Accepting that logic makes restraint impossible by definition.
It would be reasonable to see a joint safety body from Google, OpenAI and Anthropic as a contributor to a wider system. It would not be acceptable to expect their approval as sufficient authority to expose the public to catastrophic risk. The companies should be able to challenge the regulator’s reasoning, appeal its decisions and improve its methods. They should not be able to terminate or override it. The next question would be around who would fund it – because the power dynamic would once again be in question if the funding paper trail led directly or indirectly back to those who are most impacted by the decisions.
