Commentary. The newest pledges from the artificial-intelligence industry are better than silence. They are not enough.
In a voluntary agreement reported after a White House meeting on Sept. 29, major AI companies promised stronger internal controls for cybersecurity, biosecurity and chemical risks, along with independent audits and board-level oversight. The commitments address real dangers and could improve practices inside companies that have often guarded safety information too closely. But they remain promises made by firms to police themselves.
That distinction matters. Rules written by governments can impose common obligations, define liability and give affected people a route to challenge misconduct. Voluntary commitments cannot reliably do those things, especially when companies face intense pressure to release more capable systems before competitors do.
The case for restraint
The United Nations’ human-rights chief, Volker Türk, has warned that the world is running out of time to establish safeguards as countries and companies race to develop increasingly powerful AI. He has called for independent monitoring, stronger international cooperation and a greater role for civil society and people affected by automated decisions. The warning should not be dismissed as anti-technology alarmism: it is an argument for ensuring that those who bear the risks have a meaningful voice in setting the rules.
AI systems already influence employment, education, credit, health care and access to information. Frontier models also introduce less familiar hazards, including assistance with cyberattacks or the development of dangerous biological and chemical materials. A company’s internal review may identify some of these problems, but the public cannot assess a safety regime that remains largely confidential.
“The clock on AI regulation is ticking,” Türk said, arguing that safeguards must be implemented “not in words, but in practice.”
The United States’ current preference for industry self-regulation reflects a legitimate concern: badly designed rules could burden smaller developers, protect incumbents and slow beneficial research. Legislators should take that concern seriously. A government that demands approval for every model update, or treats low-risk applications like high-risk systems, would create needless costs and could push innovation into less transparent jurisdictions.
Why voluntary action still falls short
Those objections do not justify leaving the most consequential decisions to private companies. The central problem is not whether businesses can devise useful safety standards; it is whether every significant developer will face comparable obligations, including when compliance reduces speed or profit.
Minimum standards should therefore focus on demonstrable outcomes rather than prescribing one technical method. Developers of the most capable systems should be required to test for defined risks before deployment, document what they tested, notify authorities of serious incidents and permit genuinely independent audits. Liability rules should make clear who is responsible when firms ignore known dangers or release systems without adequate safeguards.
Such a framework can be flexible. Lower-risk tools should face lighter requirements, while systems with the capacity to affect critical infrastructure, personal safety or democratic processes should face stricter scrutiny. Confidential information can be protected without making oversight purely private.
The international dimension is equally important. The UN says 29 states and the European Union have backed a joint call for tighter controls on frontier models, while new global initiatives aim to improve scientific cooperation and governance. Washington’s resistance to a broad international regime is understandable if “global governance” becomes a slogan for vague, centralized control. Yet AI companies operate across borders, and a patchwork of incompatible rules will leave gaps that the most reckless actors can exploit.
A better bargain
Our view is straightforward: voluntary commitments should be treated as a starting point, not a substitute for law. Governments should use them to identify workable practices, then turn the most important protections into enforceable standards. Industry should help write technically credible rules, but it should not have the final word on whether those rules apply.
The alternative is not a choice between innovation and regulation. It is a choice between accountable innovation and a race in which safety becomes a marketing claim. The companies’ promises deserve scrutiny—and a chance to prove themselves—but the public should not be asked to trust that proof without independent verification.
AI may deliver extraordinary benefits. That is precisely why its governance cannot depend on goodwill alone.