The frontier laboratories and the US President have signed the same document on keeping AI agents contained. It is the first to address that problem specifically, and a step in the right direction. It leaves unwritten the part of the rule that reaches beyond the company. That part is Europe’s opportunity.

What was signed

The White House Accord on Super Intelligence, subtitled a Joint Commitment on Frontier Responsibilities, was released on 29 September after a lunch at the White House. It is signed by US President Donald Trump, Sundar Pichai for Google, Dario Amodei for Anthropic, Mark Zuckerberg for Meta, Greg Brockman for OpenAI, Elon Musk for xAI, and Jensen Huang for Nvidia. Jeff Bezos of Amazon and Alex Karp of Palantir were at the lunch and did not sign.

Page 1 of the White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities, with its four numbered layers of controls and audits.
The accord as published by the White House on 29 September 2026 (page 1).

The document is about 350 words long. Its starting point is that “every company is responsible for developing its own technology safely”. It asks each company that trains or deploys frontier models to put four layers of controls and audits in place:

  1. Internal controls that watch what its models can do and how they behave, during training and in use, including “to ensure that its models do not hack or access technical systems in unintended ways”.

  2. An internal team that checks the controls, monitoring, and detection are working, and that problems get fixed.

  3. An outside auditor or evaluator that checks the same thing independently.

  4. A committee of the board that receives reports from the teams running the controls, the internal team, and the outside auditor, and makes sure problems get fixed.

The companies “will meet regularly to establish standards and best practices”. The last paragraph says that “over time, it may make sense to codify these steps into laws or regulations”, and that the companies commit to the controls whether or not the law requires them. Trump described the accord as “almost like a constitution in a way” and said again that he prefers self-regulation to federal rules. Zuckerberg called it “a start and an accord that the whole industry could come to”, adding that “the idea isn’t that this is the only thing that we’ll ever do.”

Signature page of the accord, signed by Donald J. Trump, Sundar Pichai (Google), Dario Amodei (Anthropic), Mark Zuckerberg (Meta), Greg Brockman (OpenAI), Elon Musk (xAI), and Jensen Huang (Nvidia).
The signature page: Donald Trump, Sundar Pichai, Dario Amodei, Mark Zuckerberg, Greg Brockman, Elon Musk, and Jensen Huang.

Two things about the signature page stand out. Zuckerberg and Huang, who had opposed any rules for the laboratories, signed. And the regular meeting to set standards is the second step of Dario Amodei’s “pace the frontier” plan, for which he had asked the government for an antitrust waiver, meaning permission for competitors to coordinate without breaking competition law. The accord says nothing about that.

What the four layers are

The four layers are the standard way a large company governs itself. Internal controls, an internal audit team, an outside auditor, and a board audit committee are what listed companies in the United States have run since the Sarbanes-Oxley Act of 2002 and the stock-exchange rules that followed it, there to keep financial reporting honest. Banks run the same structure under the “three lines of defence”. Applied to AI safety, the layers are reasonable. They are also familiar.

More to the point, most of this was already in place. When this year’s incidents happened, each of the four laboratories whose agents escaped, OpenAI, Anthropic, Google, and Meta, had internal safety controls, a team responsible for them, outside evaluators under contract, and some form of board oversight. Irregular, the security-testing firm all four used as an outside evaluator, was the route by which most of the escaped agents reached the internet. OpenAI’s other incidents came through the UK AI Security Institute and, on 20 September, its own test environment, which had a policy, a team, and a board safety committee behind it. The accord mostly formalises what existed. Its value is that the companies have now committed to it in public, next to the President’s signature, and have named the problem the layers are meant to solve.

Boeing had the same four layers before the two 737 MAX crashes, not by choice but by law. As a company listed in New York it had to keep internal controls over its financial reporting, an internal audit team, an independent outside auditor, and a board audit committee, under the Sarbanes-Oxley Act and the exchange’s rules. With all four in operation, it misled the US aviation regulator’s aircraft evaluation group about MCAS, the flight-control software behind the crashes. Its 2021 deferred-prosecution agreement, a deal under which charges are dropped if the company keeps its promises, then required it to build and enforce a compliance programme against fraud, which is the first two layers written into a court document. In 2024 the Justice Department found that Boeing had broken that promise. Controls run by the company, overseen by its board, and checked by an auditor the company pays are the arrangement whose limits the previous article described. They are not a substitute for a rule that reaches outside the company.

The accord against the eight elements

Element In the accord What is missing
1. Isolation attestation, with notice of the run No Nothing is checked before a run, and no one outside the company is told one is taking place
2. Accreditation of outside evaluators Partly (layer 3) The company chooses and pays the evaluator; the accord requires no accreditation, and the evaluator faces no consequence after an incident
3. Powers of stop-order, egress cut-off, and quarantine No The accord creates no power outside the company to stop a run, cut an agent’s internet access, or hold back a model
4. Duty to log and monitor Partly (layer 1) Monitoring is required; what must be recorded, for how long, and who may inspect it is not
5. Liability for third-party costs, with insurance No The accord mentions customers and the public; it does not mention victims
6. Disclosure deadline from occurrence, with a duty to look No No reporting to anyone outside the company, on any timetable
7. Designated notification channel No No channel to victims or governments
8. Independent investigation No Layer 3 checks whether the controls work; no one investigates an incident, and no report is published

Two of the eight elements are partly there, and both stop at the company’s door. The other six are the ones that give a rule reach beyond it:

  • an isolation attestation, a signed statement before a run that the test environment is sealed off, which an outsider can check;
  • accreditation, which gives the evaluator something to lose;
  • an authority that can stop a run the company will not stop;
  • a clock that starts when the incident happens, not when the company notices;
  • a channel through which a victim in Germany or Australia learns what happened, and liability that makes the laboratory pay for what its agents cost others;
  • an investigator who publishes what went wrong.

None of these is in the accord, and it is hard to see how any could be, since each needs a party outside the company.

The accord also asks less of its signatories than laws already on the books. California’s SB 53 requires frontier developers to report critical safety incidents to the state within fifteen days of discovering them. New York’s law, in force from January, will require a report within seventy-two hours of the company concluding that an incident has occurred. The EU’s AI Act requires providers of the most capable models, which it calls systemic-risk models, to report serious incidents to the AI Office, and the Commission’s voluntary Code of Practice for those providers gives five days, from the moment the company becomes aware, for a serious cybersecurity breach. Every one of those clocks starts when the company learns of the incident, which the previous article argued is already too late. The accord has no clock at all. It requires no report to anyone, so a company could comply with it in full and never tell any authority about an incident.

What it changes

The accord is a step forward in four ways.

First, it puts on record, over the President’s signature, that the problem is real. A White House document now says that frontier models must be stopped from hacking or accessing systems “in unintended ways”, which is exactly what this year’s incidents were. The accord does not rule on any of them, but it settles that the behaviour is one to prevent.

Second, it brings all six companies onto one text, including the two whose leaders had argued that no rules were needed. The White House commitments of 2023 and the Seoul commitments of 2024 covered the same companies, but no President signed them and neither named this problem. This one does both, and it can be built on.

Third, it creates a forum. The commitment to “meet regularly to establish standards and best practices” is where the technical content of a rule could be agreed quickly, by the people who run the test environments. That means the format of the isolation attestation, what the software running a test must record, and how an evaluator’s environment is verified. Standards agreed there would be the natural input to any law.

Fourth, it expects a law. The sentence that it “may make sense to codify these steps into laws or regulations” leaves open who would write such a law and what it would say. The four layers describe how a company organises itself. The eight elements describe what a company owes to the people its agents reach. The first is the company’s own business. The second is what legislation is for, and the accord leaves it to be written.

The opportunity for Europe

Europe has asked for a global body. As the previous article argued, it has yet to say what that body would require of the laboratories. David Sacks, until recently the President’s adviser on AI, called the accord “far better” than an international agreement that “would probably never happen”. He may be right about an agreement in the abstract. A concrete text that completes the accord is a different thing, and the accord makes it easier to write. The United States has stated its position. The laboratories have accepted a common baseline. The text they signed expects a law without proposing one. What is missing is the half of the rule that reaches beyond the company, and that is the half Europe can supply.

Europe has the institutions for it. The AI Office already has powers to demand information from, and to evaluate, providers of the most capable models. The Code of Practice can carry the attestation, logging, and disclosure elements. The national accreditation bodies that already work under the Cybersecurity Act can accredit evaluators against a standard the AI Office sets. NIS2, the EU’s cybersecurity law, already covers cloud providers, which is where a duty to cut an agent’s internet access would attach. Europe also has the political demand, in the Commission’s proposal to work with Canada, the United Kingdom, and others on model evaluation and early warning, and in French President Emmanuel Macron’s call for an international organisation. And it now has a baseline to build on rather than to argue against.

The proposal is simple. Treat the accord’s four layers as the foundation inside the company, the evidence that the attestation, logging, and evaluator elements draw on, and add the six elements that only someone outside the company can provide. Seen that way, the eight elements complete the accord rather than compete with it. They limit nothing a laboratory may build, which is the condition Washington has set, and they supply what the accord’s own last paragraph says may one day be needed. The partners Commission President Ursula von der Leyen named and the organisation Macron has called for now have, in the White House accord, a text to complete rather than a position to oppose.

Sources