An independent evaluator finds an AI developer’s safeguards inadequate. The company disagrees and continues. Can the evaluator preserve and publish the evidence, and who has the responsibility and authority to act on it? That is the practical test of independence at the center of this essay.

That scenario provides one way into Dario Amodei’s We Must Pace the Frontier. His central argument is that advances in AI capability must slow enough for safety work to keep up. He argues that the additional time should improve operational reliability, alignment, understanding of model internals, and testing. Pacing, in his account, generally means making progress more deliberately; a broad pause is one of the more ambitious possibilities he considers.

What Amodei proposes

Dario’s plan has three parts, which he says can proceed in parallel. The outline below follows his categories; the later sections assess what each would add to existing governance.

Embedded evaluators

Each frontier developer would give an external team continuing access to assess safety practices, report incidents and examine models and training processes. Anthropic commits to taking this step and calls for other companies to follow. Amodei argues that independent scrutiny would make pacing commitments verifiable, inform the public and supply a second opinion.

Pacing within democracies

Frontier developers in democratic countries would establish common safety standards and limits on unchecked capability advances, with government support where needed. Amodei favors regulation covering unwilling firms, alongside voluntary coordination and capability-linked safety checkpoints. He also argues that restrictions on access to chips and model capabilities, together with stronger security, could preserve the geopolitical room for democracies to slow down.

Global pacing

Governments would seek agreements, including with China, at four increasingly difficult levels: prohibit narrowly defined dangerous uses; test models before release; limit the rate at which AI helps build more capable AI; and substantially restrain overall development, potentially through a pause. Amodei sees the narrower agreements as more attainable and stresses the risks of unverifiable restraint. His argument is that wider cooperation could extend the time available for safety work.

Our analysis follows the three parts of Amodei’s plan. Within the second, we examine common safety conditions and strategic restrictions separately, because making a test meaningful and preserving a geopolitical lead require different evidence.

The strongest reading of Amodei’s plan starts with the connection between its parts. His definition of pacing includes third-party confirmation of safeguards, and he argues that embedded evaluators across a critical mass of US companies would make verifiable pacing more viable. The steps can proceed in parallel, but common commitments still need credible evidence that companies keep them. International agreements add a further challenge: obtaining reliable evidence about activity across jurisdictions, including work a participant may conceal.

Existing arrangements offer more than general principles. There are concrete precedents for independent challenge, publication protections, risk thresholds and public response powers. They also differ in scope and authority. The task is to identify where a proposed improvement needs better execution, where an applicable duty needs enforcement, and where a different allocation of authority or a new measurement method is necessary.

How other leaders’ positions compare

The significance of these positions depends on what each participant is prepared to make binding. Agreement that AI should be developed safely leaves open how severe the risk is, and three disputes about the response: whether a company’s own incentives are sufficient, who should test its judgment, and whether restraint should be voluntary or enforceable across competitors. Those disputes affect different parts of Amodei’s plan differently.

Support for scrutiny is not yet agreement on the terms of restraint

Sam Altman endorsed pacing on September 12 and said OpenAI would also give independent evaluators access comparable to employees. This directly converges with Amodei’s first step, although the post leaves the engagement details for later. Separately, OpenAI’s August 18 account describes pausing specified frontier research workloads while strengthening safeguards. That is a company-reported operational response, rather than evidence that a common industry pacing agreement is already in place.

Elon Musk endorsed Amodei’s post on September 12. His brief response supplies no corresponding evaluator-access terms or measurable pacing commitment. It signals agreement, while leaving implementation unspecified in that statement.

Demis Hassabis, Google DeepMind chair and Alphabet chief scientist, supported the direction while reserving judgment on details. His July proposal gives that position an institutional form: a standards body modelled on a federally overseen public-private partnership, initially voluntary pre-release assessments, and possible later mandatory testing for US-market deployment, with coordinated slowing if necessary. This overlaps with Amodei’s common checkpoints; its initial point of intervention is pre-release review, rather than the continuing internal presence of an embedded evaluator.

Altman’s access promise gives the first proposal a potential second participant. Musk’s endorsement supplies no equivalent commitment. Hassabis offers a possible institution for common checkpoints, while leaving its eventual compulsory character open. Altman’s commitment and Hassabis’s proposal favor forms of external scrutiny; they do not establish agreement on a shared threshold for slowing development, who would enforce it, or what happens when a participant refuses. Counting endorsements would therefore overstate the coalition available to implement the whole plan.

Company incentives and geopolitical competition supply competing reasons to act

Mark Zuckerberg, Meta’s CEO, argued on September 15 that customer demand for trustworthy agents and potential liability give labs incentives to develop safely. He reported that Meta delayed Muse’s release for safety and security work without waiting for competitors. He also endorsed independent evaluators and a more diverse range of evaluators, and said Meta commits most compute to serving users rather than recursive self-improvement. These are company-reported practices, not independently verified here. His challenge is therefore substantive: alignment can be a competitive advantage, and firms can choose restraint themselves. Support for evaluation overlaps with Amodei’s first step; it does not establish agreement on permanent access, publication rights or shared pacing rules.

Zuckerberg’s August essay supplies a broader objection: delayed US releases could surrender a narrow geopolitical lead. He proposes early government access to intermediate training checkpoints and a board role in approving release criteria and reviewing compliance. He also allows that a larger lead could leave time to mitigate new risks. He locates safety in widely distributed AI and competing interests that check one another, warning against labs keeping powerful models to themselves. The view he criticizes, that enough time could perfect a single benevolent superintelligence, is not Amodei’s proposal; his account nevertheless raises a question for pacing: could withholding capabilities concentrate the power it aims to control? The dispute with Amodei therefore also concerns how much room exists for delay, who judges it and whether restraint protects safety or gives rivals an advantage. Zuckerberg’s alternative would itself need scrutiny of board independence, effective government access and the claimed benefit of faster distribution.

Jensen Huang, Nvidia’s CEO, told CNBC on September 15 that developers should keep testing and engineering products until they are safe to release. He rejected the need for new laws, regulations or antitrust changes to do that work. He also rejected warnings of near-term extinction, saying, “We’re not going to die in 2030.” Part of the disagreement therefore concerns the severity of the risk itself. On his account, companies can and should engineer and test products properly before release under existing laws. Amodei’s coordination proposal must therefore show what shared restraints would achieve beyond competent firms acting on their own.

Zuckerberg offers a mechanism by which competition and liability could reward safety: users prefer reliable agents, and liability makes failures costly. His reported release delay and OpenAI’s account of pausing research are concrete examples to investigate. Because both are company-reported, they also illustrate the value of Amodei’s proposed independent scrutiny.

Amodei’s own unilateral commitment to embedded evaluation also recognizes room for company action, while calling on governments to require wider coverage. The unresolved question is whether commercial and legal incentives address risks that customers cannot observe or that fall on people outside the transaction. That is our test of the competing arguments, not a demonstrated failure of Meta’s approach. Amodei must show where those incentives are insufficient and why shared restraints would work better; his critics must explain how their preferred incentives contain those less visible or external risks.

Government support determines which commitments can extend beyond willing firms

President Donald Trump adds a geopolitical priority: maintaining US technological leadership. In his September 14 response, he dismissed calls for additional guardrails, invoked existing criminal and regulatory powers, and alleged a “SICK conspiracy going on against AI and Data Centers” that, he said, pleased China. Those are his political claims; the post does not establish the legal sufficiency of those powers. His administration’s AI Action Plan prioritizes innovation, infrastructure and international leadership. Yet his June 2 executive order, section 3, directs a voluntary framework for government access to covered frontier models while expressly declining to authorize mandatory licensing or pre-clearance.

Both Amodei and Trump treat geopolitical advantage as consequential, but draw different implications for pacing. Amodei argues that coordinated restraint can proceed within the room a US lead allows. Trump’s September statement names Amodei while rejecting additional guardrails. That creates a concrete political obstacle to obtaining US support for Amodei’s wider rules and international bargains, although it does not determine every future policy decision.

The June order leaves a narrower area of possible cooperation on assessment. The framework it directs would provide pre-release access for the federal government and jointly selected trusted partners, keyed to advanced cyber capabilities, without Amodei’s comparable public-reporting commitment. The direction to design a framework does not establish that it is operating. Willing developers can begin evaluations and common assessments themselves; extending rules to nonparticipants or entering an international bargain requires authority their agreement cannot supply. Existing legal powers must be assessed on their own terms, rather than inferred from either Trump’s confidence in them or his opposition to additional guardrails.

How much weight should Amodei’s call carry without consensus?

The evidence behind the warning and the support available for its remedies require separate judgments. Amodei grounds his call in reported acceleration of AI-assisted AI development and control failures, including the OpenAI-Hugging Face incident and his account of less severe incidents across the industry, including at Anthropic. OpenAI’s cited account corroborates an incident and its decision to pause specified workloads. It does not independently establish Amodei’s characterization of the danger or his projected pace of further capability gains. Huang’s confidence about near-term survival does not answer those incident-specific questions.

The weight of Amodei’s warning should therefore turn on evidence of the incidents’ scale, repeatability and controllability, and on whether additional time improves safeguards. Continuing evaluator access could help test those claims if the access and reporting terms permit meaningful scrutiny. Disagreement about regulation or geopolitical strategy does not resolve the technical risk; evidence of a serious risk would still leave the effectiveness of each proposed remedy to be shown.

The practical consequence is uneven. Embedded evaluation can proceed at willing companies and be judged by the access, disclosure and decisions it produces, while leaving nonparticipants outside that scrutiny. Common checkpoints need enough coverage to prevent participants from being undermined by consequential activity outside the arrangement, or public authority capable of extending the rules. Broader international restraint needs reciprocal government commitments and credible verification.

Universal agreement is not a prerequisite for every useful step, but the identity and activity of those outside an arrangement matter more as its ambition grows. The case for taking Amodei’s warning seriously rests on the evidence behind it; the case for adopting each remedy also depends on its effectiveness and coverage. The statements establish neither an agreed industry diagnosis nor support for every step, but they identify commitments that can now be tested. The question is which commitments remain useful with partial participation, and which fail without wider agreement.

Embedded evaluators: what survives disagreement?

The first proposal makes continuing external scrutiny the basis for checking whether pacing commitments are kept. Its scope includes training pipelines and day-to-day practices, as well as completed models. The question for this section is what that scrutiny can achieve when the developer disputes a finding.

Amodei proposes “employee-like access” and publication “without editorial control by Anthropic,” subject to specified redactions. Unfavorable findings alone would not justify redaction; reviewers could identify consequential omissions and report the access they received or were denied. Those are meaningful protections to assess, not details to overlook while raising an independence objection.

The practical attraction of continuity is straightforward. A reviewer who sees a process over time may recognize that a reassuring test used a different configuration from the one actually being deployed. Continuing access may also reveal which warnings were addressed and which disappeared between teams. These are reasons to test the arrangement, rather than assume that an external label or a desk inside the company settles its value.

There are close precedents. METR’s May 2026 Frontier Risk Report describes privileged access during a pilot involving four developers and a separate red-team exercise with Anthropic. The report also explains the limits of negotiated disclosure. Participants could withdraw before approving nonpublic information, while having no approval right over the industry report itself.

The new engagement should be compared against those actual disclosure terms. A future contract may improve them; the earlier pilot does not determine its contents.

Altman’s access promise raises the same practical questions. Two companies could offer comparable access while choosing different terms for contested redactions, responses to findings and termination. The useful comparison would be between the resulting engagements: what evidence each evaluator can obtain, what it can disclose, and who must respond.

NIST’s AI Risk Management Framework 1.0, at MEASURE 1.3 (p. 29) and GOVERN 2.3 (p. 23), contemplates regular assessment by experts outside frontline development, including independent assessors, and assigns responsibility for risk decisions to organizational leadership. It is voluntary. Those provisions place assessment alongside leadership responsibility; they do not transfer operational decisions to the reviewer.

The binding starting point in Europe is the EU AI Act, Regulation (EU) 2024/1689. For providers of general-purpose AI models with systemic risk within its scope, Article 55(1) requires model evaluations, adversarial testing, assessment and mitigation of systemic risks, serious-incident reporting, and adequate cybersecurity. A provider cannot discharge those duties merely by hiring an evaluator. An adverse finding may bear directly on its own risk-assessment and mitigation duties; whether it also triggers incident reporting depends on what happened, not simply on disagreement with the reviewer.

The EU GPAI Code’s Safety and Security chapter sets out commitments for its signatories and is a particularly close comparator. These are voluntary-code commitments, not evaluator rights imposed on every provider. Appendix 3.5 addresses qualified external evaluators and adequate access and resources, with exceptions. Measure 3.5 separately addresses post-market monitoring, conditional protection against retaliation and responsible disclosure, including a 30-business-day limit on delaying publication unless a longer period is exceptionally necessary.

The Code also addresses publication of external evaluations. Measure 7.4 requires available external reports to be included in the provider’s Model Report only in a way that respects confidentiality and leaves evaluators in control of publishing their findings. The specific non-retaliation and 30-business-day disclosure commitments sit in the separate post-market measure. These protections give a concrete basis for comparison, but a contract should identify which applies to each activity rather than assume that one role carries every safeguard in the Code.

The EU AI Act also provides a public route to independent evaluation. Article 91 allows the Commission to request Article 53 and 55 documentation and additional information necessary to assess compliance; the provider must supply it. Article 92 lets the Commission appoint independent experts to evaluate a model on its behalf. Under its specified investigation conditions, the Commission can request access through appropriate technical means, including source code; providers must supply the requested access. A developer cannot make a compulsory access request disappear by terminating a private engagement. Yet Article 78 also requires protection of specified confidential interests, subject to its exceptions. Compulsory access does not itself supply Amodei’s proposed public-reporting terms.

For enforcement, Article 93(1)(b) lets the Commission request mitigation following an Article 92 evaluation that raises serious and substantiated concern of systemic risk at Union level, where necessary and appropriate. Paragraph 1(c) separately authorizes requests to restrict availability, withdraw or recall a model. The compliance-measures limb in paragraph 1(a) concerns Articles 53 and 54. These are concrete powers, with specified conditions, rather than an automatic consequence of an evaluator’s adverse finding.

Article 93(2)–(3) also permits structured dialogue and a Commission decision making offered mitigation commitments binding. Under Article 101(1), intentional or negligent infringement of relevant provisions, refusal of requested information or access, and failure to comply with Article 93 measures can attract Commission fines. The answer to the opening scenario therefore changes once public authority is engaged: company disagreement does not extinguish the applicable duties. A private evaluator’s report can inform that process, but does not itself compel the Commission to act or give the evaluator power to stop development.

An engagement team should therefore separate the mandates if one assessor performs both roles: which access arises from the contract, which from a public request, and which disclosure rules govern each resulting record? The recommendation preserves the distinction between evidence for public enforcement and evidence for public debate. Neither function makes the other unnecessary. Amodei’s proposal could make evidence available continuously, before a public investigation; the Act supplies powers an evaluator’s contract cannot confer.

Return to the disputed finding. Amodei already narrows the permitted redactions and lets reviewers disclose that an omission affects their conclusions. This supplies a disclosure remedy; it leaves open who decides whether a contested redaction fits a permitted category, such as commercially sensitive information. The engagement could specify an adjudicator and timetable for that dispute, preserve evidence while it runs, and state which reporting rights survive termination. It could also identify a recipient who must answer the finding. These are proposed additions to the published terms.

The evaluator need not hold a unilateral veto, and Amodei proposes none, for the work to matter. A well-supported report can inform management, a board or a regulator, each acting within its own responsibilities. Giving an assessor decision power also creates a new question about competence, accountability and review. The case for independent information should not silently become a case for unreviewable authority.

For a board or legal team negotiating the engagement, the most revealing exercise would be to work through one adverse finding before signing: evidence preserved, disclosure contested, development continuing. Name the actor responsible at each step, the deadline, the decision and the review route. Where there is no contractual duty to respond, identify any independently applicable legal duty. Under the EU AI Act, the provider’s obligations and the Commission’s powers remain distinct from the evaluator’s contractual rights.

Common standards: who decides what a pass permits?

In the second part of the plan, Amodei proposes linking a model’s capabilities to evidence that it can be used safely. His illustrative checkpoints would require specified alignment assurances when a model reaches a specified capability, drawing on evaluations, interpretability analysis and audits of training environments. He also considers limits on inputs such as training compute and internal use of AI to improve AI.

The question is who legitimately sets these safety conditions and what makes them binding across competitors. Amodei explicitly prefers regulation covering unwilling firms, with voluntary coordination proceeding alongside it. The analysis should therefore examine what the parallel route can deliver while broader rules develop.

The Seoul Frontier AI Safety Commitments already connect risk assessment, intolerable-risk thresholds and mitigation to decisions about further development or deployment. They contemplate abstaining where mitigation cannot keep risk below the specified thresholds. This is a substantial precedent for risk-conditioned restraint, although the text of a voluntary commitment cannot establish that every participant fulfills it.

The EU AI Act already connects some safety duties to public decisions. Its Article 51 classifies general-purpose models with systemic risk by high-impact capabilities or a Commission designation of equivalent capabilities or impact. The training-compute threshold creates a presumption of high-impact capabilities; it is not a passing safety score. Classification brings the Article 55 duties into play, rather than certifying that a model is safe or establishing Amodei’s proposed sequence of capability-linked permissions.

The timetable also matters. The Commission’s GPAI guidance identifies August 2, 2025, for the obligations and August 2, 2026, for Commission enforcement powers, including fines. Providers of models placed on the market before August 2, 2025, have until August 2, 2027, to comply. These GPAI dates remain in Articles 111(3) and 113 of the Act as amended in July 2026.

Coverage remains a material difference. The Act’s Article 2 connects GPAI coverage to placement on the Union market and excludes specified pre-market research, testing and development, while preserving other applicable law and excepting real-world testing from that exclusion. For a covered model, Article 55 nevertheless requires assessment and mitigation of risks arising from development as well as market placement and use. Continuing private access could add scrutiny of excluded pre-market work and a standing presence without awaiting a public investigation; it still needs dependable contractual rights.

Under Article 55(2), providers may use a code to demonstrate compliance until a harmonized standard is published; other adequate means remain possible. The Code therefore supports compliance without being compulsory itself or conclusive proof of compliance. Its Measures 4.1 and 4.2 connect risk acceptance to decisions to proceed and call for safety margins reflecting uncertainty in assessments and mitigations. Existing governance therefore already links several of the functions a pacing scheme would need. For covered providers, enforcing those duties and testing the quality of compliance may be more useful than inventing another assurance label. Amodei’s scheme could still add common checkpoints across jurisdictions and continuing access beyond those legal routes; those additions require their own authority and evidence.

A shared checkpoint could add comparability. Amodei already warns that measures of internal ingredients may be easier to game than external behavior. Even a valid test leaves a separate question: what decision should its result support? The same passing score could be treated as evidence supporting a limited deployment, as grounds for additional testing, or as permission for a substantially more capable training run. Each is a different decision requiring its own justification.

The International AI Safety Report 2026 at pages 13 and 99–100 describes limits in using pre-deployment evaluations to predict real-world behavior. That does not make testing futile. It means that a checkpoint must specify what the evidence supports, how uncertainty affects the decision, and when the assessment must be repeated. A certificate’s title cannot do that work.

Three judgments should remain visible: the test’s validity, the acceptable level of risk and the legal authority for the resulting restriction. Technical experts may be best placed to assess the first. The second involves public choices that industry expertise alone cannot resolve. The third depends on the jurisdiction and the conduct being governed.

Competition law makes that last distinction concrete, and Amodei raises it himself. He calls for government support, including a narrow antitrust waiver for certain safety conversations, and points to Hassabis’s proposed mechanism as a possible venue. Huang contests the need for that legal accommodation; Amodei describes some coordination as legally challenging and requiring government support. The Department of Justice’s business review procedure at paragraph 9 provides a statement of enforcement intentions for specified proposed conduct, which the Division may later reconsider in the public interest. It is not a general waiver for an industry pacing agreement. Sharing evaluation methods and agreeing to constrain competitive activity require separate attention to the actual arrangement and its legal basis.

Hassabis’s proposed standards body therefore gives the checkpoint discussion a specific institutional design to examine. It would develop assessment protocols and the benchmarks defining frontier models, beginning with voluntary pre-release review and contemplating a later requirement to pass before US-market deployment. The transition would need to settle how technical assessments become binding conditions, who authorizes those conditions and how contested decisions are reviewed. Continuing evaluator access could inform that process; it would not settle those questions by itself.

This is also where a shared threshold should be tested against departure and exception. Suppose one company rejects the risk criterion, or a government wants an exception to preserve a strategic advantage. The arrangement needs to state who may decide, what reasons must be given and what happens to the shared claim of safety. That is a design question even when the underlying tests are excellent.

The best objection is that such formality could delay useful cooperation. That objection has force. Common research methods, incident learning and narrower voluntary commitments can improve practice before an institution has universal coverage. Their limits should be stated in the claims made for them; a useful experiment need not be represented as binding industry-wide assurance.

Strategic restrictions: three causal claims to keep separate

The strategic component of pacing within democracies rests on Amodei’s claim that they can slow only while preserving their lead over authoritarian competitors. He proposes restricting China’s access to powerful chips and manufacturing equipment, tackling smuggling and remote access, preventing unauthorized distillation of frontier models, and strengthening defenses against model-weight theft. He argues that these measures would create room for pacing and make a future agreement with China more likely.

That is a proposed causal chain to examine: restrictions preserve a lead, the lead buys safety time, and the stronger position encourages cooperation. Existing export-control institutions already make choices in this area. For example, the January 2026 US rule moved specified advanced-chip exports to China and Macau from a presumption of denial to conditional case-by-case review. The eCFR text current to September 16, checked September 18, retains that treatment in section 742.6(b)(10)(iii)(A)(1), alongside a presumption of denial for other covered transactions. This illustrates a policy choice within an existing control system.

The existence of a policy instrument establishes neither its effectiveness nor the consequences of making it more restrictive. Whether a restriction delays a competitor, whether the additional time produces safety improvements, and whether the restriction encourages a reciprocal agreement are three separate causal claims. Evidence for one should not stand in for the others.

A serious assessment would look for substitution, evasion, implementation costs and the responses of the governments expected to cooperate. It would also specify the safety work that the additional time is meant to permit. The conclusion here is deliberately limited: export controls may form part of a pacing strategy, but their legal availability does not establish the strategic bargain on which that strategy relies.

Global coordination: four bargains, four verification problems

Amodei’s third part extends cooperation to governments outside the democratic group, especially China. His four levels move from prohibiting dangerous uses and requiring testing to limiting recursive self-improvement and, most ambitiously, slowing overall development. He argues that an agreement must either be reliably verifiable or narrow enough that a breach would not create an existential military disadvantage. The response here asks what evidence and enforcement each particular bargain would need.

Folded paper islands are connected by a fine graphite line that becomes partly obscured beneath translucent blue layers.

AI-generated editorial illustration · The distance between commitments. A paper-and-pigment composition exploring reciprocal promises and partial visibility.

Level one: dangerous-use prohibitions

For dangerous uses, start with the law already in place. The Biological Weapons Convention, Articles I, III and IV, establishes weapons prohibitions, addresses assistance and requires national prevention measures. An AI-specific agreement could specify additional prevention, reporting or cooperation duties. Those additions would need to identify who must do what while preserving the distinction between prohibited activity and legitimate research.

The treaty binds states parties; it is not a complete specification of a model provider’s domestic obligations. Nor is an incident-investigation mechanism equivalent to preventive oversight. The UN Secretary-General’s Mechanism operates separately from the Convention and concerns alleged weapons use, rather than routine inspection of AI development. The useful question is which missing function a proposed agreement would actually supply.

Level two: testing before release

Reciprocal testing begins from a different foundation. The Bletchley Declaration process and the 2024 safety-institute network announcement provide precedents for shared risk recognition and technical cooperation. They do not by themselves demonstrate comprehensive, compulsory testing.

A testing agreement needs to distinguish two assurances: that a declared model was tested adequately, and that the declaration included the relevant models. Amodei expressly identifies the secret-model problem. A constructive next step is to specify coverage, evidence access, challenges and the response to an adverse or inconclusive result. Agreement on methods could remain valuable even where the stronger assurance is unavailable.

Level three: limits on recursive self-improvement

The recursive-improvement proposal raises a measurement problem before its enforcement problem can be resolved. Research such as RE-Bench shows how selected AI research-engineering tasks can be evaluated, while explaining limits arising from task horizons, feedback and generalization. Such work is useful evidence for developing measurements. It is not a ready-made unit for a treaty governing the rate of AI improvement.

An agreement would need to say what is being limited: compute, experiments, a measured capability gain or some other observable activity. It would then need rules for aggregating work across organizations and deciding when a change counts as acceleration. Imperfect proxies may be useful, but their errors and avenues for evasion must fit the consequence attached to crossing the threshold.

Level four: broad restraint or a pause

Broad restraint places the greatest weight on coverage and timely response. Amodei says this is unlikely to happen soon, citing severe defection incentives and the need for high confidence in verification. Research into hardware-enabled verification identifies possible ways to observe compute, configuration and location, alongside implementation and tampering challenges. This supplies concrete avenues for investigation, not proof of a deployed global inspection system.

For any proposed arrangement, ask how much development could occur between a breach and an effective response. Improving detection may still leave a problem if the available response arrives too late. Conversely, imperfect detection may be tolerable for a narrower commitment whose breach does not create the same strategic consequences. Verification should be assessed against the particular bargain.

The sensible conclusion is differentiated. Narrow prohibitions may chiefly need clearer duties and better implementation; shared testing may need coverage and challenge procedures; rate limits require defensible measurements; broad restraint demands much stronger confidence in compliance and response. As Amodei himself argues, failure to establish the broadest arrangement would not erase the value of narrower agreements or informal norms. Our contribution is to distinguish the evidence each can credibly supply.

What would make the plan worth adopting?

Taken further than Huang stated it, the engineering argument raises the strongest challenge to this institutional reading: operational competence may be the scarce resource. More procedures could consume people and time needed for safety work. A proposal should therefore identify the decision each additional safeguard improves and the evidence that would justify its cost. Amodei himself argues that slowing capability gains would free resources for operational excellence, so the competing uses of time and expertise belong in that comparison. The answer is not to place every conceivable safeguard around every activity.

Zuckerberg’s emphasis on company responsibility also deserves weight: both NIST and Article 55 place responsibility on leadership or the provider, rather than transferring it to an evaluator. Responsibility within the company does not, by itself, let outsiders verify how it was exercised. The comparison above also leaves a coordination problem: responsibility within one firm does not establish dependable restraint across its rivals. The safety benefit of a shared rule still needs evidence. The EU AI Act supplies a public route to evidence and action within its scope; a contract can supplement that route but cannot replace it.

Operational skill also needs a setting in which inconvenient findings can matter. An evaluator may discover a problem without having a protected reporting route. A valid test may inform a decision whose risk criterion remains contested. A reciprocal promise may be credible for declared activities while leaving important undeclared work outside view. Those are different failures requiring different responses.

Return to the evaluator whose finding the company disputes. A protected report can supply evidence of what happened; an identified decision-maker must then determine what follows. That distinction carries into the common-checkpoint proposal, where reliable evidence must meet an authorized risk decision. International agreements add their own problem of coverage: even sound assessment of declared work can leave consequential undeclared development outside view. Amodei’s plan is most useful where it connects these functions while recognizing their different demands.

The practical priority is to develop arrangements whose claims can be tested now. For providers already subject to the EU AI Act’s systemic-risk duties, the first question is whether those duties are being implemented and enforced. Continuing private scrutiny can supplement them, while a common international checkpoint would require decisions about authority and coverage that the Act alone cannot settle. Companies can negotiate evaluator access, dispute procedures and reporting rights, then examine whether scrutiny changes consequential decisions. Checkpoint pilots can test shared methods while the authority, risk criteria and coverage of a binding scheme are worked out. Governments can pursue narrower international commitments alongside research on the measurements and verification needed for broader restraint. Strategic restrictions require a separate showing that the time gained improves safety and supports the proposed bargain.

Confidence is greater in these institutional distinctions than in the predicted safety benefit. Evidence that continuous scrutiny changes consequential decisions, that checkpoints predict the risks they govern, or that reciprocal monitoring detects relevant breaches in time would strengthen the case; contrary operational evidence would weaken it.

Practical implications

  1. For evaluator engagements, rehearse a disputed finding. Identify the evidence, publication rights, recipient, response deadline and review route, including what survives termination. For an EU-covered model, map the finding to the provider’s Article 55 duties and any Commission process separately from the contract. Independence alone does not confer authority to stop development.

  2. For common checkpoints, specify the decision a pass supports. Separate test validity, acceptable-risk judgment and legal authority. Preserve uncertainty, exceptions and reassessment in the decision record.

  3. For policy teams assessing strategic restrictions, test each causal step. Identify which control is meant to delay a competitor, what safety work the delay should permit, and what would show that the restriction encourages reciprocal agreement. Evaluate substitution, evasion and counterpart responses separately from the control’s legal availability.

  4. For international proposals, match verification to the obligation. Testing, prohibiting assistance, measuring acceleration and detecting undeclared development require different evidence. State the benefit of a narrower agreement without claiming the assurance of a broader one.

  5. For pacing itself, identify the safety gain. Specify what additional time should improve and what evidence would show that improvement. A slower calendar alone cannot establish success.

Citations

No judicial decisions are cited. The legal analysis draws on the linked legislation, treaty text and official regulatory materials, alongside institutional and technical evidence; the source note records the limits of this review.

Informational analysis only. This essay does not constitute legal advice.

AI Lex Intelligence with Zola Valashiya.

About the contributors

Zola Valashiya writes and edits AI Lex Intelligence. His work connects technology law and policy with the practical questions of building and running a legally defensible AI governance program. AI Lex Intelligence, editor

Disclosure. Zola Valashiya is the editor of AI Lex Intelligence.