Four layers inside the company
On 29 September, Donald Trump and six technology-company executives signed a commitment at the White House on controls for frontier models. The document proposes four layers: internal controls during training and deployment; a team within each company to check that those controls work; an “independent” external auditor or evaluator; and an independent board committee to receive reports and oversee remediation. It sounds like a safety architecture. The awkward question appears in the next line: who checks that the architecture is truly independent?
The accord names specific concerns: capabilities related to cybersecurity, biosecurity and chemical threats, as well as unintended access to technical systems. It also calls for monitoring whether models behave as intended, identifying failures and remediating them. This is not an empty promise: it assigns internal responsibilities and recognises that an assessment outside the development team may add scrutiny. Yet the same text leaves unspecified the rules that would let anyone judge whether these layers do more than reassure the signatories themselves.
It sets no audit frequency, minimum evaluator qualifications or scope of access to models, data, incident records or security tests. It does not say how an evaluator is selected or paid, what conflicts must be disclosed, who receives the full report, what is published or which authority can act if a company leaves a risk uncorrected. The signatories do commit to meeting regularly to establish standards and best practices for system safety; the text does not define their content, set a timetable for adopting them or say how they could be enforced. The board committee must receive reports and ensure problems are addressed; the accord describes no external route for checking that it has done so.
The distinction matters because an audit is more than hiring someone with that title. Independence depends on observable conditions: who appoints and pays the reviewer, whether the reviewer can refuse the assignment, what evidence they may examine, whether they control their conclusions and whom they can alert to a serious finding. Calling an auditor “independent” states an aspiration; it does not replace rules that protect that independence when the evaluator works for the organisation being evaluated.
A political commitment, not a compliance regime
The signatories describe each layer as something companies “should” implement and say they are committed to doing it. The document itself says that, over time, it may make sense to codify the steps into laws or regulations. That places the accord in the realm of voluntary commitments: it opens the door to future regulation, but does not cross the threshold. Trump called it “morally binding” to reporters, according to the Associated Press, and said he would appoint someone to oversee the accord. That promised oversight still needs a structure, authority and rules absent from the signed text.
The contrast with a legal obligation is practical. A rule can define who must comply, empower an authority to request evidence, set deadlines and establish consequences subject to review. The accord lists practices its signatories want to adopt, but provides no penalties, fines, launch suspensions or process for handling complaints. Nor does it require publication of external audit reports. A customer, affected worker or community near a data centre receives no new right here to demand an audit or obtain a remedy.
That does not show that the companies lack controls, or that every hired auditor will be compliant. The Associated Press reported that some of the measures were already being taken in some form by the signatories. The point is narrower: on its own, the accord does not let the public distinguish a robust safety programme from a review limited to risks chosen by the company or a compliance statement unsupported by enough information to assess it. Making that distinction requires criteria, access and observable results.
The structure also keeps the centre of gravity inside each company. An internal team operates the controls; another internal team reviews them; an external evaluator reports; and a board committee receives the reports. That chain could provide effective oversight if reviewers have independence, information and the ability to compel remediation. It could also become a set of reports moving through corporate hierarchy while regulators, courts and the public cannot see what was found. The accord gives the outline of the chain, not its external safeguards.
The next step is not another signature
The White House presented the document as a starting point for frontier-model safety. The promised meetings could produce shared practices; their value will depend on how participants measure them and whether they leave results others can examine. Public debate should now move from adjectives to mechanics: what counts as a frontier model? Which standard does the auditor use? Can they examine confidential tests and records? How are they protected from retaliation? Who sees their findings? What happens if the board committee disagrees or the company leaves the risk uncorrected? Without answers, “four layers” describes a corporate-governance structure, not a public accountability system.
One route would turn the commitment into binding rules defining independence, minimum qualifications, access and reporting, with protection for sensitive information and external oversight. Another would require each company to publish which controls it adopted and what its auditor found, with clear limits to avoid revealing vulnerabilities that could aid attacks. The signed text adopts neither route. It acknowledges that legislation may follow and leaves open what happens in the meantime.
External audits can improve an internal review; they do not automatically turn a promise into a guarantee. The Washington accord put the auditor on the organisation chart and left out of the document who checks the auditor’s independence, what the auditor can see and what consequences follow from the report. The commitment to develop standards creates a basis for shared work; the choice and oversight of the evaluator still depend on rules the text does not establish. That is the missing test if “self-policing” is to mean more than a reassuring phrase spoken by the people who control the technology.