On 28 May 2026, at a Tech7 event on the margins of the G7 Digital and Tech Ministerial Meeting under the French G7 Presidency in Paris, the OECD launched version 2.0 of the Hiroshima AI Process (HAIP) Reporting Framework. The pitch is deliberately modest: a streamlined, voluntary questionnaire through which organisations describe how their practices line up against the Hiroshima Process International Code of Conduct for Organisations Developing Advanced AI Systems, the code drafted under Japan's 2023 G7 Presidency and advanced under Italy's 2024 turn. More than 50 companies have already pledged to file, and reports received by 1 September 2026 will feed the OECD's next analytical review.
That is not a headline that moves markets. But the design choice behind it — broaden participation by lowering friction, not by threatening penalties — is the most interesting thing about AI governance this spring, and it deserves a fair hearing on its merits.
The strongest case for going further
Start with the steelman. Voluntary disclosure has an obvious failure mode: the firms with the most to hide simply don't show up, and the ones that do can grade their own homework. The OECD's own first-round results — roughly 25 reports analysed in its 2025 study How are AI developers managing risks? — illustrate the gap. A serious regulator could reasonably argue that frontier models capable of cyber-offence, bio-uplift, or large-scale manipulation are too consequential to depend on whoever volunteers. The EU AI Act already imposes binding transparency and systemic-risk obligations on general-purpose models; from that vantage, a voluntary OECD form looks like a polite suggestion where a rule belongs.
The Brookings Institution's assessment of the first cycle sharpens the critique rather than dismissing it. Submissions ranged from 9 to 60 pages, with inconsistent scope — some described company-wide policy, others a single model. Most organisations "described governance processes without clearly distinguishing between implemented practices and planned or piloted measures," and reports "provided limited quantitative evidence" for safety claims. If you cannot tell what a company actually does from what it intends to do, comparability collapses, and a transparency exercise risks becoming a marketing one.
Why streamlining is the right answer, not stricter rules
Those are real defects. But the cure the framework's critics imply — mandatory, audited, statutorily backed reporting — would solve them at a cost that falls hardest on exactly the participants the ecosystem most needs to hear from.
The first-round cohort tells the story. Brookings found that of 24 participants, 18 were large enterprises; only three were medium-sized and three micro. Smaller firms, it noted, "faced capacity constraints navigating open-ended questions without standardized guidance." When disclosure is expensive, scale becomes a moat: incumbents absorb the compliance cost as a fixed line item, while a 20-person model-tuning startup either skips the market or burns runway on lawyers. A mandate calibrated to OpenAI and Google would, in practice, entrench them.
Version 2.0 reads as a direct response. The OECD explicitly designed it to broaden participation across the AI value chain, welcoming not just frontier developers but deployers, cloud providers, and small and medium-sized enterprises — the actors who configure and ship AI into real products and who were nearly invisible in round one. Cutting the form down and writing it for non-specialists is not a dilution of ambition; it is the precondition for the data being representative of the market rather than of its six largest companies.
This is the proportionality argument in its cleanest form. The marginal transparency gained from forcing a Romanian computer-vision SME to produce a 60-page audited filing is small; the marginal chilling effect is large. A voluntary, lightweight instrument that 50-plus firms opt into beats a mandatory one that a handful comply with and everyone else routes around.
Keep it voluntary, but make the soft pressure honest
None of this excuses the comparability problem. The fix, though, lives inside the framework's own logic, not in legislation. Brookings' recommendations point the way: offer structured guidance and worked examples so answers converge without becoming boilerplate; build a filterable public database so reports can actually be compared; and — crucially — distinguish self-attestation from independent verification on the face of each report. A reader should never have to guess whether "we red-team our models" means a standing team or a slide deck.
There is also a quieter benefit that justifies participation even absent enforcement. Japanese participants reported that the exercise improved "coordination across teams working on trustworthy AI" and clarified internal governance — the discipline of writing down what you do has value before any regulator reads it. That intrinsic payoff is what makes voluntary uptake plausible rather than naive.
The signal to watch
The risk now is drift. A voluntary OECD framework can quietly harden into a de facto mandate when procurement officers, insurers, and enterprise buyers start treating a HAIP filing as a tender prerequisite. That would import every cost of a mandate without the democratic accountability of having legislated one. Governments and the OECD should resist the temptation to let the form metastasise into a checklist gate, and should keep the SME on-ramp genuinely light.
The number that matters arrives after 1 September 2026. If the second cohort is meaningfully larger and visibly more diverse — more deployers, more SMEs, more countries — the streamlining bet will have paid off, and the case for binding global mandates weakens accordingly. If participation stalls at the same few dozen incumbents, the voluntary model will have hit its ceiling, and the harder conversation becomes unavoidable. Either way, the 2.0 release is the right experiment: widen the tent before you nail it shut.