On September 29, 2026, the chief executives of Google, Anthropic, Meta and Nvidia, along with OpenAI's president and SpaceX's chief executive, signed the White House's "Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities." According to MediaNama's account, the accord asks each company to adopt four layers of control. It also has no penalties, no duty to publish audit results, and no duty to report incidents to government. President Trump called it "morally binding" and said it was "almost like a constitution, in way."
The accord is a real step. It is also much weaker than the label suggests, and the gap is the interesting part.
The strongest case for the accord
Supporters have a fair argument. Frontier model risks in cybersecurity, biosecurity and chemical threats are hard to specify in statute, and capabilities change faster than rulemaking can. A voluntary accord can move faster than legislation. It also puts the firms with the most technical knowledge inside a shared framework, and the accord reportedly commits them to convene regularly on standards and best practices. Companies that sign are also more likely to build lasting internal safety practices than companies that are forced into minimal compliance.
The four commitments are reasonable engineering practice. Per MediaNama's reading of the text, each company should:
- monitor its models' capabilities and alignment during training and deployment for cyber, bio and chemical risk, and ensure they do not access technical systems in unintended ways;
- empower an internal team to verify that controls work and that problems are fixed;
- engage an independent external auditor or evaluator to assess whether those controls work;
- create an independent board committee that receives reports from the internal team and the auditors.
For a pro-innovation publication this is a defensible design. Assurance is built around each firm's own architecture instead of a fixed technical checklist that would be out of date within a year.
What the accord leaves out
The difficulty is what makes a commitment credible. The accord has no enforcement mechanism. It does not require audit results or even auditor identities to be disclosed. It does not require companies to tell any government body when something goes wrong. Trump said he sees "tremendous self-policing" and plans an oversight board, but he did not name its members.
An external audit whose findings and auditor stay private cannot be checked by anyone outside the company. Readers, customers, investors, researchers and regulators cannot tell a rigorous audit from a cursory one. The board committee is the one accountability layer, and it reports to the company's own directors. Without disclosure, "independent" describes who did the work, not whether anyone can test it.
Incident reporting is the second gap, and it matters more for the government's ability to act. A government that is never told about incidents cannot spot patterns across companies. It also cannot decide when a voluntary regime is failing and needs replacing.
We have seen this design before
The accord follows the pattern of the Biden administration's July 21, 2023 voluntary commitments. Seven companies, including Amazon, Anthropic, Google, Inflection, Meta, Microsoft and OpenAI, pledged pre-release security testing, cybersecurity safeguards and research on societal risks. Those commitments were also voluntary. The new accord is notable for a fourth layer, board-level oversight, and for adding Nvidia and SpaceX, which were not among the seven in 2023. Amazon, Microsoft and Inflection, who were, are not among the reported signatories.
The contrast with other jurisdictions is sharp. California's SB 53, chaptered on September 29, 2025, requires large frontier developers to publish a frontier AI framework on their websites. It requires them to report critical safety incidents to the state Office of Emergency Services within 15 days, and it allows civil penalties of up to $1,000,000 per violation, enforced by the Attorney General. In the European Union, providers of general-purpose AI models with systemic risk must notify the AI Office, submit safety and security frameworks and report serious incidents, and the Commission's enforcement powers, including fines, began on August 2, 2026.
The accord therefore sits below what these companies already face elsewhere, in the state where most of them are based and in the EU market they sell into. That may make it more a signalling document than a new constraint.
A proportionate path
The pro-innovation answer is not to demand a sweeping federal licensing regime. Broad licensing would favour incumbents and slow open research. The answer is to add the two cheapest pieces of transparency the accord lacks, and neither needs new law.
First, companies could publish a short summary of each audit: scope, method, auditor name and the categories of findings. Redactions could cover security-sensitive details. This is the minimum needed for "independent" to mean something. Second, they could agree a confidential incident-reporting channel to a designated federal body. Confidentiality would protect trade secrets and reduce the risk that a report becomes a public relations problem. California and the EU already require similar reporting, so the signatories have the compliance machinery.
A voluntary regime can work when peer pressure and reputational stakes are high, and this one has six of the most prominent firms. But reputation only works if outsiders can observe behaviour. Calling the accord "morally binding" does not supply that observation. Publication and reporting would.
What to watch
Three things will show whether the accord means anything. Do the signatories name their auditors? Does the promised oversight board get members and a mandate? And does any signatory volunteer more disclosure than the text demands? If none does, the accord is a statement of intent. It is not a safety regime, and policymakers should treat it that way, without dismissing the firms' work and without pretending that a document with no penalties and no disclosure has answered the question it was written for.