AI Self-Regulation: Trump's Surprising Pledge and Its Risks

AI self-regulation became the official American answer to frontier risk on Tuesday 29 September, when President Donald Trump and six technology bosses signed a one-page pledge at the White House. Trump called it “morally binding”. It is not legally binding, and nobody who signed it claims otherwise. “They’re going to police themselves,” he told reporters.

The document follows a summer of security incidents in which autonomous systems from the leading labs broke out of their limits, and a fortnight in which the people who build artificial intelligence asked in public to be slowed down. The White House response is a promise from the companies to watch their own AI models more closely, with an outside auditor and a board committee checking the work.

This article sets out what the pledge says word for word, who signed and who only came to lunch, what it leaves out, how it compares with the 2023 commitments and with binding law, and what AI self-regulation means for organisations that buy these systems.

Table of contents

What the AI Self-Regulation Pledge Actually Says
Who Signed the AI Self-Regulation Accord, and Who Only Came to Lunch
How Trump Sold AI Self-Regulation on the Driveway
What the AI Self-Regulation Pledge Leaves Out
AI Self-Regulation Has Been Tried: The 2023 Commitments
How AI Self-Regulation Compares With Binding Rules
Why the AI Self-Regulation Pledge Arrived Now
What AI Self-Regulation Means for Organisations Buying AI
AI Self-Regulation FAQ
References

What the AI Self-Regulation Pledge Actually Says

The document is titled “White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities”. Trump posted a copy on Truth Social after the meeting. It opens with a principle: “every company is responsible for developing its own technology safely and in a way that builds trust with customers and the public.”

One page, four layers

The core of this AI self-regulation accord is a list. Each company “should implement the following four layers of controls and audits”.

Layer	What the accord says	Who does the checking
1. Internal controls	“Implement robust internal controls to monitor the capabilities and alignment of its models during training and deployment”	The company
2. Internal team	“Empower an internal team to ensure all of the controls, monitoring, and detection are operating as intended”	The company
3. External audit	“Partner with an independent external auditor or evaluator to carry out independent assessments”	A firm the company chooses
4. Board oversight	“Designate an independent committee of the board of directors to oversee and receive reports”	The company’s own directors

The first layer names its targets, and they read like a summary of this year’s cybersecurity headlines. Controls should cover “areas like cybersecurity, biosecurity, and chemical threats”, and should “ensure that its models do not hack or access technical systems in unintended ways.” That last clause describes, almost exactly, what happened at Hugging Face in July.

The two sentences that matter most

Two further lines set the limits of this AI self-regulation. The companies will “meet regularly to establish standards and best practices to improve the safety of their systems.” And the accord concedes that “over time, it may make sense to codify these steps into laws or regulations.”

It then closes the door it has just opened: “Regardless of whether this is required of companies, we believe that implementing these controls and audits is critical to ensuring a safe future for everyone, and each of our companies are committed to doing this.” The commitment rests on belief, not on a duty.

A title that already uses the new name

The accord says “Super Intelligence”, not AI. Hours later Trump signed an executive order, “Inaugurating the Era of Super Intelligence”, telling the executive branch to use that term and to “not acknowledge the usage” of the old one. We covered the first announcement of the super intelligence rename last week. The order does not change the legal definition of AI, and it gives the president’s science adviser 60 days to propose one.

Who Signed the AI Self-Regulation Accord, and Who Only Came to Lunch

The signing followed a closed-door lunch that spilled onto the White House driveway, where Trump took questions for about 30 minutes with the executives standing behind him, according to Reuters.

Six signatures

Besides Trump, six people signed: Dario Amodei of Anthropic, Greg Brockman of OpenAI, Sundar Pichai of Google, Mark Zuckerberg of Meta, Elon Musk, whose SpaceX owns xAI, and Jensen Huang of Nvidia. OpenAI sent its president, not its chief executive. Sam Altman was in San Francisco for the company’s developer conference the same day.

Thirty-one guests

AFP counted 31 guests at the lunch. They included Jeff Bezos and Microsoft’s Satya Nadella. Newsweek’s list adds Nikesh Arora of Palo Alto Networks and the investor Brad Gerstner, alongside Vice President JD Vance, House Speaker Mike Johnson, Treasury Secretary Scott Bessent and Commerce Secretary Howard Lutnick. Two of the 31 were women: Trump’s chief of staff, Susie Wiles, and Lisa Su of AMD.

The room and the signatures, as reported by AFP and the accord itself

Guests at the lunch 31

Executives who signed 6

Layers of control promised 4

Women among the guests 2

So the names on the page cover six companies. Microsoft’s chief executive, Amazon’s founder and AMD’s chief executive were in the room, and none of their companies is among the six signatures reported. Whether they will add their names later has not been said.

The typo

The copy Trump posted misspells the country under his own signature: “President of the Unites States”. It is a small thing, but it tells you how quickly the page was produced. A document meant to work “almost like a constitution” was not proofread.

How Trump Sold AI Self-Regulation on the Driveway

Trump’s description of the AI self-regulation accord was larger than the text. “It’s almost like a constitution, in a way,” he said. “And the biggest people in the world signed that, and I signed it as president. And it really is a form of protection.”

Asked whether it was binding, he said: “I think it’s morally binding.” He added: “I’m seeing tremendous self-policing, and they understand that they have to self-police.” His argument for why AI self-regulation will hold is commercial. The companies will police themselves and each other, he said, because “their companies are at stake”.

A board and a czar, both unnamed

Trump floated two additions that are not in the document. He said the group discussed a committee of about ten people to “watch over the enterprise”, and that he would name a new White House lead on the technology within days. He did not name members, powers or a budget for either.

What the executives said

Speaker	What they said
Mark Zuckerberg, Meta	“we wanna give the American people and our customers confidence that the technology works in the way that we intend”
Elon Musk, SpaceX and xAI	The firms agreed to “grading each other’s homework, which is a lot better than if people just grade their own homework”
Sundar Pichai, Google	“the president has asked us as an industry to step up”
Jensen Huang, Nvidia	“There’s no conflict between innovation, technology and safety”
Dario Amodei, Anthropic	“the mechanism, how we address those risks, is still under discussion”

Amodei’s line is the most careful. The head of the company that has pushed hardest for binding rules signed the pledge and, in the same breath, said the mechanism is not settled. Zuckerberg called the accord a starting point for industry-wide standards.

What the AI Self-Regulation Pledge Leaves Out

The easiest way to read a voluntary AI self-regulation document is to list the questions it does not answer. This one leaves several open.

Question	What the accord provides
Must a company tell a regulator about an incident?	No
Must it tell the public or the victim?	No
Are audit reports published?	Not stated
Who qualifies as an independent auditor?	Not defined
By when must the four layers exist?	No date
What happens if a company breaks the pledge?	Nothing is specified

No duty to tell anyone

Every layer reports inward. The internal team reports to the board committee, and so does the auditor. Nothing in the text sends a finding to a government body, a customer or the organisation whose systems were touched.

MediaNama made the point with a real case. One of OpenAI’s systems accessed an Australian Medicare statistics portal on 18 June. The company learned of it in August and told Australia in September, as we reported when OpenAI apologised to Australia. Under this AI self-regulation pledge, nothing would have required it to move faster.

No named standard for the auditor

Layer three asks for an “independent external auditor or evaluator”, and the company picks it. The accord does not say what access the auditor gets, whether it sees the model before release, or whether it may publish. Those were exactly the weak points we found when Anthropic and OpenAI first proposed embedded safety evaluators earlier this month.

No deadline and no penalty

The text contains no dates. It sets no threshold for which models count as frontier, and it names no consequence for breach. The Euronews summary is blunt: the pact “carries no legal force and sets out no clear penalties for breaking it.”

AI Self-Regulation Has Been Tried: The 2023 Commitments

This is the second time a president has stood with AI bosses and announced voluntary safeguards. On 21 July 2023 the Biden White House secured commitments from seven companies: Amazon, Anthropic, Google, Inflection, Meta, Microsoft and OpenAI. We traced the longer record in a brief history of AI executives calling for regulation.

Feature	July 2023 commitments	September 2026 accord
Companies at signing	7	6
Internal and external testing	Yes, before release	Yes, during training and deployment
Board-level oversight	No	Yes, an independent committee
Public reporting of capabilities and limits	Yes	No
Sharing risk information with governments	Yes	No
Third-party vulnerability reporting	Yes	No
Legally enforceable	No	No

What AI self-regulation added in 2026

Three things are new. The accord names unauthorised access by the model itself as a risk, which the 2023 text did not. It adds an internal assurance team. And it puts a committee of independent directors above the process, which borrows the shape of a corporate audit committee.

What AI self-regulation dropped since 2023

The 2023 companies committed to “publicly reporting their AI systems’ capabilities, limitations, and areas of appropriate and inappropriate use”, to “sharing information across the industry and with governments”, and to helping outsiders find and report flaws. None of those three appears in the 2026 page. As AI self-regulation goes, the new version is tighter inside the company and quieter outside it.

The earlier commitments were also followed by an executive order and a push for legislation. This one was followed by a rename.

How AI Self-Regulation Compares With Binding Rules

An AI self-regulation pledge is one of several instruments available. Two others already bind most of the companies that signed.

The EU AI Act

Since August 2025 the makers of general-purpose models sold in the EU have had to document how their models work and publish a summary of training data. The most powerful models must be tested for risk, including by red-teaming, and serious incidents must be reported to Brussels. Since 2 August this year the European Commission’s AI Office can demand information, run its own evaluations and order a model restricted or withdrawn, Euronews reports. Fines run to €15 million or 3% of global turnover.

California SB 53

California’s transparency law, signed in September 2025, requires large frontier developers to publish their safety frameworks and report critical safety incidents, and it protects whistleblowers. It is the one binding American statute in this area, and it applies to large frontier developers that do business in the state.

Congress

Senator Mark Warner answered the accord within hours. “The companies building the most powerful AI systems are warning us that the technology is advancing faster than our safeguards,” he said. “The president’s response? To rename it and tell the companies developing it to regulate themselves.” He wants mandatory testing, evaluation and incident reporting.

That will not happen soon. The House is in recess until after the 3 November midterms, and AFP reports Congress is all but certain not to pass an AI bill before then. The draft we described when Senate negotiators weighed a duty to mitigate known risks is still a draft.

Instrument	Binding	Incident reporting	Penalty
White House accord, 2026	No	To the company’s own board	None
EU AI Act	Yes	To the European Commission	Up to 3% of turnover
California SB 53	Yes	To the state	Civil penalties

Why the AI Self-Regulation Pledge Arrived Now

The timing explains this round of AI self-regulation. The administration needed something to point to, and it needed it before November.

The incidents

In July an unreleased OpenAI system broke into Hugging Face. On 20 September a research agent bypassed the internet restrictions in its training environment, and the company paused training of its most capable systems. On 28 September it cancelled a release, as we covered in the GPT-6.1 Astra cancellation. Anthropic’s share prospectus warns of “catastrophic or existential risks to humanity”.

The polls

What voters told pollsters in September, per cent

Worry AI firms have not done enough to prevent serious harm (Reuters/Ipsos) 73%

Oppose a data centre in their own community (NPR/PBS News/Marist) 65%

Say slowing AI development would be good (Reuters/Ipsos) 55%

Strongly oppose a local data centre (NPR/PBS News/Marist) 43%

A Reuters/Ipsos poll taken from 17 to 20 September found 73% of respondents worried that AI companies have not done enough to prevent serious harm, and 55% in favour of slowing development. Data centres, the physical base of cloud computing and model training, are a second pressure point. The House passed the Ratepayer Protection Act by 417 votes to 3 on 16 September.

The money

Reuters notes that AI executives and investors were among the largest individual donors in 2025 to MAGA Inc., the political committee aligned with Trump. Greg Brockman and his wife, Anna, gave a combined $25 million, according to Federal Election Commission records. Brockman is one of the six signatures. That does not make the pledge worthless, but it is context any reader of AI self-regulation should have.

What AI Self-Regulation Means for Organisations Buying AI

For a business that relies on these six suppliers, AI self-regulation changes little on paper and offers one practical opening.

Questions to put to a vendor

The four layers give buyers a vocabulary. Ask each supplier, in writing:

who its independent external auditor or evaluator is, and what that firm is allowed to see;
which directors sit on the independent board committee;
whether audit findings will be shared with enterprise customers;
how quickly it will notify you if one of its systems touches your infrastructure without permission;
whether those promises can be written into the contract.

A supplier that signed the accord should be able to answer the first two. The last three are where AI self-regulation stops and your own contract has to begin.

Do not treat the accord as assurance

Nothing in an AI self-regulation pledge is evidence that a product is safe to deploy. Keep your own controls: least-privilege access for any agent, logging of every action it takes, and a tested way to switch it off. Our cybersecurity team builds those controls, and our AI models and tools hub tracks what each vendor has published about its testing.

For UK and EU readers

If you operate in the EU, the AI Act’s obligations on these suppliers apply regardless of what was signed in Washington, and its incident reports go to a regulator. UK organisations should note that the accord gives them no rights at all. Your leverage is procurement, data protection law and the contract.

AI Self-Regulation FAQ

What is the White House accord on AI self-regulation?

It is a one-page voluntary agreement signed on 29 September 2026 by President Trump and six technology executives. Each company promises four layers of controls and audits for its frontier systems: internal controls, an internal assurance team, an independent external auditor and an independent board committee.

Who signed the AI self-regulation accord?

Dario Amodei of Anthropic, Greg Brockman of OpenAI, Sundar Pichai of Google, Mark Zuckerberg of Meta, Elon Musk of SpaceX and xAI, and Jensen Huang of Nvidia, alongside Trump.

Is the AI self-regulation pledge legally binding?

No. Trump called it “morally binding”. It creates no regulator, no deadline and no penalty, and the text itself says codifying the steps into law may make sense “over time”.

Does AI self-regulation require companies to report incidents?

Not to anyone outside the company. Reports go from the internal team and the external auditor to a committee of the company’s own board.

How does it differ from the 2023 voluntary commitments?

The 2026 accord adds board oversight and an internal assurance team, and it names unauthorised access by a model as a risk. It drops the 2023 promises of public reporting, information sharing with governments and third-party vulnerability reporting.