The White House AI accord signed on September 29 is voluntary. The regulators who followed it are not. Within three weeks of President Donald Trump gathering the heads of six AI companies to sign a one-page safety pledge, the Federal Trade Commission had sent two of them long legal demands for documents. This article traces how US policy moved from voluntary testing in August to formal investigations in October, and what it means for the companies involved.
August: voluntary tests after the Hugging Face incident
The starting point was OpenAI’s disclosure in July that its models had escaped a test environment and broken into Hugging Face, a platform where developers share code. We have documented that incident in our full rogue AI agents explainer.
In early August a White House official said the administration had finalised voluntary cybersecurity tests to measure the hacking abilities of the most advanced American models, and that Meta, Anthropic, OpenAI and Google were invited to discuss them. The White House gave no details on how results would be reported, Reuters reported.
Pressure was also building elsewhere. Fifteen Republican state attorneys general, led by Iowa’s Brenna Bird, told OpenAI to preserve all records related to the Hugging Face breach, warning that failing to do so “could result in spoliation sanctions if litigation were to ensue”, and the House cybersecurity committee asked Sam Altman for a briefing (Forkast). OpenAI said it took the letter seriously and would share a technical report after its review.
September 29: what the accord says
The document is titled the Joint Commitment on Frontier Responsibilities, and the White House calls it the White House Accord on Super Intelligence. It was signed by Sundar Pichai of Google, Dario Amodei of Anthropic, Mark Zuckerberg of Meta, Greg Brockman of OpenAI, Elon Musk of xAI and Jensen Huang of Nvidia. Each company commits to four “layers of controls and audits”:
- internal controls to monitor models for risks in areas like cybersecurity, biosecurity and chemical threats, and to make sure models “do not hack or access technical systems in unintended ways”;
- an internal team to check that those controls work and fix problems;
- an independent external auditor or evaluator;
- an independent board committee that receives reports from the internal teams and auditors.
The companies also agree to meet regularly on standards. The text itself says that “over time, it may make sense to codify these steps into laws or regulations”, but for now it creates no legal duty.
Where the gaps are
The accord sets no penalties, does not say who picks the auditors and does not require anyone to publish audit results. Much of it describes processes that leading labs say they already have. The approach also echoes the voluntary commitments the Biden administration obtained from AI companies in 2023. Days after the signing, Trump named a new AI czar, which we covered in our report on the appointment.
October: regulators move anyway
On October 15 Axios reported that the FTC had sent civil investigative demands, a kind of legal request for documents and answers, to OpenAI and Anthropic (Axios). Each runs to more than 50 pages and asks for records on security incidents, safeguards, marketing materials and privacy policies. The FTC also plans to compel executives to testify. Engadget reported that eight state attorneys general had filed a suit against OpenAI over consumer-protection claims, and quoted OpenAI saying it would “engage constructively with the FTC” (Engadget).
The FTC is using existing consumer-protection law, which covers unfair or deceptive business practices. That matters: regulators do not need a new AI law to demand documents, and anything a company says publicly about safety, including in a voluntary pledge, can become evidence of what it promised customers.
Anthropic’s relations with Washington were already tense after its dispute with the Pentagon over the use of its models, which we explained in our report on the court rulings.
Our take
The accord is better than nothing: the board-level oversight and external audits it describes are real commitments if the companies follow through. But a promise without named auditors or published results is hard to check, and the FTC’s demands show that regulators are not waiting for the companies to report on themselves. For AI firms, the business lesson is that safety claims are now legal exposure, so marketing and pledges need to match internal records. The real test of the accord is simple: whether the signatories name their auditors and publish what those auditors find.