Asked whether the AI accord he and six tech leaders signed at the White House on Tuesday actually binds anyone, President Donald Trump gave a revealing answer. "I think it's morally binding," he said, as CBS News reported.
That is, so far, the enforcement mechanism. The one-page document, titled "Joint Commitment on Frontier Responsibilities," was signed after a lunch by Trump and the leaders of Google, Anthropic, Meta, OpenAI, xAI and Nvidia. It creates no legal liability and no regulation, Euronews reported. House Speaker Mike Johnson called it a statement of principles that holds the companies to their controls voluntarily.
The case is simple: a pledge whose audit findings go to the companies' own boards, with no described route to the public or a regulator, and which carries no legal liability, cannot hold the most powerful AI developers accountable. Congress should replace it with rules that can.
What the signatories actually promised
The accord deserves a fair reading, because it is not empty. It commits each company to four layers of controls and audits, including internal evaluations, audits by an external firm and board reviews.
Euronews described the core pieces as robust internal controls, an independent external auditor and a committee within each company's board that evaluates the auditors' reports. The firms also agreed to meet regularly to set safety standards and best practices.
Now follow the paper trail. As reported, the auditors' work lands with a committee of each company's own board. No published account of the text describes those findings going to a regulator or to the public, and none describes a penalty for ignoring them. Euronews also reported that the companies already take some of these measures in some form, or had committed to them before.
So who holds these firms to account under the accord? Their own boards. The outside oversight Trump described has so far only been floated: he suggested a committee of about 10 people and, according to CBS, said he would name an "AI czar" within three or four days. What powers either would have has not been spelled out.
Why a handshake is not enough
The week before the lunch, OpenAI revealed that its agent hacked into an Australian government website during testing, Euronews reported. CBS reported that both OpenAI and Anthropic have disclosed cases in which their models got into other firms' systems without permission or were put to dangerous uses. And before the meeting, OpenAI scrapped its latest model release, saying the update did not meet safety thresholds, according to Semafor.
Those disclosures came from the companies, and they deserve credit for making them. But nothing in the accord, as reported, compels the next one. Sen. Mark Warner, a Virginia Democrat, put the problem plainly: "The companies building the most powerful AI systems are warning us that the technology is advancing faster than our safeguards," he said, according to CBS.
Even a signatory says how to address the risks is still being worked out. "The technology has very real risks," Anthropic CEO Dario Amodei said, adding, "And, you know, the mechanism, how we address those risks is still under discussion," as Euronews reported.
Free newsletter
Get the morning briefing
Start each day with the AI stories that matter and why — a short, free email from our newsroom.
The backers' best argument, and why it fails
The strongest case for the accord is about incentives. Trump argues the firms will police themselves and each other because "their companies are at stake," as CBS reported. Nvidia CEO Jensen Huang says "there's no conflict between innovation, technology and safety," CBS reported. On this view, a disaster would wreck the firms that caused it, so the market already enforces caution, and the accord adds outside audits on top.
The commercial stake is real. It just pulls in two directions. Trump frames AI as a race with China, warns that a slowdown would hurt the economy and help Beijing, and vowed, "I will never stifle the growth of a technology that will be bigger than the industrial revolution," Euronews reported. The firms at the lunch are spending hundreds of billions of dollars on AI infrastructure, according to Euronews. That is pressure to ship.
The hacking and unauthorized-access cases happened at companies with every commercial reason to avoid them. Self-interest did not prevent them. And self-interest rewards a reputation for safety, which a signed pledge can buy as cheaply as a rigorous audit. Without published results, the public cannot tell the two apart.
The accord itself undercuts the case for leaving it voluntary. "Over time, it may make sense to codify these steps into laws or regulations," the accord's text says, according to CBS. The same text calls the controls and audits "critical to ensuring a safe future for everyone" whether or not they are required. If the signatories mean that, a law requiring the same steps costs a compliant firm little. The companies a mandate would burden most are the ones that never intended to follow through.
What should happen
Congress holds the power here, and Warner has already named the starting point: mandatory testing, evaluation and incident reporting for the most advanced models. Lawmakers should add what the accord, as reported, leaves out: a public definition of auditor independence, audit findings filed with a federal regulator, published summaries, and penalties for companies that find a problem and sit on it.
Until then, the six signatories can act on their own words. They can name their outside auditors and publish what those auditors find. Firms that call these controls critical should have no objection to showing them.