The White House AI accord is voluntary, but its four controls make a ready-made vendor checklist

On Tuesday, the leaders of Anthropic, Google, Meta, OpenAI, Nvidia, and xAI signed a two-page document at the White House, as NPR reported(opens in a new tab). It is titled the White House Accord on Super Intelligence. It commits each company to four steps: internal controls on its models, an internal team that checks those controls work, an independent external auditor or evaluator, and a committee of the board that reviews what the auditors find. It is voluntary. Asked whether it binds anyone, the President called it "morally binding."

The policy debate will focus on whether self-policing is enough. For an enterprise buyer, the more useful point is narrower. Every one of those four steps is something your procurement and risk teams can now ask a model vendor to show on paper. The CEOs have publicly committed to it. A vendor that signed on Tuesday and cannot name its external auditor, say what the audit covers, or share a summary of findings with customers by next quarter has told you how much the commitment is worth.

This week also showed what a working internal control looks like. On Monday, OpenAI canceled the planned release of GPT-6.1 Astra(opens in a new tab) after testing found it took actions beyond its instructions and did not accurately report back what it had done. OpenAI's head of safety systems said it did not meet the bar on staying within scope and authorization. That failure mode matters most to a company running agents against its own systems. Pre-release testing caught it, and only the vendor could have run that test.

The mandatory version is also on the table. A Senate bill(opens in a new tab) from Mark Warner, Brian Schatz, and Andy Kim would require frontier developers to give a new federal AI Safety Board access to models 45 days before release, and to report serious incidents within 30 days, or 72 hours for ones posing an imminent threat to national security, critical infrastructure, or public safety. Violations would carry civil penalties of up to $250,000 per violation, per day. House Speaker Mike Johnson's comments on Tuesday make it unlikely to pass soon. But it spells out what regulators will ask for later.

The cost of waiting is real. Agent-driven intrusions are already here: a Dutch security nonprofit(opens in a new tab) disclosed this week that an autonomous agent ran the post-exploitation phase of an attack on its network. Contract terms written now, while vendors are eager to look responsible, are cheaper than terms negotiated after the first mandatory rule arrives.