Self-Regulation Is Not AI Safety: Why Voluntary Pledges Keep Failing

The AI industry's preferred approach to safety has become voluntary self-regulation, and critics argue that this arrangement accomplishes little beyond creating the appearance of oversight. Companies including OpenAI, Google DeepMind, and Anthropic have published safety frameworks, model cards, and usage policies in recent years, but none of these documents carry binding force or independent verification. The result is a system where the entities building the most capable systems also decide what counts as safe and whether they have met their own standards.

The pattern is not new. Social media platforms spent a decade issuing community guidelines and transparency reports while researchers documented harms that the companies themselves had the data to see. Tobacco, financial services, and pharmaceutical companies all made similar arguments that internal expertise made external rules unnecessary, and in each case the eventual regulatory apparatus was built over industry objections. AI developers now make the same case, pointing to internal red teams and safety teams as evidence that they can police themselves.

What makes the current moment different is the pace and concentration of capability. A handful of labs control the frontier models, and the compute required to train them runs into the hundreds of millions of dollars per run. That concentration gives those labs unusual leverage over how safety is defined, measured, and disclosed. When a company publishes a safety policy, it is simultaneously the author, the enforcer, and the judge of compliance.

Several concrete gaps illustrate the problem. Voluntary commitments typically lack third-party audits, standardized incident reporting, or penalties for noncompliance. Safety teams inside these companies have seen departures and reorganizations that reduce their independence from product teams. Meanwhile, governments have moved slowly: the EU AI Act passed but its most consequential provisions phase in over years, and US federal legislation remains stalled while states patch together their own rules.

The open question is whether external pressure can force binding standards before a serious incident does. Researchers, former employees, and some lawmakers are pushing for mandatory disclosure of training data, evaluation results, and incident reports, along with liability rules that make companies answerable for foreseeable harms. Until those exist, self-regulation functions less as safety and more as a placeholder that lets everyone claim progress without proving it.