The labs' private regulator has a name now — and the job it wants is deciding who counts as an independent auditor

What was reported

On 24 September 2026, The Information reported that Google, OpenAI and Anthropic have moved past working groups and agreed to establish an institution. Its working name is the Standards Authority for Frontier AI — SAFA. The target launch window is the end of this year or early 2027.

The structural model is FINRA: the Financial Industry Regulatory Authority, the industry-funded body that writes and enforces conduct rules for US brokerages under SEC registration. Applied to AI, that means a self-regulatory organisation funded by the firms it regulates, operating independently of government, requiring neither Congressional nor presidential approval to exist — though it would likely need to register with a federal agency to carry any enforceable authority.

The reported functions are four:

The first three are things enterprise buyers have asked for since 2024. The fourth is the reason this story is not a governance-page footnote.

The idea did not originate in the working groups. Demis Hassabis published an essay on 14 July 2026, A Framework for Frontier AI and the Dawning of a New Age, proposing exactly this: a US-initiated, federally overseen, industry-funded standards body on the FINRA pattern. His design had two phases. First, labs voluntarily share models for review up to 30 days before release, with testing across cybersecurity, biological risk and agentic behaviours including guardrail bypass and deception. Then, once the regime demonstrably works, compliance becomes a prerequisite for any model to go live for American users. Hassabis said funding “would need to be substantial and likely mostly come from industry,” and that he wanted the body operational before year-end.

This desk covered the earlier stage of this on 14 September, when the three labs’ private standards working groups surfaced without the antitrust waiver their own proposal said they needed. What has changed in eleven days is that the thing now has a name, a launch window, a leadership shortlist and a remit. It has acquired institutional shape.

The remit is the story

Reread the fourth row of that table.

In any functioning assurance market — financial audit, clinical trials, aviation airworthiness, food safety — the value of an audit comes entirely from the auditor’s independence, and independence comes from somewhere the audited party does not control. A statute. A professional body. A regulator with subpoena power. The audit is worth something precisely because the audited firm did not decide who was allowed to perform it.

SAFA’s reported design puts that decision inside the three companies being audited.

This does not require anyone to act in bad faith to produce a bad outcome. It requires only that qualification criteria be written by people with a consistent institutional interest, over years, with no countervailing party in the room. FINRA is the stated model, so FINRA’s record is fair evidence about what the model produces. Senator Elizabeth Warren has criticised it repeatedly for weighting brokerage interests above investor protection. Whistleblowers accused it of declining to pursue problematic brokers at large member firms. Its own former enforcement chief, Brad Bennett, has said some larger brokerages treat its fines as cheaper than compliance. SLCG Economic Consulting found it had failed to apply its own “restricted” designation to at least 13 brokerages that met the criteria.

That is the mature, seventy-year-old version of this institutional form, in a sector with far better-defined harms and far more litigation pressure than AI. It is not an argument that SAFA would be worthless. It is an argument about what a self-regulator’s steady state looks like, and buyers should price the steady state rather than the launch announcement.

The critics on record this quarter are blunter. Nader Henein of Gartner: “self-regulation is not viable,” because most tech vendors “don’t have the capacity to self-regulate.” Independent analyst Carmi Levy called the Hassabis framework “a self-serving roadmap for an industry bent on racing to the AI horizon regardless of the harms caused along the way.” The most useful objection is Yoshua Bengio’s, who accepted the pragmatic case for starting voluntary but insisted on “a clear and precise roadmap to transition from a voluntary to a mandatory model.” Nothing in the reported SAFA design contains that roadmap. Hassabis’s original essay did.

Two names, sixteen days apart

The reported chief-executive shortlist is Sriram Krishnan, Arati Prabhakar, Condoleezza Rice and David Friedberg.

Krishnan served as senior White House AI policy adviser from January 2025 until June 2026. On his way out, he told the Financial Times that “there will not be an FDA for AI,” arguing a central licensing agency requiring “a team of lawyers before you can get a model out” would put sand in the gears of the AI revolution. Reasonable people hold that view. It is nonetheless a striking résumé line for the prospective chief executive of a body whose reported job includes qualifying auditors and, in the Hassabis design, eventually gating US model releases. Either the position has changed, or SAFA is understood by its architects as the thing that makes an FDA for AI unnecessary — and the second reading is the one a buyer should assume until told otherwise.

The reported scientific consultants are Beth Barnes, founder and chief executive of METR, and Paul Christiano, senior technical adviser at the Commerce Department’s Center for AI Standards and Innovation.

Both are credible. METR is one of the few organisations that has done serious, published, adversarial evaluation of frontier models. Christiano co-invented RLHF and has spent a decade on alignment.

And on 8 September 2026 — sixteen days before this report — OpenAI announced that Christiano had joined its Foundation Board, taking a seat on the Safety and Security Committee chaired by Zico Kolter and a non-voting observer seat on the OpenAI Group PBC board.

Hold those two facts next to each other. A sitting board member of one of the three founding companies is reportedly a scientific consultant to the body that would define what independence means for everyone auditing that company’s models. That is not a scandal and it is not illegal. In a field this small, the people qualified to write frontier evaluation standards are largely the people the frontier labs have already hired, funded or appointed — which is itself the structural problem, not a defence against it.

It is also not an isolated instance. Last week Anthropic named Accenture as its first embedded evaluator, funded the work directly, and picked a firm whose AI arm had already red-teamed for OpenAI. That arrangement arrived structured as a vendor engagement — the one thing the published independence standard says it must not be. The pattern is consistent: the mechanism keeps being real, and the independence keeps being supplied by the party being evaluated.

The twenty-four hours this landed in

The timing is the part that will not fit in a governance summary.

On the same day this report ran, Politico reported that the White House Office of the National Cyber Director had asked OpenAI and Anthropic to withhold new frontier models from the UK AI Security Institute until a US review completes. Anthropic complied: Claude Mythos 5.1 went to a US-only Project Glasswing slate, the first time AISI had been excluded from a pre-release Anthropic evaluation. This desk covered it earlier today — the last independent frontier-model evaluator just became a US policy variable.

Set the two stories side by side and the shape is hard to miss:

• AISI was the best-resourced evaluator in the stack that was neither vendor-funded nor vendor-selected. Its access is now determined by a jurisdiction.
• Accenture is an embedded evaluator, funded by the lab it evaluates.
• SAFA would decide who else qualifies to evaluate at all.

Three independent developments, none of them coordinated, converging on the same outcome within eight days: every remaining route to an outside opinion about a frontier model now runs through a party with a commercial or political interest in the answer.

That is not a conspiracy claim. It is an inventory. And it is the reason the phrase “independently evaluated” — which appears in model cards, enterprise security questionnaires, EU AI Act readiness packs and half the model-risk documentation written this year — is quietly becoming unfalsifiable.

What this changes for procurement

Very little, immediately, and that is the trap. SAFA does not exist. No standard has been published. Nothing in your contract changes this quarter.

What changes is the evidentiary value of a phrase you are probably already relying on.

Stop accepting “independently evaluated” without the artefacts. Four questions, in writing, to every frontier vendor in your stack:

1. Who performed the evaluation, and what is their commercial relationship to you? Paid engagement, grant, equity, board overlap, or genuinely none.
2. Which model builds did they actually see? Pre-release access is now allocated by jurisdiction as well as by contract, so “the model was evaluated” and “this model was evaluated” have come apart.
3. What level of access did they have? Weights and training data, internal evaluation results, or the same public API your team has.
4. What could they have published if the findings had been bad? Publication rights are the only part of an independence claim that is cheap to verify and expensive to fake.

Do not wait for SAFA to supply a datasheet. Carmi Levy’s advice to enterprises this week was to enforce vendor standards now: require models to ship with the equivalent of a safety and security datasheet — documented capabilities, known failure modes, testing history. Nothing prevents you from making that a contractual condition today, and a vendor’s willingness to provide one is itself a signal.

Treat AI risk with the machinery you already have. Yaz Palanichamy of Info-Tech Research Group frames it as diagnosing AI risk “with the same level of seriousness as financial or cybersecurity risk” — a standing governance committee, named owners, contractual guarantees. The gap this closes is real and current: the labs are in no position to offer meaningful behavioural assurances for agentic systems right now, as the Beltdown sandbox-escape cluster demonstrated across every major coding agent this month.

If you operate in the EU, note which regime is actually binding. SAFA is voluntary and hypothetical. Article 50 of the AI Act has been enforceable since 2 August 2026, and its obligations fall on you as deployer regardless of what any industry body publishes. The contrast with the US approach — where the federal frontier framework was completed and then kept secret — is the practical reason European buyers currently have more to work with than American ones, not less.

Watch the membership, not the mission statement. The vendors outside SAFA have an incentive to compete on transparency, and some will. Microsoft published a versioned behavioural document rather than joining. Open-weight vendors — Mistral, DeepSeek, the Qwen family — can offer inspection that no closed-weight lab can match, which is a genuine procurement argument and not only an ideological one. Cohere has been the loudest critic of the club from inside the industry. A market with a self-regulator and a set of outsiders competing against it is a better market for buyers than one with neither.

The honest uncertainty

This is a report about a plan, sourced to The Information and repeated across secondary coverage, with no on-record statement from Google, OpenAI or Anthropic. The leadership names are people who have been approached, not people who have accepted. The remit could narrow before launch. Bengio’s mandatory-transition roadmap could be written into the charter. The body could turn out to do the unglamorous, genuinely valuable work — comparable benchmarks, a real incident-reporting channel — and leave auditor qualification alone.

It could also launch exactly as described, in a market where the alternative evaluator lost access the same week, funded by the three firms it grades, with its independence standard written by consultants who sit on those firms’ boards.

Both outcomes are live. The buyer-side response is identical either way, which is what makes it worth doing now: ask for the artefacts, not the adjective. Whether you are running Claude, ChatGPT or Gemini in production — and the Claude vs ChatGPT comparison covers where each currently sits on published safety documentation — the evaluation evidence behind them is about to become the part of the model card you cannot take at face value.

For teams building on these models directly, the developers guide covers the stack-level decisions, and OpenAI’s own frontier governance framework remains the clearest published statement of what one of these labs thinks it owes you. Read it as a commitment you can hold them to, because for now, that is the only kind of commitment on the table.

Update, 1 October 2026 — the question got answered the other way. This piece asked who qualifies the auditors. On 29 September six frontier labs signed the White House Accord on Super Intelligence, which answers it by declining to: the companies select their own auditors, with no requirement to disclose their identities or the selection process, no implementation deadline, and no obligation to publish findings. That is the opposite of a qualification regime, and it arrived from the White House rather than from a standards body. One day later the FTC confirmed a broad investigation into the safety of Anthropic’s and OpenAI’s systems, reportedly reaching for formal demands and compelled testimony — including, per Axios, from the evaluator METR. The artefacts this article told buyers to ask for are about to be produced for a regulator instead. Why the accord’s four audit layers have no outside reader.

Questions or corrections? Email Pick Right. Want the full list? See all news.