Hardware FixRecommendedDevice not working? Your driver may be the problemCheck updates for common hardware issues.Fix DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run Scan×
FREEDOM251

Freedom251 › Blog › accountability

AI Companies Promise to Police Themselves: What Could Go Wrong?

By Freedom251 Team · · 7 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Voluntary AI safety pledges can get companies to adopt shared practices sooner than legislation, but a pledge is not proof that a system is safe or that its maker will face consequences for failing to follow its own rules. The central accountability question is who sets the risk thresholds, who can verify the evidence, and what happens when a company falls short.

What have AI companies promised to do?

The commitments discussed here focus on frontier AI: the most capable systems and the risks associated with developing and deploying them. They are not a complete account of every AI system or every kind of harm.

As an Amazon Associate I earn from qualifying purchases.

The 2023 White House commitments

In July 2023, seven leading companies made voluntary commitments through a White House initiative. The archived White House document covers risk testing, information sharing, cybersecurity, ways to identify AI-generated content, public reporting, research into societal risks, and beneficial applications. These commitments outline intended practices; by themselves, they do not establish that a company carried them out effectively.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The 2024 Seoul commitments

The AI Seoul Summit commitments set out a more specific framework for frontier AI safety. Signatories committed to assess risks across development and deployment, set thresholds for intolerable risk, explain their mitigations, decide what to do when a threshold is reached, maintain internal accountability, and provide public transparency. The text allows limits on disclosure where sharing could increase risk or reveal sensitive commercial information disproportionately.

The commitments also describe an extreme case: “In the extreme, organisations commit not to develop or deploy a model or system at all, if mitigations cannot be applied to keep risks below the thresholds.” That is a consequential promise, but its force depends on how thresholds are set, how evidence is checked, and whether the commitment has consequences beyond public criticism.

The Seoul initial signatory list included 16 organisations, with four added later, according to the UK Department for Science, Innovation and Technology’s 2024 commitment page. That group should not be confused with the seven companies in the 2023 White House initiative or with developers who later published transparency reports.

What could go wrong when companies assess their own pledges?

A voluntary promise may have no built-in penalty

The Seoul text describes its commitments as voluntary. That means the commitment itself does not create the same legal duties or consequences as a binding law or regulation. It does not mean a company is exempt from other laws that apply in a particular jurisdiction. The distinction matters: a pledge may set expectations, but the pledge alone does not specify a regulator, legal remedy, or penalty for failing to meet them.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The company may define the threshold it must meet

Seoul asks signatories to set thresholds for intolerable risk and to explain how they decided on them. This gives organisations room to adapt assessments to their systems, but it also leaves important judgment calls with the organisations unless outside actors can meaningfully influence or check those decisions. If thresholds are vague, hard to compare, or adjusted without a clear explanation, the public may not know what “below the threshold” means in practice.

Security exceptions can also limit scrutiny

Some information about vulnerabilities or safeguards could create additional risks if published openly. Seoul therefore allows limits on public disclosure in specified circumstances while encouraging more detailed sharing with trusted actors. The trade-off is real: withholding sensitive details can be prudent, but outsiders may then lack enough evidence to compare claims or determine whether a mitigation is adequate. A useful disclosure should make clear what was assessed and why some details are withheld, without exposing information that could itself enable harm.

Internal review may not be independent

Companies can assign governance roles and operate internal safety-review processes while still facing commercial and competitive incentives tied to release timing and capability. That is an analytical risk, not evidence that every company’s reviewers are conflicted or ineffective. It does explain why an internal sign-off and an independent evaluation answer different questions: the former shows a company has a process; the latter can give outsiders a separate check on the claims made about that process.

A written framework cannot establish real-world performance

A framework describes intended procedures. It does not, on its own, show that mitigations work under actual conditions or that an incident will be prevented. In a 2025 arXiv preprint, Jennifer Wang, Kayla Huang, Kevin Klyman, and Rishi Bommasani assessed publicly disclosed behavior against a rubric based on the eight White House commitments. Their scores measure public evidence under that rubric, not an official audit, a legal finding, or the full contents of company operations.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Across the companies they assessed, the authors reported an average overall score of 52%. For model-weight security, they reported an average score of 17%, and 11 of 16 companies received 0% under their rubric. Those figures indicate gaps in the disclosures the authors evaluated; they do not establish the actual security of each company’s model weights or measure real-world harm. The authors argued that disclosures should be proactive and verifiable.

Rules can lag behind changing systems

Frontier AI safety practices are still developing. UK guidance describes frontier safety processes as emerging and says its document is not final. The Seoul commitments allow approaches to evolve with the science and call for public updates explaining changes. Adaptability is useful when capabilities and evidence change, but it makes version history important: readers need to see what changed, when it changed, and why a company departed from an earlier approach.

What does the public evidence show—and what does it not show?

The International AI Safety Report 2026 describes safety frameworks as a prominent organisational approach and notes that at least 20 developers had published transparency reports in the G7 reporting context. It also records that the EU General-Purpose AI Code of Practice is voluntary in its current form. These are distinct facts about frameworks, reports, and a code; none by itself proves that a particular developer complied with its stated practices.

The report presents third-party auditing, verification, and standardisation as ways researchers argue risk management could be strengthened. That is a case for better checks, not a claim that a single audit method can settle every safety question. Public reports are most useful when they expose enough detail for comparison, while appropriate trusted reviewers can examine sensitive evidence that cannot safely be published in full.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How do the main accountability approaches differ?

Approach Who sets the expectations? Who checks the evidence? What is public? Is it mandatory, and what follows failure?
Internal company framework The developer sets its own processes and, in the Seoul model, its risk thresholds. Company governance and review processes; independence is not inherent. Depends on the company’s reporting and any applicable commitment. An internal framework is not itself a binding legal requirement; the framework alone does not establish an external consequence.
Voluntary multi-company or government-backed commitment Signatories adopt shared commitments; the Seoul text leaves signatories to set thresholds. Internal processes, with Seoul calling for consideration of independent third-party and government evaluations. Implementation information, subject to limits for security and sensitive commercial information; more detail may go to trusted actors. The Seoul commitment is voluntary. Consequences are not specified as legal penalties by the commitment itself.
NIST AI Risk Management Framework NIST provides a voluntary framework for incorporating trustworthiness into design, development, use, and evaluation. The framework supports organisational risk management; it does not itself make an evaluator independent. Disclosure requirements are not established by the framework as described here. Voluntary, not binding law. NIST released AI RMF 1.0 on January 26, 2023, a Generative AI Profile on July 26, 2024, and says the framework is being revised.
Independent evaluation Evaluation criteria depend on the applicable framework, evaluator, and scope. A third party can assess claims separately from the developer; UK guidance says this can help verify safety claims. Depends on what the evaluator is permitted to disclose and what security-sensitive information must remain restricted. Evaluation is not automatically mandatory, and its consequences depend on the surrounding commitment or legal regime.
Binding regulatory requirements Requirements are set by the relevant law or regulator, within its jurisdiction and scope. Determined by the applicable oversight regime. Disclosure and reporting duties depend on the specific law or rule. Mandatory where applicable; the particular consequence for noncompliance depends on the law. The commitments discussed above do not establish those consequences.

No approach has a universal ranking independent of the risk and jurisdiction. A voluntary framework can organise work and establish common expectations; independent evaluation can test claims; binding rules can create duties and consequences. These mechanisms can complement one another rather than serve as substitutes.

What would make a pledge more accountable?

Publish comparable evidence

A report should identify what was tested, which risks were considered, the thresholds used, the mitigations applied, remaining uncertainty, and any changes to the company’s approach. This lets readers compare the substance of claims rather than count the presence of a policy document. Where details are withheld, the report should explain the reason and distinguish public information from material shared with trusted reviewers.

Use independent evaluation and trusted oversight

UK frontier guidance says external third-party evaluation can help verify claims about system safety. The Seoul commitments call for appropriate consideration of evaluations by independent third parties and governments, and contemplate more detailed sharing with trusted public actors where broad disclosure would pose a risk. These are proposed accountability mechanisms in the guidance and commitments, not a guarantee that every signatory is already subject to an independent audit.

Connect failure to consequences

The National Telecommunications and Information Administration’s 2024 recommendations call for an ecosystem of independent evaluation and consequences for failing to deliver on commitments or manage risks properly. A consequence could give a commitment practical force beyond reputation, but the available description of the recommendations does not establish a specific enforcement mechanism. In any particular case, readers should distinguish a policy recommendation from a requirement already binding on a company under applicable law.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Track changes instead of treating a pledge as permanent

Because safety processes and scientific understanding can change, companies should make revisions legible: publish the new approach, explain what prompted it, and identify which earlier commitments or thresholds it replaces. That makes flexibility easier to assess and reduces the chance that a pledge’s meaning shifts without public notice.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

accountabilityAI governanceAI SafetyArtificial Intelligencetechnology policy

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.