At the UN Security Council, OpenAI and Anthropic called for international coordination on testing while Donald Trump rejected supranational control of AI. Shared technical standards are the likely compromise, and the companies that write today’s tests have the most to gain from them.
The UN Security Council’s September 23 session on artificial intelligence confirmed that international AI governance will not look like banking regulation, with one agreed supervisory architecture. It also showed who is shaping what will take its place.
OpenAI chief executive Sam Altman urged governments to cooperate on benchmarks, safeguard evaluations and other technical protections for powerful systems. Anthropic chief executive Dario Amodei warned about the consequences of poorly controlled frontier models. Hugging Face chief executive Clément Delangue and Yoshua Bengio, co-chair of the UN’s scientific panel on AI, also briefed the session. France convened it as a high-level briefing on AI and international security. The council first debated AI in July 2023, but Security Council Report, which tracks its work, described this as its first meeting focused specifically on the safety risks of increasingly capable systems, including loss of human control.
In his own UN address, President Donald Trump rejected what he called a globalist scheme to control AI. That rules out a supranational regulator with authority over US model development for as long as this administration holds office. It leaves room for something narrower: common tests and reporting formats that governments adopt while keeping their own rules.
Who benefits from common tests
The heads of the two largest US frontier labs made the case for that narrower layer at the Security Council, and their interest in it is commercial as well as civic.
OpenAI and Anthropic already run the most extensive dangerous-capability evaluations in the industry. They employ the red teams, maintain the preparedness and responsible-scaling frameworks, and have shaped the test suites that government institutes use. If those methods become the accepted international evidence that a model is safe to deploy, the labs’ existing work doubles as the technical part of their compliance file in every major market. Legal, data-protection and liability obligations still differ by jurisdiction and still cost money. But the testing burden, which is the most expensive part to build from scratch, becomes reusable, so the cost of entering each new market falls sharply.
For a challenger, the same standard is a fixed cost. A startup or mid-sized open-weight developer would have to build or buy an evaluation programme sized for frontier labs before it could sell across borders. Harmonisation cuts total compliance cost for the industry while moving that cost’s burden towards smaller players. That is the classic pattern of incumbents supporting regulation they are already equipped to meet.
The obvious objection is that the rivals OpenAI and Anthropic actually worry about can afford the same testing. Meta, Alibaba’s Qwen team, DeepSeek and Mistral are well funded, and none would be priced out by an evaluation programme. On cost alone, the moat stops startups, not competitors.
The moat works through design instead. Those four rivals share a trait: they release open-weight models. A standard built around gated, pre-deployment testing of models the developer controls fits the closed labs’ business and sits awkwardly with models that are downloaded, modified and redeployed by others. The question is not whether Meta or Alibaba can pay for tests, but whether the tests can certify what they ship. The limit on the moat is who writes the standard. China takes part in the ISO/IEC committee, so Chinese labs and regulators will help shape the rules, and the US closed labs will not write them alone.
Delangue’s presence was the reminder of the other side. Hugging Face hosts much of the world’s open-weight model distribution. Evaluation regimes built for a handful of closed frontier systems, with gated access and pre-deployment testing, fit poorly with models that anyone can download, fine-tune and redeploy. If the shared layer assumes a small number of accountable developers, open-weight releases become harder to certify. Delangue’s community has more to lose from a standard designed around OpenAI and Anthropic than from national rules that exempt research and small developers.
Where the shared layer gets built
Four vehicles are competing to become that layer.
The international network of AI safety institutes, launched in 2024, has the technical staff but a weakened mandate. Washington renamed its own institute the Center for AI Standards and Innovation in 2025, dropping “safety” from its title, and China is not a member.
The European Union’s general-purpose AI code of practice, published in 2025, has legal force behind it, but only within the EU’s jurisdiction. Labs will comply with it, but Washington and Beijing will not adopt it as their standard.
The US National Institute of Standards and Technology produces well-regarded frameworks, but they are voluntary and, in the current political climate, carry a US label that Beijing will not adopt.
That leaves the international standards bodies. ISO and IEC’s joint AI committee has already produced ISO/IEC 42001, the AI management-system standard published in 2023, and both the US and China take part in its work. Standards written there can be referenced by EU law, US procurement rules and Chinese national standards without any government conceding authority to a supranational body. That is exactly the kind of instrument the Security Council debate pointed to.
Our view is that the shared layer will be written mainly through ISO/IEC, with evaluation methods drawn from the labs and government institutes and with the EU code of practice acting as the first large-scale user. That process is slow, but its slowness helps adoption: standards that take years to write tend to reflect what the largest participants already do.
Coordination survives rivalry, narrowly
There is already evidence that narrow coordination can survive geopolitical conflict. The US and China opened a dedicated government-to-government AI dialogue in Geneva in May 2024. At trade talks in New York on September 20–21 this year, led by Treasury Secretary Scott Bessent and Vice Premier He Lifeng, Washington proposed a mechanism for notifying each other of AI incidents with national-security implications, and sent it to this week’s Trump–Xi summit. Chip export controls were kept off the table. Agreeing to notify another state about a severe model incident does not require either side to share the other’s licensing regime.
Incident formats are the part of the shared layer most likely to arrive first. They describe events rather than set rules, and both governments benefit from early warning. Cybersecurity tests, dangerous-capability assessments and model-provenance records follow a similar logic because they measure technical properties rather than decide who controls the industry.
What it means for the industry
The result is a two-layer system. National governments keep authority over what models may do, which sectors may deploy them and what liability applies. A thinner international layer defines how companies measure and report the systems underneath those rules.
For the largest labs, that is close to the best available outcome: one body of evidence, many markets. For open-weight developers and challengers, the key question is whether the standards scale with company size and deployment risk, or assume every developer can afford a frontier-lab testing programme.
The likely vehicle already exists. ISO/IEC TS 42119-2, published in November 2025, set out how to test AI systems by adapting the established software-testing standards with a risk-based approach. It is the lead document in the committee’s AI testing series. We expect the shared evaluation layer to be written as further parts of that series. We also expect a part covering the evaluation of general-purpose models to reach publication by the end of 2028, drafted largely from methods the closed labs and government institutes already use. Whether that part treats open-weight release as a risk to be certified or as a deployment model to be accommodated will decide who the standard favours.