Six safety conditions for upcoming laws

In short. Singapore, Japan, South Korea, Australia and the EU are drafting or reviewing rules for advanced AI or large data centres. If each wrote the same six conditions into its own law and accepted the others’ safety tests, the most capable models trained or hosted there would be tested independently before release, their serious incidents shared, and local copies harder to withdraw or steal. A condition in law binds more than a signature, because courts and licences enforce it on data centres a country physically hosts. How much safer that makes AI depends on what the tests find and what is done about it. Several openings come before the Geneva AI Summit in June 2027; not every review has a fixed timetable.

This is for people who can act on one of those decisions. It follows an earlier post on who holds the physical levers in the AI build-out and asks how to turn leverage into something that lasts.

Why statements are not enough

On 21 September, Finland and Norway launched A Call for Control of Frontier AI Models (“frontier” meaning the most capable models). It asks companies for mandatory testing by independent evaluators before release, asks governments to share reports of serious incidents, and asks the UN to explore an institution “able to set standards, enable verification, and convene states when capability thresholds are crossed”. By 24 September, 29 countries and the European Commission had signed¹.

The same week, the United States added 19 signatories to its Joint Statement on AI Opportunity Partnership, first signed in June. It commits signatories to “pro-innovation regulation” and to aligning their AI supply chains with the United States; 54 countries have signed². At the UN, the US President said the United States rejects any global framework for controlling AI³.

Nineteen countries, including Germany, the Netherlands, Australia and Singapore, signed both. The texts are not strictly incompatible, but they pull in opposite directions, and signing both cost nothing. A signature alone commits very little.

Agreements fare little better under pressure. In January the United States threatened rising tariffs on European allies until it could acquire Greenland⁴; Europe debated its Anti-Coercion Instrument and did not use it⁵. In September, Denmark and Greenland signed an amendment to their 1951 defence agreement that expands US military rights on the island with no end date⁶. In June the US government ordered Anthropic to cut off non-US citizens from its most capable models⁷; the EU’s cybersecurity agency got access only on 10 September⁸. A bill in Congress would penalise allies whose chip-equipment export rules differ from Washington’s⁹. A real chokepoint used alone can backfire: when Japan restricted three chipmaking chemicals to Korea in 2019, Korea built its own supply, Japanese suppliers lost market share, and the policy goal was not met¹⁰.

What holds under pressure has four properties:

	A signed statement	A condition in law
Automatic: works without a new decision when pressure arrives	No	Yes, until the law is changed
Hands tied: giving in is legally hard	No	Yes, it takes legislation or a court
Immovable: rests on something that cannot be moved from abroad	No	Yes, for data centres on your soil
Pooled: no single country can be singled out	On paper	Partly, if several countries adopt the same text and recognise each other’s tests

The last row is the hard part. Identical laws raise the cost of picking countries off one by one; they do not remove it.

The six conditions

Each applies to companies that train or host the most capable models, above a size threshold, in the country passing the law. None needs a treaty. The first two concern safety directly, the next two control of what is hosted, the last two verification and enforcement.

1. Testing before release. Evaluators from a recognised AI safety institute in any participating country may test a model trained or hosted there before it is released. The EU already has the access powers (model weights and hosting infrastructure) but uses them in investigations after release¹¹; this condition adds the step before.
2. A shared definition of a serious incident, reported to all. Korea’s AI Basic Act, Singapore’s new data-centre law and Australia’s proposed standards each contain some reporting duty¹²¹⁵¹⁶, but they cover different things, from cyber incidents and outages to AI incidents. A common definition, with reports going to every participant, is new.
3. Protected model weights. Weights trained or stored in the country meet a common security standard, so a model is no easier to steal from a host’s data centre than from its developer.
4. Continuity for essential users. Government and critical-infrastructure users keep access to models hosted in the country during a crisis. This only works where the weights are actually hosted locally under a contract that survives a withdrawal; a frozen copy also ages.
5. Known chip locations. Operators can show where their advanced chips are, and export licences for chips and their key inputs carry the same condition. This is a prerequisite for verifying many kinds of agreement, though not sufficient on its own.
6. A local off-switch, with due process. The operator can isolate or stop a workload on a lawful order of the host country, with notice and review. A stop on safety grounds overrides condition 4.

None of this is exotic. The United States already attaches conditions to the advanced chips it lets the United Arab Emirates host, and the approved status of the two main UAE operators lapses in April 2027 unless renewed¹³. Conditions 3 and 5 follow that format.

The conditions should be open to any country willing to meet them, China included. A club that tests only Western-hosted models and shares incidents only internally would look like a bloc, not a safety regime, and would miss the incidents that matter most.

What changes if all six pass

Suppose the five write these conditions into the rules they are drafting and agree that a test by one institute counts for all. By the Geneva summit:

• The most capable models trained or hosted there are tested before release, by institutes whose access does not depend on another government’s goodwill. One accepted test instead of five makes complying cheaper than avoiding.
• Serious incidents travel in days, from Seoul to Canberra, Tokyo, Singapore and Brussels, before they reach the press.
• Fewer places to steal a model from, because weights on member soil meet one standard.
• Governments keep the tools they depend on, for models hosted locally. Access from abroad can still be cut; local copies cannot be withdrawn by a phone call.
• Groundwork for verification. Known chip locations and lawful stop orders are part of what the international body the Call for Control asks for would need.
• A coalition that is harder to break. Abandoning a commitment means changing a law in public, not quietly ignoring a statement.

This does not govern computing inside the United States or China. But any developer that wants to train, host or sell in these places meets the same tested, reported standard, before the next generation of models rather than after.

When the decisions are made

Where and when	Opening	Fits
Singapore, now	Codes of practice and licensing rules for the Digital Infrastructure Bill, passed 7 October; commencement is expected in 2027. Security and resilience requirements will cover data centres of 10 MW or more and major cloud providers; the minister said even economic commitments can be licence conditions15	2–6
Japan, from late October	A new working group will review the AI Promotion Act and related rules, including whether legal changes are needed. The minister has not committed to a bill or a 2027 timetable17	1–3
EU, 3 December 2026, 17:00 CET	AI Gigafactory tender closes; access terms and contracts follow selection14	1, 4–6 for frontier tenants
EU, 9 December	Deadline to turn the Product Liability Directive into national law. States may remove the “development risk” defence for chosen products, after notifying the Commission and normally waiting six months18	2–3, via courts
EU, ongoing	AI Act testing powers and the list of experts who use them11. The AI Office will review the Code of Practice at least every two years; its Q&A gives no specific review date23	1
South Korea, no earlier than 22 January	Notices under the AI Basic Act before its grace period on fines ends (it may be extended); export licences for top-end AI chips, required since 1 September1219. In my reading, compulsory testing access may require a decree or law change; that legal route needs confirmation.	2, 5
Australia, early 2027	AI Standards legislation: frontier labs “granted authorisation to undertake large scale AI training in Australia” must meet minimum security and safety expectations1621	All six
Everyone, 21–22 June 2027	Geneva AI Summit, with a Call for Issues opening this autumn20	Mutual recognition

Two things tie these together: the same text, drafted once and adapted to each legal system; and recognition of each other’s tests, so an evaluation by Korea’s institute counts in Singapore and a report filed in Australia reaches Japan. Recognition needs agreed test protocols, accredited evaluators and a way to withdraw it. Add a rule that no member licenses a large cluster another has refused without consulting first, and picking members off gets harder.

A date on this chart is an opening, not a delivery plan. For each condition, I would name the official who owns the draft, the decision they can change, and who checks implementation afterwards. Procurement can turn public spending into obligations, but dependence on one supplier can weaken that leverage. UK guidance already calls for early commercial involvement, avoiding vendor lock-in, open standards and support beyond the initial contract²⁴. For condition 4, I would turn that into explicit continuity terms and a tested way to switch providers. Interoperability helps with switching; it does not itself guarantee access to a withdrawn model.

What I’m asking

• If you are drafting one of these instruments, include the conditions that fit and write in recognition of tests by other participants’ institutes.
• If you work at an AI safety institute, agree with your counterparts that one accepted evaluation counts for all, and say so publicly.
• If your government signed the Call for Control, turn it into a working group on shared text, with Geneva as the deadline.
• If you work near a government that hasn’t joined, Japan especially, which is reviewing its AI law now and holds key parts of the chip supply chain, make the case that these conditions serve its own security, whatever it signs.
• If you fund this work, pay for the drafting: one set of model conditions with legal versions for each jurisdiction.

What could go wrong

The United States could forbid its companies from accepting foreign testing, as it restricted access in June; companies might then stop training in these countries, so the coalition must be worth more as a host and market than staying away. Trade agreements such as the CPTPP, which binds Japan, Singapore and Australia, restrict requiring companies to use or locate computing facilities in a country as a condition of doing business²². Conditions 1, 2 and 5 do not require that; 3, 4 and 6 can, so they work best for facilities companies choose to build locally, through procurement for government users, or under public-policy exceptions that are untested for AI safety. An off-switch also needs due process to survive investor claims. A host’s leverage is strongest while computing is scarce. And pooling is the weakest link: each country will be tempted to make its own deal. These risks are real, but each is smaller than relying on signatures.

Notes

The research for this post was carried out with the help of AI research agents (Claude, made by Anthropic) and checked by three independent model reviews. Anthropic is directly affected by several of the laws discussed, and its models are named in some sources. The header image was generated with an AI image tool. Every factual claim links to a source; corrections are welcome.

References

1. Office of the President of Finland, “A Call for Control of Frontier AI Models”, September 2026 (with endorsements to 24 September). presidentti.fi
2. U.S. Department of State, “AI Opportunity Statement” (Joint Statement on AI Opportunity Partnership). state.gov
3. Seoul Shinmun, “US ‘rejects international control of AI’ vs EU ‘must manage risks’”, 24 September 2026. v.daum.net
4. Reuters, “Key moments in Trump’s push to control Greenland”, 21 September 2026. reuters.com
5. Reuters, “Trump’s Greenland tariffs prompt calls for unprecedented EU counter-measures”, 18 January 2026. reuters.com
6. The White House, Agreement between the United States, Denmark and Greenland amending the Defense Agreement of 27 April 1951, 22 September 2026. whitehouse.gov
7. Euractiv, “Anthropic blocks all Mythos access after US order to cut off non-citizens”, June 2026. euractiv.com
8. Euronews, “The EU got access to Anthropic’s most powerful model three months later”, 10 September 2026. euronews.com
9. U.S. Congress, H.R. 8170 (MATCH Act), text. congress.gov
10. ”Japan–South Korea trade dispute”, overview of the 2019 export restrictions and their effects. wikipedia.org
11. Commission Implementing Regulation (EU) 2026/1755 on evaluations and proceedings for general-purpose AI models, July 2026. eur-lex.europa.eu
12. Ministry of Science and ICT (Korea), “The AI Basic Act comes into force”, January 2026; IAPP, “A window into South Korea’s AI Basic Act”. msit.go.kr, iapp.org
13. Federal Register, “Enhanced favorable treatment for the United Arab Emirates under the Export Administration Regulations”, 14 July 2026. federalregister.gov
14. EuroHPC Joint Undertaking, “Call for tenders for the selection of Artificial Intelligence Gigafactory Consortia and the establishment of AI Gigafactories”, deadline checked 16 October 2026. eurohpc-ju.europa.eu
15. Ministry of Digital Development and Information (Singapore), “Closing Speech by SMS Tan Kiat How for the Second Reading of the Digital Infrastructure Bill”, 7 October 2026; Parliament, Bill 20/2026, passed 7 October. mddi.gov.sg; parliament.gov.sg
16. Department of the Prime Minister and Cabinet (Australia), “Getting it right: Building AI infrastructure that works for Australia”, consultation paper, September 2026. pmc.gov.au
17. Digital Agency (Japan), Minister Furukawa’s press conference, 6 October 2026, including the question on the timing of an AI law amendment. digital.go.jp
18. Directive (EU) 2024/2853 on liability for defective products, Article 18 (derogation from the development-risk defence). eur-lex.europa.eu
19. Ministry of Trade, Industry and Resources (Korea), “Amendments to the Public Notice on Trade of Strategic Items take effect”, September 2026. motir.go.kr
20. Geneva AI Summit 2027, official site. genevaaisummit.swiss
21. Digital Watch Observatory, “Australia unveils AI framework for data centres, copyright and infrastructure”, 16 July 2026 (legislation planned for early 2027). dig.watch
22. Comprehensive and Progressive Agreement for Trans-Pacific Partnership, Chapter 14 (Electronic Commerce), Article 14.13 (Location of Computing Facilities). international.gc.ca
23. European Commission, “Questions and answers on the code of practice for General-Purpose AI”, section “How will the Code be updated?”, checked 16 October 2026. digital-strategy.ec.europa.eu
24. UK Government, “Artificial Intelligence Playbook”, 2025, principle 8 and “Buying AI”; “Guidelines for AI procurement”, 2020, drafting requirements and contract implementation. Playbook; procurement guidelines