Navigating AI Regulation: What a FINRA for AI Could Mean & the Gaps It Might Leave Behind

Key Takeaways

The "FINRA for AI" concept offers a valuable starting point, but it is a beginning rather than a destination. Its strengths, independence, specialization, and enforcement authority, address real needs. Yet it leaves open the questions that matter most: who is accountable across the AI supply chain, how do we govern globally, and how do we audit systems we cannot fully explain.

For business leaders and policymakers navigating this landscape, the lesson is clear. Do not wait for a single perfect regulatory solution to emerge. Instead, build internal governance practices, invest in verifiable AI and documentation, and engage proactively with the evolving standards taking shape across jurisdictions. The organizations that treat responsible AI as a competitive advantage, rather than a compliance burden, will be the ones best positioned when comprehensive frameworks finally arrive.

Nine days after Demis Hassabis published a manifesto, the Trump administration was reportedly drafting a near-identical plan of its own. That is the speed at which this idea is moving, and it is exactly why the gaps in it deserve attention now, not later.

On July 14, the Google DeepMind CEO published A Framework for Frontier AI and the Dawning of a New Age, proposing a US-led, industry-funded Frontier AI Standards Body modelled on FINRA, the Wall Street self-regulator that oversees roughly 3,300 brokerage firms under SEC supervision. By July 17, Bloomberg was reporting that Treasury Secretary Scott Bessent had developed a strikingly similar SEC-anchored proposal, now under review by the White House Chief of Staff. Within a week, one person's essay had become a live policy option. That is the real story here, and it is a genuinely encouraging one: the field is converging on the idea that frontier AI needs independent oversight, fast.

The part worth examining closely is not whether oversight is coming. It clearly is. It is who gets to design it, and who gets left out of the room while they do.

legal route to compel a developer who declines to share a model. There is no UK AI bill before Parliament to change that. If a well-resourced voluntary body with government backing can operate for 32 months without gaining that authority, "operational before year end" describes the start of the voluntary phase, not a guarantee that the mandatory phase follows on any set timeline.

The Mythos and Fable episode is Hassabis's own evidence for why ad hoc government action falls short, and it is a fair example. Anthropic's most capable models were suspended for nineteen days in June under an export-control order issued with no established protocol, negotiated in real time with nothing to point to. That is a genuine gap, and a standards body is a reasonable answer to it. But the same episode that justifies the need for a body does not by itself settle which design should govern it, and it says nothing about who gets a seat at the table that decides.

## What a Durable Version Looks Like

None of this is an argument against the proposal existing. A voluntary testing regime is real progress over no regime at all, and every serious lab leader now agrees oversight is coming, which is further than the conversation had moved a year ago. The open question is who designs the next version, and that is precisely the kind of problem no single company, however credible its CEO, can solve alone.

A durable framework needs three things the current draft does not yet have: publicly reviewable benchmarks and evaluation criteria, not ones set behind closed doors by the labs being tested; an explicit path in for open-weight developers rather than a compliance cost that happens to fall hardest on them; and genuine authorship, not just consultation, from the markets and infrastructure builders this body will govern by default whether or not they are in the room.

That is the room DeAI Summit convenes in Malta: frontier lab founders, decentralised infrastructure builders, regulators, and capital allocators, across eight verticals, working the same table instead of legislating past one another. The Malta Declaration exists because the gaps in this framework, sovereign enforcement, open-weight legitimacy, a seat for the countries that use these systems without building them, will not close on their own.

## What to Watch Over the Next Six Months

• Whether voluntary gets a statutory deadline. The Bessent/SEC proposal is the mechanism that could give this body real authority. Without an executive order or legislation behind it, the standards body operates in the same mode the UK's AISI has occupied for three years.

• Whether open-weight developers get a genuine path in. Meta's position, inside or outside the incumbent circle, is the test case. Watch whether thresholds are set by capability, by revenue, or by some mix that quietly protects the labs setting them.

• Whether Congress ties this to the state-preemption debate. The Great American AI Act's freeze on state AI law is a much larger fight this proposal could get pulled into.

• Whether an international body absorbs it or competes with it. Altman's IAEA-style forum is the most direct alternative on the table. If the US body launches unilaterally while the EU's binding regime is already active, expect friction over whose standard the rest of the world actually follows.

---

Hassabis is right that the decisions made now shape what comes next, and to his credit, his own essay says this cannot be left to technologists alone. The real test is whether the next draft of this framework has a seat for the people the current one leaves out.

DeAI Summit 2026 convenes that room, 25 to 28 November, MFCC, Malta. deaisummit.org