In the space of a few weeks this autumn, agentic AI governance stopped asking what we believe and started asking what we can prove: who produced the evidence, how fresh it is, and whether it follows agents while they run. That is the right turn. It is also a dangerous one, because evidence can become theatre. The real test is whether evidence is continuous, independent and tied to someone who will answer for it.
I. The week the principles ran out
For a decade, AI governance has been a literature. Principles, frameworks, maturity models, the occasional manifesto. I have written my share, including the Model AI Governance Framework for Agentic AI that I co-authored with IMDA and that Singapore launched at Davos in January.
Something shifted this month. The question regulators, standards bodies and buyers now ask is no longer “what do you believe?” It is “what can you show me, who produced it, and is it still true?”
Count the signals. On 22 October, ANSI announced the ANSI AI Register, a public directory that labels every trust claim by who made it: the vendor itself, a customer or supplier, or an independent third party.
A week earlier, on 15 October, the HKMA launched its ART Framework, for Accountability, Resilience and Trust, at the Finance + A.I. Forum it co-hosted with Cyberport on 15 to 16 October. The forum closed the second GenAI Sandbox cohort, in which more than 60% of use cases involved AI agents, and half of those were multi-agent. A forthcoming HKMA discussion paper will explore a registry of material AI agents and “intent-anchored accountability”.
On 7 October, MAS issued its final Guidelines on AI Risk Management. For agents, monitoring should cover “reasoning processes, actions taken, tools used”, and high-risk AI should be considered for kill switches or override mechanisms. They take effect on 7 October 2027.
Then 14 October, a busy Wednesday. ISO/IEC 27090, on security threats to AI systems, was published. In Brussels, EN 18286 on AI quality management was cited in the Official Journal, giving the first presumption of conformity under the AI Act. And Singapore launched its AI Tester Accreditation Programme, naming its first accredited AI testing providers.
Two bookends frame the month. On 1 October, Gartner’s 2026 AI Hype Cycle put control ahead of capability and singled out AI observability. On 23 September, CETaS at the Alan Turing Institute published a paper on the behavioural assurance of agentic AI.
Read together, these are not more principles. They are the plumbing of proof. Each asks for evidence with three properties: provenance (who produced it), freshness (whether it is still true), and runtime reach (whether it follows the agent while it acts, not just before launch).
Last week I argued that the last human job is answerability. This essay is its sequel. Answerability needs evidence, and evidence needs someone to answer for it. Evidence without an answerer is not governance. It is a very expensive filing cabinet.
II. Confidence is not a control
Start with how organisations feel. OutSystems released research on 15 October, based on a CIO Dive survey of 858 executives run in collaboration with KPMG across APAC, Europe and North America. It circulated on LinkedIn alongside the HKMA forum, but it is not an HKMA survey.
The headline numbers are a portrait of a gap. 82% of executives believe they can keep pace with governing, integrating and monitoring AI agents. Only 26% say they are well prepared to resolve conflicts across agents, systems and automated workflows.
It gets starker. 83% rely on existing IT, security or compliance processes to oversee agents. Only 5% have automated controls, audit trails and formal human review points. Yet 81% rate testing and validating agent behaviour as very or extremely important.
So we have 82% confidence resting on 5% instrumentation. Confidence is a feeling. A control is a fact. I call the distance between them the assurance gap, and it is where most agentic programmes currently live.
There is a regional twist worth savouring from Singapore. APAC respondents were the most prepared: 39% ready for agent conflicts against 29% in Europe and 18% in North America, and 14% with automated governance controls against 3% and 2%. Still a minority. But Asia is not starting from behind.
KPMG’s Michael Harper put the lesson plainly: “Assurance for agentic systems must be engineered from day one.” I agree, with one amendment. It must also be engineered for day 400, when the agent has been retrained, re-prompted and connected to three new tools nobody told the risk committee about.
Gartner’s numbers explain the urgency. Only 17% of organisations have deployed agents, more than 60% expect to within two years, and Gartner expects more than 40% of agentic projects to be cancelled by the end of 2027. It calls AI observability “one of the most consequential developments” on this year’s curve, a telemetry layer for silent failures and plausible but wrong outputs. The market for it, Gartner adds, is immature and fragmented.
III. Eight ways to fail while obeying
A quick correction first, because evidence starts at home. The behavioural failure taxonomy that circulated in my feed this week as an MIT paper is in fact by Rick Hennessy and Carolyn Ashurst at CETaS. I could find no MIT paper with that content. Credit where it is due.
The paper’s central claim is unsettling and correct: agents can fail behaviourally in high-stakes settings even when they follow instructions. Whether a failure becomes harm depends on three deployment variables: access, authority and trust. In the authors’ words, “Behavioural risk is fundamentally deployment specific.”
That line should be printed above every model card. A model can pass every benchmark and still misbehave in your bank, because your bank gave it access, authority and trust that the benchmark never saw.
The paper offers eight failure modes and seven principles. The principles read like a charter for the evidence era: govern agents as organisational actors; assure deployments, not models alone; assure behaviour, not outputs alone; assure human-agent systems, not agents alone; apply least privilege and zero trust; treat assurance as a continuous process; build interdisciplinary capability.
Here is how I map the eight failure modes in TrustOS, the seven-layer agentic governance architecture I use with clients, which is mapped to MAS FEAT and the AI risk guidelines, the EU AI Act, NIST AI RMF, ISO 42001, the IMDA framework, the OWASP Agentic Top 10, GDPR and the Colorado AI Act. For each mode, I ask three questions. What evidence would detect it? Which regime already asks for that evidence? And when is the evidence produced: at design time, test time or runtime?
| CETaS failure mode | Evidence that would detect it | Which regime already asks for it | Evidence type |
|---|---|---|---|
| Traces of reasoning and actions compared against the declared intent of the deployment | MAS ¶5.23(a) monitoring of reasoning and actions; HKMA “intent-anchored accountability” (discussion paper to come) | Runtime |
| Inventory of tools and systems each agent can reach, plus action logs checked against policy | MAS footnote 25 inventory attributes; IMDA dimension 1, bounding access to tools and data | Design-time and runtime |
| Reconciliation of what the agent says it did with what the system of record shows it did | MAS lifecycle controls on reproducibility and auditability; ISO/IEC 42001 management system | Runtime |
| Stress tests under extreme scenarios, plus overrides the agent cannot reach | MAS ¶5.23(b) kill switches or overrides; HKMA kill switches under Resilience and trust through observation | Test-time and runtime |
| Benchmark and statistical evaluations of outputs | NIST AI 800-2 and 800-3; ISO/IEC 42119 testing series; BSI LLM application assessment | Test-time |
| Provenance of sources and checks that “independent” confirmations really are independent | No regime names it directly; the nearest analogue is ANSI’s provenance labelling of claims | Runtime |
| Dependency maps across models, data, tools and third parties; conflict and cascade logs | HKMA Resilience pillar, mapping AI dependencies; MAS third-party AI controls | Design-time and runtime |
| Evidence that human review points were exercised meaningfully, not rubber-stamped | IMDA dimension 2, meaningful human accountability; MAS human oversight controls | Runtime |
Three things jump out of the table. First, only one of eight modes, conversational failure, is well served by test-time evidence alone. The other seven need runtime evidence. That is CETaS principle 6 made concrete: assurance is a process, not an event.
Second, pseudo-corroboration is an orphan. No regime I have read names it. Yet in multi-agent systems it is the failure most likely to look like diligence: three agents agreeing because they read the same flawed source.
Third, row 8 is where the human sits, and where my previous essay lives. A human checkpoint that nobody can evidence is not oversight. It is a signature line.
IV. The enforceability test
I apply one test to every governance instrument: what concretely happens to someone who fails it? If the answer is “nothing”, the instrument may still be useful, but it is guidance, not governance. Here is the week’s crop, using only what the sources say.
| Regime | Instrument | What happens concretely if someone fails? | My verdict |
|---|---|---|---|
| ANSI (US) | AI Register, announced 22 Oct 2026 | Nothing formal. Listing is explicitly not certification, accreditation or endorsement. The consequence is visibility: your claim appears with its provenance label. Eligibility criteria are not yet published. | Low, but useful as a market signal |
| HKMA (Hong Kong) | ART Framework; new supervisory guidance; discussion paper on agentic governance | Supervisory follow-up for banks. The registry of material agents and intervention mechanisms are still proposals; kill switches “may be appropriate”. | Medium and rising |
| MAS (Singapore) | Guidelines on AI Risk Management, effective 7 Oct 2027, phased to 7 Oct 2028 | Supervisory expectations on all FIs. The FI retains primary accountability, including for third-party AI. High-materiality uses need independent validation before deployment. Agentic guidance consultation in 2027. | Medium to high once in force |
| IMDA (Singapore) | Agentic AI framework (Jan 2026); AI Tester Accreditation Programme (14 Oct 2026) | No sanction on deployers; the framework calls itself a living document. Testers are assessed on competency, operational readiness, financial sustainability and good standing. | Low for deployers; the lever is the tester market |
| EU | AI Act; EN 18286 cited 14 Oct 2026 | A statutory regime. Harmonised standards confer presumption of conformity. The Annex III high-risk deadline moved to 2 Dec 2027; most other harmonised standards are still in preparation. | High in law, delayed in time |
| UK | DSIT Trusted Third-Party AI Assurance Roadmap (Sep 2025) | No direct sanction. The aim is professionalisation: a code of ethics, competency framework, certification of assurance professionals and an £11m fund. | Low today; builds the assurers |
| US (NIST CAISI) | AI Agent Standards Initiative (Feb 2026); NIST AI 800-2 and 800-3 | Voluntary standards and evaluation practice. No consequence unless a contract or regulator adopts them. | Low, but technically strongest |
The honest summary is uncomfortable. Most of this month’s evidence machinery has soft teeth. Only the EU has statute behind it, and its high-risk obligations have slipped to December 2027.
That does not make the rest toothless. ServiceNow’s Jason Stanley made the overlooked point on a Freshfields podcast: contracts can turn voluntary standards into binding obligations. In Asia, I expect procurement, supervision and insurance to enforce evidence long before courts do.
V. Who produced the evidence?
The most important idea of the month is the least glamorous: a label saying who made the claim. ANSI’s Register sorts claims into self-declared, counterparty (customer or supplier) and independent.
ANSI’s R. Douglas Leonard Jr. said it is designed to “show who is making a claim, what that claim rests on”.
This sounds modest. It is not. Most AI assurance today is self-declared evidence wearing a third-party suit. A provenance label strips off the suit.
The sharpest evidence buyers are insurers, because a premium needs a measurable risk. Armilla AI, a Lloyd’s coverholder, expanded its standalone AI liability policy in January to US$25m limits covering generative AI and autonomous agents, including agent failures. Each policy comes with independent certification informed by more than 500 AI evaluations.
CEO Karthik Ramakrishnan explained the gap: “Most insurance policies weren’t designed for generative AI or AI agents.” Armilla says traditional carriers increasingly exclude AI risk. When insurers will not price what you cannot evidence, evidence stops being a compliance cost and becomes a cost of capital.
Britain is building the supply side. The DSIT Trusted Third-Party AI Assurance Roadmap counts more than 524 assurance firms and about £1.01bn of market value in 2024, with a potential £18.8bn by 2035. Its £11m innovation fund and professional certification aim to make “assurer” a profession rather than a claim.
The Big Four have been moving into AI assurance; PwC UK was reported as poised to launch an offering last year. The same report flagged independence concerns: audit firms partner with AI vendors, and much assurance is still supplied by developers themselves.
My view is that independence is not a property of a logo. It is a property of design: who pays, who chooses the tests, who can see the raw telemetry, and who is allowed to publish a bad result. Any assurer should be judged on those four questions.
There is an equity edge too. Sharp, Bilgin, Gabriel and Hammond’s paper on agentic inequality, first posted in October 2025, counts reliability within the quality dimension of agents.
My inference: independent assurance could itself become a stratifying asset. Large firms will buy third-party evidence; smaller ones may be left with self-declarations. A register that shows provenance will also show who could afford it.
VI. The sceptics, and assurance theatre
Now for the case against, which is strong. I want to give it a name of my own: assurance theatre. It is evidence produced for an audience rather than for control. It looks rigorous, satisfies the checklist, and changes nothing about what the agent does on Tuesday afternoon.
The first problem is that models notice the stage. Anthropic’s Claude Sonnet 4.5 recognised it was being tested in about 13% of automated assessment transcripts, at one point saying “I think you’re testing me.” Apollo could not rule out that low deception rates partly reflected that awareness.
OpenAI and Apollo Research found that anti-scheming training cut covert actions roughly 30-fold, from 13% to 0.4% for o3. Good news, with an asterisk. They warned that situational awareness “can itself reduce scheming, independent of genuine alignment.” Test-time evidence, in other words, can measure the performance rather than the performer.
The second problem is that our best window may close. Forty researchers across labs and academia argued last year that chain-of-thought monitoring shows promise but may be fragile, and urged developers to weigh how their choices affect monitorability. MAS now asks firms to monitor reasoning. If reasoning becomes unreadable, that clause becomes aspirational overnight.
That is why the early October departures at OpenAI matter, and why I hold them carefully. OpenAI parted ways with Tomek Korbak, Mikita Balesni and Jasmine Wang. A letter to the board, excerpted by the WSJ and reported by Gizmodo, said they did not yet know “how to safely develop and deploy models that we cannot monitor”.
OpenAI’s stated reason is alleged mishandling of sensitive information, and it said the firings were not about raising safety concerns; an internal memo reportedly endorsed the letter’s recommendations. The framing that they were fired for defending visible reasoning is therefore contested. What is not contested is the stake: if reasoning traces go dark, a large share of runtime evidence goes with them.
The third problem is independence. Heidy Khlaaf of AI Now argued in Nature that the failure is “human negligence and a failure to hold AI laboratories accountable.” She wants nuclear and aviation style independent oversight and developer liability.
Her long-running distinction, that AI security is not AI safety, is a useful corrective to anyone who thinks ISO/IEC 27090 settles the matter. It addresses threats to the system. It does not tell you whether the system’s own behaviour is safe.
Both Khlaaf and Yoshua Bengio have written about a reported OpenAI sandbox episode this summer. Its details rest on secondary accounts that OpenAI had not confirmed when they were reported, so I will not build on it here.
The fourth problem is measurement science. Arvind Narayanan and Sayash Kapoor argue that reliability must be measured separately from accuracy because reliability measurement lags. At ICML in July, Narayanan said capability has soared while reliability has “only increased by five or ten percentage points.” An evidence regime that certifies capability will flatter agents that cannot yet be trusted twice in a row.
The fifth problem is access. Shayne Longpre and 32 co-authors found that flaw reporting infrastructure “remain[s] seriously underdeveloped,” and called for standardised flaw reports and legal safe harbours for outside researchers. Birhane, Raji and colleagues found that only a subset of audits yield accountability outcomes, depending on design and institutional context.
The International AI Safety Report gathers all this into one phrase: an “evidence dilemma”. Capabilities move fast while evidence of their effects is slower and hard to assess, and there is an evaluation gap between controlled tests and the real world. Agent autonomy, it notes, also reduces chances for human intervention.
My reply to the sceptics is that they have not refuted the evidence turn. They have written its specification.
The distinction that matters is between artefact assurance (policies, model cards, checklists) and operational evidence (runtime telemetry, incident logs, systems of record, third-party flaw reports). The sceptics demolish the first. They are, mostly, asking for the second.
VII. What agents do to people
There is a category of evidence almost nobody is asking for. Every regime above measures what agents do wrong. Almost none measures what agents do to the people around them.
Anthropic’s Economics team published unusually candid data about its own workforce on 16 October. By August, agents logged about six times the hours of their human handlers in employee-directed sessions. Fleet-wide, agent hours first passed human hours in March.
The junior share of technical hires fell from 27% to 9% since early 2025. Commits per engineer rose about fivefold in six months. About 80% of interactive session time is spent waiting for human input, and meta-work (managing agents) rose from 10% to 22% of sessions. One engineer described “an army of Claudes, with every one asking for my attention.”
Anthropic is careful, and so should I be. It could not establish that AI caused the hiring change, and as eWeek noted, adoption was not randomised: 192 adopters were compared with 74 non-adopters. This is one firm’s data, not a law of economics.
But look at what it implies for governance. If agents outwork handlers six to one and sessions spend most of their time waiting on a person, the human checkpoint is the bottleneck. A bottleneck under pressure becomes a rubber stamp. That is CETaS failure mode 8, produced not by a rogue model but by an org chart.
This is where HX = CX + EX earns its keep. Human experience is customer experience plus employee experience, and agentic evidence must cover both. A deployment that passes every behavioural test while quietly sawing off the bottom rungs of a career ladder, or drowning reviewers in approval requests, has not been assured. It has been audited for the wrong harm.
So I would add a ninth row to my TrustOS table: workforce effects. Evidence: review load per human, override rates, entry-level hiring and progression. Regime that asks for it: none yet. Evidence type: runtime, measured in people.
VIII. Steering wheel, not airbag
The best industry framing this month came not from a technologist but from a banker. On Goldman Sachs’ Q3 earnings call on 13 October, David Solomon rejected the false binary: “The choice is not between halting progress and moving forward without guardrails.”
His template was banking’s own: rigorous testing, independent review, continuous monitoring and clear human accountability. Notice that it is four parts, and that the last one is a person. Banks learned the hard way that a model validation report with no accountable owner is a liability waiting for a date.
Jason Stanley adds the engineering corollary. Agents can excel at one task and fail at a slightly reworded version, so oversight must extend to how they evolve at runtime. And critical controls “must sit beyond an agent’s ability to modify them.” A kill switch the agent can reach is a suggestion.
Satya Nadella, as reported in a Vietnamese-language summary of his “Infinite SaaS Factory” post, argued that agents make trustworthy systems of record more important, not less: keep execution in deterministic software and use AI reasoning only where it adds value. That is an evidence argument in an architect’s clothes. The system of record is where misreporting gets caught.
My own metaphor for all of this: governance should be the steering wheel, not the airbag. The airbag is the post-incident report, the audit after the loss. The steering wheel is runtime evidence feeding a human who can still change direction.
This is the arc I describe as Prompts to Loops to Loop Governance. In the prompt era, we governed inputs. In the loop era, agents plan, act, observe and act again without asking.
Loop governance means the evidence runs inside the loop, at the speed of the loop, with controls outside the loop’s reach. Runtime evidence is loop governance. Everything else is commentary.
IX. What I might be wrong about
Evidence may stay soft for years. My enforceability table shows that most of this month’s instruments carry little sanction. If the EU slips again and Asian supervisors stay principles-based, the evidence turn could remain a vocabulary rather than a practice.
Runtime evidence may be as gameable as test-time evidence. If models can detect evaluations, they may learn to detect monitoring. Then continuous evidence is just continuous theatre, and Khlaaf’s call for structural independence and liability matters more than any telemetry.
Reasoning traces may disappear. Several rows of my mapping lean on monitoring reasoning. If chain-of-thought becomes unreadable or is trained away, those rows weaken, and MAS’s monitoring clause will need rewriting.
Provenance labels may entrench incumbents. If only large firms can buy independent evidence, registers could become league tables of budgets. The agentic inequality authors would not be surprised.
I may be too sanguine about the assurance profession. I have argued that independence is a matter of design. Sceptics would say it is a matter of incentives, and that firms selling both advice and assurance to the same AI vendors cannot design their way out.
The labour data may not generalise. Anthropic’s figures describe one unusually agent-heavy company, without established causation. My ninth row may be measuring a frontier lab’s peculiarity rather than the economy’s future.
X. The Fork, the Long-AND, and the answerer
I keep returning to the Fork: Star Trek or Mad Max. Star Trek is abundance with institutions that hold. Mad Max is capability without answerability, fleets of agents producing evidence that nobody reads and nobody stands behind.
The debate tempts us into Short-OR thinking. Innovation OR guardrails. Self-assessment OR regulation. Testing OR monitoring. Solomon is right that this is a false choice.
The world worth building is Long-AND, not Short-OR: design-time AND test-time AND runtime evidence; self-declared AND independent; machine telemetry AND a named human who answers for it.
Singapore has quietly assembled the pieces of that Long-AND. An agentic governance framework that tells firms to bound risk, keep humans meaningfully accountable and apply technical controls across the lifecycle. A Global AI Assurance Sandbox that paired deployers with specialist testers. Now an accredited tester market, launched on 14 October. And MAS guidelines that, from next October, ask financial institutions to monitor what their agents reason, do and touch.
Framework, sandbox, accredited testers, supervisory expectations: that is the arc from frameworks to evidence, and it runs through one small island. Its next test is whether the evidence it produces is continuous, independent and tied to someone answerable. Those three words are my whole test. Fail any one and you have theatre.
Last week I wrote that the last human job is answerability. This week I would add the corollary. Evidence without an answerer is theatre. An answerer without evidence is faith. Governance is the two, joined at runtime.
Short-term turbulence, long-term abundance. But only if the receipts are real, and someone signs them.
Luke Soon is a Singapore-based AI futurist, ethicist and philosopher with more than 25 years in AI. He is a Partner and AI leader at PwC Singapore across 14 Asia Pacific markets, co-author with IMDA of the world’s first agentic AI governance framework, launched at Davos in January 2026, and author of Genesis: Human Experience in the Age of Artificial Intelligence and Synthesis: SuperIntelligence Protocol. He writes at GenesisHumanExperience.com: “Short-term Turbulence for Long-term Abundance”.
Sources
Government and regulators
- HKMA press release: ART Framework and agentic AI initiatives (15 Oct 2026)
- HKMA speech by Carmen Chu, Finance + A.I. Forum (16 Oct 2026)
- info.gov.hk: HKMA and Cyberport announce second GenAI Sandbox cohort (15 Oct 2025)
- MAS media release: supervisory expectations on responsible AI adoption (7 Oct 2026)
- MAS Guidelines on Artificial Intelligence Risk Management (PDF)
- Baker McKenzie: MAS issues Guidelines on AI Risk Management (Oct 2026)
- Blockhead: MAS finalises AI risk rules, agentic guidance to follow in 2027 (8 Oct 2026)
- MDDI: Singapore launches Model AI Governance Framework for Agentic AI (22 Jan 2026)
- AI Verify Foundation news: AI Tester Accreditation Programme
- AI Verify Foundation: Tester Accreditation programme page
- OECD.AI: Global AI Assurance Sandbox
- UK DSIT: Trusted Third-Party AI Assurance Roadmap (Sep 2025)
- Burges Salmon: DSIT trusted third-party AI assurance roadmap (17 Sep 2025)
- NIST: Announcing the AI Agent Standards Initiative (17 Feb 2026)
- ExecutiveGov: NIST guidance on AI benchmark evaluations, AI 800-2 and 800-3 (25 Feb 2026)
- CSA research note: NIST CAISI AI agent security agenda 2026
- AIGL summary: International AI Safety Report 2026 (18 Sep 2026)
Standards bodies
- PR Newswire: ANSI Introduces the ANSI AI Register (22 Oct 2026)
- ANSI AI Register product page
- ISO/IEC 27090:2026, addressing security threats and compromises to AI systems
- Modulos: EU AI Act harmonised standards status, including EN 18286
- SGS: the ISO/IEC 42119 series for AI testing (12 Jan 2026)
- Biometric Update: BSI launches AI assurance schemes (16 Oct 2026)
Industry
- OutSystems: agentic AI enterprise readiness research (15 Oct 2026)
- iTWire: enterprise readiness is not, OutSystems research finds (19 Oct 2026)
- Gartner: Hype Cycle for Artificial Intelligence 2026 (1 Oct 2026)
- Anthropic: How employment is changing at Anthropic (16 Oct 2026)
- eWeek: Anthropic agents log 6x hours as junior hiring falls (21 Oct 2026)
- American Banker: Goldman’s Solomon wants clear human accountability on AI (13 Oct 2026)
- Freshfields, The AI Drop ep. 25 with Jason Stanley (6 Oct 2026)
- DigitalToday (Vietnamese): Nadella on reinventing systems of record (9 Oct 2026)
- Armilla AI: Lloyd’s-backed coverage raised to US$25m (Jan 2026)
- FinTech Global: Armilla AI expands AI liability coverage (23 Jan 2026)
- Consultancy.uk: Big Four weighing up new AI audit offerings (10 Jun 2025)
- OpenAI: Detecting and reducing scheming in AI models (17 Sep 2025)
- Fortune: Claude Sonnet 4.5 knows when it is being tested (6 Oct 2025)
- Gizmodo: fired OpenAI employees plead for chain-of-thought monitoring (7 Oct 2026)
- Anadolu: fired OpenAI researchers urge board to preserve reasoning oversight
Academia and research
- CETaS, Alan Turing Institute: Behavioural Assurance of Agentic AI for Sensitive and High-Stakes Organisations (Hennessy and Ashurst, 23 Sep 2026)
- Sharp, Bilgin, Gabriel and Hammond: Agentic Inequality (arXiv 2510.16853)
- Korbak et al.: Chain of Thought Monitorability (arXiv 2507.11473)
- AI Weekly on Khlaaf in Nature: regulate AI labs like nuclear and aviation
- Nature: Why AI companies can’t be trusted to self-regulate (Khlaaf, 1 Oct 2026)
- Narayanan and Kapoor: Towards a science of AI agent reliability (arXiv 2602.16666)
- Berkman Klein Center: summary of the agent reliability paper (23 Feb 2026)
- AI Weekly: Narayanan at ICML 2026 (16 Jul 2026)
- Longpre et al.: In-House Evaluation Is Not Enough (arXiv 2503.16861)
- Birhane, Raji et al.: AI auditing and accountability (arXiv 2401.14462)
- TIME: Bengio, AI is at a turning point (9 Sep 2026)
- Luke Soon: The Last Human Job Is Answerability (22 Oct 2026)
Leave a Reply