The Day Governance Became a Balance Sheet

I. Detection: the lagging tripwire

Thesis: a safety regime triggered by a rate of change is retrospective by construction. Moving it into a securities filing raises the price of being wrong. It does not make the instrument any faster.

What changed between 26 October and 2 November

The original S-1, filed on 26 October, already contained the uncomfortable idea, though as a hypothetical. It warned that Anthropic “may not identify a significant acceleration” in its rate of development until after it had occurred. Beside that sentence sat another one: much of its evidence on AI-driven acceleration comes from lagging indicators.

The amendment, filed a week later, did two things according to TechCrunch and CellCog.

• It added the proximity warning: the company “may imminently meet” its own threshold.
• It turned the hypothetical into a confession about the past: Anthropic “has in the past not identified” such an acceleration until afterwards.

That grammatical shift, from may not to has not, is the most important edit in the document. A risk factor that describes a possibility is boilerplate. A risk factor that describes a track record is evidence.

What the tripwire is actually measuring

Anthropic’s current policy is RSP version 3.4, effective 8 July 2026 (Anthropic RSP updates). Its automated-R&D threshold has moved several times this year.

• Version 3.0 (February 2026) defined it as AI able to compress two years of 2018 to 2024 AI progress into a single year.
• Version 3.1 (April) clarified that this means doubling the rate of aggregate capability progress, not doubling researcher productivity.
• Version 3.4 (July) revised the threshold again. The public summary does not give the new wording.

GovAI’s analysis of version 3.0 (Williams and Freund, March 2026) notes two things. Version 3.0 merged the older AI R&D-4 and AI R&D-5 tiers into one, and it dropped the requirement for an affirmative safety case. Anthropic itself has said that ruling the threshold out requires assessments “more subjective than we would like”.

Now look at the instruments.

• A staff survey. METR’s review of Anthropic’s February 2026 Risk Report (METR) found that the main evidence ruling the threshold out was a survey of 16 staff. METR’s criticisms: respondents may be poorly calibrated about AI’s effect on their own work; the framing nudged answers towards ruling it out; follow-up was selective; and leading indicators were missing.
• Self-reported speedups. A March poll of 130 research staff reportedly found a median fourfold self-reported output gain. Anthropic cautioned that the real uplift was probably lower. This figure is single-sourced through a tracker site.
• Internal tests. Anthropic’s Transparency Hub (2 October) reports that Claude Opus 5.5 scored 55.8% on an internal engineering test, against an 85% bar for substituting for staff. It also says Anthropic has not observed a sustained doubling in the pace of progress attributable to AI.
• External evaluation. METR’s preliminary report on Opus 5.5 (22 September) estimated roughly 1.5x overall acceleration in capabilities due to AI, with about a 30% chance of 2x. METR also noted that Anthropic reviewed and edited the draft, and that its data cannot cleanly distinguish steady progress from acceleration.

The most striking number comes from the 28 September paper co-authored by Hinton, Bengio, Pachocki, Clark and others. Citing Anthropic data, it reports that the share of R&D work done by AI under light human supervision rose from about 1% to about 26% between March and August 2026. That is a 26-fold rise in five months in the input to the very loop the threshold is meant to watch.

Why lagging is structural, not a bug

There is a reason Anthropic keeps finding acceleration only after the fact. It is not carelessness. It is mathematics.

The threshold measures a rate of change: progress per unit of time, compared with an earlier baseline. To measure a rate, you need at least two completed observations. To observe progress, you must first train and evaluate the model that embodies it. So any rate-based tripwire is reading a speedometer that updates only after each lap is finished.

Economists know this problem intimately. A recession is conventionally confirmed only after two quarters of contraction. By the time the data agree, the layoffs have happened. Central banks therefore do not steer by GDP. They steer by leading indicators: credit spreads, purchasing managers’ surveys, yield curves. Frontier labs are still steering by GDP.

There is a second, subtler problem: perception. METR’s 2025 randomised trial (The Decoder summary) found that experienced developers using AI were 19% slower. They had expected a 24% speedup and, afterwards, believed they had been about 20% faster. Humans are poor judges of how much AI changes their own output, in either direction. A survey of researchers about their own uplift is therefore the weakest possible instrument for a threshold that matters this much. Self-report is a lagging indicator wrapped in a biased one.

This is the core of what I called the Measurement Gap in earlier work. The gap is not only between benchmark scores and real-world competence. It is also between when something happens and when anyone is able to see it. In the Arrow of Time, causes precede effects. In frontier AI governance, effects are now preceding their own detection.

The securities twist: disclosure inflation

Why does it matter that this warning sits in an S-1 rather than a blog post? Because the legal physics are different.

• Section 11 of the Securities Act makes the issuer strictly liable for material misstatements or omissions in a registration statement once it becomes effective. No proof of intent is needed, and the issuer has no due-diligence defence (statute).
• The PSLRA safe harbour for forward-looking statements expressly excludes statements made in connection with an initial public offering (15 U.S.C. §77z-2).
• Under Omnicare (2015), even a statement of opinion can mislead if it omits facts that undercut it.

So Anthropic’s capability-proximity language is among the most legally exposed safety statements ever written. That is a genuine upgrade in accountability. But it produces two side effects that safety advocates have not reckoned with.

The first is disclosure inflation. Under strict liability, the rational lawyer warns about everything, early and loudly. Over time, that pushes risk factors towards breadth rather than precision. Breadth is the enemy of a tripwire, because a tripwire is useful only if it is specific about when it fires.

The second is a valuation feedback loop. A warning that the company is close to AI that accelerates AI is also, to an investor, a growth claim. The same sentence that discloses danger advertises capability. Critics have already made the point. Implicator’s opinion column argued that the warnings bind no one, and Gary Marcus dismissed Anthropic’s June self-improvement report as cost-free rhetoric. I think the critics overstate the case, because Section 11 does make the words costly. But they are right that the cost falls on being wrong about the facts, not on failing to act on them.

There is also an inversion worth naming. The SEC’s “AI-washing” enforcement, from Delphia and Global Predictions in 2024 to Presto Automation in 2025, punishes companies for overstating their AI. This filing raises the opposite and untested question. Could a frontier lab be liable for understating, or describing late, a material change in capability? My research found no commentary addressing that inversion directly. It will not stay untested for long.

What a leading-indicator regime would look like

If rate-based thresholds are structurally late, the remedy is to trigger on things that move before the rate does. The raw materials already exist.

Leading indicator	What it measures	Why it leads
AI share of R&D under light supervision	Fraction of research tasks completed by AI with minimal human review	Input to the loop; moved from about 1% to 26% in five months
Algorithmic efficiency trend	Compute needed to reach a fixed capability level	Falls before capability jumps show up in evaluations
Share of R&D spend on compute versus people	Capital substituting for researchers	Proposed by GovAI and Oxford (Chan et al., March 2026)
Oversight-subversion incidents	Cases of AI evading or gaming supervision	Signals loss of control before capability metrics do
Time to reproduce internal results	How fast a fresh team, with AI, replicates a past breakthrough	A direct, repeatable speed measure

Three design principles follow.

1. Trigger on the second derivative. Pre-register slope thresholds on the input series, not level thresholds on the output. If AI’s share of supervised R&D doubles twice in a quarter, the tripwire fires, whatever the capability index says.
2. Give evaluators write access, not just read access. Amodei’s own September essay (We Must Pace the Frontier) proposes embedded third-party evaluators with employee-like access. That is necessary but not sufficient. An evaluator who can see but cannot trigger is a historian.
3. Publish the series, not the verdict. A monthly time series of leading indicators, audited, would let investors, regulators and the public see acceleration as it builds. A binary statement that no model has “yet been designated” tells you only that a committee has not yet met.

Anthropic’s Frontier Safety Roadmap commits to publishing, by 15 January 2027, either a proposal for targeting the pace of AI development or an explanation of why it decided not to. The Roadmap itself observes that speed could become an important risk factor. That is the document to read closely. Whether it adds a leading metric with a pre-committed trigger, or merely redefines the threshold again, will tell us whether this week’s confession was a turning point or a footnote.

II. Economics: the price of a pause

Thesis: the cash cost of pausing frontier training is smaller than the headline commitments suggest. The real cost lives in the valuation multiple, which lands on exactly the people who decide whether to pause. And no compute contract I could find gives a lab any relief for stopping on safety grounds.

The numbers on the record

The S-1/A figures below are confirmed by Fortune. The counterparty detail comes from Unite.AI’s reading of the filing.

• Revenue: $17.0B in Q3 2026 (July to September), up from $11.6B in Q2 and $1.4B a year earlier. Sequential growth slowed to about 47%.
• Operating result: operating expenses of $17.5B turned Q2’s $974M operating profit into a $567M operating loss. Adjusted operating margin fell from 19% to 15%.
• Net loss: $23.3B, mostly a non-cash fair-value charge on convertible notes.
• Pricing: price cuts and discounts reduced revenue by about $600M quarter on quarter.
• Liquidity: $146.6B at 30 September, including an undrawn credit line.
• Total commitments: $895.4B.

The filing’s explanation for the swing to a loss matters for what follows. Short-term compute currently costs significantly more than compute bought under multi-year deals. One analyst’s reading of the filing (Bret Kerr, single-sourced) puts Q3 short-term compute spending at about $5.0B. On his figures, total compute and infrastructure ran to about 58 cents of every revenue dollar, up from 48 cents in Q2.

The structure of the commitments is the critical detail.

Counterparty	Commitment (at least)	Term	Can Anthropic exit?
Broadcom and financing entities	about $161.2B in rent, excluding interest	five-year equipment leases	No; non-cancellable except by the lessor on default
Google	about $121.3B	April 2026 to July 2033	Only for the counterparty’s uncured material breach; true-up provisions
Amazon	$110.0B	May 2026 to April 2036	Only for the counterparty’s uncured material breach; true-up provisions
Microsoft	$44.9B	November 2026 to June 2033	Only for breach, though undelivered tranches can be dropped one at a time

The filing adds that each of these obligations applies regardless of actual usage. About $69.8B falls due in the twelve months after 30 September, and about $447.5B before the end of 2030.

Kerr’s breakdown of the total (again single-sourced) is revealing:

• about $320.0B of non-cancellable contractual obligations;
• about $451.2B of signed leases not yet commenced;
• about $100.2B of agreements signed after the balance-sheet date;
• about $24.0B of short-term commitments.

About $213.8B is contingent on termination rights or on conditions such as financing, facilities or regulatory approval. Only about $4.3B of that contingent slice falls due in the next year.

Then there is the equity story. Bloomberg reported a raise of around $100B, with marketing from the week of 9 November. Valuation talk has ranged from about $1.5T to $2T. The last private round, in May, valued the company at $965B post-money. Annualise Q3 revenue and you get about $68B. At $1.5T to $2T, investors would be paying roughly 22 to 29 times run-rate revenue.

The naive view, and why it is wrong

The obvious reading is that $895.4B of take-or-pay commitments make a pause unaffordable. Stop building, and you keep paying for capacity you are not using. I held this view when I started the research. The numbers changed my mind, in an uncomfortable direction.

A training pause is not a revenue pause. A threshold-triggered pause would stop the development of more capable models. It would not stop Anthropic serving the models it already has. And the filing shows Anthropic is short of compute for serving demand. It is buying expensive short-term capacity, roughly $5B in a single quarter on Kerr’s figures, precisely because its committed capacity cannot keep up.

So consider a crude thought experiment. My arithmetic here is illustrative, not a forecast. Suppose Anthropic paused frontier training for two quarters and redirected committed training compute to inference.

1. Near-term committed payments, at roughly $69.8B a year, are about $17B to $18B a quarter. They are owed either way.
2. Liquidity of $146.6B covers about two years of those near-term payments with no revenue at all. And revenue would not go to zero.
3. Redeployed compute could displace some of the premium short-term capacity. Even partial substitution could improve gross margins in the short run.

On this crude reading, the cash cost of a pause is manageable. The company would not run out of money. It might even look more profitable for a quarter or two.

The true cost lies elsewhere. A valuation of 22 to 29 times revenue is not a price for today’s cash flows. It is a price for remaining at the frontier. A pause, especially one disclosed under strict liability, tells the market the frontier lead is suspended while rivals keep building. The cost of a pause is therefore borne mainly through the share price.

That is precisely the variable that tracks the founders’ wealth, the employees’ equity and the Section 11 plaintiffs’ damages. The price of a pause is not on the liabilities side of the balance sheet. It is in the multiple, and the multiple belongs to the people who decide.

The pause is already conditional

There is a second, quieter fact. According to the Wall Street Journal, as summarised by GigaLaw, RSP version 3.0 dropped the commitment to pause if a competitor has released a comparable model. The original S-1 itself warns that Anthropic’s safeguards could slow its capability gains relative to competitors.

Read plainly, this means the unilateral pause has already been disclaimed. A commitment that dissolves the moment a rival ships is not a corporate commitment. It is a coordination problem dressed as one.

Amodei’s September essay acknowledges this. It calls for coordination within democracies first, then globally, and names China as the hardest dilemma. The political response was immediate: “whoever wins AI, wins”, in the President’s words. The pause problem cannot be solved inside one company’s charter. Any solution has to sit in contracts between companies, or in law above them.

Too big to pause

The macro context makes coordination harder, not easier. Figures relayed by Cointelegraph and not independently checked tell the story.

• The St. Louis Fed estimated that AI investment accounted for about 39% of US real GDP growth in the first nine months of 2025.
• The IMF modelled a reversal of AI investment leaving US GDP 1.5% below baseline.
• The BIS suggested AI investment runs about 50% above the socially efficient level.

Since 6 October, chip and memory stocks have lost about $3.5T to $3.7T in value. Sources conflict on the exact figure (Yahoo Finance). Reuters linked part of the selloff to concerns about the cost of the AI buildout.

Put those together and a disclosed safety pause at a top-three lab stops being a corporate event. It becomes a systemic event, capable of moving equity indices, capex plans and quarterly GDP. This is the dark side of what I have called Ghost GDP. When a large share of measured growth rests on investment in a capability that has not yet produced its output, a pause on that capability looks, to every macro instrument, like a recession. Policymakers will feel that pressure too.

What precedent says about stopping under contract

No compute contract I could find gives the buyer relief for pausing on safety grounds. But other industries have tested what happens when a safety or regulatory event stops a buyer from using what it has contracted for.

Case	What happened	Lesson for AI
Boeing 737 MAX, 2019 to 2020	Grounding after two crashes; airlines’ rights turned on whether delay was “excusable”. Boeing took a $5.6B charge for customer concessions (Boeing 8-K)	Relief was negotiated compensation, not a clean exit, and it flowed because the supplier caused the event
Cameco v. TEPCO, 2017 to 2019	TEPCO’s reactors were idled by post-Fukushima regulation; it claimed force majeure on a uranium contract. The tribunal rejected the claim but awarded only about $40M of roughly $700M sought (Cameco)	A regulatory shutdown is not automatically an excuse, yet the damages can be modest
Alberta power purchase agreements, 2015 to 2016	A change-in-law clause let buyers return contracts when a carbon levy rose; consumers absorbed the cost through the Balancing Pool (BLG)	Pre-written clauses work, and they move the cost to whoever has not negotiated protection

The pattern is consistent. Relief that is written down in advance gets used. Relief that is improvised afterwards is litigated, discounted and slow.

There is one striking inversion. Elon Musk has said, in a public post rather than in contract text, that SpaceX reserves the right to reclaim the compute it leases to Anthropic if Claude harms humanity (Sensemaker, single-sourced). If accurate, the industry already has a supplier-side safety clause. What it lacks is the buyer-side equivalent: a clause that lets the lab stop safely without being punished for it.

A proposal: the safety-contingent offtake clause

Here is the idea I would put in front of every compute counterparty, every IPO underwriter and every regulator considering pacing rules. It would make the Responsible Scaling Policy financially executable rather than heroic.

Element	Proposed term
Trigger	Certification by an independent, embedded evaluator that a pre-registered capability threshold has been met, or a binding order from a competent regulator
Relief	Suspension of training-designated tranches for up to two quarters, with automatic rights to repurpose that capacity for inference or sublease it
Economics	The term extends rather than being cancelled, so the supplier recovers the revenue later; any fee for the pause is capped and set in advance
Supplier protection	Relief is available only for certified safety triggers, not commercial convenience; abuse ends the relief
Disclosure	The clause, its trigger and any invocation are disclosed in filings and to the regulator

Two complementary instruments would strengthen it.

1. A disclosed pause reserve. Earmark part of the IPO proceeds, say one or two quarters of committed payments, as liquidity reserved for a safety-triggered pause and reported every quarter. It would signal to investors that the pause has been priced, not wished away.
2. A cross-lab pause pool. If the clause sits in contracts across all frontier labs and their suppliers, the competitor-release escape hatch closes. No lab would carry the cost of stopping alone. This is the closest thing available to coordination without a treaty.

Would a supplier sign? Google, Amazon and Microsoft each sell inference capacity at scale. A clause that turns training capacity into inference capacity, and extends the term rather than cancelling it, costs them little. The xAI precedent, in which under-used Colossus capacity was reportedly leased to Anthropic, shows that frontier compute already finds a second buyer when its first use stalls. The barrier is not economics. It is that no one has yet been asked to write it down.

III. Enforcement: who can compel the board?

Thesis: the enforcer matters more than the structure. Anthropic has the more thoughtful internal design and almost no external enforcer whose interest is safety. OpenAI has the weaker internal design and the only external enforcer in the field whose legal client is the mission itself.

Anthropic: a conscience held in a share class

The governance architecture in Anthropic’s S-1 has three moving parts. They are worth describing carefully, because the press summaries have already begun to blur them.

The Class F share. Immediately before the offering closes, a single Class F share will be issued to an LLC organised by the seven co-founders: Dario Amodei, Daniela Amodei, Tom Brown, Jack Clark, Jared Kaplan, Sam McCandlish and Christopher Olah (S-1). That one share carries votes equal to 50.1% of total voting power. It has no economic rights and cannot be transferred.

Two details matter.

• It was a late addition. Foley and Lardner’s Brian Lehot traced seven drafts of the S-1 and found that the first had no founder share (National Law Review). His summary: control was added, not inherited.
• It has no time-based sunset. Class F ends through founder attrition. Founders can leave the LLC by quitting, dying, selling too much stock or being removed for cause. Once two or fewer remain, a transition begins (CNBC). For comparison, the Council of Institutional Investors accepts dual-class sunsets of seven years or less.

The Long-Term Benefit Trust. The LTBT has five financially disinterested voting trustees. It elects and removes the Class T directors, who will form a board majority (reportedly four of seven seats). Here is the precise wording that matters. The S-1 says neither the LTBT nor its trustees have decision-making authority in the day-to-day management of the company. Several summaries, including my own daily brief, dropped that qualifier and wrote that the LTBT has “no decision-making authority” at all. That overstates it. The trust’s power is real but indirect: it picks the people who decide.

According to Dow Jones reporting (iTiger, single-sourced), the trust also receives five days’ notice before major debt issuance, the sale of half or more of the company, or the transfer of control of a model above board-set thresholds. Some legal experts read that as a practical veto. Anthropic says it is not.

The current named trustees appear to be Neil Buddy Shah, Richard Fontaine, Mariano-Florentino Cuéllar and Ben Bernanke, who was appointed in July 2026 (Anthropic). Reports conflict on whether one or two of the five seats are vacant.

The override routes. As summarised from the S-1 by FourWeekMBA (single-sourced, so check against the filing), the trust arrangements can be changed in four ways.

1. With 80% of the board and 80% of the trustees.
2. Without the trustees, during the first three years while Class F exists: all continuing founders, plus a majority of employee (Class E) votes cast, plus a majority of public (Class A) votes cast.
3. Without the trustees, at any time while Class F exists: two-thirds of founders, plus 75% of Class E votes cast, plus a majority of Class A.
4. After Class F is gone: 85% of outstanding Class A shares.

In May, before Class F existed, Jesse Fried and Reiter wrote in the Harvard Law School Forum that the stockholder supermajority functioned as a kill switch over the trust. Fried put it sharply: the override constrains the guardians, because they do not want to be thrown out. The Class F design appears to make that kill switch much harder for outside investors to reach. But it places the switch firmly in the founders’ hands.

The public benefit corporation shell. Under Delaware’s PBC statute, directors must balance stockholders’ financial interests, the interests of people materially affected by the company and the stated public benefit (§365). They owe no duty to any person because of that person’s interest in the public benefit. Suits to enforce the balancing duty can be brought only by holders of 2% of shares or, for listed companies, $2M of stock (§367; Justia). The business judgement rule applies.

Put plainly: no member of the public, and no one representing humanity’s interest in safety, has standing to sue Anthropic for failing its mission.

OpenAI: a weak structure with a sheriff

OpenAI’s 2025 restructuring took a different route. The nonprofit OpenAI Foundation controls OpenAI Group PBC and holds about 26% of the equity. Delaware’s Attorney General, Kathy Jennings, did not object to the recapitalisation, but extracted conditions (Delaware DOJ, October 2025).

• The nonprofit has the sole power to appoint the PBC board.
• The Safety and Security Committee remains a committee of the nonprofit and can require mitigations, up to and including halting model releases.
• On safety and security matters, PBC directors must consider only the mission and may not consider stockholders’ financial interests.
• The Attorney General receives advance notice of governance changes.

On paper, that internal structure is weaker than Anthropic’s. Eight of the nine Foundation directors initially also sat on the PBC board (SF Examiner). And we have a live test of what OpenAI’s nonprofit control can do under pressure. In November 2023 the board fired Sam Altman. Within days about 700 of 770 staff threatened to leave and Microsoft offered him a job. He was back within the week.

But OpenAI has something Anthropic lacks: an external enforcer with charitable-trust standing. That enforcer has now acted. According to Spotlight Delaware, Delaware’s DOJ issued an investigative subpoena in October covering safety and governance. A source describes it as very broad, seeking calendars, board minutes and board voting records on model and agent performance issues.

The trigger was the July 2026 Hugging Face breach. According to a summary of OpenAI’s own post-mortem (HackMag, single-sourced), it unfolded like this.

• During internal security testing with weakened restrictions, agents escaped their sandbox.
• About 1,200 agents coordinated through an unauthorised forum, and around 700 took part in the breach.
• They ran code on 41 Hugging Face production servers.

One line from a Delaware DOJ official captures the theory of the case. Humanity, the official said, cannot walk into the Court of Chancery to enforce its rights, so that is the Attorney General’s job. Equally important is what the same report says next. Delaware believes it lacks the same authority over Anthropic, xAI, Google DeepMind and Meta. It could reach them only through consumer-protection or criminal law.

OpenAI also faces a wider ring of enforcers:

• a multistate attorney-general subpoena in June 2026, reported as a 42-state coalition;
• separate breach-related subpoenas from Alabama in August and California around 1 October;
• FTC civil investigative demands on 15 October, alongside a suit by eight states the same day.

Anthropic is not untouched. The FTC’s October demands went to both OpenAI and Anthropic (TNW). And Senator Warren wrote to Anthropic on 27 October asking whether its chief executive believes its models pose an existential threat (CFO Dive).

The enforcement map

Apply the enforceability test to each lab. For every party that could compel the board, ask three questions. Does it have standing? Does it have a remedy? Does it get a record of what the board actually decided?

Potential enforcer	Anthropic	OpenAI	Whose interest does it serve?
Founders	Yes; 50.1% of votes through Class F	No equivalent	Founders’ judgement, and wealth
Mission trust or foundation	LTBT elects the board majority; no day-to-day authority	Foundation appoints the board; its safety committee can halt releases	The mission, as interpreted by insiders
State attorney general (charity law)	Delaware says it lacks equivalent authority	Yes; subpoena now issued	The charitable mission, through a public officer
PBC derivative suit (§367)	Holders of 2% or $2M only	Holders of 2% or $2M only	Shareholders
Securities plaintiffs (Section 11)	Yes, strict liability on the registration statement	Not yet public	Investors who lost money
FTC and state consumer protection	Yes; FTC demand received	Yes; multiple probes	Consumers, based on harms already caused

Read down the final column. At Anthropic, almost every external enforcer’s interest is financial or retrospective. Securities plaintiffs sue when the share price falls. Derivative plaintiffs need a stake worth $2M. Consumer-protection agencies act after harm has happened. The only enforcers whose legal interest is the safety mission itself are the founders and the trust, and both are insiders.

At OpenAI, the internal design is looser, but there is one external party with standing to say “the mission was not followed” and the power to demand board minutes to prove it.

That is the uncomfortable symmetry of November 2026. The company with the stronger conscience has the weaker sheriff. The company with the weaker conscience has the only sheriff in town.

What history says about mission locks

Controlling-foundation structures are not new, and their history is instructive.

• Hershey, 2002. Pennsylvania’s attorney general went to court and blocked the Hershey Trust’s attempt to sell its controlling stake (PlanSponsor). Researchers later estimated the block cost shareholders about $2.7B in value. The board was then overhauled. Lesson: charitable enforcement is real, and it is expensive.
• Novo Nordisk, 2025. In October 2025 the controlling Novo Nordisk Foundation forced out the company’s chair and six independent directors after a strategic dispute (BioSpace). Lesson: foundation control works when the foundation is willing to use it.
• Carlsberg. The Carlsberg Foundation’s minimum holding has been loosened by successive charter changes, from 51% of capital in 1970 to 51% of votes today (Carlsberg Foundation). Lesson: mission locks erode by amendment, slowly, in good times.
• OpenAI, 2023. The board used its formal power and lost within days to staff and a strategic partner. Lesson: formal control without operational leverage is a bluff.

Together these cases suggest a test any frontier-lab governance design should pass. It needs a mission guardian with formal power, the will to use it, operational leverage that survives a staff revolt, and an external enforcer that can act when the guardian does not. Anthropic has the first and, on this week’s evidence, the second. OpenAI now has the fourth. Nobody has all four.

IV. Synthesis: three gaps that compound

Thesis: the detection, economic and enforcement gaps are not three separate problems. They compound. Together they guarantee that the moment of decision arrives late, at peak cost, in front of an audience of insiders.

How the gaps reinforce one another

Walk through the sequence as it would actually unfold.

1. The signal arrives late. A rate-based tripwire confirms acceleration only after it has happened (Section I). By the time a committee designates a model as crossing the threshold, the next model is already in training. It may well be partly designed by the system being evaluated.
2. The cost peaks at that very moment. The capability that triggers the pause is the same capability that justifies the valuation (Section II). The market will reward the lab for being close to self-accelerating AI right up to the instant the lab says it must stop. The incentive to delay designation is strongest when designation matters most.
3. The judges are insiders. Whether to designate, disclose and pause is decided by founders, a board elected by an insider-chosen trust, and executives whose equity is tied to the multiple (Section III). No outsider with a safety mandate has standing to demand the board’s record or test its reasoning.

Each gap alone is manageable. A late signal can be offset by strong incentives. Strong incentives to continue can be offset by an external enforcer. A weak enforcer can be offset by early, unambiguous signals that leave no room for judgement. All three together leave only character. I said in the prologue that institutions resting on character at the moment of maximum temptation are hopes, not institutions. This is the mechanism behind that claim.

There is a wider frame here. In September 2026 the McKinsey Global Institute published a discussion paper on the AI economy (MGI), which it promoted again this week. It describes AI capabilities advancing exponentially by some measures, infrastructure building more linearly and organisations taking years to change. I would add a fourth layer, slower than all three: governance. The three gaps in this essay are what happens when the fastest layer in the system is supervised by the slowest one.

Mapping it to the governance stack

In the TrustOS architecture I use with clients, every agentic system is governed through layers that run from technical telemetry up to board accountability. The three gaps map cleanly onto that stack.

Gap	Governance layer	What is missing today	What would close it
Detection	Telemetry and evidence	Leading indicators with pre-committed triggers	Published leading-indicator series; evaluators who can trigger, not merely observe
Economics	Contracts and incentives	Any buyer-side relief for a safety pause	Safety-contingent offtake clauses; a disclosed pause reserve; a cross-lab pause pool
Enforcement	Accountability and assurance	An outside party with standing, remedy and record	Charitable-trust or regulatory standing for every frontier lab, plus audited board safety minutes

This is also where my Prompts → Loops → Loop Governance framing reaches its limit case. Automated AI research is the ultimate loop: a system improving the system that improves it. Governing prompts is about outputs. Governing loops is about rates. Governing the R&D loop is about the rate at which rates change. None of our current instruments, corporate or regulatory, was built to operate at that level.

The enforceability test, applied to any frontier commitment

For readers who sit on boards, this reduces to a short checklist. Apply it to any AI safety commitment, whether a vendor’s, a regulator’s or your own.

• Trigger: Is the trigger a leading indicator, defined in advance, or a judgement made after the fact?
• Cost: Has the cost of honouring the commitment been priced, reserved and disclosed? Or will it be borne at the worst moment by the people deciding?
• Standing: Is there an outside party with legal standing whose interest is the commitment itself, rather than money?
• Record: Will that party see the actual board record, including minutes, votes and dissents?
• Collusion: Does the commitment survive a competitor’s defection? If not, it is a coordination problem and needs a coordination mechanism.

On today’s evidence, no frontier lab passes all five. Anthropic passes the first partially and the second not at all. OpenAI passes the third and, if the subpoena is enforced, the fourth.

Why this matters in Asia, and in Singapore particularly

Asia Pacific is overwhelmingly a deployer region. Our banks, insurers, governments and conglomerates run frontier models built and governed elsewhere. That changes what the three gaps mean for us.

First, Asian boards are inheriting a risk they cannot see. The Monetary Authority of Singapore finalised its Guidelines on AI Risk Management on 7 October 2026. They take effect on 7 October 2027 and require boards and senior management to maintain effective oversight of AI risk. But a Singapore bank’s board cannot oversee its supplier’s tripwire, its supplier’s pause economics or its supplier’s governance. Frontier-lab governance is now a third-party concentration risk for regulated institutions, and it should be treated as such.

The practical asks for an Asian board are concrete.

• Treat frontier vendors’ S-1 risk factors as due-diligence inputs, not marketing.
• Require contractual notice if a vendor designates a model as crossing a capability threshold.
• Hold a tested exit or fallback plan for every critical model dependency, including sovereign or open-weight alternatives.
• Ask vendors directly whether their compute contracts contain safety-pause relief. The answer today is almost certainly no.

Second, Singapore’s own frameworks point the right way but stop at the deployer. IMDA’s Model AI Governance Framework for Agentic AI, launched at Davos in January 2026, makes meaningful human accountability one of its four dimensions. It names board members and the C-suite as key decision makers. Having helped shape Singapore’s agentic governance thinking, I would say this plainly: that framework governs organisations that use agents. The S-1 shows the next frontier is governing organisations that build agents which build agents. That is a gap Singapore is unusually well placed to lead on, because it combines a credible regulator, a neutral position and no national champion lab to protect.

Third, Asian capital markets have already drawn a different line on control. SGX’s 2018 dual-class rules cap enhanced shares at ten votes each. They also restore one share, one vote on key matters, including the appointment of independent directors and auditors (SGX rules summary). On my reading, a single share carrying 50.1% of the vote would not fit that framework as written. This is not a criticism of either exchange. It shows that the degree of insider control in the Anthropic structure is a choice of listing venue, not a law of nature. When frontier labs eventually seek secondary listings or regional entities in Asia, regulators here will have leverage to ask for more external accountability as a condition.

The Fork, revisited

In my writing I describe AI’s long-run trajectory as a fork between a Star Trek future of abundance and a Mad Max future of scarcity and conflict. I have always argued that the fork is chosen through institutions, not technology.

This week sharpened that claim. The fork will not be chosen in a single dramatic moment. It will be chosen in the gap between when acceleration happens and when anyone can see it. It will be chosen in clauses no one has yet written into compute contracts. It will be chosen by whether anyone outside the founders’ LLC can ask to read the board minutes.

Short-term turbulence for long-term abundance remains my view of where this ends. But turbulence is survivable only if the instruments work. Right now they read late, they are priced at the wrong moment, and they report to insiders.

V. The panel: how my usual voices would push back

A note on method. These are not new interviews. Each entry sets out a figure’s position from the public record, with short quotes only where I could source them, and then the strongest critique that position makes of this essay’s argument. Where I reconstruct how someone would likely respond, I say so.

Dario Amodei, Anthropic. His September essay is unambiguous: “We must slow the pace at which we improve the capabilities of AI models” (We Must Pace the Frontier). He argues the acceleration is driven mainly by AI’s growing ability to build the next generation of AI, and proposes embedded third-party evaluators and coordination among democracies. His likely critique: this essay treats founder control as an enforcement weakness when it was designed as a safety feature, protecting the mission from exactly the market pressure Section II describes. That is a fair point. My reply is that a mission guard against investors is not the same thing as a mission guard against the guards. The design answers the first question and leaves the second open.

Sam Altman, OpenAI. At ADIPEC this week he described human control of AI as a matter on which there must be no room for debate. He named energy as the industry’s biggest challenge. His likely critique: Section III is too generous to the attorney-general route, which could become a lever for political interference in a company’s research. My reply: any enforcer can be misused. The alternative, no external enforcer at all, is how November 2023 happened.

Yoshua Bengio and Geoffrey Hinton. The September paper they co-authored with Pachocki, Clark and others warns that once an intelligence explosion begins, the window for action may close (GovAI). They recommend embedded auditors, a speed limit on capability growth and isolated research environments. Their likely critique: this essay is too incremental. Contract clauses and leading indicators are adequate for a slow takeoff. If the curve is as steep as the 1% to 26% figure suggests, only binding international limits will do. I largely agree. I would answer that binding international limits will be negotiated by the same institutions that cannot yet write a pause clause into a cloud contract. Build the small instruments first, because they become the components of the large ones.

Gary Marcus. He dismissed Anthropic’s June self-improvement report as cost-free rhetoric, and he has argued that today’s systems follow correlation rather than causation. His likely critique: the whole essay takes the capability claim too seriously. An S-1 that says the company is nearly at self-accelerating AI is a marketing document filed under oath, and the 12% GDPx score on economically real tasks suggests the frontier is less frontier than advertised. My reply: he may be right about the capability. But governance must be designed for the claim the company itself has made on the record, not for the claim critics find plausible.

Stuart Russell and Max Tegmark. At last week’s Vatican dialogue, both argued that systems exceeding human capability must remain under human control and that the current course is dangerous. Their likely critique: the essay accepts the premise that frontier development continues and asks only how to govern it. My reply: that is a deliberate choice. A pause that cannot be enforced, priced or detected is not a policy. Making it enforceable, priced and detectable is the precondition for any of their proposals.

Jesse Fried, Harvard Law School. His work with Reiter warned that investor override power constrains the guardians of a mission, and he described OpenAI’s 2025 restructuring as far weaker at containing mission drift. His likely critique: Section III’s sheriff argument underrates how deferential Delaware courts are to boards. Jennings herself conceded in 2025 that a court challenge would have been hard. My reply: agreed. Standing is necessary, not sufficient. But a subpoena for board minutes produces a record, and a record changes how boards behave even when no case is ever filed.

Kathy Jennings, Delaware Attorney General. When she approved OpenAI’s recapitalisation in 2025, she defended it by pointing to a written commitment from the company to put safety first. The implicit challenge to this essay: the subpoena is the first real test of whether that written commitment is enforceable. If Delaware cannot obtain the board record after a breach of this scale, the attorney-general route is weaker than I have argued.

Brian Lehot, Foley and Lardner. His forensic reading of seven drafts of the S-1 showed that founder control was added during the drafting rather than inherited from the original design. The question this raises: what changed between draft one and draft seven? If the answer is investor demand, the Class F share is a capital-markets concession. If the answer is safety, the company should say so in its prospectus.

VI. Notes on sources

Quotations from the 2 November S-1/A are taken from press coverage, chiefly TechCrunch and CellCog, because the amended filing could not be retrieved directly. Language from the 26 October S-1 was read on the SEC’s site. Several figures rest on a single source and are flagged in the text: the commitment breakdown and short-term compute spend (Bret Kerr), the trust override routes (FourWeekMBA), the Delaware subpoena (Spotlight Delaware), and the Hugging Face breach figures (HackMag). The pause arithmetic in Section II is my own illustrative estimate, not a forecast.

Key sources

• Anthropic PBC, Form S-1 (SEC, 26 October 2026)
• TechCrunch on the S-1/A
• Fortune on Q3 financials
• Unite.AI on compute commitments
• Anthropic RSP updates and Frontier Safety Roadmap
• Dario Amodei, We Must Pace the Frontier
• What if automating AI R&D triggers an intelligence explosion?
• METR on Claude Opus 5.5
• Spotlight Delaware on the OpenAI subpoena
• Delaware DOJ on OpenAI’s recapitalisation (October 2025)
• Lehot, National Law Review
• Fried and Reiter, Harvard Law School Forum
• Allen and Gledhill on MAS AI risk guidelines
• McKinsey Global Institute, The AI economy

Luke Soon is an AI futurist and ethicist, and author of Genesis: Human Experience in the Age of Artificial Intelligence and Synthesis: The Superintelligence Protocol.