The tentative name is the tell. Google, OpenAI, and Anthropic are reportedly assembling a body called the Standards Authority for Frontier AI. In that phrase, "Frontier AI" does all the branding while "Standards" quietly does the governing. The word "safety" never appears.
I spent forty hours in 2017 tracing Golem's ERC-20 distribution logic against the economic model in its own whitepaper, and found an integer overflow in the allocation math. That week installed a habit I have never managed to break: a claim is real only where it is executable. Golem promised a computational marketplace. The contract promised an integer. The gap between those two things was the entire audit.
SAFA arrives in exactly that gap. No charter. No member list. No published standard. Only anonymous sourcing. That is not grounds for dismissal. It is grounds for reading the name very carefully.
The reported facts are thin, and the thinness is itself data. Three labs are said to be forming a nonprofit-style standards organization. A venture capitalist with recent government policy experience, Sriram Krishnan, has been invited to serve as its chief executive. Launch is described as happening "at the end of this year or early 2027" — a range that should bother anyone who reads timestamps professionally. Those two dates cannot both be true. One of them is a placeholder.
Everything else is absent. No bylaws. No funding disclosure. No definition of what a "frontier" model is, which is the single most consequential definition in the entire document set. No answer to who audits, who pays, who is sanctioned, or what happens when a member violates the standard it helped write. A standard without a violation clause is a press release with footnotes.
Set this against the existing landscape. The Frontier Model Forum already exists. So does the Partnership on AI. MLCommons publishes benchmarks. ISO/IEC 42001 defines an AI management system. NIST maintains an AI Risk Management Framework. The EU AI Act has moved from proposal to binding law with phased obligations. China requires model filing. The field is not empty. SAFA is not filling a vacuum; it is competing inside a crowded room for the right to be the reference standard.
Crypto has run this experiment before. The ICO era produced a stream of self-regulatory proposals from issuers who were, conveniently, the entities that needed regulating. Almost none survived contact with enforcement. The one governance artifact that did survive was the Ethereum Improvement Proposal process — adversarial, public, slow, and painful precisely because it had no owner.
The leak itself deserves attention. Anonymous sources describing a not-yet-announced consortium are usually testing something: public reaction, regulator reaction, or the willingness of the invited CEO to accept. In blockchain terms, this is a mempool broadcast, not a confirmed block.
Strip the branding and a standards body does four things. It defines terms. It specifies measurement. It certifies compliance. It sanctions deviation. The first two are cheap. The third is where money and power live. The fourth is where legitimacy is decided — and it is the one thing SAFA has reportedly not addressed. A safety standard without sanctions is a whitepaper, not a protocol.
What would frontier AI standards actually contain? Based on every comparable framework in the field, the technical surface looks like this: capability evaluations with defined thresholds, red-team protocols, model cards with structured disclosure, post-deployment incident reporting, and — critically — training compute disclosure, meaning FLOPs. Each of these is an interface. Each interface has an enforcement surface. Every enforcement surface has a cost curve.
Here the asymmetry becomes architectural rather than political. The three reported founders all operate closed-weight, API-mediated systems. An API is perfectly legible to an auditor: you can meter it, rate-limit it, query it, log it. A downloadable weight file is not. Once a model is on a torrent, no evaluation regime reaches it. A standard written by API-first companies will naturally, and perhaps unintentionally, define compliance as a property that only API-first companies possess.
I documented this exact pattern in 2024 while dissecting the custody architectures behind the spot Bitcoin ETF applications. The multi-signature and threshold-signature schemes in institutional cold storage were technically defensible. They were also optimized for auditor legibility, not censorship resistance. Compliance-driven centralization does not require anyone to intend centralization; it only requires the compliance surface to be legible and the alternative to be invisible.
Run the precedent forward. If SAFA's evaluations become procurement checkboxes — cloud marketplaces, government contracts, enterprise risk committees — the standard stops being voluntary the moment a purchasing department adopts it. That is how voluntary frameworks become facts. Not through law. Through procurement. Post-Dencun rollups taught a similar lesson about resource assumptions. While blob space was abundant, fees collapsed and everyone treated cheapness as structural. The assumption held until demand filled the channel, and then scarcity returned on schedule. Free safety consensus is currently abundant because nobody has needed to price it. Once standards carry procurement consequences, the price appears, and it appears asymmetrically.
Who pays determines who is served. Credit rating agencies were paid by the issuers they rated, and the 2008 post-mortem made the consequences of that alignment explicit for a generation. If SAFA funds itself through membership tiers, certification fees, or audit services, the incentive gradient is set before a single standard is drafted. If it funds itself through government grants, it is no longer a private body. Either way, the revenue model is the real charter.
The name deserves one more pass. The founders reportedly landed on "Standards Authority" rather than "Safety Authority." That is not a synonym choice. Standards bodies accumulate power by being referenced. Once a regulator, a procurement team, or a court cites a standard, the organization that owns it has effectively been delegated rulemaking authority without ever receiving a vote. That is the quiet part of the phrase.
There is also the personnel question, and it matters more than the org chart. A chief executive drawn from venture capital and government policy connects two networks that private standards bodies have historically used to substitute for statutory authority. This is not a conspiracy; it is a career path. The revolving door is a governance mechanism with a very low node count and no slashing conditions.
Then there is the question of who was left out. Meta, xAI, Amazon, Apple, Microsoft, and every Chinese lab are absent from the reported founding group. Microsoft's absence is especially conspicuous given its capital relationship with OpenAI. Exclusion can be accidental. It can also be a design decision, because a standard that open-weight publishers cannot meet is a standard that excludes open-weight publishers without ever naming them. Ask the NFT market how that ends. In 2021 I spent two weeks tracing the URI resolution path behind BAYC's metadata and found centralized fallback URLs sitting under a decentralization narrative. The token was immutable. The asset was not. Ownership was real only until a server went dark.
Notice what is missing from the reported scope entirely: agents, open weights, multimodal misuse, and biological or cyber thresholds. Those are the four hardest technical questions in frontier safety, and none appears in the leak. A standard that avoids the hardest interfaces is not a standard. It is a press strategy with an org chart.
The geopolitical layer is not subtle either. A private American standard, adopted through procurement, functions as a non-tariff barrier in a way legislation never could. China's filing regime already excludes external standards by construction. If two blocs formalize private certification schemes on opposite sides, fragmentation is not a risk scenario; it is the default. Fragility is the price of infinite composability — and governance composes too. Every added layer of private standard multiplies the interfaces at which two systems can fail to recognize each other.
There is a reflexivity problem buried underneath all of it. The value of a standard depends on belief in the standard, not on its text. A framework nobody cites has no force; a framework everybody cites has force even if it is technically weak. Standards are therefore a coordination asset, and coordination assets are fragile at exactly the moment they are tested. I reverse-engineered the UST burn logic in 2022 and located the precise point where the mechanism tipped. The arithmetic never failed. What failed was the shared belief that made the arithmetic matter. Standards bodies are exposed to the same reflexivity, at lower velocity and higher legitimacy.
One last structural point: evaluation economics. Independent red-teaming requires model access and inference compute. A handful of labs can fund that. A research group cannot. The standard therefore encodes a capability threshold at the enforcement layer that has nothing to do with model capability. It encodes who can afford to prove they are safe — and the data-labeling industry will be pulled along, adding safety labels, red-team corpora, and abuse-case annotation to a pipeline that already runs on invisible labor.
The counter-intuitive reading is that "without government oversight" is not a flaw in SAFA's design. It is the product being sold. Three labs do not need a regulator; they need the appearance of regulation without its binding force. A body that writes standards, certifies members, and answers to no one delivers exactly that: reputational cover, procurement legitimacy, and a lobbying instrument, none of it attached to statutory accountability.
But the second-order risk is worse than capture. Capture is visible. Failure is quiet. If SAFA becomes a logo rather than an enforcement surface, it absorbs the political oxygen that binding regulation would otherwise consume. Legislators get to say the industry is handling it. Two years later, the charter is a PDF and the standard is a press release. Self-regulation that fails is not neutral; it delays the statutory action its own existence was meant to preempt.
I have watched one coordination failure at close range. The 2022 Terra collapse was not a code failure. It was a belief failure. The burn logic executed exactly as specified, all the way to the bottom. SAFA is a coordination mechanism with three nodes and no slashing conditions — cheap to reach finality, and just as cheap to reverse.
Track four signals over the next eighteen months: whether Krishnan accepts the role, whether the charter names any sanction, whether membership opens beyond three American closed-weight labs, and whether any standard becomes a procurement requirement. If the first two resolve yes and the second two resolve no, SAFA will be remembered as a brand. Hype creates noise; protocols create history. A standards body is a protocol. Its enforcement surface is its consensus. Without one, there is nothing to run.