The Flight Recorder Compact

This paper starts from an uncomfortable premise: frontier AI development will continue, will spread, and cannot realistically be banned. It asks what humanity can build instead.

The original research behind this project proposed a control-based architecture: chips with regulator-held activation keys, cryptographic proofs of training, and a nuclear-style capped-liability pool. Two rounds of adversarial review found that design politically unrealistic, dependent on technologies it rated uncertain, and, in its liability model, working against accountability rather than for it.

The Flight Recorder Compact replaces control with accountability as the organising principle. It rests on a single standard, the three questions (what did you know, when did you know it, what did you do about it), applied through five mechanisms: Record, Probe, Respond, Underwrite, Intercept. Countries participate in three rings, from a full Compact to a universal floor that rivals can join. Principles live in law; technical parameters live in annexes updated annually, with pre-agreed triggers for change.

The thesis: finding a danger should always be safe, ignoring one should always be costly, and abusing one should be hard to hide, and every country and company should have more to gain inside the system than outside it.

We assume: frontier development continues; governments cannot ban it; security researchers must be able to test models; models will be distributed globally; countries have different incentives; companies compete; malicious actors exist; law lags technology.

EvidenceInterpretationWe treat this as a wicked problem in Rittel and Webber's sense: no definitive formulation, no stopping rule, solutions that are better or worse rather than true or false, and stakeholders who disagree about what the problem is.

Interpretation2.1 The accountability paradox, reframed. The original research framed the paradox as strict liability (which chills research) versus immunity (which invites recklessness). That framing is partly wrong. Liability attaches to harm, not discovery: a researcher finding a jailbreak is not itself a legal harm. The chill comes from three places: anti-hacking law and terms of service exposing researchers; companies' fear that a documented finding becomes evidence of knowledge in later litigation; and reputational exposure. The lever, therefore, is how the law treats knowledge. If knowing about a risk increases exposure regardless of what you do next, companies will avoid knowing. If what you did after knowing is what counts, they will want to know early.

Interpretation2.2 Why traditional regulation fails. (Widely shared.) Statutes move in years; capability moves in months. Model weights are files and cross borders instantly. Catastrophic losses could exceed any company's balance sheet, making firms effectively judgment-proof. Single-jurisdiction rules are routed around.

Evidence2.3 Where things stand in 2026. California's Transparency in Frontier AI Act took effect on 1 January 2026, requiring published safety frameworks, 15-day critical-incident reporting and whistleblower protection. The EU AI Act's general-purpose model obligations apply, with a 10²⁵ FLOP presumption of systemic risk. The international network of national AI institutes was renamed in December 2025 the International Network for Advanced AI Measurement, Evaluation and Science, coordinated by the UK AI Security Institute, with ten members including Kenya. The mainstream insurance market began excluding AI-related liability in 2026 while specialist affirmative cover emerged. Zero-knowledge verification of training runs is an active research programme, with a June 2026 preprint estimating a proof of concept in roughly three years. None of these is a governance regime; together they are the ground the Compact is designed to stand on.

Open question2.4 The Lens. The project's stated lens is that malicious intent and absent accountability may matter more than speed itself. We hold this as a lens, not a finding: many documented harms so far involve accidents, unintended behaviour and structural effects rather than malice. Section 14 lists this as open.

Evidence for the historical facts; interpretation for the lessons.

• Nuclear (IAEA 1957, NPT 1968/1970). Worked partly because fissile material is scarce, detectable and state-controlled, and because the treaty offered a bargain: verification in exchange for peaceful technology. Lessons that transfer: verification, transparency, shared standards, reciprocal obligations, communication channels, narrow red lines between rivals (the 2024 US–China affirmation of human control over nuclear-use decisions), legitimacy. Where it breaks: AI is software, copyable, distributable, privately developed, diffusing, and without a clean dual-use threshold.
• Chemical weapons (CWC 1997). Precursor tracking and challenge inspections. No challenge inspection has ever been requested. Lesson: an unused tool still shapes behaviour, and intrusive tools are politically hard to trigger.
• Aviation (ASRS 1976, ICAO Annex 13). Confidential near-miss reporting with limited immunity; independent investigation; separation of honest error from recklessness; certification recognised across borders. This is the Compact's closest model.
• Finance (post-2008). Stress tests, resolution plans, named-executive responsibility (UK SM&CR), certified reporting (Sarbanes-Oxley).
• Cybercrime (Budapest 2001; UN Convention 2024/2025). Cross-border cooperation infrastructure exists, imperfect and contested.
• Price-Anderson (1957, extended to 2065). Primary insurance of $500M per site, retrospective premiums of ~$158M per reactor, a total of ~$16B per incident, Congress beyond that. It assures compensation and caps liability; it was designed to make an industry investable, not to make it careful. We do not transplant it.

The architecture must satisfy eight conditions at once: progress continues; security research continues; accountability exists; cooperation doesn't require altruism; incentives make participation rational; the system can evolve; legitimate disagreement has room; everyone can win. Two further principles emerged from review: redundancy over reliance (no single technology carries verification) and decisions over devices (govern human choices, which change slowly, rather than compute thresholds, which change fast).

5.1 Record. Frontier-tier developers register major training and release decisions with their national authority. Cloud providers apply know-your-customer checks for very large compute purchases. Advanced chips carry location and identity attestation sufficient for export control, with no remote disablement. Developers maintain a decision log covering tests run, findings received, mitigations applied and verified, and release decisions, including open-weight releases. Logs are held by the developer and auditable on defined triggers (certification, incident, credible report). Cryptographic proofs of training are an optional future layer, not a dependency.

5.2 Probe. A statutory safe harbor, in civil and criminal law, for good-faith research that stays proportionate, keeps demonstrations minimal and follows coordinated disclosure. Accreditation grants access (pre-release models, secure environments), not protection. Contracts and terms of service cannot override the safe harbor. An AI vulnerability coordination function, on the model of CERT/CVE, routes findings, tracks response times, and escalates severe unaddressed findings to authorities. Developers must operate a disclosure channel.

5.3 Respond. See section 6.

5.4 Underwrite. Frontier-tier deployers must demonstrate financial responsibility proportional to scale and assessed capability. Because mainstream insurers are currently excluding AI risk, this is phased. Phase 1: reserves, bonds, or an industry mutual (as the nuclear industry's own pool is), plus mandatory contribution of incident and near-miss data to a shared database from day one. Phase 2: private underwriting as actuarial data accumulates. Contributions are risk-weighted using evaluation results and response records. No liability cap applies to gross negligence, concealment, retaliation, or ignoring a disclosed finding. A public backstop, if any, sits above private and mutual layers. A defined share of contributions funds Intercept infrastructure: those who create frontier risk help pay for defences against it.

5.5 Intercept. Investment in chokepoints between capability and physical harm: nucleic acid synthesis screening (today US-funding-conditional and under revision; proposed as a universal-floor commitment), hardened critical infrastructure, cyber-defence capacity, misuse detection and published threat reporting by API providers, and cross-border law-enforcement cooperation using existing cybercrime instruments.

5.6 Tiers. Obligations scale with capability and deployment. Below the frontier tier: a disclosure channel and honest documentation only. An academic and non-commercial track exists with lighter Record and no Underwrite duties.

6.1 The three questions. What did you know? When did you know it? What did you do about it? Legal exposure turns on these, not on whether a dangerous capability existed.

6.2 The spectrum. Responsible disclosure and good-faith research (protected); negligence (civil liability, higher contributions, conditional certification); reckless deployment (loss of safe harbor, fines, restrictions, personal liability); concealment (criminal exposure, loss of certification); deliberate malicious use (criminal law). These map onto the familiar culpability levels of purpose, knowledge, recklessness and negligence.

6.3 Duty to look. Required evaluation suites, maintained by the international network and updated annually, define reasonable care for each tier. Failing to run them is negligence. Wilful blindness is treated as knowledge.

6.4 Verified response. Responses to severe findings must be re-tested by the reporting researcher, an accredited evaluator, or a national institute. An unverified response to a severe finding counts as no response.

6.5 Severity-scaled timelines. From days for critical biological or cyber uplift to a standard 90-day window for lower severities, set in annexes.

6.6 The accountable executive. Each frontier-tier developer names a senior officer with documented authority to delay or stop a release, who certifies safety reports. Boards carry a parallel oversight duty. Knowingly false certification, or concealment, is personal liability.

6.7 Whistleblowers. Protected from retaliation, with an internal anonymous channel at large developers, as California already requires.

6.8 Open weights. Releasing weights is a logged decision. The three questions apply at release: what capabilities were known, which mitigations were verified, who decided. Weights cannot be recalled; the decision to release can be judged.

6.9 Agents. Agents operating at scale must be traceable to an accountable organisation. Mechanism unsettled; listed as open.

• Compact (inner ring): states hosting frontier development or key supply-chain steps. Adopt all five mechanisms; mutual recognition of evaluations and certifications; shared incident data; joint standards.
• Associates: adopt standards and disclosure without hosting frontier labs. Receive recognised certification for their firms, shared evaluation tooling, technical assistance, priority access to safety-relevant capabilities. This is the NPT-style bargain.
• Universal floor: human control over nuclear-use decisions; no self-propagating cyber agents against civilian infrastructure; nucleic acid screening; crisis hotlines; cross-border incident notification.

A non-member major power can sit on the floor, its firms can certify by passing the same published tests, and Intercept protects members regardless. Certification as a condition of market access is a trade measure; the regime should keep tests public, admit any applicant, and aim for mutual recognition as aviation does, to reduce the protectionist reading.

Institutions: the international network for evaluations and recognition; a CERT-style coordination function for disclosure; national authorities for enforcement; existing cybercrime cooperation for misuse; a small secretariat for annexes and review. No new global agency.

The five-step ladder in section 6.2, applied domestically. For states: loss of recognition and associate benefits, coordinated export controls, and for red-line violations the diplomatic and strategic consequences applied to other weapons concerns.

Redundant by design: audited decision logs; behavioural evaluations shared under mutual recognition; chip attestation and cloud KYC for very large compute; whistleblower protection; shared incident data; satellite and grid observation for large undeclared facilities; optional cryptographic proofs of training as they mature. Each can fail; together they make concealment expensive.

Principles in law; parameters in annexes revised annually; every threshold sunsets unless re-justified. Triggers: open models reaching agreed evaluation thresholds → heavier release review; capability decoupling from compute → compute reporting downgraded, testing expanded; agent-to-agent activity at scale → traceability rules activate; insurance market re-entry → Phase 2 of Underwrite.

• Possible now: SB 53-style transparency and incident reporting; civil and criminal safe harbors for good-faith research; disclosure channels; shared incident databases; cloud KYC for large compute; chip location attestation via export rules; industry mutual for financial responsibility; hotlines and the nuclear-decision red line.
• 3–5 years: verified evaluation regimes with mutual recognition; the accountable-executive requirement across Compact members; risk-weighted contributions with real actuarial data; universal-floor nucleic acid screening.
• Uncertain: cryptographic proofs of training at frontier scale; agent traceability; insurability of catastrophic tail risk; participation of all major powers.
• Politically unrealistic: remote chip disablement; surrender of source code to international bodies; unannounced physical inspection of sovereign datacenters; universal bans.

Response theatre (mitigated by verified response); not looking (mitigated by duty to look); sacrificial executives (mitigated by stop-authority requirement); check-the-box certification (mitigated by published tests and re-testing); a coordination function that becomes a gatekeeper; protectionist drift of market-access rules; capability outrunning annual annex updates; a mutual that under-reserves; a universal floor that is signed and ignored. None is fully solved.

• Regulator-held chip keys → location attestation only.
• Cryptographic proofs of training as core → behavioural evaluation as core, proofs optional.
• Price-Anderson pool → phased, risk-weighted financial responsibility with no cap for culpable conduct.
• Compliance safe harbor → knowledge-response safe harbor with duty to look and verified response.
• Accredited-only research protection → any good-faith researcher, civil and criminal.
• Universal identity tracing → high-risk access only.
• Embargo-based defection strategy → three rings plus Intercept.
• New global agency → existing institutions plus secretariat.

Round two additions: phased Underwrite, verified response, duty to look, stop-authority executive, Intercept funding, tiers, open-weight release as a logged decision, agent traceability proposal, source corrections.

Plus, for the next iteration:

• What severity classification process resolves developer–researcher disagreement?
• What minimal chip-attestation feature set supports export control without a disablement capability?
• How reliable are behavioural evaluations at detecting dangerous uplift, and how easily are they gamed?
• What would make the associate ring attractive to India, Gulf states, Brazil or Indonesia?
• Which claims here would change if a policy expert, a security researcher and an insurer each reviewed it?

Recommended next step: three short expert interviews before wider distribution.