A who-does-what plan for AI safety, built around Trusted Deployers: certified hosts that keep dangerous models guarded without ending open access.

AI has reached a new level of public interest. That may seem like a silly thing to say, as it’s been of interest for a while. But prior (broadly public) interest was about it as a tool, or about the money to be made or lost, or about an effect on jobs.

The new interest demands policy. It demands action. The new interest is connected with risks I consider real. Being real doesn’t make these risks certain. But being real, even with uncertainty, is reason enough to act.

I’ve written lately about risks, cybersecurity risks, and loss-of-control risks. These tried to explain complex topics, starting from the initial premise. Recommendations follow the explanation. This piece will be a bit different. Its focus is upon what I think we should be doing. You might consider it a policy piece. Policy in a completed form has to be a bit broad. There’s always more than one thing going on. As such, I’ll lay out my outline first, and then offer below the extra detail, background and context that I think is important to understanding each point in that outline.

If you’re scanning the outline and see something you disagree with, I’d suggest you continue on, because the outline is, by design, abbreviated, and not fully descriptive.

This isn’t the only effort of this type. Institute for Progress (IFP) and AI Futures are two well known efforts. What distinguishes this most of all is thinking more deeply about how models are deployed. This is a background element that’s somewhat ignored, because it’s not as novel and is not as visible to users. But it’s absolutely critical. I don’t expect this plan would replace plans from well known organizations, but by illustrating a gap, I hope to inspire improvement amongst those plans.

Who and What

This outline is categorized by who would be expected to do what. In some cases, someone is expected to do it, but there’s also another role, of providing the incentives that improve the expectation they will.

Enforcement is deliberately vague. It depends on jurisdiction, has to fit existing legal frameworks, and will need to be worked out, and negotiated, through the political and legal systems. It would feel like I was putting the cart before the horse to even guess at how that would take shape at national and international levels.

Layer 1: Infrastructure and Distribution

Trusted deployers

Who are they? A new designation that existing and new organizations can be certified as. Expect major cloud providers (AWS, Azure, Google), AI labs (for self-owned) and neoclouds to join immediately. The plumbing largely already exists, but needs standards and certification.

Revenue model? Charging for compute and operational services as a utility function. Or, an internal unit (for a lab, government, or large organization)

Core Responsibilities

• Develop secure environments to host models that receive an independent AI Deployment Safety Level (AIDSL) rating. Example, but not comprehensive list of requirements:
  • Comprehensive monitoring, telemetry, and auditing (including multi-turn agent pattern detection).
  • Resistant to external cyberattacks and insider threats.
  • Resistant to internal cyberattacks. At minimum red-teamed by deployed model and a second highly capable model.
  • Guardrails applied by default to all deployments which prevent access of dangerous capabilities.
  • Strict controls for any guardrail exceptions as used for “limited” access deployments. For example, accessing users must be known directly, or an evidence chain validated using only trusted organizations.
• Understand the sensitivity of any model deployed. Never deploy a model in an environment with an AIDSL rating insufficient to the combination of deployment type and model sensitivity.
  • Use internal qualification for small custom models and Independent Evaluator data for larger/frontier models.
  • Models under training assumed to be at least X% more capable than the best model trained to date at the given scale. If the training scale is unprecedented, increase X by a size factor. (X should be established by independent evaluators)
• Perform or validate Know Your Customer (KYC) verification for all model providers, for Independent Evaluators and anyone with access to deployments with guardrail exceptions.
• Provide access to Independent Evaluators to confirm secure environments meet standards

<