Governance & compute verification

Mandatory template under Article 53(1)(d) of the EU AI Act for the public summary of training content. Providers of general-purpose AI models must publish this summary. It covers data sources such as large public datasets, the most-scraped web domains and user data.

South Korean law in force since 22 January 2026. The link is to the Korea Legislation Research Institute's unofficial English translation. The law requires generative AI outputs to be labeled. AI-generated sounds, images or videos that are hard to tell apart from real ones must be clearly disclosed. The law also sets risk-management duties for AI systems trained above a compute threshold.

Argues that AI compute is detectable, excludable (access to it can be withheld) and quantifiable, which makes it a lever for regulatory visibility, resource allocation and enforcement. It also warns of privacy, economic and centralization risks.

Proposes on-chip weight snapshots, training-run records and chip supply-chain monitoring so that governments can verify that no actor ran a prohibited large training run.

Report finding that states could eventually verify compliance with rules on large-scale AI development through six largely independent approaches, from chip security features to whistleblower programs.

Overview of verification approaches for three example policy goals. It argues that more access, such as physical inspections of data centers, can often substitute for technical mechanisms that are still immature.

Case study of verification in three types of nuclear arms control agreements. It draws lessons for agreements on AI development that relies on thousands of specialized chips.

Workshop-based overview of hardware-enabled mechanisms (HEMs) for reporting training compute, cluster configuration or location in a verifiable way. HEMs are features built into AI chips or servers. The overview also covers open questions about implementing them.

RAND working paper introducing hardware-enabled governance mechanisms for AI chips, the export-control objectives they could support, and the attacks they would need to withstand.

CNAS report proposing on-chip governance mechanisms for data-center AI chips, such as privacy-preserving verification and operating licenses that a chip needs to keep running. It names export control enforcement as a near-term application.

Issue brief proposing delay-based location verification for AI chips. A chip's response times to trusted landmark servers set an upper limit on its distance from them. The brief estimates the cost of a firmware update and a landmark network.

First paper in a three-part series proposing flexible hardware-enabled guarantees (flexHEG). The proposal places an auditable guarantee processor in a tamper-protective enclosure to monitor the use of AI accelerators.

Introduces proof-of-training-data protocols, which let a model trainer show which data produced a set of weights. Examples include pre-committed random seeds and checks based on models' tendency to temporarily overfit their training data. In the authors' experiments, these protocols caught all known proof-of-learning attacks.

NVIDIA's announcement of an opt-in, customer-installed service that streams GPU telemetry (operating data) to a fleet dashboard. NVIDIA states that its GPUs have no hardware tracking technology, kill switches or backdoors.

Multi-author report on how AI developers could make verifiable claims about the safety, security, fairness and privacy of their systems. It analyzes ten institutional, software and hardware mechanisms, such as third-party auditing, red teaming, audit trails and secure hardware for machine learning. It recommends steps to implement or improve them.

Bill introduced in the U.S. House on 15 May 2025. It would require export-controlled advanced chips to carry location verification mechanisms before export. It would also require license holders to promptly report credible information on diversion or tampering.

White House policy plan. Its recommended actions include exploring location verification features on advanced AI chips to enforce export controls. They also include having NIST's Center for AI Standards and Innovation (CAISI) evaluate frontier AI systems for national security risks and assess risks from adversaries' AI systems.

CSET report that assesses methods for verifying the location of AI chips to enforce export controls. It judges the methods on verifiability, accuracy, security and repeatability. It finds that the most feasible approach is ping-based verification (timing a chip's network replies) supplemented by physical inspections. The report also sets out that approach's limitations.

Report finding that many international AI agreements could be verified without speculative technology. It finds that rules on data-center AI development appear verifiable within a few years, given dedicated verification hardware and serious effort. It also finds that detailed rules on mobile AI-enabled devices in sensitive domains, such as weapons, face severe political barriers.

Taxonomy for assessing whether proposed international AI agreements can be enforced. It splits compliance into three problems: preventing uncontrolled resource acquisition, detecting all capacity outside the control regime, and preventing escape from the regime. It also defines an enforcement breaking point, the compute threshold at which a policy loses its effectiveness.