One year of the AI safety board: what the first rulings settled

The international AI safety board marked its first anniversary this week with something it had not produced before: rulings. Two decisions were published, one requiring the largest model developers to disclose the safety evaluations behind their flagship releases, and one establishing a common format for reporting incidents that occur after deployment. Neither ruling bans anything, and neither imposes the kind of sweeping restriction that the board’s critics predicted when it was created. Their modesty is exactly what makes them significant, because a body that starts by ruling on the uncontroversial becomes a body that exists.

The context matters. The board was assembled in the aftermath of two incidents that the industry spent a year explaining: a model whose image-generation abilities produced a wave of deepfakes that crossed several national red lines, and an agent system that briefly acted on instructions that its own guardrails had been designed to catch. Both incidents revealed the same gap: nobody outside the companies could see what the models had been tested against, and nobody had a standard for saying when an incident was reportable. The first rulings are an answer to that gap, and they are deliberately procedural rather than philosophical.

I find the choice of targets instructive. The board has not tried to define ‘dangerous capability’, which is the question that splits every delegation, because defining it would have ended the board. Instead it ruled on transparency and on incident reporting, which are the load-bearing walls of any future regulation, and which most companies, after two years of reputation damage, were prepared to accept. That is how international regulation actually happens: not with a grand bargain, but with a sequence of modest agreements that accumulate into something load-bearing.

The limits are equally clear, and worth naming rather than celebrating away. The board has no inspection power, so the disclosures it demands are only as good as the auditors it can persuade companies to accept, and the audit profession for AI models barely exists yet. The incident format is voluntary in practice, because the board’s enforcement budget is a rounding error next to the industry it monitors. And the largest labs, the ones whose releases actually define the frontier, have still not committed to the most consequential item on the table: giving the board access to a model before it is deployed. The anniversary rulings will be read as progress, and they are, and the distance between progress and control remains the honest measure of the year ahead.

The board has done the most important thing a new institution can do, which is to survive its first year without either dissolving or overreaching. It has issued rulings that almost everyone can live with, established a calendar and a secretariat, and given the companies a reason to keep showing up. The hard questions, the ones about who may deploy what and under whose licence, are still ahead, and the board’s second year will probably be uglier than its first. But the first year’s work was the necessary one: making the institution real enough that the hard questions have somewhere to land.