The short answer
The three leading AI labs are talking about policing themselves — before regulators or customers force the question. On September 15, 2026, OpenAI confirmed that it, Anthropic and Google DeepMind have spent several weeks discussing AI safety, including a proposal for a shared industry standards body that would run pre-release evaluations of frontier models and could call for an industry-wide slowdown if a dangerous capability threshold is crossed. The idea, floated by Google DeepMind’s Demis Hassabis in July, is loosely modeled on FINRA in finance. Nothing has been founded yet, and it raises live questions about antitrust and how it would sit alongside binding law.
For teams that build on these models, this is not a spectator story. A voluntary body does not lift a single obligation off you: in the EU you still answer to the AI Act, and everywhere you still own the risk of what your product does. If governance is becoming a gating factor on model releases, it belongs in your architecture and your EU AI Act compliance planning today, not after a body that does not yet exist starts issuing verdicts.
What the labs confirmed
The story moved from rumor to record on Tuesday, September 15, 2026, when Chris Lehane, OpenAI’s chief global affairs officer, acknowledged that OpenAI, Anthropic and Google DeepMind “have been in talks for several weeks regarding AI safety.” The confirmation followed reporting that the three companies were working toward a standards body for the industry, and an essay published days earlier by Anthropic CEO Dario Amodei arguing the labs should coordinate to slow the pace of frontier AI and avoid catastrophic risks.
The specific proposal on the table originated in July with Demis Hassabis, who leads Google DeepMind. His idea: a US-led oversight organization — compared loosely to the Financial Industry Regulatory Authority (FINRA), which polices brokerages under government backing — that would vet the most capable models before they reach the public and could trigger an industry-wide slowdown when a genuinely dangerous capability appears. Hassabis was candid that this would not be cheap: funding, he said, “would need to be substantial and likely mostly come from industry, in order to attract world-class technical talent and provide the necessary compute resources for large-scale testing.”
The executives are not fully aligned on how far to go. Sam Altman framed coordination as healthy — “it’s great for our industry to say we want to come together… and make sure we have enough time to do this safely” — and signaled OpenAI would embed third-party evaluators to monitor for safety. Amodei went further, proposing a government waiver to shield the coordination from antitrust liability, an idea Lehane publicly downplayed by arguing the labs do not need a waiver to collaborate on safety. That gap — industry self-policing versus government-anchored oversight — is the unresolved core of the whole effort.
Self-regulation, not law — why the distinction matters
It is easy to read “standards body” and picture a regulator. It is not one. What the labs are discussing is a private, voluntary arrangement among competitors — closer to an industry consortium than to a government agency. That distinction is the whole game. A voluntary body can publish evaluations, set testing norms, and create peer pressure, but it cannot compel anyone, and a company that dislikes a verdict can, in principle, walk away. History with self-regulatory efforts in tech is mixed precisely for this reason: they move fast when interests align and stall the moment they diverge.
There is also a structural tension the labs will have to navigate: coordinating on when and whether to release products is exactly the kind of behavior antitrust law scrutinizes. That is why a government waiver came up at all, and why Lehane’s insistence that none is needed matters — the legal footing is genuinely unsettled. It is also why the effort may ultimately lean on legislation rather than a handshake: OpenAI has voiced support for the proposed FRONTIER Act, which would require independent verification organizations to monitor safety at the largest labs. Backing a law is a tacit admission that a purely voluntary club may not hold.
For anyone building on top of these models, the practical takeaway is that none of this is compliance you can rely on. Binding obligations still come from actual law — the EU AI Act with its General-Purpose AI code of practice, plus GDPR, and sector regimes like DORA in finance or HIPAA in US healthcare. A private standards body might one day produce evaluations you can cite in your own documentation, which would be useful. But it will not stand between your product and a regulator, and it will not answer for how your application uses a model. That responsibility stays with you.
What it means for US & EU software teams
The first implication is that model releases could become less predictable. If pre-release safety reviews and voluntary slowdowns become normal, the cadence teams have grown used to — a steady drumbeat of more capable models and cheaper tokens — may get lumpier, with capabilities gated, delayed, or rolled out region-by-region. If your roadmap quietly assumes the next frontier model lands on schedule, that assumption now carries more risk. Architect for it: keep your model layer abstracted, avoid hard-wiring one provider’s latest endpoint into core logic, and make provider or version switches a configuration change rather than a rebuild. That portability is the heart of a resilient GenAI integration.
The second is that “the vendor tested it” is not a governance strategy. Even a well-funded standards body would evaluate base models, not your application — not your prompts, your retrieval data, your tool permissions, or the decisions your users make on the output. Your obligations under the EU AI Act and your sector rules attach to the system you ship, so you need your own evaluations, guardrails, and audit trail regardless of what the labs agree among themselves. Treat vendor safety testing as one input, never as your compliance evidence.
Third, this is a procurement and vendor-risk signal worth logging. The labs are telling you, in public, that governance is becoming a first-class constraint on their products. That belongs in how you evaluate AI vendors: ask what pre-release testing and independent verification a provider actually submits to, how it handles model deprecation and version pinning, and what it commits to on availability if a release is paused. Feeding those questions into contracts and architecture — the kind of diligence a mature AI, ML and data practice bakes in — is how you keep optionality instead of inheriting whatever the frontier decides.
What to do now
- Inventory your model dependencies. List every frontier model and version your product relies on, and where switching would hurt. You cannot manage release risk you have not mapped.
- Keep the integration portable. Abstract the model behind your own interface so a delayed, gated, or deprecated release becomes a config change, not an outage. Test at least one fallback provider in a real path, not just on paper.
- Own your evaluations. Build and version your own safety and quality tests against your use case — prompts, data, tools, edge cases — rather than leaning on the vendor’s model-level testing as evidence.
- Anchor governance in real law. Map your AI system to the EU AI Act (and its GPAI code of practice), GDPR, and any sector regime you fall under. That, not an industry pledge, is what an auditor or regulator will ask about.
- Update vendor diligence. Add questions on pre-release testing, independent verification, version pinning, deprecation notice, and availability commitments to your AI procurement and contracts.
Frequently asked questions
What did OpenAI, Anthropic and Google confirm?
On September 15, 2026, OpenAI’s global policy chief Chris Lehane confirmed the three labs have been in talks for several weeks about AI safety. Reporting indicates the discussions include a proposal for a shared industry standards body to test frontier models before release. The talks are early-stage; no body has been formed and no binding rules exist.
What would an AI standards body actually do?
The concept, floated by Google DeepMind’s Demis Hassabis in July 2026, is a US-led organization — loosely modeled on the finance sector’s FINRA — that would run standardized pre-release evaluations of frontier models and could call for an industry-wide slowdown if a dangerous capability threshold is crossed. Hassabis said funding would need to be substantial and mostly industry-backed.
Is this the same as the EU AI Act?
No. The proposed body is voluntary self-regulation by private companies, not law. The EU AI Act is binding regulation with a General-Purpose AI code of practice and enforceable obligations. A private body could complement the AI Act but does not replace legal compliance. In the EU you still answer to the AI Act regardless of what the labs agree.
Does coordination like this raise antitrust concerns?
It can. Competitors coordinating on when and whether to release products invites antitrust scrutiny if it suppresses competition. Anthropic’s Dario Amodei suggested a government waiver to address that; OpenAI’s Chris Lehane argued no waiver is needed to collaborate on safety. The question is unresolved, and it is one reason the effort may lean on legislation like the proposed FRONTIER Act.
What should teams that build on frontier models do?
Track which model versions you depend on and keep your integration abstracted enough to switch providers if a release is delayed or gated. Document your own evaluations and guardrails rather than relying on a vendor’s testing, and align that with the EU AI Act where you operate in the EU. Do not outsource your risk management to a body that does not yet exist.
Sources
TechCrunch — OpenAI, Anthropic, Google have been in talks on AI safety for weeks
CNBC — OpenAI, Google, Anthropic discuss collaboration on AI safety issues
Tech Xplore / AFP — OpenAI, Anthropic and Google are working to create an AI standards body