The Governance Ultimatum

The UN's Global Dialogue on AI Governance opened in Geneva on July 6 — the first General Assembly-mandated forum where all 193 member states, not an invited subset, convene on the technology. Bletchley in 2023, Seoul in 2024, New Delhi earlier this year were host-government affairs by invitation. Day prior, on July 1, the Independent International Scientific Panel on AI issued an evidence-based assessment of opportunities, risks, and impacts of artificial intelligence.

The Panel is the genuinely new instrument here — forty scientists from all five UN regions, co-chaired by the Turing laureate Yoshua Bengio and the Nobel laureate Maria Ressa, mandated to give governments a shared, independent evidentiary basis. And what it handed them, stripped to its spine, is one sentence: the world cannot govern what it cannot understand. Current safeguards, the report finds, cannot keep pace with the growth of AI's capabilities. There is no technical guarantee that the most advanced systems will follow the instructions they are given. And it names a paradox any auditor will recognize instantly: policymakers need evidence to govern well, but by the time the evidence is unambiguous, it may be too late to act on it.

Now put that beside another central finding — AI risks are unevenly distributed across populations and countries, while AI development and the wealth it creates are highly concentrated. By the report's own numbers, the United States controls roughly three-quarters of the compute behind the world's leading AI systems and China about fifteen percent; together, close to ninety percent. Most frontier models are built by companies headquartered in those two nations. Which means something the diplomats in that room cannot have enjoyed hearing: 191 of the 193 governments at the table lack the independent capacity to evaluate, stress-test, or audit the systems they are being asked to govern. Any standard agreed in Geneva depends, for its technical enforcement, on the voluntary cooperation of the two countries that build and run the systems being regulated.

Say that in audit language and the problem is stark. This is an assurance engagement in which the auditor cannot access the evidence, cannot test the controls, and must rely on the representations of the party being examined. The Panel even enumerated the missing capacities directly: model evaluation, domain-specific auditing, agentic testing, secure integration, the training of independent evaluators. Read that list again. It is not a list of missing laws. It is a list of missing audit infrastructure.

Here is the order-of-operations problem underneath the whole week. The Secretary-General framed the goal well: when countries align on how to test systems, measure risk, and assign responsibility, "safety travels with the technology"; when they don't, a scramble of incompatible national rules shelters nobody. But look at what "assign responsibility" quietly requires. You cannot assign responsibility for a decision you cannot trace. You cannot test a system that keeps no inspectable record of how it reached its output. The treaty everyone is waiting for presupposes an artifact that does not yet exist at any scale: a verifiable, portable record of how AI systems arrive at their decisions. Provenance is the substrate beneath "assign responsibility" and "test the system," and the governance conversation has walked all the way up to it, named the missing audit capacity out loud, and does not have the architecture that would make audit possible.

You cannot govern what you cannot audit, and you cannot audit what keeps no lineage.

There is a sovereignty story here too, one people and companies have already begun writing. The report is blunt that access is not benefit — availability of AI without the surrounding capacity for accountability produces little — and warns that nations may gain access to the technology while losing influence over its standards, infrastructure, and governance. That is the sovereignty problem one scale up from the enterprise version: states, like companies, are being offered the use of a system whose means of production — and whose means of verification — belong to someone else. The answer at both scales is the same. The only way a party that did not build a system can nonetheless hold it accountable is if the system carries a record that party can inspect and does not have to rent. Sovereignty — national, corporate, or individual — dissolves without a lineage you can audit yourself.

Debates on AI regulation have been argued from the perspective of centralized global control — which the United States has flatly rejected, saying it will not accept international bodies asserting centralized governance of AI — versus voluntary trust, which the Panel has just said cannot keep pace. Both poles are right about their own object, and both leave the real gap untouched, because the gap is neither a world authority nor a good-faith promise. It is infrastructure: the verifiable decision record that makes any system inspectable, by anyone with standing, without a treaty and without a central controller. You do not need a global government to audit a system. You need the system to keep a lineage you can check. That threads between the two poles the summit could not reconcile — verification without centralization — and it is the one thing neither the manifesto-writers nor the treaty-drafters are building.

Geneva did real work this week. It made children's safety a headline priority — the Secretary-General called for an AI Child Safety Pledge, and the President of the General Assembly put on the record that the overwhelming majority of deepfakes are sexual and aimed at women and girls. Even that harm runs into the same wall: you cannot enforce a child-safety standard against a system whose outputs you cannot trace to a source.

The consensus on what is wrong outran the capacity to verify it years ago. That capacity is the layer I am invested in, because everything above it — every pledge, every standard, every assignment of responsibility — is a promise until it exists.