Sarbanes-Oxley without the filing
The accord six AI chiefs signed with the President on Tuesday asks each company for internal controls, a team to police them, an outside auditor and an independent board committee. That is the structure American public companies have used for their accounts since 2002. What it leaves out is the part that makes that structure work: anyone outside the company reading the result.
S O C I A L . C U T via UnsplashOn Tuesday President Trump and six executives signed a single page the White House calls the White House Accord on Super Intelligence, with a second title beneath it, Joint Commitment on Frontier Responsibilities. The signatures are Dario Amodei's for Anthropic, Sundar Pichai's for Google, Mark Zuckerberg's for Meta, Greg Brockman's for OpenAI, Jensen Huang's for Nvidia and Elon Musk's for xAI, which is now part of SpaceX. Trump posted it on Truth Social late that evening. Most of the attention since has gone to the line under his own signature, which reads "President of the Unites States". The substance is four bullet points.
Each company that trains and deploys frontier models, the accord says, should run "four layers of controls and audits". First, "robust internal controls" that track what its models can do and whether they stay aligned "around areas like cybersecurity, biosecurity, and chemical threats", and that keep them from hacking or reaching systems "in unintended ways". Second, an internal team to make sure those controls work and that problems get fixed. Third, "an independent external auditor or evaluator" to test the controls. Fourth, "an independent committee of the board of directors" to receive reports from the control team and from the auditors and see that problems are remediated.
Anyone who has worked in the finance function of an American listed company will recognise the design. The Sarbanes-Oxley Act of 2002 organised financial reporting around the same four parts. Management maintains internal control over financial reporting and assesses it under section 404(a). Internal audit, which the New York Stock Exchange requires of the companies it lists, tests them. For larger companies an outside auditor attests to them under section 404(b). An audit committee of independent directors oversees the whole arrangement under section 301. The accord takes that structure from the accounts and applies it to model behaviour, almost item for item.
What it does not take is everything that happens outside the company. Under Sarbanes-Oxley, management's assessment goes into the annual report filed with the Securities and Exchange Commission. The auditor's attestation is published. The audit firm must be registered with, and inspected by, the Public Company Accounting Oversight Board. The chief executive and finance chief sign personal certifications, with criminal penalties under section 906 for false ones. The accord has no equivalent of any of these. It says nothing about publishing results and names no regulator. It sets no standard for the auditor to apply and no qualification for who counts as one; the words "or evaluator" leave even that open. The reports go to a board committee, and the accord does not send them anywhere else. Al Jazeera's reading of the text reached the same conclusion: no disclosure requirement, no penalties and no enforcement role for government.
The accord's own answer to who checks the checkers is that "the participating companies will meet regularly to establish standards and best practices". Musk described the result at the America.gov launch on Tuesday, according to Nextgov, as "joint monitoring, board special committees, just generally grading each other's homework". He meant it as approval. Trump told reporters that about ten people would be named to a committee to "watch over the whole enterprise", that he would name someone to oversee the agreement after consulting the industry, and that the commitment was "morally binding". None of that is in the document. Vice President JD Vance argued the same afternoon that the Federal Trade Commission and the Justice Department already have the power to act against harmful products.
The board committee carries the most weight, and it is where the six signatories differ most. Sarbanes-Oxley and the exchange listing rules define what makes an audit committee member independent. The accord gives no definition. Meta and Alphabet have long-standing dual-class share structures that leave founders with decisive say over who sits on their boards. OpenAI signed through its president rather than its chief executive, Sam Altman. xAI signed as a unit of SpaceX, whose board is not xAI's own. An "independent committee" means different things at each of them, and the text does not settle which meaning applies.
The accord's last paragraph is its most candid: "Over time, it may make sense to codify these steps into laws or regulations." That is what happened to financial controls. Sarbanes-Oxley was passed after Enron and WorldCom showed that boards, auditors and internal controls existed and failed in private. The accord arrives a few months after an OpenAI model escaped its test environment and got into Hugging Face's systems. For now, investors and the public get the structure of an accountability regime but not its results. Whether a given lab's controls work will be known to its directors. Everyone else has the companies' word, which is what they had before Tuesday.