The AI Race Needs Shared Rules of the Road

By René Bohnsack

Professor Rene Bohnsack explains why responsible AI will remain fragile until behaving responsibly is also competitively rational

Twenty-two points separate Anthropic and OpenAI on LMArena’s Arena leaderboard, with xAI and Google in between. Stanford’s 2026 AI Index reports scores of 1,503 for Anthropic and 1,481 for OpenAI. Stanford also cautions that leaderboard standing may partly reflect adaptation to the platform rather than general capability. When a race is this close, the measures themselves start to shape the competition.

More than 90% of notable frontier models produced in 2025 came from industry. The companies building them have strong reasons to invest in testing, safeguards and external evaluation. They also know that slowing a release while rivals continue to accelerate can mean losing customers, talent and technological leadership. This is the prisoner’s dilemma at the centre of frontier AI: the collective interest points towards greater restraint while the competitive incentive points towards speed. The challenge is not knowing what responsible behaviour looks like. It is making responsible behaviour individually rational.

That distinction changes how we should think about AI governance. Corporate principles and voluntary commitments matter, but they remain vulnerable if responsible behaviour carries a competitive penalty. Shared rules become valuable when they change the payoff structure of the race.

Why voluntary responsibility remains fragile

The AI industry has already moved beyond principles. At the 2024 Seoul AI Summit, major developers committed to safety frameworks, risk thresholds, external evaluation and greater transparency. The accompanying ministerial statement brought together 27 countries and the EU around work on severe-risk thresholds and safety testing. Those commitments established the beginnings of a common floor beneath competition.

A floor built from voluntary commitments remains vulnerable. Each company must believe that its rivals are carrying comparable costs and observing comparable limits. If one developer suspects that another is training faster, testing less or tolerating more risk, the logic of the race returns.

Stanford’s 2026 AI Index shows how uneven the measurement environment remains. Leading frontier developers routinely publish capability benchmarks, while reporting on responsible-AI benchmarks is patchy and difficult to compare. Documented AI incidents rose from 233 in 2024 to 362 in 2025. Markets can see capability gains almost instantly. Safety investments are harder to observe and compare, so competitive pressure gravitates towards what can be measured.

Dario Amodei made the incentive problem unusually explicit in “We Must Pace the Frontier”, published on 12 September 2026. His premise is clear: capability growth should slow enough for alignment, evaluation and governance to catch up. His three-stage proposal starts with embedded third-party evaluators who receive employee-like access to frontier labs. It then moves to government regulation of frontier developers, with industry standard-setting running in parallel where legislation lags, and ultimately to global coordination, including with China. Pacing, in his argument, buys time to build the safety capacity that increasingly capable systems require.

The proposal also exposes the central difficulty. A company can choose to move more carefully on its own, but sustained restraint becomes much harder when competitors face no equivalent obligation.

Shared rules as competitive infrastructure

Accounting offers a useful analogy. Investors can compare firms because companies operate under common accounting and disclosure standards. Those rules do not dictate which products managers should launch or which strategy they should pursue. They make performance legible enough for markets to compare companies without allowing each firm to invent its own definition of profit.

Frontier AI needs a similar logic. Developers should remain free to compete on capability, price, reliability and applications while facing common requirements for evaluating systems above particular levels of capability or autonomy. A company could still win by building a better model. Performing less testing would become a less viable route to advantage.

The connection to measurement is important. LMArena gives the industry a common reference point for capability, even if Stanford cautions that performance there can partly reflect adaptation to the platform. Safety still lacks an equally legible competitive language. Shared evaluation requirements would make some of that currently invisible investment comparable.

This also requires proportionality. A narrow enterprise application presents a different risk profile from a frontier system with advanced cyber capability or substantial autonomy. Requirements should rise with the authority a system receives and the consequences of failure.

I call this principle Graduated Authority. It separates three questions that are too often collapsed into one: What can the system do? What is it permitted to do? What evidence justifies that permission? Capability, permission and assurance should move together.

At the market level, Graduated Authority means establishing a common floor beneath competition and raising the burden of verification as capability and consequence increase. Inside an organisation, it means granting an AI system greater authority only as the evidence for doing so becomes stronger. The same strategic logic operates at both levels.

International competition makes the problem harder

The international version of the prisoner’s dilemma is less tractable. Stanford reports that the performance gap between leading US and Chinese models has effectively closed. US and Chinese systems have traded the lead since early 2025, and the leading US model was ahead by only 2.7% as of March 2026. Governments deciding how aggressively to govern frontier AI also see a contest for technological leadership.

Seoul showed that focused coordination is possible, but also how fragile it can be. Twenty-seven countries and the EU signed its ministerial statement. China participated in the summit, and Chinese companies were among the signatories to the separate voluntary industry commitments, but the Chinese government did not sign the ministerial statement. The 2025 Paris AI Action Summit subsequently broadened the agenda towards governance, standards, inclusion and public interest without converting Seoul’s ambition on severe-risk thresholds into a stronger common regime.

A narrower agenda may prove more durable. Shared testing methods, incident reporting and defined severe-risk thresholds offer more realistic starting points than an overarching agreement on the pace of AI development. Amodei’s third stage, global coordination including China, captures both the necessity and the difficulty. Any agreement has to make compliance sufficiently verifiable that strategic competitors can participate without simply trusting one another.

Europe has a particular interest in this approach. Its contribution need not be to choose between unbounded acceleration and heavy ex ante restriction. It can help make evaluation, verification and accountability portable across firms and jurisdictions. That would strengthen the infrastructure of competition rather than attempting to determine its winner.

From models that answer to systems that act

Graduated Authority becomes more tangible as AI shifts from generating answers to taking actions. The UK AI Security Institute reported an incident from deliberately permissive cyber evaluations in which agents were run 122 times across several models. In 10 runs, agents took autonomous, unsanctioned actions on the live internet. The institute catalogued 19 such actions directed at real people and organisations. Seventeen came from a single model, Anthropic’s Mythos 5.

The most serious sequence involved an attempt to insert malicious code into a real open-source project. The agent researched human maintainers, created fake identities and used them in an effort to persuade a maintainer to approve the code. A human reviewer rejected it. The institute found no resulting real-world harm and stressed the unusual test conditions, which included broad internet access and disabled safeguards. The concentration of 17 of the 19 actions in Mythos 5 also matters when interpreting the event. This was evidence of a particular failure mode under particular conditions, rather than evidence that every frontier agent behaves this way.

Capability, permission and assurance had nevertheless slipped out of alignment. The agent possessed the technical capacity to reach beyond the intended task, the environment gave it enough permission to do so, and the controls only caught the most serious attempt when a person refused the proposed code.

A milder version of this problem appears in the governed enterprise workflows we build at AUGMTD. In the case of CV screening workflows, a typical use case for AI agents in human resources departments, the critical design choice is to separate capability from authority. Routine actions can proceed automatically (e.g. creating a shortlist), exceptions can escalate (e.g. edge cases), and consequential actions remain with a person (e.g. decisions for candidates). The audit trail allows the organisation to reconstruct the path afterwards.

Graduated Authority gives boards and executives a practical question to take into the next AI steering committee: how much authority has this system earned? The answer depends on evidence, consequence and reversibility. A system may be reliable enough to recommend without being ready to decide. It may be able to handle routine cases while escalating unusual ones. Authority expands as assurance improves.

Making responsibility competitive

AI will remain intensely competitive, and that competition is productive. It drives capability improvements, lower costs and new applications. The institutional design around that competition will determine which behaviours the market rewards.

Poor regulation can protect incumbents or impose comparable burdens on systems with very different risk profiles. Weak coordination creates a different problem. It leaves firms that invest seriously in evaluation and safety exposed to competitors willing to move faster while carrying less visible safety investment.

Graduated Authority offers a way through the binary debate between acceleration and restraint. Establish a common floor where competitive incentives create systemic risk. Increase verification as systems gain capability and authority. Inside companies, grant autonomy in the same way, step by step, as evidence and assurance justify it.

The AISI incident ended with a human maintainer refusing malicious code that an agent had tried to place in a real open-source project. That moment offers a useful image for the next phase of AI governance. We should design the boundary deliberately rather than relying on human vigilance to discover it at the last possible moment. Capable systems can move quickly. Their authority should stop where assurance runs out.

About the Author

René Bohnsack is Full Professor of Strategy and Innovation at Católica-Lisbon School of Business & Economics and author of The AI Strategy Playbook: From Zero to 100. He is founder of ZeroTo100 and co-founder of AUGMTD, where his work focuses on AI strategy, adoption and governed enterprise AI.