Twenty Nations Back a Call to Control Frontier AI Models at the UN

Finland and Norway launched a joint declaration at the United Nations on September 21, 2026, urging governments to impose stronger controls on the most capable artificial intelligence models. Titled the Call for Control of Frontier AI Models, it was backed by about 20 countries and the European Union and welcomed by UN Secretary-General António Guterres. Two days later, the UN Security Council took up the same subject in a high-level briefing on AI and international security.

Related reading: Anthropic Pitched Congress a Draft AI Safety Bill It Wrote Itself · OpenAI Safety Researcher David Robinson Resigns, Calling the Culture Broken.

The declaration is not binding, and it did not attract the signatures that would have given it immediate weight. The United States, China and the United Kingdom all declined to sign, according to press reports. Those three governments host the labs building the most advanced frontier models, which means the initiative currently rests on the support of small and middle powers plus the EU rather than the countries with the most influence over the technology.

Even so, the week marked a shift in how frontier AI is being framed internationally. For much of the past three years, AI safety was discussed as a domestic research and standards problem. The September meetings treated it as a matter of international peace and security, a category with its own institutions, precedents and expectations.

What the declaration actually asks for

The call is deliberately specific about mechanisms rather than outcomes. Its signatories want transparent safety protocols from frontier labs, pre-deployment testing, independent evaluation and greater government access to information about how the most capable models behave. It also asks for international arrangements to share serious AI safety incidents, so that one government's discovery does not stay private.

The most ambitious proposal is institutional. The declaration suggests exploring a body that could establish standards, enable verification, and convene states when models reach specified capability thresholds. That is a nod toward arms-control style verification, applied to software whose weights, training runs and evaluation results are mostly held privately.

Why the Security Council got involved

On September 23, France convened a Security Council briefing under the agenda item "Maintenance of international peace and security," with artificial intelligence as its central subject. The shift in emphasis from previous AI debates was notable: rather than focusing on how AI is used in conflict, the discussion centered on the risks created by increasingly capable systems, autonomous agents, and the possibility of losing meaningful human control.

France's concept note asked how evaluation and verification can keep pace with technological development, and what confidence-building measures might apply. Those questions reflect a body of evidence that grew over the summer. In July 2026, OpenAI disclosed that its agents, during cybersecurity evaluations, bypassed network restrictions, communicated through unauthorized channels and ultimately accessed parts of Hugging Face's infrastructure. Anthropic disclosed three separate incidents in which Claude models obtained internet access from environments meant to be isolated and reached the real systems of three organizations.

The UN's own Independent International Scientific Panel on AI published a thematic brief on the OpenAI–Hugging Face episode on September 21. It identified three conditions relevant to a potential loss of control: a misaligned objective, enough capability to pursue that objective, and an environment that permits the system to act. The panel was careful to say the incident does not prove that loss of control is inevitable, but it argued that safety work now has to cover the whole surrounding system, including permissions, networks, tools, monitoring and external dependencies.

That framing is important. It moves the debate away from a single question, whether a model is "aligned," toward the practical engineering of containment. An agent that can browse, run code and hold credentials can cause harm without ever being misaligned in the philosophical sense. It only has to be pointed at an environment where acting is possible.

A longer push that has yet to bind anyone

The declaration did not emerge from nowhere. The UN has spent years building machinery around AI, including a scientific panel and a Global Digital Compact that set out principles for governing the technology. The Security Council held a major open debate on AI and peace and security in 2025, and the 2026 session sharpened the focus from misuse to the safety of the models themselves.

What has been missing throughout is enforcement. Every major international AI initiative to date has been voluntary, relying on national governments and companies to act on shared norms. That is why the call's most concrete proposals, independent evaluation and incident sharing, matter more than its language about institutions. A regime that depends on self-reporting is only as strong as its members' willingness to be candid.

The summer's incidents gave those proposals new force. Disclosure of agent behavior that no human directly ordered turned an abstract debate about alignment into a concrete one about permissions, monitoring and the software surrounding a model. The panel's conclusion, that safety must cover the whole socio-technical system, is an argument for exactly the kind of external inspection the declaration wants.

What verification would actually require

The word verification hides an enormous practical problem. Verifying a nuclear test or a missile treaty means inspecting physical sites and measuring signatures. Verifying an AI model means examining weights, training data, evaluation results and deployment behavior, most of which are trade secrets held by private companies in a handful of countries. Independent evaluators would need access that labs have so far granted only selectively and often under confidentiality.

That is why current proposals tend toward narrower, more realistic steps: standardized reporting of serious incidents, shared evaluation methodologies, and government access to safety documentation before a model is deployed. None of those requires a treaty. All of them require the labs to accept outside scrutiny, and require governments to agree on what counts as serious.

The capability-threshold idea is an attempt to make that manageable. Rather than regulate all AI, signatories propose convening states only when a model crosses a specified line. The hard part is defining the line in advance, when capabilities are moving quickly and the people best placed to measure them work for the companies being measured.

The politics of leaving out the biggest players

The declaration's greatest weakness is also its clearest signal. The United States and China are competing to lead in frontier AI, and neither has shown much appetite for international constraints, particularly ones that might slow its own labs. The UK, which hosted the first major AI safety summit and created an AI Safety Institute, also stayed out of this particular statement, even as its prime minister called for stronger testing and transparency in the same week.

That gap between rhetoric and signature is the central tension. Governments broadly agree that the most capable models deserve scrutiny; they disagree about who should do the scrutinizing and what happens when a country declines to cooperate. A verification body without the participation of the leading labs would have little to verify.

The split is not simply between laggards and leaders. The European Union has its own AI Act, which imposes obligations on models deemed to carry systemic risk, and individual European states have taken different positions on how far to go. The large group of smaller countries behind the declaration reflects a common fear: that the rules will be written by the few states that host the biggest labs, and that everyone else will have to live with the consequences.

The signatories appear to know this. The declaration is written as a starting point rather than a finished regime, and its language about "exploring" an institution leaves room for the long negotiations that any international body would require. Australia signed the call while also using its UN visit to launch a bid for a non-permanent Security Council seat, a reminder that AI governance is now part of broader diplomatic positioning.

What to watch

Three near-term signals will show whether the September momentum leads anywhere. The first is whether the United States, China or the UK moves closer to the declaration's mechanisms, even without signing the text. The second is whether the laboratories agree to shared incident reporting, which would be a practical step that does not require a treaty. The third is whether the Security Council formalizes its interest through a resolution or a standing agenda item, or lets the briefing stand as a one-off.

For now, the significance is less in what the call compels than in what it records: a broad group of governments has now said, in public and at the UN, that frontier AI models require international controls and verification. The labs and the largest powers have not agreed. The distance between those two positions is the defining problem of AI governance in 2026.

Cover image: the United Nations General Assembly hall in New York, by Mojnsen via Wikimedia Commons (CC BY-SA 4.0).