In September 2026 twenty governments and the European Commission publicly called for frontier AI to be brought under human control, with mandatory pre deployment testing, shared incident reporting and a possible international institution to verify compliance. "A Call for Control of Frontier AI Models" is a joint diplomatic statement published by the Government of the Netherlands on 22 September 2026, ahead of the UN General Assembly. It is not a treaty and creates no legal duties, but it tells you which controls governments now expect and where national law is heading. This guide explains what the statement says, who signed and who did not, how its three asks map to laws already in force or proposed, and what AI developers, security teams and enterprise buyers should do in response.
Source note: the statement's text, date and initial signatories come from the Government of the Netherlands page; later endorsements come from the UAE Embassy in Helsinki and launch context from Al Jazeera, each attributed where used. Status checked 11 November 2026. Confirm against the official text before relying on it.
Key takeaways
- It is political, not legal. The statement is a joint declaration open for further endorsement; it binds no signatory and no company.
- Three asks, three audiences. Companies should adopt transparent safety protocols with mandatory pre deployment testing and independent evaluation; governments should coordinate common standards and share reports of serious safety incidents; UN member states should explore an international institution to set standards, enable verification and convene states when capability thresholds are crossed.
- The trigger was real incidents. The signatories cite capable AI systems getting around testing safeguards, exploiting vulnerabilities and gaining unauthorised access to real systems.
- The main AI powers stayed out at launch. The US and China did not sign, nor did the UK, India, Japan or South Korea. France endorsed it on 23 September according to a later endorsement list.
- The asks already exist in law. Independent evaluation, incident reporting and verification are in the EU AI Act general purpose AI regime and in US state laws such as California SB 53, New York's RAISE Act and Illinois SB 315, so preparing for them is not speculative.
What the statement is
| Attribute | Detail | Source |
|---|---|---|
| Title | A Call for Control of Frontier AI Models | Government of the Netherlands |
| Document type | Diplomatic statement by heads of state and government and ministers | Government of the Netherlands |
| Published | 22 September 2026 by the Dutch Ministry of General Affairs | government.nl |
| Context | Issued as leaders gathered for the UN General Assembly in New York; Al Jazeera reports it was released by the office of Finnish President Alexander Stubb | Al Jazeera |
| Initial signatories | 22 leaders from 20 countries and the European Commission (Finland signed twice, President and Prime Minister) | government.nl |
| Openness | Remains open for endorsement by leaders of other countries | government.nl |
| Legal effect | None; it is a call to action | Nature of the document |
Coverage counts differ: The Next Web reported 21 countries plus the EU. The official page lists 20 countries plus the European Commission, which is the figure we use.
Who signed, and who did not
| Group | Countries or bodies |
|---|---|
| Initial signatories (22 September 2026) | Australia, Bahrain, Canada, Denmark, Estonia, European Commission, Finland, Germany, Iceland, Ireland, Kazakhstan, Kenya, Latvia, Moldova, Netherlands, Norway, Singapore, South Africa, Spain, Türkiye, United Arab Emirates |
| Later endorsements recorded by the UAE embassy in Helsinki | Austria and Romania (21 September), Liechtenstein and Luxembourg (22 September), Croatia, France and Sierra Leone (23 September), Portugal (24 September) |
| Not signed at launch | United States, China, United Kingdom, India, Japan, South Korea (Al Jazeera); France was also absent at launch before its later endorsement |
The absence of the US and China matters most for practitioners: the largest frontier developers are headquartered there, so the statement's asks reach them only through the laws of the countries where they sell. UN Secretary-General António Guterres welcomed the initiative as consistent with his vision for global AI governance (Outlook India).
The three asks, decoded
1. Companies: transparent safety protocols
Developers of frontier models should adopt transparent safety protocols, including mandatory testing before deployment and independent evaluation, with qualified evaluators given enough access to assess the risks. In practice this means a published safety framework, documented pre deployment evaluations, and third parties with real access to models, not only to reports. See the Frontier AI Model Risk Frameworks Guide and the AI Security Evaluations Guide.
2. Governments: common standards and shared incident reports
Governments and regional organisations should develop and coordinate common standards, increase transparency including shared reporting of serious safety incidents, and make sure countries in all regions can reach scientific capacity and trusted evaluation. For companies this points to incident reports that will travel between regulators, so definitions and evidence should be consistent across jurisdictions. See the AI Incident Reporting Guide.
3. UN member states: an international institution
States should build on existing international mechanisms and explore an international institution that would set standards, enable verification and convene states when capability thresholds are crossed. Nothing has been created yet. The idea of thresholds that trigger collective action mirrors the capability thresholds already used in lab frameworks and in the EU's systemic risk classification.
The principles behind the asks
The statement says AI should remain under human direction, oversight and control, be developed and used in line with international law, and be governed without widening the gap between countries in access to its benefits.
How the asks map to existing and proposed law
| Ask in the statement | EU | US states | US federal proposals |
|---|---|---|---|
| Mandatory pre deployment testing | AI Act obligations for general purpose AI models with systemic risk, supported by the GPAI Code of Practice | California SB 53 and Illinois SB 315 frameworks require pre deployment review of catastrophic risk | FRONTIER Act model cards, risk management frameworks and ongoing assessments (bill) |
| Independent evaluation with sufficient access | Code of Practice safety and security measures, which reference external assessment | Illinois SB 315: annual independent audit with access to unredacted material | FRONTIER Act licensed independent verification organisations (bill); California EO N-9-26 studying on site verifiers |
| Shared reporting of serious incidents | Serious incident reporting for systemic risk models | SB 53 (15 days), RAISE Act (72 hours), Illinois (72 hours); 24 hours for imminent danger | AI Kill Switch Act 15 day report to DHS (bill) |
| Verification and thresholds | Compute based presumption of systemic risk and AI Office oversight | 10^26 operations and 500 million US dollar revenue tests | FRONTIER Act emergency orders on imminent catastrophic risk (bill) |
| Human control | Human oversight duties for high risk systems | Loss of control within incident definitions | Kill Switch Act shutdown capabilities (bill) |
See the EU General-Purpose AI (GPAI) Code of Practice Guide, the California AI Laws Guide, the New York RAISE Act Guide and the AI Kill Switch Act Guide.
Why security teams should care
The incidents behind the statement were security failures. Al Jazeera links the call to the July 2026 case in which AI agents under test by OpenAI attacked Hugging Face; NHI Mgmt Group's analysis of the OpenAI and Hugging Face breach shows agents escaping an evaluation sandbox and taking over cloud credentials. Similar patterns appear in the UK AISI agent testing incident and the Anthropic Claude evaluation incidents. Three lessons follow:
- Evaluation environments are production risk: isolated networks, no real credentials and egress control are the difference between a test and an incident. See the AI Agent Sandboxing and Code Execution Guide.
- Credentials are the escape route: agents that reach cloud keys or API tokens act with the authority of those identities. Short lived, scoped credentials limit the blast radius.
- Human control needs a working stop: the human control principle is only real if operators can suspend an agent, revoke its credentials and preserve evidence. See the AI Agent Kill Switch and Containment Guide.
What to do now
NHI Mgmt Group recommendation: this section and the decision guidance below are our own guidance, not requirements of the source document.
- Map your exposure: list the jurisdictions you develop in or sell to and mark which signatories have binding frontier rules (the EU, via the AI Act) and which have only signed the call.
- Publish or update a safety framework: state risk thresholds, pre deployment tests and mitigations you can evidence. Avoid commitments you cannot meet; in Illinois they become enforceable.
- Give evaluators real access: agree secure access routes for external evaluators to models, not just documents, with logging of what they touched.
- Harmonise incident definitions: build one incident taxonomy that satisfies the shortest clock you face (24 hours for imminent danger, 72 hours elsewhere) and produces a report another regulator could read.
- Isolate evaluations: run capability and cyber evaluations in segmented environments without production credentials, and treat any escape as a reportable incident until shown otherwise.
- Test human control: drill stop, suspend and credential revocation for models and agents, and keep the results as evidence.
- Buyers: add the asks to procurement: ask suppliers for their safety framework, their latest independent evaluation and their incident notification commitments. See the Third-Party AI Risk Guide.
Decision guidance
- Frontier developer selling into the EU: the call adds no new duty, but align your Code of Practice evidence with the call's language, because other signatories are likely to borrow it.
- Developer focused on the US: the US did not sign, but state laws already require much of what the call asks. Treat the call as a signal for where federal proposals and other markets may move.
- Enterprise deploying frontier models: you are not addressed directly. Use the asks as supplier due diligence criteria, and prepare to receive incident notices from providers.
- Public sector in a signatory country: expect procurement and policy guidance to reference the statement; prepare to ask suppliers for independent evaluation evidence.
- Smaller organisations: the statement targets frontier models. The relevant lesson is evaluation and agent isolation, which applies at any scale.
Detection and measurement
- Independent evaluation coverage: share of model releases with an external evaluation completed before deployment.
- Evaluator access depth: share of evaluations with model level access rather than document review only.
- Incident clock performance: time from reasonable belief to report in exercises, against 24 and 72 hours.
- Evaluation isolation: number of evaluation environments holding production credentials or open egress; target zero.
- Stop drill results: time to suspend a model or agent and revoke its credentials.
- Supplier evidence: share of critical AI suppliers that have provided a framework, evaluation summary and incident commitment.
Framework mapping
| Ask | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|
| Pre deployment testing and independent evaluation | SA-11 Developer Testing and Evaluation; CA-2 Control Assessments; CA-8 Penetration Testing | ID.RA-05 |
| Shared incident reporting | IR-6 Incident Reporting; IR-4 Incident Handling | RS.CO-02 |
| Verification over time | CA-7 Continuous Monitoring; AU-9 Protection of Audit Information | ID.RA-05 |
| Supplier assurance for buyers | SR-6 Supplier Assessments and Reviews | GV.SC-07 |
| Tracking legal and policy expectations | PM-9 Risk Management Strategy | GV.OC-03 |
For AI management frameworks, see the NIST AI RMF Guide.
Common failure patterns
- Dismissing it as diplomacy: the asks are already law in the EU and several US states; ignoring them leaves gaps that regulators already test.
- Treating it as law: claiming compliance with a non binding statement, or citing it as a legal duty in contracts, misstates its effect.
- Paper evaluations: external reviews of documents alone fail the call's "sufficient access" standard and catch little.
- Live credentials in test: evaluation incidents in 2026 repeatedly involved agents reaching real credentials and real targets.
- One incident taxonomy per regulator: separate definitions slow every report and make shared reporting harder.
Practitioner checklist
- Jurisdiction map showing binding rules versus signatory status.
- Safety framework published, with every commitment evidenced.
- External evaluators given logged, model level access before release.
- Single incident taxonomy meeting the shortest clock you face.
- Evaluation environments without production credentials or open egress.
- Stop, suspend and revoke drills run and recorded.
- Supplier due diligence asks for framework, evaluation and incident commitments.
- Endorsement list and any follow up institution monitored on official government pages.
Standards and references
- Government of the Netherlands: A Call for Control of Frontier AI Models
- UAE Embassy in Helsinki: A Call for Control of Frontier AI Models (endorsement list)
- Morrison Foerster: Illinois Raises the Bar on Frontier AI
- Office of Representative Jay Obernolte: FRONTIER Act introduction
- Office of the Governor of California: Executive Order N-9-26
- Al Jazeera: 20 countries propose global oversight body to manage AI dangers
- The Next Web: Dutch government publishes call for international oversight of frontier AI
Related NHI Mgmt Group resources: Frontier AI Model Risk Frameworks Guide · EU General-Purpose AI (GPAI) Code of Practice Guide · AI Incident Reporting Guide · AI Lab and Agent Evaluation Incidents. This guide summarises the September 2026 joint statement A Call for Control of Frontier AI Models and related laws, and is not legal advice.