Before deployment
Independent standards and evaluation
Frontier and other high-consequence systems need dynamic thresholds, held-out testing, advance review, and certification that is not controlled by the organization being assessed.
An independent international protection framework
From Frontier AI Standards to Enforceable Protection
Demis Hassabis has proposed a serious structure for testing frontier AI. Independent researchers have identified the missing pathway for reporting safeguards that fail after deployment. The next task is to connect these functions to continuing proof that required protections remain operational.
Standards determine what must be proven. Engineering must keep it true in operation.
Independent standards
Proportional assurance
Protected vulnerability reporting
Continuous operational evidence
After deployment
Independent disclosure and repair
Researchers need a protected channel that can grade serious safeguard failures consistently, notify every affected provider, coordinate remediation, and verify the repair.
During operation
Continuing proof of protection
Certification must be supported by current evidence that required guardrails remain installed, healthy, non-bypassed, and actively enforcing their defined boundaries.
The emerging convergence
Two recent proposals define complementary parts of the same protection system
On July 14, 2026, Demis Hassabis proposed a frontier AI standards body that would establish changing capability thresholds, conduct or commission rigorous evaluations, receive frontier models before release, build independent held-out tests, support third-party auditors, address critical post-release vulnerabilities, and coordinate a slowdown if the evidence required it.
On August 3, 2026, Rich Barton-Cooper and Adam Gleave identified the other end of the lifecycle: researchers who discover jailbreaks and safeguard bypasses after deployment often lack a safe, consistent, independent reporting route. They proposed public year-round channels now and, over time, a third-party clearinghouse able to grade severity, notify affected providers, coordinate repairs and disclosure, reward researchers, and publish aggregate evidence.
The shared principle. Organizations should not remain the sole judge of the systems they build, the safeguards they claim, the vulnerabilities reported to them, or the urgency of their own response.
The missing layer
Testing and disclosure are essential—but neither is the guardrail itself
A standards body can decide what evidence is required. An independent clearinghouse can reveal when a safeguard has been defeated. The provider can then repair the affected system. None of these functions, by itself, proves that a deployed AI remains within its permitted authority while it is operating.
Real operating conditions change. Tools, permissions, software, connected systems, users, environments, and other agents may differ from the conditions represented in an evaluation. A system may pass a test and later acquire a new execution pathway. A behavioural safeguard may refuse a harmful request until a jailbreak defeats it.
Pre-release assurance
Test capabilities, failure modes, deception, safeguard bypass, dangerous-domain performance, and the adequacy of the proposed deployment controls.
Operational assurance
Verify throughout deployment that authority, tools, resources, pathways, escalation, continuation, and external effects remain within their approved bounds.
Post-release learning
Receive vulnerabilities safely, classify them independently, coordinate interim containment and remediation, and share transferable lessons across providers.
Reassessment
Reopen certification when capabilities, permissions, integrations, deployment conditions, safeguards, or the potential consequences materially change.
A model institutional framework
The Artificial Intelligence Protection Agency connects the functions without claiming to own them
SafeWave first developed the Artificial Intelligence Protection Agency concept in 2025. It has now been rewritten as a concise Model Charter for Independent International AI Protection—a starting framework for qualified international participants to adopt, test, revise, and expand, not a finished constitution or a claim that SafeWave can establish the institution.
The updated framework incorporates the strongest practical features of the Hassabis proposal and the independent disclosure proposal. It would steward protection standards, support independent assessment and certification, establish proportional proof requirements, recognize protected vulnerability-clearing mechanisms, require continuing operational evidence, and coordinate responses to severe cross-border risk.
AIPA would not be limited to systems called “frontier.” Capability matters, but so do operational authority, tool and resource access, deployment environment, scale, irreversibility, difficulty of recovery, and possible consequences. A model below a frontier threshold may require the highest assurance if it controls a biological laboratory, power grid, weapons pathway, financial infrastructure, robotic system, or other high-consequence environment.
The institutional boundary. AIPA would certify, verify, publish findings, and coordinate. It would not operate a centralized global command system or possess unilateral technical control over the world's AI systems.
Continuous operational evidence
A simple live assurance view could show whether required safeguards are still functioning
For systems above defined risk thresholds, authorized reviewers should not have to rely only on a policy statement, a past test result, or a provider's assurance that protections remain in place. They should be able to examine current, tamper-evident evidence appropriate to the system and the risk.
A live assurance dashboard could show whether required guardrails are present, whether their control state is healthy, whether approved boundaries are being enforced, whether tampering or bypass has been detected, whether a material vulnerability is under remediation, and whether a change has triggered reassessment.
The dashboard is not the safeguard. It is evidence infrastructure. The underlying protection must exist independently and remain effective even if the reporting interface fails. Sensitive technical, personal, proprietary, infrastructure, and national-security information would require controlled access and proportionate disclosure.
The proof principle. Certification should apply only to a defined system, version, authority, environment, and period. When those conditions change, the evidence and certification must change with them.
Technology-neutral compliance
The standard should define the protection—not select the provider
An independent institution should establish outcomes, proof obligations, assurance levels, and minimum properties of effective protection. It should not require one commercial product, patent portfolio, model family, national technology, or engineering provider.
SafeWave has focused specifically on preventive AI systems engineering. Its architecture is one developed candidate for translating authority, execution, escalation, replication, provenance, critical assumptions, containment, and recovery requirements into enforceable control behaviour. The discipline of patent clarification has helped identify hazards, define boundaries, distinguish overlapping functions, and close gaps as precisely as possible.
That work demonstrates that strict operational guardrails can be engineered. It does not establish that SafeWave is the only possible solution. Other organizations should be free to develop different compliant architectures, and every implementation—including SafeWave's—should face the same independent evidence and performance requirements.
A realistic pathway
International independence does not require pretending governments do not exist
AIPA could not operate outside the realities of governments, markets, national security, and geopolitical competition. Its essential strength would be independence from control by any single government, corporation, military alliance, technology provider, or geopolitical bloc.
A practical path could begin with voluntary advance-review and certification pilots; shared development of thresholds and evidence requirements; independent technical staff and secure evaluation capacity; accredited auditors and vulnerability clearinghouses; and recognition by laboratories, governments, insurers, investors, procurement authorities, cloud and compute providers, and critical-infrastructure operators.
Formal consequences would remain distributed. Governments could incorporate standards into law, market access, or procurement. Insurers and investors could make assurance a condition of coverage or financing. Operators could be required to suspend or reduce authority when certification conditions fail. No single institution would hold a global switch.
The invitation. AIPA is offered as a template idea. Its final governance, representation, financing, legal authority, and technical standards should be developed collaboratively by legitimate international participants.
The immediate opportunity
Bring the emerging pieces into one serious international design process
The Hassabis proposal provides a credible starting structure for dynamic frontier evaluation. The Barton-Cooper and Gleave proposal supplies a credible post-deployment disclosure and remediation function. The AIPA Model Charter connects these to proportional assurance, independent certification, continuing operational evidence, cross-domain coordination, and protection from geopolitical or commercial capture.
No one of these proposals is sufficient alone. Together, they define a practical direction that governments, laboratories, open-source communities, standards experts, researchers, engineers, insurers, infrastructure operators, and civil society can examine and improve.
- The cited authors and organizations have not endorsed AIPA, SafeWave, or this brief.
- A model charter does not create legal authority, institutional legitimacy, technical capacity, or international participation.
- A dashboard cannot substitute for independently enforceable safeguards.
- Engineering claims, including SafeWave's, require implementation-specific validation, adversarial testing, and independent review.
Assess a System
The SafeWave questionnaire can be completed privately in the browser using a real, planned, anonymized, public, hypothetical, representative, or composite system. It can help expose unclear authority, missing evidence, unverified critical assumptions, unstable control states, and recovery gaps.
Use it without identifying yourself. Responses remain in your browser unless you deliberately submit them. No name, employer, organization, model, system, deployment, or personal or work email is required. You may complete and save the questionnaire without sending anything to SafeWave. If you request the optional free report, you may use a separate, non-identifying return address; it will not be used for promotion.
SafeWave provides the assessment because improving AI safety is part of our mission—and because, if an organization finds the work valuable, it may later choose to explore implementation or partnership. There is no obligation. Private use, submission, a report request, and any later discussion are separate decisions.
The assessment does not certify safety, determine legal or regulatory compliance, replace domain-specific assurance, or grant organizational, governmental, operational, regulatory, or deployment approval.
Primary public sources
Source basis
- Demis Hassabis, “A Framework for Frontier AI and the Dawning of a New Age” — published July 14, 2026.
- Rich Barton-Cooper and Adam Gleave, “AI Jailbreak Disclosure Is Broken. Here's How to Fix It” — published August 3, 2026.
- Google DeepMind, “Strengthening our Frontier Safety Framework” and Frontier Safety Framework 3.1 — updated April 17, 2026.
SafeWave's AIPA Model Charter v2.1 updates its December 2025 institutional proposal using these public developments as source material. The sources informed the framework; they do not endorse it.