A credible audit market protects the public, and it protects auditors who do the work properly from being undercut by those who don’t.
On Sept. 29, leaders of Google, OpenAI, Anthropic, Meta, xAI and Nvidia signed the White House Accord on Super Intelligence. Among other commitments, they agreed to bring in an independent outside auditor to check whether their artificial intelligence safety controls work. The commitments are voluntary, but the accord says they could eventually be written into law.
I have spent more than 25 years auditing companies’ security and compliance practices, so I should be cheering. People in my field have urged outside audits of the most powerful AI systems for years. But the accord leaves out the part that gives an audit meaning: rules for the auditor.
The accord doesn’t define who qualifies as independent, how much access an auditor gets, or what standard they measure against. Each company chooses its own auditor. Under those terms, two companies can both announce that they passed an independent audit and mean completely different things. One might have hired a firm with deep technical expertise and full access to its systems. The other might have hired a consultant who also sells it testing services and reviewed a slide deck.
I should be upfront about my stake. My firm audits companies’ security and AI controls, and we would likely compete for this work. That stake is also why I want the rules written first. A credible audit market protects the public, and it protects auditors who do the work properly from being undercut by those who don’t.
We’ve seen what happens without those rules. After the accounting scandals of the early 2000s, Congress created the Public Company Accounting Oversight Board to inspect audit firms and enforce independence rules. Financial audits earn public trust today because someone audits the auditors.
Critics of this approach make a fair point. The science of testing frontier AI models is young, and the methods change with each new model. Rigid rules written now could lock in today’s techniques and slow a field that needs room to experiment. On this view, voluntary commitments give companies that room.
I agree that lawmakers shouldn’t dictate how to test an AI model. Those methods should keep evolving. Rules about who can do the testing are a separate matter, and they hold up over time. An auditor shouldn’t sell other services to the company it reviews. It should have proven expertise in the systems it’s checking. It should get enough access to see whether safeguards work in practice. And someone should check its work. None of those requirements depend on which testing technique is current.
Much of the groundwork already exists. International standards bodies have published requirements for organizations that audit companies’ AI practices, including rules on auditor competence and impartiality. Connecticut passed a law this year creating a state-supervised pilot that will approve up to five outside organizations to verify AI systems against safety standards. I testified before the California Senate on what standards AI auditors should meet. States are already working through these questions, and Washington can learn from them.
Timing matters. Once companies start naming their auditors, the market will settle on its own definition of “independent,” and it will probably be the most convenient one. If Congress later turns the accord into law, it will inherit whatever definition the market chose.
The accord builds a sound structure: company safeguards, an internal check, an outside audit and board oversight. That structure works in finance and cybersecurity because each layer has clear expectations behind it. For AI, the third layer is still empty. Policymakers should decide who is qualified to fill it before they require anyone to use it.
Patrick Sullivan is vice president of strategy and innovation at A-LIGN.
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
