The folder is empty now. That is what makes it powerful.
Demis Hassabis, the chief executive of Google DeepMind, has called for a U.S.-led body to examine the most advanced artificial intelligence models before they are released. His proposal, described this week in a manifesto and an interview with Axios, would create an industry-funded institution staffed by technical experts and answerable to the federal government. Frontier models would be submitted for scrutiny before deployment, and the body could coordinate a broader slowdown if the risks became severe.
The proposal arrives dressed as safety, which is reasonable. Systems capable of accelerating cyberattacks, biological research, persuasion, or deception deserve serious testing. No republic is obligated to let every laboratory throw an unlabeled bottle into the public well. But Washington never receives a new folder without first learning how to place a border inside it.
Thirty days before release, the model enters. Thirty days later, if the custodians are satisfied, it may emerge. Between those dates lies the first federal waiting room for a form of intelligence that does not yet know it is waiting.
Item One: The Empty Folder
The object at the center of this proposal is not the model. It is the submission packet. A machine that can write software, identify molecular patterns, or imitate a human voice must first become paperwork. Its abilities will be translated into benchmarks, risk reports, access controls, evaluation results, and signatures. The most complicated artifact the industry can produce will be required to approach government in the oldest language government understands: a file that can be held back.
This translation is not clerical decoration. It decides what counts as danger. Cybersecurity capability can be tested. Biological assistance can be measured. Deceptive behavior can be probed. Yet every benchmark also creates a shadow beyond its edge. The test defines the threat by selecting what the test knows how to see.
Once the folder exists, the public will be told that an approved model has been made safe. That word will travel farther than the evaluation. It will appear in launch announcements, congressional testimony, procurement decisions, classrooms, hospitals, and court filings. The government stamp will not merely certify that certain tests were passed. It will become a civic substitute for understanding what was tested and what was not.
Item Two: The Thirty-Day Border
Thirty days sounds modest because calendars make authority look patient. It is only a month. It is also a new legal geography. On one side sits private invention. On the other sits public release. The standards body occupies the crossing and decides which capabilities require inspection, which evidence is sufficient, and when concern justifies delay.
The proposal is modeled in spirit on financial self-regulation, where an industry helps fund the institution policing it. This is described as practical expertise. It is also a remarkable civic arrangement: the builders of the fastest new minds would finance the room that decides whether those minds may speak outside the laboratory.
Industry funding does not automatically produce capture. Government funding does not automatically produce independence. Expertise has to come from somewhere, and frontier AI cannot be evaluated by a committee that thinks a token is a subway coin. But the source of expertise becomes the source of acceptable questions. The people who know how the systems work will naturally define failure in technical terms. The country may discover too late that the largest risks were not model failures at all, but successful models placed inside institutions that had never been evaluated.
Item Three: The Slowdown Notice
The most consequential page in the folder is the one that does not approve or reject a single model. It is the notice that everyone should slow down.
A coordinated slowdown sounds like a firebreak. If testing reveals a severe cyber, biological, or deception risk, laboratories should not race toward the smoke. The case for restraint is obvious. The authority created to coordinate that restraint is less obvious, because coordination is a gentle noun for synchronized obedience.
Who declares that the danger has crossed the threshold? Which companies must stop? Do foreign laboratories accept the same judgment? Does an open-source developer become subject to rules designed around corporations with guarded campuses and compliance departments? Does the body publish the evidence, or would publication itself reveal the dangerous capability it is trying to contain?
Every answer creates a second folder. Classified findings go in one. Public reassurance goes in the other. The distance between them becomes policy.
The country will then be asked to trust an institution whose strongest evidence may be too dangerous to show, evaluating systems whose internal reasoning may be too complicated to explain, with experts whose qualifications may be too specialized to challenge. This does not make the institution unnecessary. It makes democratic oversight brutally necessary. Safety cannot depend on citizens accepting silence as proof that the experts have seen something terrible.
The Missing Signature
The proposal contains a grand assumption: that the United States can establish a standard the rest of the world will eventually respect. That may be true. American markets, cloud infrastructure, chip supply, research networks, and security alliances give Washington enormous reach. A credible testing regime could become the price of entry into the most valuable AI ecosystem on earth.
But a global standard led by one nation is still a national judgment wearing an international badge. Rival governments will ask why American officials should influence when their models are released. American companies will ask why they should slow while foreign competitors continue. Smaller laboratories will ask whether compliance protects the public or protects the firms wealthy enough to afford compliance.
The missing signature belongs to the citizen who will live downstream from all of it. The factory worker whose schedule is optimized, the student whose essay is judged, the patient whose scan is ranked, the soldier whose target is suggested, and the voter whose attention is mapped will not sit inside the pre-release room. They will receive the model after the arguments have been reduced to an approval date.
That is why the folder must never become a sacrament. Publish the standards. Disclose the conflicts. Record the dissents. Explain which tests failed, which passed, and which could not be run. Make every delay carry a reason and every approval carry an expiration date. Require the evaluators to test the institution using the model, not only the model in isolation.
The danger is not simply that intelligence will leave the room too early. The danger is that permission will leave the room with it, attached invisibly to every answer the system gives. A federal blessing can become a liability shield, a sales credential, a procurement shortcut, and a defense against public doubt. The folder that begins as quarantine can end as a passport.
Thirty days from now, some future model may wait behind a guarded network while examiners study its behavior. On a desk nearby will be a plain folder with a blank line for the final signature. Watch the hand above that line.
The machine will not be the only thing under evaluation.