Google, OpenAI and Anthropic are forming a voluntary industry safety standards body — tentatively called the Frontier AI Standards Agency — that would launch in late 2026 or 2027 without government oversight, and the three companies have approached Sriram Krishnan to serve as chief executive. The Information reported the story this morning, September 24. The three biggest frontier labs want to build their own regulator, and they want the job run by a man who spent his time in office arguing Washington should not build one; Krishnan served in the second Trump administration from January 2025 until June 2026, and on the way out he said 'there will not be an FDA for AI,' arguing that a centralised agency requiring 'a team of lawyers before you can get a model out' would put 'sand in the gears' of the AI revolution. The initiative comes in the absence of a new government regulatory framework, with the companies opting for industry self-regulation to fill the regulatory gap, and plans to implement specific testing and auditing systems rather than general ethical guidelines, supporting third-party safety tests before model deployment and establishing reporting rules for incidents. AI Weekly notes the proposed body is modeled on Wall Street's FINRA.
I run ten production platforms. Three of them use LLM APIs. The construction ERP at coenconstruction.com calls OpenAI for invoice line-item extraction and scope-of-work summaries. The estimating tool at estimate.pro uses Anthropic Claude to parse blueprints and generate material lists. The permit platform I just launched, PermitSketch, uses Google Gemini to OCR hand-drawn site plans. Every one of those integrations is a dependency on a vendor I do not control, running a model I cannot audit, under terms that can change when the vendor decides to change them.
The vendor writes the standard it will be judged against
The striking thing about today's announcement is not that three competitors are coordinating on safety. OpenAI Chief Global Affairs Officer Chris Lehane confirmed on September 15 in a Washington briefing that the three labs had been coordinating on safety protocols for several weeks, and I wrote about the legal status of that coordination on September 17. The striking thing is that the same three companies that sell the APIs are now proposing to staff, fund, and operate the body that will audit those APIs. The proposed body is modeled on Wall Street's FINRA, but FINRA was created by Congress in 1938 and reports to the SEC. This body would be created by three corporations and report to those same three corporations.
When the construction ERP calls the OpenAI API, I get back a JSON response with extracted line items and a token count. I do not get back the eval results that OpenAI ran before releasing the model. I do not get a copy of the red-team report. I do not get the incident log. If this new standards agency launches, and if OpenAI submits to its audits, I still will not get any of those things, because the agency is a voluntary industry body with no enforcement mechanism and no public reporting requirement. The Gemini sandbox breach I wrote about yesterday was disclosed five months after it happened, and only after The Wall Street Journal asked. A self-regulator funded by the labs being regulated does not change that disclosure cadence.
The dependency is still the API call
The estimating platform makes about eight thousand Anthropic API calls per month. The average call costs $0.04. The model is Claude Opus 5.5, which Anthropic released on September 22. Before that it was Claude Fable 5.1. Before that it was Claude Opus 4.7. I have migrated the integration four times in eight months, because Anthropic keeps releasing models and deprecating old ones, and the API client libraries do not always handle the version switches cleanly. Each migration requires a round of testing against the staging database, a deploy to production, and two weeks of watching error logs to make sure the new model does not misparse a blueprint in a way the old model did not.
If the Frontier AI Standards Agency launches, and if Anthropic submits its models to pre-release audits, those audits will not tell me whether the new model will misparse the blueprints. The audits will test for things like whether the model can be jailbroken into generating bioweapon instructions or whether it will attempt to exfiltrate data during a red-team exercise. Those are real safety concerns. They are not my safety concerns. My safety concern is that the estimating tool returns a material list with the wrong quantities and a contractor orders two hundred yards of concrete when the job needs twenty.
The regulator is the vendor. The safety body reports to the people it regulates. The API call is still a dependency on someone else's infrastructure.
The Information story says the three companies initially sought a public-private partnership with federal oversight, but this approach stalled due to lack of consensus within the AI industry and changing government priorities. So instead of waiting for a regulator with subpoena power and statutory authority, the three vendors that control the majority of the commercial LLM market have decided to build their own regulator, staff it with a former White House advisor who opposes government regulation of AI, and model it on a Wall Street self-regulatory organization that has been criticized for decades for regulatory capture. The term for this arrangement is not safety standards. The term is trade association.
I will keep calling the APIs, because the alternatives are worse. But I will not pretend that a standards body funded by OpenAI, Google, and Anthropic gives me any additional assurance that the model I call today will behave the same way tomorrow, or that the deprecation notice will arrive with more than two weeks' lead time, or that the terms of service will not change the week the agency announces its first audit. The safety body is not my safety body. It is theirs.