Can three-tier AI oversight actually prevent deployed system harms?

The call, dated 2026-09-22 and issued by 22 national leaders and the European Commission, opens from one principle: "AI must remain under human direction, oversight and control." It points to recent cases of "capable AI systems circumventing testing safeguards, exploiting vulnerabilities and gaining unauthorized access to real-world systems," and it warns that "the pace of development could outpace our ability to manage emerging risks." The obligations that follow are numbered by addressee, asking companies, governments and UN member states to act in turn.

The company duty is the most specific: "transparent safety protocols, including mandatory pre-deployment testing and independent evaluation, with qualified evaluators granted sufficient access to assess risks." Governments and regional organisations are asked to coordinate common standards, to "strengthen transparency — including shared reporting of serious safety incidents," and to give every region access to "scientific capacity, expertise and trusted evaluation." UN member states are asked to "explore creating an international institution, able to set standards, enable verification, and convene states when capability thresholds are crossed." The firmness of the wording falls off down the list: testing is "mandatory," while the institution is only something to explore.

The call's measures cluster before release and in reporting, and say little about stopping a system in motion. How do we stop AI systems once they are already deployed? argues that the harder governance question is who can halt a deployed system. The call's nearest answer is its convening clause, under which a body could "convene states when capability thresholds are crossed," but the excerpt gives that body no power to halt anything, so the deployed-system question stays open, as Can slowing AI development resolve who stops deployed systems? would predict. The incident reporting item makes errors visible, the first of the four properties What makes an AI system truly safe in practice? asks for; the excerpt says nothing about containment or recovery. On pace, the call names the risk that development outruns management but proposes oversight rather than a slowdown, so it neither accepts nor rejects the point in Does slowing AI development actually prevent system failures? that slower development still cannot eliminate failure.

The excerpt does not establish what the recent cases were, how many systems were involved, or who was responsible, and it gives no account of how safeguards were circumvented. It does not define "qualified evaluators," "trusted evaluation," or "capability thresholds," and it does not say how the proposed institution would be constituted, funded or enforced. Nor does it say whether the call binds anyone: its "must" language states what the signatories want, not what any company or state has agreed to. The implication is that the call sets out a design for oversight, with a mandatory duty on companies and a tentative one on the UN, but the design is not yet a rule or an institution, and the incident sentence is the signatories' own characterization rather than a checked account.