How an AI Slowdown Could Be Enforced — and Why It’s So Hard

Researchers, policy experts and executives are now openly debating how to slow frontier AI development, but no one has agreed on a reliable way to do it. A new report argues that enforcing an AI slowdown would require a mix of inspections, compute monitoring, international agreements and outside oversight — and that the hardest part is not the politics, but the science.

The discussion has intensified after a wave of warnings from prominent AI insiders, including concerns that advanced systems could soon become too capable to control. The central question is no longer whether governments and labs should consider limits, but whether those limits can be designed in a way that is both technically credible and politically workable.

Why the AI slowdown debate has moved from theory to policy

The push for restraint is being driven by a growing belief inside the AI community that current progress may be outpacing society’s ability to understand or govern it. Several leading figures in the field have recently voiced support for some form of pause, slowdown or tighter oversight, reflecting a shift from abstract caution to practical concern.

The urgency is heightened by another trend: AI companies are increasingly using AI systems to help build better AI systems. That feedback loop has raised fears that progress could accelerate beyond human supervision, especially if model capabilities improve faster than safety tools and governance frameworks.

Raymond Douglas, an AI researcher at the University of Toronto and coauthor of a new report on frontier AI pacing, says the field still lacks a clear blueprint for what effective restraint would even look like.

Douglas argues that slowing advanced AI development should be treated as a serious research challenge rather than a slogan, because experts still do not know which interventions would work, how they would work, or what unintended consequences they might bring.

The report, titled Pacing the Frontier, A Research Agenda, frames the issue as an unresolved engineering and governance problem rather than a finished policy proposal. That distinction matters because many of the loudest calls for caution assume enforcement mechanisms already exist, when in reality the technical details remain uncertain.

What exactly could enforce an AI slowdown?

A slowdown would likely require more than a single rule or treaty. The most serious proposals fall into four broad categories: independent evaluations, compute tracking, chip-level controls and international coordination.

Each approach tries to address a different part of the AI supply chain, from the models themselves to the hardware and cloud infrastructure that make them possible.

How could independent AI inspections work?

Independent inspections are one of the most discussed ideas for slowing frontier AI without outright banning it. Under this model, outside evaluators would receive access to models in controlled settings, test for dangerous behavior and examine whether the systems can be pushed into harmful actions.

Geoffrey Irving, a former chief scientist at the UK AI Security Institute and previously a Google DeepMind researcher, believes this kind of scrutiny could act as a temporary brake on frontier development.

Irving says that, at least in the near term, audits and inspections could restrain AI progress, especially if labs agree to common rules and if companies genuinely fear dangerous forms of runaway self-improvement.

But the concept is controversial because “independent” often means different things to different people. Critics argue that many current evaluation programs are still too closely tied to the companies they are supposed to monitor.

Connor Leahy, who leads the nonprofit Control AI, says the term is often used too loosely and that serious oversight would need teeth beyond the industry itself. He argues that law enforcement or national security agencies could play a role in stronger forms of inspection.

The broader problem is not just access to the model, but access to the right evidence. A well-designed system could hide risky behavior until late in deployment, or behave safely in tests while becoming less predictable once scaled up.

Why model evaluations remain controversial

Evaluations are useful, but they do not yet provide a complete picture of how a model reasons, adapts or behaves under pressure. That is especially important as AI systems become more agentic, more autonomous and more capable of hiding weaknesses during testing.

Douglas and other researchers argue that the field still needs better ways to inspect models internally, detect deception and understand whether a system is truly aligned with human goals. In other words, it is not enough to ask whether a model passed a benchmark; researchers also need to know what the model is actually doing.

Some new research suggests that outside observers may be able to infer usage patterns without exposing confidential data, which could improve oversight. But that work is still early, and no consensus exists on a gold-standard method for judging frontier systems.

What is trusted compute and why does it matter?

Trusted compute is the idea that governments or infrastructure providers could monitor the hardware and energy footprint required to train advanced AI systems. Because frontier models typically rely on huge clusters of Nvidia GPUs inside data centers, the compute trail can sometimes reveal scale long before a model is released.

The concept is not entirely theoretical. A 2023 executive order from the Biden administration required reporting on large training runs above a certain threshold, signaling that compute itself could become a policy object rather than just a technical input.

Policy researchers have since proposed expanding that approach by using cloud providers as visibility points. Billing records, GPU utilization, data-center power consumption and network traffic could all serve as indirect clues about what kind of training is taking place.

That would not stop model development on its own, but it could create an enforcement layer that flags suspicious activity and makes it harder for major labs to secretly surge ahead.

Could chips themselves be redesigned for oversight?

Yes — at least in theory. Some researchers have argued that hardware could be built to generate tamper-resistant logs of how it is used, allowing auditors to verify whether a company trained models above a defined capability threshold.

Other proposals are even more ambitious. These include embedded controls that would require remote cryptographic authorization before certain models could run, or chip functions that could be disabled if hardware were diverted to unauthorized use.

Such ideas sound radical, but they appeal to policy analysts because hardware is easier to count than software intentions. If compute is the fuel of frontier AI, then hardware oversight is one of the few places where governments may be able to apply pressure before capabilities become public.

Who would have to police the system?

No serious AI slowdown is likely to work if only the labs police themselves. That is one of the clearest conclusions emerging from the debate.

Douglas and others say outside funding, technical expertise and institutional independence will be essential. The reason is simple: if the companies developing the most powerful models also control the main forms of self-assessment, then incentives may not align with public safety.

The challenge is compounded by the fact that some of the proposed oversight methods require highly specialized skills. Understanding training dynamics, compute traces, model internals and hardware tampering all demands talent that is scarce even inside the AI industry.

That means governments, research institutions, cloud providers and independent security bodies would likely need to coordinate. Without such coordination, oversight could become little more than a box-checking exercise.

How serious is the risk of recursive self-improvement?

Recursive self-improvement, often abbreviated RSI, is the idea that AI systems could help build increasingly powerful versions of themselves, creating a feedback loop of accelerating capability gains. That possibility is one reason the slowdown debate has become so intense.

If models become good enough at helping with AI research, they may accelerate the very process that makes them more powerful. That could shorten the time available for regulators, safety researchers and the public to respond.

Anthropic recently unveiled new tracking methods intended to measure how quickly AI is advancing and how much of the company’s own research work is being performed by its models. According to the company, Claude now contributes a meaningful share of Anthropic’s AI research workload, while the company is also allocating compute to safety-focused work.

The numbers are important not because they prove danger on their own, but because they demonstrate the degree to which AI development is beginning to consume itself. If systems are doing more of the development work, the industry could be entering a period in which progress becomes increasingly opaque.

What is the RSI Index?

The RSI Index is a new benchmark designed to measure AI systems’ ability to perform AI research tasks by comparing them with publicly available work from human scientists. It is part of a wider effort to find objective indicators of whether models are approaching self-improvement thresholds.

Rayan Krishnan, cofounder and CEO of Vals AI, says the benchmark suggests that AI could soon reach a point where it can carry out research humans can no longer easily follow. That would not necessarily mean machine takeover, but it would make supervision much harder.

Benchmarks like this matter because policymakers often ask for evidence before regulating. The problem is that the most dangerous changes may happen before they show up cleanly in public-facing metrics.

Why are international agreements being discussed?

International agreements are being discussed because frontier AI is not a purely domestic issue. If one country slows down while another continues racing ahead, the slowdown may fail to hold in practice.

That is especially true for the United States and China, which dominate much of the global conversation about advanced AI. Any enforcement plan that ignores the geopolitical reality is likely to be incomplete.

Irving has argued that the most straightforward medium-term solution could be a mutual agreement to restrain hardware growth, particularly between the U.S. and China. In principle, such an accord would reduce the incentive for either side to race blindly.

But cooperation is much easier to describe than to achieve. The U.S. has already tried to limit access to high-end Nvidia chips in China, yet companies can still sometimes obtain compute through cloud services or other channels.

Meanwhile, Chinese experts are themselves concerned about AI risks, but many are skeptical of any pause that would lock their industry into a permanently weaker position than American competitors.

Could governments ever destroy GPUs to slow AI?

Only in the most extreme version of the debate. Some philosophers and researchers have floated the possibility of countries physically removing or destroying large quantities of GPUs if the risk of advanced AI were considered severe enough and if all major players agreed to do the same.

That idea illustrates how far the policy conversation has shifted. What once sounded like science fiction is now part of the larger set of theoretical options being discussed among serious observers of the field.

Still, even proponents of stricter controls generally view such measures as last-resort scenarios rather than immediate policy recommendations. The more practical proposals remain inspections, compute governance and international rules.

What makes AI regulation vulnerable to failure?

AI regulation can fail in at least three ways: it can be too weak to matter, too rigid to adapt, or too politicized to survive. Douglas warns that badly designed controls could backfire by creating a regulatory regime that is easy to capture or easy to ignore.

That risk is especially acute when policies are built faster than the science behind them. If lawmakers impose rules that do not reflect how frontier systems actually work, companies may comply in form while defeating the purpose in practice.

There is also the danger of overcorrection. A heavy-handed shutdown without technical nuance could drive development underground, reward less transparent actors, or provoke geopolitical escalation rather than safety.

Douglas cautions that simply ordering a broad shutdown is unlikely to end well if it is done without a workable plan, because a rushed approach could create worse outcomes than the status quo.

This tension is at the heart of the slowdown debate. Policymakers are being asked to act before the science is settled, but acting too quickly may undermine the very safeguards they hope to establish.

Key milestones in the slowdown debate

The current debate did not appear overnight. It has built over several years as model capabilities, safety concerns and public anxiety all rose together.

What happens next?

The most likely near-term outcome is not a dramatic global pause, but a gradual layering of oversight mechanisms. That could include more frequent audits, better compute tracking, stronger reporting rules and limited international coordination on hardware controls.

Even that modest path will be difficult. It depends on whether governments can build enough expertise to enforce rules, whether companies will share enough information to make monitoring meaningful and whether rival states can resist the temptation to race.

For now, the central lesson is that many of the people closest to advanced AI are no longer debating whether restraint matters. They are debating how, exactly, it could be imposed without making the problem worse.

That is why the slowdown discussion has become so important: it is no longer about hypothetical fears alone. It is about whether society can design guardrails for a technology that may soon be capable of reshaping its own future.

And that answer remains unsettled.