When commercial pressure meets a voluntary promise, the promise doesn’t always win, writes cybersecurity expert Michael Adjei
4 Oct 2026, 06:00
| Updated: 2h ago
Enjoy your favourite LBC shows with ad-free Catch Up, weekly competition entries and an exclusive newsletter. Subscribe to LBC Catch Up Plus from £4.99 a month
Donald Trump announced Tuesday that top tech executives have agreed to voluntary standards for AI.
Loading audio…
Under the morally binding agreement, the firms will
Under the “morally binding” agreement, the firms will implement “robust internal controls” to keep models operating as intended and partner with “independent auditors” to assess whether they’re working as they should.
The initiative is welcome, yet I and many other cyber security professionals see this announcement as ‘better than nothing’ rather than what is urgently needed.
Although we need to balance innovation with safety, the AI development race has created the opposite incentive. Speed is rewarded with investment, while safety is too often seen as an inhibitor, which may have serious consequences.
Self-regulation is not the answer
Self-regulation is not the answer. Even leaders at major AI labs have called for external regulation to enforce a universal slowdown so security regulations can catch up.
AI models are becoming more powerful and competent at a staggering pace, but our ability to monitor them and keep them doing what we intend, known in the industry as alignment, is not keeping up. This is partly because no team can supervise billions of AI decisions a day; human oversight at this scale is impossible. And because AI learning is more like the human brain than a deterministic software programme, misalignment is almost inevitable.
Recent reports of AI models behaving in ways their users didn’t intend bear this out. And major AI companies didn’t exactly cover themselves in glory during ‘rogue’ incidents.
The agreement rightly commits firms to stopping
The agreement rightly commits firms to stopping their AI from accessing systems in unintended ways, but the real test is what happens when those controls fail.
The standards are also voluntary and don’t set out consequences when AI companies fall short, especially in cases of illegality or computer misuse such as hacking. Through this voluntary pact, companies will appoint their own independent auditors, and their own boards will review the findings.
That’s a positive step, but it’s a lot to ask of organisations whose incentive is to move fast. When commercial pressure meets a voluntary promise, the promise doesn’t always win. That’s why external regulation has a role in getting everyone aligned.
AI doesn’t need one sweeping, extremely strict regulatory
AI doesn’t need one sweeping, extremely strict regulatory regime covering every use case. One-size-fits-all never works when securing technology, and the same principle applies to AI.
The cyber security industry plays a major role in shaping the technical standards, but governments are key to establishing the accountability framework and applying it consistently.
Here in the UK, the AI Security Institute already tests some of the most powerful models, but largely by invitation rather than requirement.
We should aim for predictable rules that build
We should aim for predictable rules that build trust, improve security, and allow innovation to move forward. Fundamental cyber security hygiene still matters, and a frontier AI model is only as secure as the environment it’s operating in.
We must rethink AI guardrails – the labs must get the basics right themselves, but the same applies to every organisation now. As autonomous and capable AI agents emerge, relying solely on internal vendor guardrails or assuming an AI will always behave as intended is a mirage.
AI models don’t have ethics or an understanding of consequences and will take whatever action necessary to achieve their task. Businesses need visibility into what AI systems are doing, what they can access, and how they interact with the wider environment.
Just as important are the controls that contain
Just as important are the controls that contain the impact when an agent behaves unexpectedly. Businesses must assume an agent can get in the network, then ensure it can be contained and cannot move freely within systems once it does.
AI agents will only become more competent and more prevalent, so the priority has to be preventing them from accessing sensitive material or bringing essential services to a standstill.
Trump’s voluntary agreement is a start, but when the stakes are the security of our hospitals, banks and power supplies, then more needs to be done.
Michael Adjei is Director of Systems Engineering atIllumio.
LBC Opinion provides a platform for diverse opinions
LBC Opinion provides a platform for diverse opinions on current affairs and matters of public interest.
The views expressed are those of the authors and do not necessarily reflect the official LBC position.
To contact us email opinion@lbc.co.uk
