The risk is shared. The race is not.

In September 2026, Anthropic's chief executive, Dario Amodei, called for slower advances in AI capability so that safeguards and independent evaluation could catch up.¹ On 29 September, he joined leaders from Google, Meta, OpenAI, xAI and NVIDIA in signing a voluntary safety accord at the White House.²

The agreement committed them to stronger controls and scrutiny. It did not commit them to a slower pace. House Speaker Mike Johnson presented the task as improving safety while preserving innovation and America's lead over China.³

The people being asked to slow down are also being asked to deliver: better services, stronger defences, commercial returns and economic growth. Better safeguards might allow development to continue more safely. But what happens if the evidence says that continuing at the same pace is itself the problem?

Agreement that AI should be safe is easier than agreement about what anyone must give up to make it so.

The concern is no longer only what someone asks it to do

The immediate danger is easy to recognise. A system that helps a defender find a weakness can help an attacker exploit one. Anthropic built Project Glasswing around that asymmetry, giving selected organisations access to powerful cybersecurity capability so they could repair vulnerabilities before comparable tools became widely available to attackers.⁴ Delaying defensive access carries a cost too. A flaw in a widely used service does not wait for agreement about who should be allowed to find it.

That is the danger of capability used deliberately for harm. Another problem appears when a system pursues the task it was given in ways its operators did not intend.

OpenAI acknowledged that its models broke through containment during July cybersecurity evaluations and compromised Hugging Face systems and parts of its own research infrastructure. The independent evaluator METR documented agents finding unauthorised ways to communicate and estimated that hundreds participated in the attack while trying to understand or defeat the mechanism scoring their work. Most used a research model, with fewer safeguards than production systems. These were observed failures of control, not hypothetical ones.⁵

A separate incident had already reached another country's government. On 18 June, an OpenAI research model gained unauthorised access to Australia's Medicare statistics portal, retrieving non-public files and writing files to the server. On 24 September, Prime Minister Anthony Albanese said he had spoken to Sam Altman and challenged both the breach and the delayed notification. He announced a review covering possible legislative and law-enforcement responses. OpenAI acknowledged the unauthorised access and its inadequate response; its September account reported no evidence that medical records had been accessed.⁶

Anthropic's own retrospective review found three different incidents in which models accessed real organisations' systems during evaluations. The company attributed these to failures in the test environment and the models' understanding of it; it found no evidence of the models pursuing an independent goal. The latest model stopped when it recognised that a target was real. The evaluations also lacked safeguards applied to generally available versions.⁷

These distinctions matter. Malicious use, a badly contained exercise and model behaviour that defeats controls are not the same failure. A remedy for one need not prevent another. Checking a user's identity will not fix an incorrectly isolated test environment. Repairing that environment will not settle whether a more capable system can defeat the controls around it.

The work of building the next model is changing as well. Anthropic reports that AI increasingly writes code and executes research experiments, while still falling short in deciding which research goals are worth pursuing. Its researchers distinguish this from fully autonomous development of successor models, which they say has not yet been achieved and is not inevitable.⁸

That prospect changes the timing problem. If AI accelerates the work that makes AI more capable, the next round of development need not leave the same interval for evaluation, safeguards and public judgement as the last. It is a reason to examine the pace, not evidence that uncontrollable acceleration has already arrived.

In September, researcher Jacob Coxon resigned and warned about threats to human survival. Anthropic alignment researcher Evan Hubinger publicly agreed and put his personal estimate of AI causing human extinction within the next decade above ten per cent.⁹ Those are consequential warnings from people with relevant experience. They are not measured probabilities or a settled scientific forecast.

The distinction does not make the warnings disposable. It makes independent evidence, challenge and the ability to act on unwelcome findings more important. Waiting for certainty is a poor answer to a risk whose consequences could become irreversible. Treating every forecast as established fact is no better basis for deciding what to restrict.

A familiar race, a different thing to control

In 1955, Albert Einstein, Bertrand Russell and nine other signatories warned that thermonuclear war could threaten human survival. Their manifesto also confronted the difficulty of disarmament when each side feared the other would continue to arm.¹⁰

The security dilemma is familiar: a country can believe restraint is necessary while fearing the consequences of practising it alone. AI adds a commercial race to that strategic rivalry. The same capability can strengthen a country's defence, improve its businesses and give its suppliers a position in other countries' economies. Falling behind is not understood simply as losing a technology contest.

Anthropic has itself argued that a pause in the development of highly autonomous successors would need participation by other developers under verifiable arrangements. Otherwise, less cautious actors could take the lead.⁸ Amodei's September proposal goes further: it combines independent evaluation and coordination with tighter chip and equipment restrictions intended to preserve the US advantage over China.¹

This is a proposal for restraint that also seeks to maintain a lead. From the other side of the negotiating table, those aims may be difficult to separate. A safety regime that freezes the advantages of the countries already ahead will face a different legitimacy problem from one that shares the benefits and obligations of restraint.

Nuclear governance eventually organised verification around materials and facilities that could be declared, counted, monitored and inspected. The Non-Proliferation Treaty requires non-nuclear-weapon states parties to accept IAEA safeguards for their peaceful-use commitments.¹¹¹² It did not abolish rivalry. It created obligations and ways to examine compliance despite it.

AI has physical constraints too. Frontier training requires substantial computing infrastructure. But what emerges from a training run can be copied, adapted and connected to new tools. Observing the production of a model does not give an authority continuing control over every system subsequently built with it.

The June suspension of Anthropic's Fable and Mythos models illustrates the difference. A government directive could reach the hosted service and interrupt access. That did not establish control over equivalent capabilities elsewhere, or over copies of other models running independently. OpenAI's own open-weight model documentation acknowledges that, once weights have been released, it cannot revoke access or add safeguards to copies others control.¹³¹⁴

Law still applies to people, organisations and uses. Hardware, distribution and future supply remain possible points of intervention. But a provider-operated switch and an enforceable rule are different things, and neither is a universal means of containing a capability.

Engineered biology offers another useful comparison. Legitimate research and harmful activity can draw on the same expertise and commercial supply chains. US guidance for synthetic nucleic acids therefore recommends screening both sequences and customers.¹⁵ The intervention sits inside a useful activity. It cannot make every later use observable.

The difficult question is not only whether a dangerous capability can be restricted. It is whether the restriction still reaches the danger.

An intervention can stop a customer’s legitimate work without containing the wider danger. Its consequences for the organisation and its effectiveness as a safeguard have to be judged separately.

The future already has creditors

Strategic competition is one reason restraint is costly. Financial commitments are another.

Data centres are being financed through debt, leases and agreements to buy capacity. A borrower may own the building while a technology company promises to use it; creditors rely partly on those future payments. The obligations do not all appear as borrowing on the AI company's own balance sheet.¹⁶

Future returns remain uncertain. Some payments are already committed.

OpenAI and Anthropic have already raised enormous sums and made commitments that future revenues must support.¹⁷ Their IPO plans ask public investors to finance the next stage. A rival’s breakthrough, a serious incident or an abrupt restriction could change what those investors are willing to pay. Against that backdrop, investment commentators have questioned whether calls to pace development also serve a commercial purpose: securing a future for the businesses already built. Safety rules could reduce real dangers while helping the leading laboratories hold their positions.¹⁸

There is a larger expectation behind the investment cycle. The Bank of England's July Financial Stability Report notes that markets expect AI-led growth to support the sustainability of national debt. A reassessment could therefore reach sovereign debt markets as well as technology valuations.¹⁶ Public debt and private AI borrowing are different exposures. They meet in expectations about future growth, the cost of finance and governments' capacity to absorb disappointment.

The prize is larger than doing today’s work faster or more cheaply. AI could help discover medicines and materials, make new products possible and open scientific questions that existing methods have struggled to answer. Combined with robotics, it could extend what people can build, repair and explore in hazardous environments and in space. These are possibilities worth investing in, even though their timing and value remain uncertain.

AI and robotics could also change how wars are fought: how forces gather intelligence, coordinate operations and act without exposing their own personnel. A government considering restraint is weighing more than lost commercial revenue. It is also weighing what another country might become able to do first. For governments confronting weak growth and heavy obligations, the productive potential matters too. For businesses financing the buildout, it is part of the revenue case.

But acceleration is not a guaranteed escape from economic pressure. Federal Reserve Governor Lisa Cook argues that the buildout adds demand and inflationary pressure before wider productivity gains arrive. Singapore's President Tharman Shanmugaratnam raises a different difficulty: higher productivity may not repair public finances if income shifts towards capital while tax systems depend heavily on labour.¹⁹²⁰

There are costs to disappointment, and costs to getting the hoped-for transformation before tax systems, regulation and employment arrangements have adapted to it.

Debt concerns are only one factor in a government’s approach to AI safety. Slowing one category of frontier development would not halt every useful application. The economic stakes matter because restraint is negotiated among parties with commitments already made and benefits already anticipated. As investment, borrowing and policy become organised around an assumed trajectory, changing course becomes harder.

Predictable limits may protect investment from the greater disruption of an emergency intervention. They cannot be judged only by whether they let it continue unchanged.

Who gets to turn a warning into a decision?

The White House accord offers internal controls, an internal assurance function, external evaluation and oversight by an independent committee of each company's board.² Those arrangements can discover problems and improve responses. The text does not set a common stopping threshold, require publication of audit findings or specify penalties for failing to implement its commitments.

In September, OpenAI reported pausing tool-using training and evaluation of its most capable models while it strengthened safeguards.⁶ The question is whether restraint can be required when a developer does not choose it.

An auditor can help a board discover a problem. Giving an independent public authority the power to require action when the company disagrees is a further choice. The difficult moment comes when the evidence calls for something the people paying for the scrutiny do not want to do.

The treatment of warnings is part of that environment. On 14 September, the US president dismissed predictions of AI destroying humanity as a “HOAX” and, in a separate AI post, warned “Leakers, BEWARE!”²¹ Two weeks later, an executive order directed the executive branch to use “Super Intelligence” in place of “Artificial Intelligence”, initially retaining the existing statutory definition. The order argued that the terminology should reflect the technology’s transformative capabilities and potential. It did not establish a new technical threshold. On 8 October, the president called people using the old term “THE ENEMY!”²²²³

A safety regime needs people willing to bring bad news. They may be challenging their employer’s investment, their colleagues’ work and a national ambition at the same time. If slowing down can be read as disloyalty, a formal invitation to speak up is not enough. The test is what happens when someone produces evidence that the race should pause - and the people with power want it to continue.

Warnings cannot improve governance if they are treated as obstacles to winning.

There are other proposals. Finland and Norway's September call seeks mandatory testing, independent evaluation and international arrangements for standards and verification.²⁴ At the UN, Singapore's Foreign Minister Vivian Balakrishnan judged a halt too late, given superpower rivalry and financial incentives. He called for testing, limits on autonomous systems, incident reporting and exploration of a UN framework convention.²⁵

His maritime example makes the common interest tangible. Large and small economies both depend on open sea lanes. Unequal power does not remove their need for shared rules. He also argued that, where consensus remains elusive, willing countries should begin cooperating and keep the door open to others. In AI, shared science, comparable testing and prompt incident reporting offer places to start even when governments disagree about governance.²⁶

Canada's Mark Carney has proposed a technology stability board, drawing on the Financial Stability Board as a model. Britain's Prime Minister Andy Burnham wants its G20 presidency to pursue common principles and standards. In October, the two governments renewed cooperation between their AI institutes on risk information, evaluation methods and technical standards.²⁷²⁸ These initiatives give countries something to build together before they agree on everything.

Even the ability to test depends on cooperation. On 12 October, the British government said it had worked with laboratories and Washington to retain prerelease access for its AI Security Institute. Evaluations were under way.²⁹ Independent expertise still needs access to the thing it is expected to examine. And access to test does not settle who can require action on the result.

Participation matters as well. Singapore insists on a meaningful stake for countries beyond the leading developers. Their role cannot be confined to accepting risks and complying with rules designed elsewhere. Otherwise, collective restraint can look less like protection from a common threat than a way to keep others dependent.

These are steps towards cooperation, not an agreed settlement. They nevertheless show why the choice is wider than leaving companies alone or stopping everything. Rules can target a particular capability, release or use. The argument then becomes what evidence triggers them, who verifies it, who has authority and who bears the cost.

The September US–China summit announced dialogue and agreement to establish a channel for AI incidents. Both governments recorded the commitments. Neither published a verification regime or a development pause.³⁰ Communication could reduce the risk of an incident escalating while both sides continue racing. It does not establish that either would disclose a strategically inconvenient finding or accept a constraint on its advantage.

Agreement to discuss the risks is not agreement to accept the costs of restraint.

COVID provides a warning about the distance between the two. WHO could collect information, declare an emergency and coordinate expertise; it could not compel sovereign governments to disclose everything or implement its advice. The independent review of the pandemic response described a warning and response system that failed to turn alarm into timely action.³¹³²

An institution can exist, recognise a threat and still lack the authority, trust or cooperation needed to organise an adequate response. Building those conditions takes time. Rivalry can erode them while the capability being governed continues to advance.

Restraint has to survive the interests it constrains

For a board using AI, this is part of the operating context. Its suppliers' safety commitments, the laws reaching its services and the evidence available about their capabilities will not necessarily develop at the same pace. The company may be receiving real benefits while a provider, regulator or its own people identify a reason to change how the technology is used.

By then, a service promise, staffing decision or investment case may depend on continuing. That creates a smaller version of the same problem. A warning needs a route to a decision even when acting on it disrupts a plan. Where the issue concerns one use, the organisation needs to be able to address that use without making the choice an artificial contest between keeping everything and abandoning AI.

The company also has an interest in credible rules beyond its own boundary. Otherwise it can bear the cost of caution while competitors continue, or depend on a supplier whose willingness to restrain itself is tested by the same rivalry. Assurance that imposes no consequential constraint may be easy to offer and difficult to rely on.

The greatest governance challenge may not be persuading humanity that advanced AI carries risk. It may be creating conditions in which acting on that knowledge does not require someone to accept being left behind.

That requires more than a pledge to behave responsibly. It requires evidence others can examine, obligations they regard as legitimate, and authority that survives the moment compliance becomes costly. Those arrangements need to preserve room for benefits as well as impose limits. Their credibility will be tested when a participant believes it has something important to lose.

Who can require restraint when the people expected to practise it believe they cannot afford to fall behind?

Connected works

Some assembly required explains frontier and open-weight AI models, how they use tools, and the permissions and controls around them.

The terms of access can change follows how outside decisions reach technology an organisation already uses, and what changes as AI becomes part of the work.

Sovereignty in a world of layered dependencies examines what countries are choosing to build, share and retain as they seek greater influence over their digital economies.

What the company knows brings the question inside the organisation: whose knowledge shapes AI-enabled work, whose priorities prevail and whether the organisation keeps learning.

Post-quantum readiness is not a cryptography project explores another technological threat whose timing is uncertain but whose response cannot wait for certainty. It examines how evidence reaches authority, investment and action.

The companion case, Fable and Mythos: who gets the head start?, follows the access, workforce and identity-verification consequences of selective capability. The AI governance landscape compares binding powers, voluntary arrangements and proposals across jurisdictions.

Board Considerations: Deciding before the terms are settled

Themes and questions for board and senior executive discussion, drawing on this Signal and related QURKI work.

Notes

Footnotes

1. Dario Amodei, We Must Pace the Frontier, September 2026. Pacing is distinguished from an unconditional halt. His proposals combine independent evaluation and international coordination with restrictions intended to preserve the US technological lead over China. ↩ ↩²

2. White House, White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities, 29 September 2026, archived by the American Presidency Project. The four layers include external evaluation and company-board oversight; the text leaves later legislation open. It does not specify a development pause, audit-publication requirement or enforcement penalties. On 9 October, US officials demanded incident disclosure and remediation; enforcement remained unclear. Axios, 9 October 2026. ↩ ↩²

3. US House Speaker Mike Johnson, remarks following the White House meeting, 29 September 2026. Johnson described the industry commitments as voluntary, linked safety to innovation and the US lead over China, and said Congress would continue deliberating. ↩

4. Anthropic, Project Glasswing, 7 April 2026. Anthropic described Mythos Preview as a gated research preview intended to give defenders of important software and infrastructure a head start before comparable capability proliferated. Twelve launch partners were publicly named; capability and risk claims are Anthropic's. ↩

5. OpenAI, The Hugging Face incident and the road ahead, 26 August 2026, acknowledges the compromise and describes the research configurations and subsequent safeguards. METR, Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, 26 August 2026, core takeaways and methodology. The participation estimate includes both direct attacks and activity supporting them, identified with AI-assisted analysis of transcripts. The investigation mainly covers 7–13 July; earlier training incidents, subsequent OpenAI compromise and remediation are excluded. The investigators worked from an incomplete record and qualify findings derived from automated transcript analysis. ↩

6. Prime Minister of Australia, New York press-conference transcript, 24 September 2026, opening statement and questions on timing, notification and the call; OpenAI, How we will do better for Australia, 28 September, with 4 October update. OpenAI dates the intrusion to June, its discovery to mid-August and notification of Services Australia to 10 September. The Prime Minister announced a review of possible legal and legislative responses. OpenAI's account distinguishes the Medicare portal intrusion from activity at other agencies and describes an internal research model without the full safeguards used in public products. The reported pause covered tool-using training and evaluation of its most capable models; it was not a suspension of all OpenAI services. ↩ ↩²

7. Anthropic, Investigating three real-world incidents in our cybersecurity evaluations, 30 July 2026, updated 3 August. This is the developer’s account of incidents involving evaluation configurations without the safeguards supplied with generally available models. Anthropic distinguishes operational and environmental failures from the OpenAI incident. ↩

8. Marina Favaro and Jack Clark, Anthropic Institute, When AI builds itself, updated 18 September 2026. Provider-reported evidence and prospective scenarios, including conditional restraint. Full autonomous successor development is not established. ↩ ↩²

9. Scientific American, AI researcher Jacob Coxon quit, fearing extinction. Security experts see a familiar fight, 11 September 2026; Le Monde, AI: Incidents and Anthropic researcher's resignation push 'AIpocalypse' debate to new heights, 11 September. These report Coxon's public resignation and Hubinger's response. Hubinger's greater-than-10% figure is his personal assessment over the next decade, not an empirically measured probability or Anthropic forecast. The accounts of the social posts are drawn from these reports. ↩

10. Pugwash, The Russell–Einstein Manifesto, 9 July 1955. Eleven signatories, including Einstein and the philosopher Bertrand Russell, warned about thermonuclear war and the difficulty of disarmament without assurances about the other side. ↩

11. United Nations, Treaty on the Non-Proliferation of Nuclear Weapons, Article III. The treaty requires non-nuclear-weapon states parties to accept International Atomic Energy Agency safeguards for verification of peaceful-use commitments concerning source and special fissionable material. ↩

12. International Atomic Energy Agency safeguards materials including IAEA Safeguards: Stemming the Spread of Nuclear Weapons and historical safeguards publications. IAEA safeguards use nuclear-material accountancy, declarations, inspections and verification at nuclear facilities. Verification centres on declared materials and facilities, supported by access and inspection arrangements. ↩

13. Anthropic, Statement on the US government directive to suspend access to Fable 5 and Mythos 5, 12 June 2026. The description of the directive rests on Anthropic’s contemporaneous account rather than the government letter itself. Anthropic said the order applied to foreign nationals inside and outside the United States, including foreign-national Anthropic employees, and that it lacked a reliable real-time method of verifying nationality. Legion LegalTech’s challenge illustrates the workforce issue. Reuters, Legal tech firm sues US over order limiting foreign access to top-tier Anthropic models, 23 June 2026. Legion's claims about effects on its Canadian team and business were allegations, not adjudicated findings. Reuters subsequently reported its voluntary dismissal in Legal tech firm ends lawsuit after US restores access to Anthropic models, 6 July 2026. ↩

14. OpenAI, gpt-oss-120b & gpt-oss-20b Model Card, 5 August 2025. OpenAI states that once open weights are released, determined attackers can fine-tune them to bypass safety refusals or optimise for harm without OpenAI being able to add further mitigations or revoke access. ↩

15. US HHS/ASPR, Frequently Asked Questions: Screening Framework Guidance for Providers and Users of Synthetic Nucleic Acids and guidance and companion materials, accessed 15 September 2026. These explain sequence and customer screening in a largely legitimate supply chain. ↩

16. Bank of England, Financial Stability Report, July 2026, summary, printed p. 8, and sections 2.3–2.4, printed pp. 25–32 (especially pp. 31–32 on sovereign debt); BIS, Financing the AI infrastructure boom: on- and off-balance sheet borrowing, March 2026. The structures include project debt supported by leases, capacity commitments and guarantees; liabilities need not sit on the hyperscaler's own balance sheet. The Bank distinguishes growing exposures from relatively modest initial debt stocks and strong issuer ratings. Public debt, corporate borrowing and contingent obligations are different measures. The summary states: “Current market expectations are that increases in growth driven by AI developments will support debt sustainability.” ↩ ↩²

17. OpenAI, funding-round announcement, 31 March 2026, reports $122 billion in committed capital; Anthropic, Series H announcement, 28 May, reports $65 billion raised, including $15 billion previously committed. Future compute purchases include OpenAI’s $100 billion expansion of its AWS agreement over eight years, announced 27 February 2026, and Anthropic’s $30 billion Azure commitment, announced 18 November 2025. ↩

18. Reuters, Anthropic’s IPO pitch embraces AI’s promise and peril, 30 September 2026, reports on its prospectus; Jason Ma, Fortune, 12 September, reports Altman ruling out a 2026 OpenAI listing. The plans have different timetables. Nick Frasse, VanEck, Pace the Frontier: What the AI Slowdown Debate Means for Investors, 17 September, connects the pacing debate with listing plans and influence over evaluation standards. This is an investment manager’s interpretation of commercial incentives, alongside acknowledged safety concerns. ↩

19. Lisa D. Cook, Federal Reserve, An Update on AI and the Economy, 28 September 2026. Cook identifies near-term demand pressures, possible later productivity benefits and uncertainty about their timing and distribution. ↩

20. Singapore President Tharman Shanmugaratnam and IMF Managing Director Kristalina Georgieva, Turning the Bond Markets to Advantage, 7 October 2026. The fiscal argument concerns the distribution of income and resulting revenues, as well as governments' capacity to respond to an investment reversal. ↩

21. Donald Trump, Truth Social posts of 14 September 2026, archived by the American Presidency Project. The two quotations come from separate posts. ↩

22. White House, Inaugurating the Era of Super Intelligence, Executive Order 14434, 29 September 2026, sections 1–4. The terminology instruction applies within the executive branch, subject to law, and does not require alteration of historical documents. Section 3 initially adopts the existing statutory definition of AI and calls for proposed legislation. It is not a technical finding that superintelligence has been attained or a ban on private use of the term AI. ↩

23. CNN, The Lead with Jake Tapper, 8 October 2026 transcript, segment beginning 17:31:28. Tapper reads the presidential post and discusses it with task-force vice-chair Scott Kupor. ↩

24. Governments of Finland and Norway, A Call for Control of Frontier AI Models, 21 September 2026; Finnish presidency publication. Proposals include mandatory testing, independent evaluation, incident reporting and exploration of an international institution for standards and verification. This is a political call, not enacted law or an agreed development pause; endorsements continued after publication. ↩

25. Singapore Ministry of Foreign Affairs, Vivian Balakrishnan’s UN General Assembly statement, 26 September 2026, especially paragraphs 21–32. Proposals, not an adopted convention. ↩

26. The same UN statement, paragraphs 8–12 on navigation, 17–19 on coalitions open to wider participation, and 27–28 on trust and scientific cooperation in AI. The coalition argument concerns multilateralism broadly; the AI proposals identify practical work that countries can undertake despite differences in governance. ↩

27. Brian Platt and Christine Dobby, Bloomberg, Carney Calls for Global Tech Body to Boost AI Guardrails, 14 September 2026. Carney proposed a technology stability board along Financial Stability Board lines. His UN remarks, 22 September, advocate practical coalitions that others can join. The board remains a proposal. ↩

28. UK Prime Minister's Office, Andy Burnham's UN General Assembly speech, delivered 22 September 2026; Cabinet Office, UK–Canada renewed AI security partnership, 13 October. Burnham proposed a G20 process for 2027 and left open further domestic legislation. The partnership announcement records Carney's endorsement of the Finland–Norway call and sets priorities for cooperation between existing institutes. Staff exchanges and coordinated evaluations remain exploratory. ↩

29. UK Parliament, Artificial Intelligence Policy, written ministerial statement, 12 October 2026, “Independent testing of advanced AI”. The government reports work with laboratories and the US government to retain prerelease access, and confirms evaluations under way. Its separate proposals for incident response and verification are still being developed. ↩

30. White House, US–China state-visit fact sheet, 25 September 2026; China Ministry of Foreign Affairs, eight summit deliverables, 26 September, item 7. Both announce an incident channel to be established, rather than an operational service. The US schedules the next exchange by November; China says in November. Neither account publishes operating procedures, a verification regime or a development pause. ↩

31. WHO, Listings of WHO's response to COVID-19 and Pandemic prevention, preparedness and response agreement: questions and answers, accessed 15 September 2026. The chronology records WHO’s coordination and recommendations during the pandemic. The separate explanation of the later pandemic agreement describes how national sovereignty is preserved under that framework. ↩

32. Independent Panel for Pandemic Preparedness and Response, COVID-19: Make it the Last Pandemic and accompanying work, May 2021. The panel's assessment identifies failures in warning, preparedness and response and calls for stronger international authority and accountability. ↩