Why compute attracts policy attention
Model weights and algorithms can be copied. Advanced chips, high-bandwidth networking, data-center power, and fabrication capacity are physical and concentrated enough to observe more readily. Compute governance uses those inputs as imperfect proxies for the capacity to train or serve powerful systems.
The inference has limits. Capability depends on data, algorithms, post-training, tools, inference-time compute, and operational skill—not training compute alone. Efficiency improvements can produce more capability from the same hardware. A compute threshold is therefore an administrable trigger, not a scientific definition of AGI or danger.
Separate three policy tools
Export controls restrict specified items, software, or services to destinations or end users. Domestic reporting requires covered firms to notify authorities about activities such as large training runs or infrastructure. Cloud customer due diligence attempts to identify who rents compute and prevent prohibited access. They have different legal bases, jurisdictions, and error modes.
U.S. controls on advanced computing and semiconductor manufacturing have changed repeatedly since 2022. The authoritative source is the Commerce Department’s Bureau of Industry and Security, including current regulations and country/end-user rules—not a static summary (BIS advanced-computing controls). A rule’s announcement demonstrates legal intent; enforcement data and supply-chain evidence are needed to assess effect.
The United States no longer has the 2023 Executive Order 14110 reporting framework as originally designed. President Trump revoked that order in January 2025 and directed agencies to review actions taken under it (White House, January 23, 2025). Describing its training-run reports or cloud KYC proposals as current binding federal law would be inaccurate unless a separate statute or live rule supplies the duty.
The European Union model
The EU AI Act uses compute within a broader general-purpose AI regime. Commission guidance says a model trained above an indicative 10^23 floating-point-operations criterion will generally be treated as a general-purpose AI model when it has the required generality, subject to case-specific exceptions. The Act presumes a general-purpose model has systemic risk at training compute above 10^25 FLOP, while allowing designation based on equivalent capability or impact (European Commission GPAI guidance, 2025).
Those numbers serve different purposes and should not be conflated. General-purpose-model obligations began applying August 2, 2025; Commission enforcement powers began August 2, 2026; models already on the EU market before the 2025 date have a later compliance transition. Covered providers must supply documentation and training-content summaries, while systemic-risk providers face additional evaluation, incident, risk-mitigation, and cybersecurity duties. Jurisdiction attaches to placing a model on the EU market, including some non-EU providers.
What compute monitoring can achieve
Compute signals can identify a manageable set of unusually large projects for regulatory attention. Advance notification can give evaluators time to plan tests. Supply-chain controls can slow acquisition by prohibited military or intelligence end users. Data-center reporting can help governments understand energy and infrastructure demands.
Monitoring can also support incident investigation: hardware inventories, cluster configuration, and access logs help establish who had capacity and when. It is most useful when paired with capability evaluations, security controls, and governance of deployment.
No one should infer that a run below a threshold is safe. Distributed training, efficient methods, fine-tuning, inference-time scaling, stolen weights, or a specialized dangerous model may fall outside a simple trigger. Regulators need authority to update thresholds and designate equivalent risk based on evidence.
Evasion and unintended consequences
Controls face smuggling, shell companies, third-country transshipment, remote access, stockpiling, and misclassification. Verification can impose privacy and cybersecurity risks if providers collect excessive identity or workload data. Detailed reporting can reveal trade secrets or create a map for attackers.
Rules can entrench incumbents. A large firm can absorb licensing, legal, and reporting costs that exclude startups and universities. Export controls can fragment supply chains, encourage domestic substitutes, and reduce scientific exchange. Restrictions may also limit beneficial medical or climate research in affected regions.
These costs do not establish that controls fail. They mean evaluation should compare a rule with realistic alternatives and track outcomes: illicit flows, price and availability, domestic substitution, capability delay, compliance burden, research access, and diplomatic effects.
What should be measured
A credible compute-governance program would report:
- which hardware, destinations, and activities are covered;
- license applications, approvals, denials, and processing times;
- enforcement actions and common evasion routes;
- threshold methodology and scheduled review;
- access effects on small firms, academia, and lower-income countries;
- privacy, security, and appeal procedures;
- how compute triggers connect to actual capability evaluations.
Value-free statistics are essential because agencies and firms have incentives. Governments may emphasize control success; affected companies may emphasize cost; chip producers benefit from broad sales; security organizations benefit from authority. Independent analysis should disclose funding and data access.
Better threshold design
Thresholds should be graduated rather than a single cliff. Lower tiers can require recordkeeping; higher tiers can add security, evaluation, incident reporting, and independent review. Rules should aggregate meaningfully related runs so developers cannot divide one project artificially, while excluding ordinary small-scale use.
Capability triggers can complement compute: evidence of strong cyber, biological, autonomous-replication, or AI-research capability may justify safeguards even below a numerical threshold. Because evaluations can be gamed or contaminated, the methodology, assessor independence, and uncertainty should be documented.
International interoperability matters. Incompatible reporting formats increase cost; incompatible thresholds create arbitrage. Common terminology, secure information exchange, and mutual recognition can help without requiring identical national policies.
Compute is a brake, not steering
Compute governance cannot specify socially desirable goals, align a model, prevent every misuse, or distribute economic gains. It can slow or condition certain projects and make them more visible. The benefit may be time for evaluation, technical safety work, diplomacy, and institutional preparation.
That time has value only if used. A restriction that delays a rival while the controlling state accelerates without safeguards is industrial strategy, not shared-risk reduction. Readers should ask whether a policy reduces aggregate danger, changes competitive advantage, or does both.
The balanced conclusion is that physical infrastructure offers one of the more enforceable governance surfaces, but compute is an unstable proxy. Effective policy pairs proportionate, updateable thresholds with capability evidence, due process, security, access safeguards, and public evaluation of results.