From Artificial Intelligence to Super Intelligence: trust must now be proven

On September 29, the White House released the White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities, an agreement between the administration and leading AI technology companies to self-regulate artificial intelligence. The Accord outlined four layers of controls and audits for companies training and deploying frontier models:

1. Robust internal controls
2. An empowered internal team responsible for monitoring and remediation
3. Independent external evaluation, and
4. Oversight by an independent committee of the board.

The increasing ability of AI to act with authority is a critical shift in the AI landscape. The Accord represents an acknowledgment both by government and industry that trust is essential to the advancement of AI, and that independent evaluators play an important role in reinforcing that trust.

While this week’s announcement is a powerful endorsement of this emerging ecosystem, there’s more work to be done to enable institutions and organizations to innovate quickly with confidence.

Why the Accord is an enterprise and board issue

Governance, cybersecurity, risk management, resilience and assurance have long been foundational to organizational trust. What is new is the speed, interconnectedness, autonomy and reach of the systems to which they now apply.

As AI systems begin to reason, make decisions, take actions and interact with other technologies, organizations need more than principles and policies. They need to be able to see what AI systems are doing, control what they are allowed to do, provide evidence that the controls are working, and gain comfort that the technology is performing as intended.

While the Accord is directed at companies training and deploying frontier models, its architecture raises important questions for every enterprise using these technologies. This is why the Accord is an enterprise issue and, ultimately, a board issue.

Layer one: controls

Trust starts with clear boundaries.

Traditional software governance was largely designed to manage access, functionality and change. Autonomous systems introduce a different challenge: governing behavior. As AI agents gain the ability to access data, invoke tools, execute workflows, and interact with other systems, the critical question shifts from what an AI system knows to what it is allowed to do.

Organizations have long established policies governing what employees, contractors, and third parties are authorized to do. They now need similar clarity regarding what authority has been delegated to autonomous systems. The challenge goes beyond simply defining those boundaries to the ability to observe how that authority is being exercised. This capability, known as observability, is now inseparable from control.

Specifically, organizations need to understand what authority has been delegated to AI agents. What information can they access? What decisions can they influence? Can they communicate externally, modify records, generate code or execute transactions? How quickly can that authority be restricted if something goes wrong?

Engineering trust into the system from the outset, in the form of identity, data, cybersecurity, infrastructure and human accountability, provides the necessary foundation for intelligence and control.

Layer two: monitoring and remediation

Controls establish the guardrails. Monitoring tells us whether they are holding.

As AI becomes embedded in customer interactions, operations, software development, financial processes and decision making, monitoring extends beyond the technology function to become a business and management capability.

Leaders need visibility into where AI is operating, which decisions of consequence are influenced by it, how it is behaving and where exceptions are emerging. They also need to understand how quickly the organization can detect a problem, intervene and recover.

This requires a different level of telemetry and situational awareness than was necessary in the past. Organizations should consider establishing a trust layer that connects technical signals to the broader business context. This encompasses business performance, resilience needs, technology and cyber risk, regulatory obligations and management accountability. The output should provide a consistent view across data, models, agents, infrastructure and third-party platforms.

The objective is to create a level of decision observability that sustains organizational confidence as AI becomes more autonomous.

Layer three: independent evaluation and attestation

Organizations have long relied on an independent perspective to establish confidence in financial reporting, technology and cybersecurity, regulatory compliance and operational resilience. The same discipline is now needed for AI.

A model may perform well in testing and still behave differently when connected to proprietary data, enterprise applications, external tools, physical systems or other agents. Evaluation and attestation therefore need to extend beyond the model to how AI operates within the enterprise. It should ask whether the system is reliable, secure and resilient; whether AI is operating within approved boundaries; and whether the surrounding controls work as intended.

This will be a continuous capability. Models change. Data changes. Dependencies change. Agent behavior evolves. A point-in-time assessment may provide confidence at launch but not six months or even six days later.

This is why the market is moving from trust by assertion to trust supported by evidence. Evaluation and attestation will need to become more continuous, more independent and more closely integrated into day-to-day operations.

Layer four: board oversight

The fourth layer of control places an independent committee of the board above the other mechanisms, receiving reports on controls and evaluations and overseeing remediation.

Boards do not need to become experts in model architecture, but they do need confidence that management understands where AI is operating, what authority has been delegated and whether the organization can monitor, evaluate and control it. Boards also need to understand and oversee the independent and objective third parties involved in evaluation and attestation. The questions are straightforward:

• Can management demonstrate and evidence that the right controls are in place?
• Is monitoring continuous and connected to business impact?
• Are evaluations credible and sufficiently independent?
• Can significant issues be detected and remediated quickly?
• Is accountability clear across management, technology providers and third parties?

While the board’s fundamental responsibility has not changed, the evidence required for effective oversight has. As AI systems become more powerful, boards require a clear and current view across the complete operating environment.

Trust requires an ecosystem

Most enterprises will not build frontier models themselves. They will rely on an ecosystem of model developers, cloud providers, enterprise software companies, data providers, implementation partners and assurance organizations.

Each has a distinct role to play. Technology providers must build security, observability and control into their platforms. Enterprises must govern how those technologies connect to their data, processes and people. Management and boards must establish clear accountability. Independent evaluators can provide evidence about whether systems and controls are operating as intended.

No single organization can address every dimension of this challenge. Establishing trust requires an ecosystem that brings together technology, cybersecurity, data governance, identity, third-party risk, operational controls, resilience, evaluation and assurance.

How EY can help

As intelligent technologies become even more advanced, the organizations that lead will be able to prove, continuously and credibly, that their systems are operating as intended. In this next era of intelligence, trust will be foundational to success.

EY is helping organizations connect these layers across the enterprise, from the overarching corporate strategy to the underlying technology ecosystem, controls, monitoring, evaluation and evidence that management and boards need to oversee increasingly autonomous systems.