18 countries ink pact to make AI 'secure by design'

AI companies have spent the past year sprinting to release flashier features, longer context windows, and cheaper API calls. But rushing frontier tech out the door usually comes at the expense of basic security.

Now, eighteen countries are trying to hit the brakes on that culture.

On Sunday, the United States, Britain, and 16 other nations unveiled a 20-page agreement pushing tech firms to build artificial intelligence that is secure by design. Officials called it the first detailed international pact aimed at keeping AI out of the hands of rogue actors.

Security over shiny features

The guidelines were signed by a broad coalition including Germany, Italy, Australia, Singapore, Chile, Estonia, and Nigeria. Notably missing from the list, as pointed out by The Verge, is China.

The core message is simple: stop treating security as an afterthought. Jen Easterly, director of the U.S. Cybersecurity and Infrastructure Security Agency, told Reuters that the guidelines mark the first collective recognition that AI cannot just be about cool features, speed to market, or driving down costs.

Technically, the document advises companies to monitor AI systems for abuse, shield training data from tampering, vet third-party software vendors, and only release foundation models after thorough red-teaming and security testing to keep hackers from hijacking the tech.

Yet, the framework is entirely non-binding. It contains zero enforcement mechanisms, and it consciously dodges the messiest debates in tech today, such as copyright issues in training datasets or defining acceptable societal use cases.

Europe is already much further along with binding AI legislation, while the polarized U.S. Congress has stalled on passing enforceable rules despite an executive order from the White House in October.

Why it matters

For enterprise teams and developers, this non-binding paper signals where procurement compliance is heading. If you sell AI tooling to global enterprises or government agencies, expect vetting checklists around training data pipelines, vendor audits, and system misuse to quickly harden into standard requirements.

For the broader industry, it is a modest attempt to reshape incentives. When every lab is racing to ship code overnight, an international framework creates a baseline expectation that shipping vulnerable AI will carry serious reputational risk.

Still, we think this pact reveals just how limited international consensus really is. Rallying 18 countries around general best practices like avoiding software tampering is relatively easy because no tech giant loses money on it. But without legal teeth or answers to data scrapers and weaponized uses, it looks more like a polite suggestion than a wall against malicious actors.