White House AI pact demands independent audits but never says who qualifies

The White House got AI's biggest players to nod along on outside safety checks — then never said who's allowed to do the checking. That blank space is the most serious flaw in the whole thing, according to Schellman, which tracks how ready organizations are for AI governance.

The White House Accord on Super Intelligence landed on September 29, 2026. It's voluntary, and executives from Anthropic, OpenAI, Google, Meta, xAI and Nvidia signed on next to President Trump. The framework stacks four layers of oversight: internal risk controls, an internal monitoring team, independent external auditors or evaluators to test whether those controls work, and an independent board committee.

Layer three is where it gets slippery. The accord demands independent assessments without defining who qualifies to run them, without saying what independence actually means, and without touching how conflicts of interest get handled. Each signatory decides for itself — so two companies could meet the identical commitment in completely different ways and both call it done.

Schellman's numbers suggest that gap is not cosmetic. Its July 2026 State of AI Governance Report found 74% of AI governance professionals think their organizations could pass a compliance audit, while only 27% say their governance programs are fully mature. The money is there — 90% have dedicated governance funding — but the paperwork lags, with 57% holding formal policies and just 44% having incident response procedures written specifically for AI.

Meanwhile, the tech keeps shipping. The same survey found 86% of companies have tested AI agents and 46% already run them in production. Agents act on their own rather than just answering questions, which makes the readiness mismatch harder to wave off.

Voluntary shapes everything here: no government oversight mechanism, no penalties for falling short, no requirement to publish audit results. So expect every major developer to start saying 'independent audit' without a shared definition behind it — leaving investors, customers and regulators to chase the follow-ups. Who ran the evaluation? Do they have commercial ties to the company? And did anyone outside see the findings?