Look at the return value, not the revert
In the summer of 2019, a decentralized exchange integration failed in production. The token contract had a transfer function that compiled cleanly, passed its own unit tests, and returned false on failure instead of reverting. The integrating protocol checked the return value. The token's own documentation claimed the return value was always true. The function selector matched. The ABI matched. The standard โ EIP-20, final, cited in every tutorial on earth โ was silent on the exact edge case that broke the integration.
The bug was not in the code. It was in the assumption that the word "standard" meant the same thing to both parties.
I keep returning to that class of failure whenever I read governance news, because the shape is identical. Three of the largest foundation-model companies โ Google, OpenAI, and Anthropic โ are reportedly pushing to establish an independent body to set AI safety standards. The headline frames this as a question of safety. The technically interesting question is narrower and far more consequential: who writes the conformance tests? Because a standard is not its charter. A standard is the set of test vectors that determine whether you pass. Whoever authors those vectors defines the industry, regardless of what the preamble says.
Tracing the gas trails back to the root cause, the anomaly is this: three companies are proposing to build the ruler that will measure their own competitors, and almost no one is asking what the ruler's markings actually are.
Context: what is on the table, and what is missing
The reported facts are thin, and I want to be honest about that before I build anything on top of them. What we have is a headline-level claim: Google, OpenAI, and Anthropic are pushing for the creation of an independent AI safety standards organization. The accompanying analysis argues the move could concentrate power, disadvantage smaller companies, and accelerate industry consolidation. That is the entire evidentiary base. No charter. No membership list. No funding disclosure. No published scope. No timeline.
Anyone who tells you they know how this will resolve is selling something. What I can do โ what my job actually is โ is map the proposed structure against governance mechanisms I have watched form, break, and harden over the last decade in an adjacent industry that solved this problem badly first. Blockchain standards are the closest available laboratory, because they went through the full lifecycle under public observation: voluntary proposal, reference implementation, conformance testing, procurement pressure, regulatory reference, and finally de facto mandatory status.
That lifecycle is not unique to crypto. It is how the FATF Travel Rule went from a non-binding recommendation to a de facto condition for exchange banking access. It is how ISO 27001 moved from a marketing badge to a line item in enterprise procurement checklists. It is how SOC 2 became the price of admission for selling software to anyone with a compliance department. None of these were legislated into existence. Each became mandatory through the same three-stage pipeline:
- Voluntary adoption by a small number of large, credible actors.
- Procurement pressure, where enterprise buyers and public agencies require the certification from suppliers.
- Regulatory reference, where legislators, unable to write technical detail, cite the private standard as though it were law.
The critical property of this pipeline is that the people who write the standard in stage one capture the market in stage three. The window between those stages is short โ typically twelve to thirty-six months โ and it closes silently. By the time stage three arrives, the standard is no longer a document you can argue with. It is infrastructure. Nobody re-litigates TCP/IP at a procurement meeting.
So the question I want answered is not "will this body be independent?" Independence, in standards work, is a property with at least four separable axes, and organizations routinely satisfy one while failing the other three. An entity can be independent of government and completely dependent on industry funders, or independent in funding and entirely captured in test authorship. The word hides more than it reveals.
The four axes are funding, governance seats, test authorship, and enforcement. I will take them in ascending order of importance, because the market's attention is allocated roughly in reverse of the actual power distribution. Everyone watches the funding. Nobody watches the test suite. That is the mistake.
The interface illusion: why standards are weaker than they read
Start with what a standard actually is at the technical layer. It is an interface definition โ a contract about behavior at a boundary. An interface has three components: the signature (what you call), the semantics (what it should do), and the failure modes (what happens when it cannot). Standards documents are historically excellent at the first, adequate at the second, and catastrophic at the third.
EIP-20 is the canonical example. The signature was specified precisely: transfer(address,uint256) returns (bool). The semantics were specified loosely: "transfers tokens." The failure modes were essentially unspecified. What happens when the balance is insufficient? The standard does not say. Return false? Revert? Return true and do nothing? All three implementations shipped, all three were compliant with the letter of the standard, and all three broke integrators differently. This is not a historical footnote. It is a live bug class. USDT's non-standard behavior in this exact dimension is why dozens of protocols carry special-case branches for a single contract address to this day.
The reason this matters for AI safety is that the proposed standard is being discussed entirely at the level of semantics โ "models should be evaluated for dangerous capabilities" โ while the actual governance power lives at the level of failure modes. A safety standard will say something like: frontier models must undergo pre-deployment red-teaming. It will almost certainly not say: what counts as red-teaming, what constitutes a pass, what happens to a model that fails, who adjudicates disputed results, and whether a model that passes and then produces harmful output post-deployment is in violation.
Those questions are not the standard. They are the conformance suite. And here is the structural insight that I want to plant early: in every standards regime I have studied, the conformance suite authored after the standard is what actually governs the industry, because it is the only artifact that a regulator, a procurement officer, or a court can point to and say "this is what compliance means."
Consider what a conformance test vector looks like in practice. In blockchain it is a JSON blob: