White House Secures Voluntary AI Pledges From Seven Tech Giants

On July 21, 2023, seven of the most influential companies in artificial intelligence made a series of voluntary commitments to the White House on safety, security and transparency in developing their systems. Amazon, Anthropic, Google, Inflection AI, Meta, Microsoft and OpenAI signed the agreement at an event attended by President Joe Biden himself, in what stands as the most visible move yet by the U.S. administration to set boundaries on a technology advancing faster than any law could regulate it.

The details matter: these are voluntary commitments, not legal obligations. No federal agency can penalize these companies if they fail to follow through. In practice, it's a statement of intent with the White House seal behind it.

What exactly they promised

The commitments, as detailed by the administration, fall into three categories.

The first concerns model safety ahead of release. The seven companies have agreed to subject their systems to internal and external testing—what the industry calls "red teaming," simulated attacks designed to find flaws before malicious actors do—and to share information about managing those risks with the rest of the industry, with governments, with civil society and with academia.

The second category covers system security: investing in cybersecurity and insider-threat safeguards to protect model weights—the trained parameters that constitute, in practice, an AI company's most valuable asset—before they're released, and making it easier for third parties to responsibly discover and report vulnerabilities.

The third aims to build public trust. This is where the most-discussed commitment lies: developing technical mechanisms, such as watermarking systems, so users can tell when content—text, image, audio or video—was generated by AI. Companies also committed to publicly reporting on their models' capabilities and limitations, appropriate and inappropriate uses, and to prioritizing research into societal risks such as bias, discrimination and privacy protection.

Why now

The announcement didn't come out of nowhere. Since ChatGPT's debut in late 2022, Washington has steadily ramped up its attention to AI even as Congress has failed to pass any specific legislation. In May, Biden had already met at the White House with the top executives of OpenAI, Google, Microsoft and Anthropic to discuss risks. That same month, Sam Altman testified before the Senate and personally called for his industry to be regulated. Also in May, the G7 launched a process at its Hiroshima summit to coordinate shared principles on generative AI among the world's leading economies.

Meanwhile, in Brussels, the EU's AI Act was moving through the traditional legislative process, complete with binding chapters and penalties. The United States, lacking the majority needed to pass equivalent legislation, has opted for the fastest route available: direct political pressure on a handful of companies that, together, control nearly all of the world's most powerful AI models.

The limits of the pledge

The lack of enforcement mechanisms has been the chief criticism leveled at the announcement from the start. There are no verifiable deadlines, no mandatory independent audits, and no legal consequences if one of the seven companies decides, a year from now, not to follow through on its promises. The whole framework rests on corporate good faith and the reputational pressure of having signed a public commitment alongside the President of the United States.

The White House has framed these commitments as a first step while it works on additional measures, including a possible executive order on artificial intelligence and a push for bipartisan legislation in Congress. Neither of those two paths has, as of now, a set date or a finalized text.

What changes for users

For anyone using ChatGPT, Bard, Meta's products or Amazon's services, the immediate effect will be limited. There won't be a mandatory label on AI-generated content next week, nor a public mechanism for reporting safety flaws in these models. What does change is the frame of reference: for the first time, the leading companies in the sector have put in writing, before their own government, what they themselves understand responsible development to mean. That document will presumably serve as a yardstick whenever one of them strays from what it promised.

How to distinguish a commitment from an obligation

A voluntary commitment can matter: it states conduct publicly and makes demands for explanation easier. But it lacks elements of a binding rule. To measure its strength, look for scope, deadline, indicator, independent auditor, publication of results and a consequence for failure. When those are absent, the main pressure is reputational.

The consolidated commitments document uses language such as “commit to” and says the pledges apply until substantially equivalent regulation takes effect. It also makes clear that existing legal obligations continue to govern. Calling it law would be wrong, but dismissing it as ceremonial would also miss something: it provides a list against which later conduct can be compared.

The list can become a tracking table. For external testing, ask who evaluates which system, before which release and what summary is published. For cybersecurity, look for vulnerability-disclosure policies and protection of model weights. For provenance, test which content types receive a signal, whether it survives editing and what the user understands.

The word “safety” needs a unit of measurement

Sharing risk information says neither how much, with whom nor how quickly. A watermark may exist and fail after compression. A red team may find problems while leaving its coverage undisclosed. Every promise needs observable evidence and a denominator: models reviewed over models released, marked content types over generated types, or vulnerabilities resolved over reports received.

The seven signatories did not represent the whole ecosystem. Open models, small companies, applications integrating APIs and foreign providers create other responsibility chains. An agreement with large laboratories can set expectations, but does not replace general rules or public oversight.

The transferable skill is to turn a corporate promise into a verifiable matrix: actor, action, deadline, metric, proof and consequence. When a company announces “responsible AI”, look for those six fields. If they cannot be filled, you know precisely what is missing instead of accepting or rejecting the statement by instinct.

Tracking should preserve versions. A company may change a policy, expand testing or adopt a standard after the agreement. Saving the date and document recognises progress without pretending it existed at signature. It also prevents an updated webpage from erasing the baseline against which action was promised.

The table should be updated with evidence, not repeated announcements. A published policy, test report or audit counts; another promise about the promise does not. That distinction turns institutional memory into a tool for accountability.