The AI Labs Want Cover. Industry Never Had Any.
The frontier labs want a regulator to answer for what their models do. In industry, the company that runs the plant answers for what its equipment does, and it builds the guardrails itself. AI agents should be governed the same way.
Dr. Alex Wissner-Gross , on this week’s Moonshots episode, called the frontier labs’ slowdown proposal a safety cartel: a group of dominant firms using safety to justify limits on how fast anyone else is allowed to compete. He is right about what it is. My reading of why is more ordinary. The labs are worried about liability, and they want a regulator to carry it.
What happened this week
Dario Amodei asked for three things: independent evaluators inside the labs, a common standard across US labs with government cover so they can coordinate the pace of releases, and international red lines starting with bioweapons. Sam Altman, Demis Hassabis and Elon Musk agreed within a day.
Peter H. Diamandis put the liability question to the panel directly. If you tell the world your model could do hundreds of billions of dollars of damage and you release it anyway, you are exposed in every court that hears the case. If a regulator approved the release, that changes. Salim Ismail put it in terms of the IPO: you cannot go public while telling investors your product might end the world, unless someone with authority has signed off on it. Wissner-Gross reports that the White House and the Speaker both said there would be no waiver.
Dave B. Blundin made the one point in the labs’ defense that holds. Once one lab says the risk is real, no CEO raising money can say otherwise, so the speed of the agreement tells you less than it looks like it does.
I agree with the cynical reading, and my argument does not depend on it. Take the proposals at face value and one thing is still missing. Every one of them is about the model. None of them is about the plant.
The labs cannot govern what happens in the factory
Evaluators, cross-lab tests and pacing all act on the model and on how it is built and released. Amodei’s own worst case is damage done where a model’s output turns into an action on a network, a payment system or a piece of equipment. That is a different layer, and it is different at every site. A chemical plant, a copper mine and a gas plant fail in different ways, protect themselves in different ways, and have different rules about who may touch what. A model vendor in San Francisco cannot know which valve may be moved in which operating mode at a plant in Western Australia. The operator knows, and wrote it down years ago.
Industry settled this a long time ago
There are hundreds of thousands of process plants running right now, and every one of them separates thinking from acting. The operator, or the optimization software above the control system, decides what the plant should do and asks for it. A layer the plant built decides whether it happens. Interlocks are rules wired into the plant so that a valve cannot open or a pump cannot start while a condition holds, whatever anyone asks for. A separate safety system, on its own hardware, shuts the unit down if the process gets away regardless. The people who built that layer assumed the operator would one day be wrong. The company that holds the license to operate built it, set every limit in it, and is accountable for how the plant is run. The instrument vendor and the control system vendor supplied equipment; they do not hold the license. That has been true since the first interlock. The lesson for agents is the layer between the thinking and the acting, and who owns it.
The AI asks. An operations layer the organization builds decides, with the plant’s own systems behind it.
What it means for how you build agents
I get asked what the multi-agent systems we build actually consist of, and the answer surprises people. Roughly nine tenths of the work is the industrial process and the operations layer around the model. One tenth is the language model. The model is the small part, and it is the part that gets cheaper every quarter, which is why it makes no sense to build your governance into it.
Recommended by LinkedIn
The architecture follows that lesson. The agents sit where the optimization software and the engineers sit today: they read the plant, weigh a trade-off against an objective, and propose an action. The action might be a work order, a changed setpoint, a revised schedule, or a message to a person. Most of what agents do in a plant never goes near the control system, so the control system cannot be the guardrail. What sits between the proposal and the action is an operations layer the organization builds and owns. It connects the agents to the plant’s data and systems, gives them their context, and runs them. Inside it sits a control plane: the part that holds the rules the organization set (what each agent must always do, what it may never do, and what it may do under which conditions, per site, per unit and per role) and decides whether a request goes, to whom, and with what approval. The model proposes. The control plane decides. Where an action does reach equipment, the plant’s control and safety systems still apply their own limits behind it. Obligations, prohibitions and permissions have been part of how our agents think from day one, and writing a rule down is not enough: a rule that must stop an action has to be enforced where the request leaves the operations layer, and setting that up and testing it is part of deploying agents.
How the pieces separate: the model and its checks, the operations layer the organization owns with its control plane, and the plant’s own control and safety systems behind it.
Swap one lab’s model for another, or a frontier model for one running on site, and the rules stay where they were, because they live in the operations layer and that layer is yours. The evaluators Amodei wants can inspect the model as closely as they like. You still decide what it is allowed to touch.
You are not going to stop this
The value on the table is enormous, and the labs know it, which is the other reason none of them wants to stop. Operators should not wait either. Every advance in automation has come with the same warning attached, and industry handled each one the same way: keep the capability, decide what it is allowed to touch, and build the protection before it acts on the plant. The scaremongering this week is loud. The drivers for going ahead outweigh it.
Wissner-Gross put it in terms of cities. If everyone had decided cities were dangerous, the answer would have been “don’t build cities”, and nobody was ever going to accept that, because concentrating people was worth more than the risk that came with it. You are not going to stop this. You have to figure out how the police works. For an industrial operator that is an architecture decision, and you can make it now, without waiting for the labs or the regulators to finish arguing.
The labs spent a weekend asking who will carry the liability for what their models do. Industry has had its answer since the first interlock: the organization that runs the plant is accountable, it sets the limits itself, and it does not hand that to whoever supplied the machine. Agents change none of that. Take responsibility for the operations layer around your agents. Build it or buy it, but own it. We built one, and it is there if you want it.
Pieter van Schalkwyk is the CEO of XMPro, specializing in industrial AI agent orchestration and governance. Drawing on 30+ years of experience in industrial automation, he helps organizations implement practical AI solutions that deliver measurable business outcomes while ensuring responsible AI deployment at scale.
He authored the Industrial AI Agent Manifesto, published by the Digital Twin Consortium in February 2026, a governance framework for trustworthy autonomous operations
Our GitHub Repo has more technical information. You can also contact myself or Gavin Green for more information.
Read more on MAGS at The Digital Engineer
How this was made: I worked with Claude to check sources, draft from my direction and edit. I do not publish anything I have not rewritten myself.
This article originally appeared on XMPro CEO’s LinkedIn blog, The Digital Engineer, on 19 September 2026.
