This was originally posted on my Substack.
tl;dr: Proposals for an "IAEA for AI" focus on what to monitor, not on who holds verification authority. Using 128 historical arms-control agreements, we show that monitoring power and compliance burden rise together while the power to contest lags behind, a pattern that historically concentrates power rather than distributing it. I argue this risks repeating the NPT's asymmetry for AI, with the Global South carrying the burden without the authority, and that this is not just unjust but unstable.
The world is beginning to imagine an “IAEA for AI,” an international body that would monitor and verify advanced systems the way the nuclear watchdog monitors reactors. It is a sensible instinct. Most of the conversation around it asks what to monitor and how, and those are hard, serious questions. But sitting underneath them is one that gets asked far less often. Who designs the system, who gets to inspect, who can contest a finding, and on whose terms?
A few days ago, I sat with these questions at Apart Research’s Global South AI Safety Hackathon, on the Asia track. I came to them the way I come to most things, as someone trained to study exclusion, to ask who is in the room and who is being decided about while standing outside it. This is the part of the work that is mine: reading the history of verification through power rather than through the numbers alone.
Why I think this matters
Let me start with the stakes, because they are what turn a design question into an urgent one. Advanced AI carries catastrophic risks, through misuse and through misalignment. It also concentrates power, and the concentration of power is itself one of the gravest risks, the possibility that a small group gains durable control over the lives of nearly everyone else. None of this stops at a border. A misaligned system, or an AI-enabled grab for control, would fall on all of us, and the parts of the world with the least cushion and the least say would feel it first and worst. That includes the place I write from. If the danger is shared, the institutions built to govern it cannot belong to two countries.
I have spent a long time around questions of who gets protected and who gets managed, who writes the rules and who is written into them. So when I look at proposals to monitor AI, my instinct is not to ask whether the technology works. It is to ask who ends up holding the clipboard, and who ends up standing in front of it.
Verification is never neutral
Here is the claim at the centre of all this, and it took me a while to be willing to say it plainly. Verification is not a neutral technical instrument. It is a structure that distributes power. To decide who watches and who is watched is to decide who holds authority and who carries obligation. A monitoring regime, written in the dry language of compliance and inspection rights, is closer to a constitution than to a thermometer.
Michel Foucault, writing about the Panopticon, argued that being watched is a relation of power in itself. The one who observes also gets to set the standard the observed is measured against. Read that into a treaty and an inspection clause stops being merely technical. It makes one party the watcher and another the watched, and it hands the watcher the authority to define what counts as a violation. The question of who can inspect is really a question about who holds the tower and who sits in the cell.
What two centuries of treaties actually show
To test whether verification really does gather power in a few hands, our team looked at the one place with a long record of it: arms control. My teammate Meenakshi Neeharika Mangipudi built the quantitative backbone, coding 128 agreements from the Alva Myrdal Centre database across three dimensions: access, recourse and burden. Access is the authority to see and inspect. Recourse is the ability to challenge a finding. Burden is the weight of reporting and compliance.
The patterns were quietly alarming. Hard verification is the exception, not the rule; states have far more often chosen to talk and to declare than to open their doors. But the sharpest signal is in how the dimensions move. Monitoring authority and compliance burden rise almost together, while the power to contest a finding fails to keep pace with either. As these regimes got better at extracting compliance, they did not get better at letting the watched answer back. Oversight grew. The right to push back lagged behind.
Where the numbers fall silent
A coding scheme can tell you whether a mechanism exists. It cannot tell you who it falls on. The Non-Proliferation Treaty is the clearest example I know. By its coded mechanisms it looks almost mild. By its history it is one of the most lopsided bargains of the last century. It split the world into nuclear haves and have-nots, put the burden of inspection on the have-nots, and left the arsenals of the powerful outside the same scrutiny. The disarmament promise meant to balance it has not really been kept for over fifty years. The injustice that matters most cannot be seen by counting mechanisms, because it lives in whom the mechanism is aimed at.
That is why the framework needed two things the data could not hold. The first is legitimacy: does a regime’s authority rest on consent or on coercion? The second is exit: can a state refuse or walk away without losing everything? These are not extra steps. They ask whether the people bound by a rule ever had a real say in it, and a real way out.
The trap hidden in building it wide
There is a lesson here for any future AI body. When we split the agreements into bilateral and multilateral, a trade-off surfaced. Two-party regimes concentrated inspection and heavy obligation. Broader multilateral ones gained more room for consultation but thinner powers to actually inspect. Widening the table tended to buy voice at the price of real access.
An “IAEA for AI” would be multilateral by design, which is exactly where I would watch for trouble. A body built for near-universal membership could hand most states complaint procedures and consultation rights while keeping genuine inspection and the power to define compliance with the few who already hold the compute. The danger is not being shut out of the room. It is the quieter one of being let in without being given any power once inside. A seat, a voice, a form to file a grievance, and no real authority to inspect, to verify, or to decide what compliance even means.
I want to be careful here, because this is a risk to watch for, not a settled prediction. But it is the shape history keeps producing when design is left to drift, and it is worth flagging.
Why asymmetry does not even hold
The deepest problem with a lopsided regime is not only that it is unfair. It is that it does not last. When a system exempts the strong and burdens the weak, and the thing being monitored is itself a source of standing, it teaches the excluded that safety lies in acquiring the capability, not in obeying a bargain that gives them nothing. India reached exactly that conclusion under the NPT. It refused the treaty as discriminatory, built the weapon, and gained standing. In the terms of our framework, it used both exit and a verdict on legitimacy, and the refusal worked.
It would be easy to read that as a case for everyone to race. It is the opposite. A nuclear weapon is a possession; a state can hold it alone and be safer. Whereas AI’s catastrophic risks, misalignment above all, do not respect the borders of whoever builds them. No one can defect their way to safety from a risk that is genuinely shared. A lopsided regime will still tempt states to walk away, and so will still fail, but here walking away buys no safety for anyone. That is what makes real inclusion not a matter of generosity but a matter of whether the whole thing holds together.
And there is a ceiling I will not pretend away. Verification distributes the power to see, not the power to enforce. Even a perfectly even-handed regime would still rest on an enforcement layer the powerful control, where a Security Council veto can shield an ally from consequences. Inclusive design is necessary. It is not enough. Both are true at once, and the argument is more honest for saying so.
The question I am left with
If verification is a structure that distributes power, then the real question for AI governance is not whether to watch, but who watches the watchers, and whether those who carry the burden of being watched will have any say in the watching. History suggests the default answer is no. What interests me is whether AI could be the case where that default is finally refused.
So here is the question I am sitting with, and would rather think through with other people than alone. If inclusive design cannot break the enforcement ceiling by itself, what would it take to redistribute not just the power to see, but the power to act on what is seen? Is that a problem of institutional design, of coalitions among middle powers, or of something these historical analogies cannot yet tell us?
The full report lays out the framework, the data, the reading of Foucault, and the comparison between the NPT and the Chemical Weapons Convention. You can read it here: Who Watches the Watchers? Governance Agency in AI Verification and Monitoring Regimes. Every response is welcome, and the sharp and disagreeing ones most of all.
