Existential-risk discourse has tended to picture catastrophe as a software event: a model becomes deceptive, an autonomous weapons system slips its leash, or a generally capable system acquires goals no human institution can contain. Those concerns are real. Yet by mid-2026 a different line of analysis deserves more attention. The practical capacity to build and deploy the most powerful systems rests on a stack of physical assets, specialist labour, cloud infrastructure, licensing arrangements and cross-border regulatory permissions. In other words, civilisational safety depends not only on whether advanced systems can be aligned, but on whether the world can govern the material basis of their development without making that basis itself a source of instability.
This shifts the question from model psychology to political economy. Who can train at the frontier, on what hardware, under which audits, through what intermediaries, with what emergency powers, and according to whose legitimacy. The dangerous illusion is that scarcity itself produces safety. In practice, scarcity without trust can produce hoarding, evasive procurement, fragmented standards and worst-case strategic planning.
From alignment panic to infrastructure realism
The institutional debate has moved. The OECD, the EU and several national governments now frame advanced AI as a governance problem involving risk management, accountability and public safety rather than mere innovation policy. At the same time, export-control regimes and cloud-monitoring proposals have put compute at the centre of statecraft. This is not simply because chips are valuable. It is because the ability to aggregate large-scale compute is one of the few observable bottlenecks in a field otherwise marked by intangible code, rapid diffusion and uneven transparency.
That observability is attractive to regulators. Training runs leave traces in procurement, power use, facility design and hardware imports. Cluster operators can in principle be licensed. Advanced accelerators can be tracked more readily than model weights copied across borders. For policymakers searching for an administrable lever on frontier capability, compute looks like the nearest thing to a handle.
Why compute became the preferred choke-point
Three properties explain the appeal. First, leading-edge compute remains geographically concentrated. Even when design, fabrication, packaging and cloud deployment are internationally distributed, they depend on a relatively small number of high-capability nodes. Secondly, compute can be counted, at least approximately. One may argue over thresholds, but regulators can define classes of hardware, reporting duties and due-diligence standards more easily than they can define dangerous ideas. Thirdly, compute is slow-moving relative to software. A data centre cannot be copied at the speed of a repository.
For safety advocates, these properties suggest an opportunity. If frontier development depends on scarce and monitorable inputs, states may be able to require incident reporting, pre-deployment testing, red-team access, model evaluations and security obligations as conditions of access. In effect, infrastructure governance could buy time for technical safety work. That is the optimistic theory.
The dangerous illusion is that scarcity itself produces safety.
The hidden risk in choke-point thinking
The dangerous illusion is that scarcity itself produces safety.
The optimistic theory omits a political fact: every choke-point is also a target. Once compute is understood as the rate-limiting input to strategic capability, it acquires the logic of a military-industrial asset. Controls designed for safety can then be repurposed for advantage; controls imposed for advantage can be defended in the language of safety. The distinction matters less in rhetoric than in how other states interpret intentions.
Interpretation is central to civilisational risk. History shows that preventive logics thrive under uncertainty. If one power believes another may soon acquire a decisive capability, the incentive is not merely to regulate but to deny, sabotage or accelerate. In that setting, a compute-control regime meant to slow dangerous development may instead shorten time horizons and reduce restraint. The risk is not a single dramatic failure but an ecosystem of reciprocal suspicion in which everyone invests in secrecy, redundancy and rapid scaling.
Brittleness is the real systems hazard
A robust governance order can absorb shocks without collapsing into panic. A brittle one looks orderly until stress arrives. Compute governance today has several brittle features. It relies on long, transnational supply chains. It depends on specialised compliance capacity concentrated in a small number of firms and agencies. It presumes that customs classifications, licensing decisions and cloud-usage rules can keep pace with technical workarounds. And it often assumes a peacetime level of cooperation among states whose broader relations are deteriorating.
A control system built for peacetime paperwork may fail in crisis time. Firms facing conflicting national rules can be pushed into over-compliance, covert arbitrage or sudden service withdrawal. Researchers unable to access legitimate compute may route work through opaque jurisdictions. Governments, seeing leakage, may conclude that only far harsher restrictions can work. Each move reduces visibility further.
Safety through denial has limits
There are good reasons to restrict access to the most advanced capabilities. The problem is that denial is not the same as governance. A strategy centred overwhelmingly on exclusion can work against weak or casual actors while leaving determined states and well-financed networks more secretive and less inspectable. It may also neglect the harder but more important task of building common expectations about testing, incident disclosure and command responsibility.
This is where the analogy to non-proliferation is both useful and dangerous. Useful, because verification, material accountancy and trusted reporting channels plainly matter. Dangerous, because advanced AI does not map neatly onto fissile material. Much of the relevant knowledge is dual-use, globally distributed and embedded in civilian markets. That makes durable control less a matter of sealing stockpiles than of sustaining legitimacy across allies, partners and rivals with divergent interests.
Legibility beats maximalism
If the aim is to reduce civilisational danger, the first requirement is not absolute control but legibility. Governments need to know where frontier-scale training is taking place, what classes of models are being developed, what safety evaluations are standard, and what emergency powers exist if a deployment appears uncontrollable. Legibility is less glamorous than prohibition, but more compatible with a world in which multiple states and private actors retain substantial capability.
A control system built for peacetime paperwork may fail in crisis time.
Legibility also demands common vocabularies. Terms such as frontier, high-impact, dangerous capability and general-purpose model are often used loosely across jurisdictions. The EU AI Act, OECD work on frontier regulation and national safety frameworks have begun the work of classification, but they still do not amount to a stable international language for compute thresholds, reporting triggers or incident severity. Without that, every border becomes a translation problem.
The cloud is now part of strategic stability
One underappreciated change is that large-scale AI development increasingly sits inside commercial cloud and data-centre arrangements rather than sovereign facilities alone. This means strategic stability now depends partly on private-sector operating procedures: customer verification, anomaly detection, secure access controls, hardware telemetry, abuse reporting and emergency shut-off protocols. These are not merely corporate housekeeping issues. They are de facto pieces of global safety architecture.
That architecture is awkwardly placed. Cloud providers are asked to behave as neutral infrastructure, safety gatekeeper, sanctions monitor and national-security auxiliary simultaneously. Those roles can conflict. If obligations are vague, firms either become timid and inconsistent or permissive and evasive. If obligations are too sweeping, they may create incentives to decentralise into less governable environments. The narrow path is not laissez-faire or embargo maximalism, but governable interdependence.
A control system built for peacetime paperwork may fail in crisis time.
Autonomy risk starts before deployment
Weapons autonomy is usually discussed at the point of use: target selection, human control, escalation and accountability. Yet compute governance matters much earlier. Training infrastructure shapes who can develop high-performance perception, planning and simulation systems at scale. The same clusters used for ostensibly civilian models may support components relevant to military autonomy, cyber operations or strategic deception. That does not imply all frontier training is suspect. It does imply that separations between civilian and security domains are increasingly administrative rather than physical.
For civilisational safety, this blurring raises two demands. One is traceability: not omniscient surveillance, but credible records of access, model lineage, evaluation outcomes and transfer. The other is crisis communication. If a state believes another is nearing a capability that could undermine deterrence or battlefield stability, there must be channels to clarify what is actually being built. In nuclear affairs such signalling mechanisms evolved painfully over decades. In AI they remain thin.
The weak point is institutional time
Technical communities often speak as if the main race is between capability gains and alignment breakthroughs. Politically, the more immediate race is between capability gains and institutional adaptation. Export rules can be issued quickly, but trusted verification systems, judicial review, allied coordination, incident taxonomies and professional audit capacity take years. That lag creates a temptation to overuse blunt instruments simply because they already exist.
The narrow path is not laissez-faire or embargo maximalism, but governable interdependence.
Overuse brings second-order dangers. The more discretionary and extraterritorial controls become, the more they are read as tools of hierarchy rather than stewardship. Allies may comply while quietly preparing fallback ecosystems. Rival powers may invest in domestic substitution with fewer transparency concessions than would otherwise have been possible. What begins as a safety measure can therefore accelerate the very decoupling that makes cooperative risk management harder.
What a less brittle regime would look like
A sounder architecture would start from resilience rather than dominance. It would combine narrowly tailored hardware and cloud controls with mandatory safety reporting at high compute thresholds, common incident classifications, protected channels for cross-border technical disclosure, and pre-agreed emergency procedures for suspected loss-of-control events. It would distinguish more carefully between restrictions intended to prevent immediate harm and restrictions intended to preserve long-run strategic advantage.
It would also accept that partial openness can improve safety. Shared evaluation methods, red-team standards and secure reporting of dangerous capabilities can reduce uncertainty even among competitors. Complete transparency is impossible and often undesirable. But total opacity is worse. The aim should be to create enough mutual visibility that states need not assume the worst from every frontier training cluster they cannot inspect directly.
The politics of legitimacy cannot be bypassed
No compute regime will endure if it is experienced by much of the world as a closed cartel. Middle-income states have legitimate interests in scientific development, public-sector digital capacity and access to advanced tools for health, education and climate adaptation. A system that treats them primarily as compliance objects will invite circumvention and political resistance. Legitimacy therefore has practical safety value. Rules seen as procedurally fair are easier to enforce and harder to portray as arbitrary containment.
This does not mean universal agreement is necessary. It means the basic terms of access and restraint must be intelligible beyond a narrow security club. International institutions are imperfect, but they remain useful for standard-setting, shared terminology and the public articulation of safety rationales that extend beyond bloc politics. In civilisational-risk terms, legitimacy is not a moral garnish. It is part of the control system.
The narrow path
The central mistake in much debate is to imagine a choice between unrestricted acceleration and comprehensive lock-down. Neither is plausible. Frontier capability will continue to diffuse unevenly; governments will continue to intervene; and private infrastructure operators will remain entangled with public safety. The relevant question is whether those interventions produce a stable order with usable visibility, or a brittle one that drives capacity underground and sharpens geopolitical fear.
The narrow path is not laissez-faire or embargo maximalism, but governable interdependence. That means treating compute as a safety-critical commons of sorts: not common property, but a shared object of restraint whose governance must survive rivalry. If civilisational risk is the category under discussion, then the problem is larger than whether any one model is aligned. It is whether the world can keep hold of the physical levers of transformative intelligence without turning them into triggers for the next systemic crisis.
