Voluntary AI Safety Standards: What AI Buyers Should Ask Vendors

On September 29, 2026, President Trump and the leaders of six AI and technology companies signed a one-page set of voluntary AI safety standards at the White House. The document commits signatories to four layers of controls and audits, including internal evaluations and reviews by an outside auditor.

If your firm buys or deploys AI inside Salesforce, HubSpot, Claude, ChatGPT, or other tools, the natural question is: does this change my vendor due diligence? Short answer: it gives you better questions to ask. It does not do the work for you.

This guide explains what the accord says, what it leaves out, and how to turn public vendor safety commitments into evidence, contract language, and internal governance you can actually defend to an examiner or auditor.

Status as of September 30, 2026: the accord text is available as a one-page document posted to the President's Truth Social account and reprinted by news outlets. No implementing details, auditor names, or reporting schedule have been published. Check the sources below for updates.

Quick Answer

The White House Accord on Super Intelligence is a voluntary pledge by frontier AI developers to run internal controls, an internal oversight team, independent external audits or evaluations, and board-level oversight of their models. It is not a law, a regulation, or a contract with you. For regulated firms buying AI, it matters because it creates new, specific things to ask vendors for: who the external evaluator is, what they assess, and how findings reach you. Your own third-party risk, data, and compliance duties stay exactly where they were. Vantage Point helps teams turn those questions into CRM-level controls in Salesforce and HubSpot.

Key Takeaways (TL;DR)

What is it? A one-page voluntary AI safety standards accord signed September 29, 2026 by the President and leaders of Google, Anthropic, Meta, OpenAI, xAI, and Nvidia.
What it commits to: four layers of controls and audits: internal controls, an internal assurance team, an independent external auditor or evaluator, and an independent board committee.
What it is not: binding law or a customer contract. House Speaker Mike Johnson called the commitments "voluntary"; the President called the accord "morally binding."
Who it covers: companies "training and deploying frontier models." Your CRM and SaaS vendors may embed those models without being signatories themselves.
Best for: CIOs, CCOs, risk and vendor-management leads who approve AI tools.
Bottom line: treat public safety commitments as a starting point for due diligence, then ask for evidence, contract terms, and your own internal controls.

What Is the White House AI Accord?

The White House AI accord is a voluntary joint commitment, titled "White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities," signed after a September 29, 2026 meeting between the President and technology executives. The President posted the one-page text and signature page to Truth Social, and the New York Post reprinted the full text.

The signature page lists the President plus Sundar Pichai (Google), Dario Amodei (Anthropic), Mark Zuckerberg (Meta), Greg Brockman (OpenAI), Elon Musk (xAI), and Jensen Huang (Nvidia). Other executives attended the meeting, according to CBS News, but the posted signature page shows those six company signatories.

Speaking to reporters, Zuckerberg said the companies agreed to "multiple layers of auditing and controls," including internal evaluations and external audits, as reported by CBS News. The accord itself says each company "should implement the following four layers of controls and audits":

Internal controls to monitor model capabilities and alignment during training and deployment, in areas such as cybersecurity, biosecurity, and chemical threats, and to make sure models "do not hack or access technical systems in unintended ways."
An empowered internal team to confirm those controls, monitoring, and detection work as intended, and that issues get fixed.
An independent external auditor or evaluator to assess whether the controls, monitoring, and detection work as intended.
An independent board committee to oversee the work, receive reports from internal and external auditors, and make sure issues are remediated.

Signatories also agreed to "meet regularly to establish standards and best practices." The text adds: "Over time, it may make sense to codify these steps into laws or regulations."

Is the Accord Binding? Voluntary Commitment vs. Law vs. Contract

No. The accord is a voluntary statement, not a statute, regulation, or agreement with customers. Axios quoted Speaker Johnson describing it as "a statement of principles ... commitments that are voluntary on behalf of the industry." Asked whether it was binding, the President said, "I think it's morally binding," according to CBS News. CBS also reported that Sen. Mark Warner called for Congress to pass mandatory testing, evaluation, and incident-reporting rules for the most advanced models. Axios reported that the accord's scope and enforcement remain unclear.

The same day, the President signed an executive order directing executive-branch agencies to use the terms "Super Intelligence" and "SI" in place of "Artificial Intelligence" and "AI." That order covers terminology and a proposed federal definition. It does not mention the accord or place obligations on private companies.

For a buyer, the difference between these instruments is practical:

Instrument	Who it binds	Who can enforce it	What it means for your firm
Voluntary commitment (this accord)	Signatories, by their own pledge	No enforcement mechanism is stated in the text	Useful evidence of intent. Not something you can rely on by itself.
Law or regulation	Everyone in scope	Regulators and courts	Sets your firm's own obligations, including for vendors you use
Your vendor contract	You and your vendor	You	The only one of the three you can directly enforce

This is not legal advice. Your counsel should decide how any public commitment affects your contracts or regulatory filings.

Who the Accord Covers, and Who It Doesn't

The accord applies to "every company that is training and deploying frontier models." That is the model layer. Most regulated firms don't buy AI there. They buy it through a platform: a CRM, a marketing tool, a service desk, or a productivity suite that calls one or more frontier models behind the scenes.

That creates three layers of accountability, and the accord speaks to only one:

Model developer: may be a signatory. Its commitments are public, but made to the public, not to you.
Platform vendor (for example, your CRM or marketing automation provider): may not be a signatory, even if it uses a signatory's models. Its contract with you is what counts.
Your firm: owns how the tool is configured, what data it sees, who can use it, and how outputs are supervised and recorded.

So the first due-diligence question is simple: which model providers does this product use, and are they covered by any public safety commitment? The second is harder: what does the platform vendor itself commit to, in writing?

What the Accord Focuses On vs. What Your Compliance Team Asks About

The accord's named risk areas are cybersecurity, biosecurity, chemical threats, and models accessing systems in unintended ways. Those are serious frontier risks. They are not the full list a regulated firm has to manage when it puts AI near client data.

The one-page text does not address, for example:

How customer data is used, retained, or excluded from model training
Accuracy of outputs used in client communications or decisions
Fairness and bias testing for customer-facing use cases
Recordkeeping and supervision of AI-generated content
Access controls inside your own CRM, which decide what an AI feature can see
Incident notice to customers

Those items still belong in your vendor review and your internal policies. If you already have an AI vendor process, our guide to third-party risk guidance for AI inside vendor contracts covers the broader contract review.

How to Use Vendor Safety Commitments in Due Diligence

A public commitment is most useful when you convert it into specific evidence requests. Use the accord's four layers as a question map, then add the items it leaves out.

Accord layer	What the text does not tell you	Question to ask your vendor	Evidence to request
1. Internal controls	Which controls apply to the model version your product uses	Which models and versions power this feature, and what monitoring covers them in production?	Model list, version policy, change-notice process
2. Internal assurance team	Who the team is, and how issues are tracked	Who owns AI safety and risk, and how are issues escalated and closed?	Named function, escalation path, remediation SLAs
3. External auditor or evaluator	Who the auditor is, scope, frequency, and whether results are shared	Who performs the independent assessment, what is in scope, and can customers see a summary?	Auditor name, scope statement, summary report or attestation
4. Board committee oversight	How findings reach the board, and what happens next	Which board committee receives AI findings, and how are material issues disclosed to customers?	Governance charter excerpt, customer notice policy
Not in the accord	Data use, retention, accuracy, bias, recordkeeping	Is our data used for training? How long are prompts and outputs kept? Can we export logs?	Data processing terms, retention settings, log export

Two tips make this work. First, ask the platform vendor, not only the model developer, because the platform decides how the model is called and what data it receives. Second, map answers to a recognized framework your risk team already uses, such as the NIST AI Risk Management Framework, so AI reviews fit your existing vendor program instead of running on the side.

Contract Terms Worth Discussing With Counsel

Because the accord is voluntary, the only way to rely on a vendor's safety program is to reflect it in your agreement. Terms firms commonly discuss with counsel include:

Program representation: the vendor maintains a documented AI safety and risk program, including independent assessment, for the term of the agreement.
Change notice: advance notice if the vendor changes model providers, materially changes its safety program, or withdraws from a public commitment it cited in the sales process.
Assessment access: a right to receive summaries of independent assessments relevant to the services you buy.
Flow-down: the platform vendor holds its model providers to equivalent controls.
Data terms: clear limits on training use and retention of your prompts, files, and outputs.

Which terms fit depends on your regulator, your risk appetite, and the use case. Get legal review before adopting any of them.

Mirror the Four Layers in Your Own AI Governance

The accord's structure is familiar to anyone in a regulated firm: controls, an owner who checks them, an independent review, and board oversight. You can apply the same shape to your own AI deployments without inventing anything new:

Controls in your systems. Permission sets, sharing rules, field-level security, and logging in Salesforce or HubSpot decide what an AI feature can read and write. Tighten them before you turn AI on.
A named owner. One person or team accountable for each AI use case, its settings, and its issue log.
Independent review. Internal audit or compliance tests AI use cases on a schedule, just like other key controls.
Leadership reporting. A short, regular report to the risk committee or board on AI use, incidents, and open findings.

This keeps your governance consistent with what you are asking vendors to show you.

What Regulated Firms Should Do Next

Inventory: list every AI feature in use, the platform it lives in, and the model providers behind it.
Update your AI due diligence questionnaire with the four-layer questions in the table above.
Ask current vendors whether they rely on any public safety commitment, and request the evidence behind it.
Review contracts at renewal for change notice, assessment access, and data terms.
Audit CRM permissions for AI-scale access before expanding any AI feature.
Watch for follow-up: implementing details, the standards signatories said they would develop, and any move toward law or regulation.

How Vantage Point Helps

Vantage Point helps organizations put AI to work inside the systems where client data actually lives. Through our compliance and security solutions, we run permission and data-access reviews, logging and retention setup, and AI governance design in the CRM. Our Salesforce implementation and advisory and HubSpot services teams configure AI features with the right guardrails, and our advisory and change management work helps owners, users, and compliance teams adopt new controls. Senior consultants only: the experts you meet are the experts who deliver.

Turn Vendor Safety Promises Into Controls You Can Show

If your team is evaluating AI in Salesforce, HubSpot, or a standalone assistant, Vantage Point can help you build the vendor questions, contract checklist, and CRM-level controls in one plan.

Talk to Vantage Point about AI vendor governance

Frequently Asked Questions

What are the White House voluntary AI safety standards?

They are a one-page voluntary accord, the "White House Accord on Super Intelligence," signed September 29, 2026 by the President and leaders of Google, Anthropic, Meta, OpenAI, xAI, and Nvidia. It commits signatories to four layers of controls and audits: internal controls, an internal assurance team, an independent external auditor or evaluator, and board committee oversight.

Are the White House AI safety standards legally binding?

No. The accord is described as voluntary, and its text does not include an enforcement mechanism. House Speaker Mike Johnson called the commitments voluntary, and the President called the accord "morally binding." The text says it "may make sense" to codify the steps in law over time.

Does the accord change my firm's vendor due diligence obligations?

No. Your firm's third-party risk, data protection, and supervision duties are unchanged. The accord gives you more specific questions to ask, such as who a vendor's external evaluator is and whether customers can see assessment summaries.

Is my CRM vendor covered by the accord?

Probably not directly. The signature page lists six companies, and the text applies to companies training and deploying frontier models. A CRM or marketing platform may use a signatory's models without signing itself, so ask the platform vendor what it commits to in writing.

What should I ask an AI vendor about safety audits?

Ask which models power the feature, who performs any independent assessment, what the scope and frequency are, and whether customers can receive a summary. Also ask how material findings are reported to customers, and how your data is used and retained.

What risks does the accord not address?

The accord names cybersecurity, biosecurity, chemical threats, and unintended system access. It does not address customer data use and retention, output accuracy, bias testing, recordkeeping, or access controls inside your own systems. Those still need to be covered in your vendor review and internal policies.

How can Vantage Point help with AI vendor governance?

Vantage Point helps firms translate AI vendor commitments into practical controls in Salesforce and HubSpot, including permission reviews, logging and retention setup, and governance workflows. Senior consultants work alongside your compliance and IT teams so AI features launch with documented guardrails.

Sources

Vantage Point is a boutique CRM consulting firm helping businesses transform with Salesforce, HubSpot, and AI. Learn more at vantagepoint.io.