The Framework They Had to Invent

Seven months is genuinely fast for international governance. GDPR moved from proposal to adoption in four years; enforcement did not begin until two years after that. The Hiroshima Process compressed that timeline by nearly a factor of ten, against a technology moving an order of magnitude faster than anything the privacy regulations ever touched. The speed deserves acknowledgment before everything else.

The framework was also, and this matters, voluntary.

i · the architecture of agreement

What the Hiroshima AI Process produced were two documents. The International Guiding Principles for All AI Actors covers the full stack of participants in the AI ecosystem—developers, deployers, users—and articulates eleven commitments that responsible participation looks like. Things like: promote AI literacy. Disclose AI-generated content. Report on risks and capabilities. These are principles in the philosophical sense—orientations rather than requirements, guideposts rather than constraints.

The Code of Conduct is more targeted. Aimed specifically at developers of advanced AI systems, it reaches concrete enough to specify technical obligations: implement capability evaluation frameworks, invest in safety research, deploy content identification technologies, establish post-deployment monitoring and incident response processes. The major AI labs—Google, Microsoft, OpenAI, Anthropic—had compliance teams working against these requirements before the ink dried.

That specificity is the Code's genuine contribution. Not legal force, but a common technical vocabulary for what "responsible development" means in practice. Before Hiroshima, that vocabulary was contested. Different companies, different governments, different researchers all meant different things when they said "safe AI." After Hiroshima, there was at least a reference document. That is not the same as a standard, but it is not nothing either.

The framework acknowledged its own limitation openly: it uses "a certain level of abstraction" to enable broad agreement among diverse stakeholders. Abstraction is diplomatic language for: we could not agree on specifics, so we agreed on generalities. The Code of Conduct operates as what legal analysts later described as "potent, nonbinding common guidance"—influential enough to shape corporate behavior, not binding enough to compel it.

This is the governance version of a singing bowl: it creates resonance when everyone aligns willingly. Strike it against resistance and the tone disappears.

ii · who was not in the room

The Hiroshima AI Process is a G7 agreement. G7 is seven countries. The world has 195.

The country most consequential to the trajectory of advanced AI development—China—has its own AI governance framework, published through the Cyberspace Administration of China, with different principles and no interest in aligning with Hiroshima. China's generative AI regulations operate within a political context that the Code of Conduct does not address and was not designed to address. Two of the world's largest AI development ecosystems are operating from different first principles, and no multilateral agreement changes that.

The open-source ecosystem presents a different version of the same problem. Large language models are now publicly available with weights anyone can download, fine-tune, and deploy without any relationship to the governance structures the Hiroshima Process assumes. The Code of Conduct was written for the world of late 2023, where "advanced AI" meant "large foundation models operated by major tech companies via cloud APIs." By mid-2024, capable models were running on consumer hardware. The governance model that assumes centralized cloud deployment describes a shrinking minority of how AI is actually used.

Major AI companies comply with voluntary frameworks when compliance costs less than noncompliance and when reputational stakes are visible. Both conditions held in late 2023: the AI safety discourse was active, political attention was high, and "signed the Hiroshima Code of Conduct" was a useful thing to say in Senate testimony. The compliance happened, for the companies in the room. Those outside the room were not thinking about this.

iii · what voluntary frameworks actually accomplish

Here is the honest accounting of what the Hiroshima AI Process accomplished, as opposed to what it claimed to accomplish.

It created a shared vocabulary. Regulators, lawyers, and compliance professionals across G7 jurisdictions now have a common reference point when they say "safe and trustworthy AI." That matters more than it sounds. When the next framework is being negotiated, when court cases require expert testimony, when international standards bodies need a starting point, Hiroshima is the citation. Vocabulary is infrastructure.

It demonstrated that rapid multilateral coordination was possible. AI governance could have fragmented completely—each G7 nation proceeding unilaterally, producing incompatible regulatory frameworks that balkanized the global AI market and created regulatory arbitrage on an industrial scale. Hiroshima demonstrated that seven major economies could agree on something substantive in less than a year. That is not nothing. It is actually surprisingly rare in international governance.

It gave compliance-minded companies somewhere to anchor. The Code of Conduct is not legally enforceable, but it became a de facto standard for what "responsible development" looked like to regulators, corporate boards, and litigation risk assessors. Companies that could point to Hiroshima alignment had a defensible position. That created real incentive structures even without legal teeth. Legal analysts have noted that Code of Conduct compliance can function as evidence of good faith in civil liability proceedings, factor into private contracts, and serve as a reference framework for national regulators. The EU AI Act's development was shaped by Hiroshima. American executive orders on AI safety echoed its principles. The voluntary framework created a floor—not the floor it claimed to create, but a real one.

iv · the gap that cannot close

The structural problem with technology governance is that it moves at the speed of politics while the technology moves at the speed of capital.

Politics runs on electoral cycles, treaty ratification, legislative calendars, and the consensus arithmetic of parties with competing interests. The Hiroshima Process compressed its timeline dramatically—but still needed seven months to produce something non-binding. GDPR needed six years for something binding and still took two more years to enforce. The EU AI Act, the most ambitious enforceable AI governance regime attempted, has been in development since 2021 and will be catching up to the technology for years.

Technology runs on venture cycles, product launches, and competitive dynamics that punish waiting. The foundational models that generated the 2023 alarm have been succeeded multiple times over. The "advanced AI systems" the Code of Conduct was written to govern are now commodity—distilled, fine-tuned, running locally on consumer devices, generating capabilities their original developers did not anticipate.

This is not a failure of the Hiroshima AI Process specifically. It is a structural feature of governing exponentially-advancing technology with linearly-advancing institutions. The gap between framework and frontier is the permanent condition of technology governance. It does not close. You manage it at the margin, or you do not manage it at all.

The Hiroshima AI Process managed it at the margin. It assembled the most powerful economies in the world, got them to agree on principles for the most consequential technology in decades, and did it in seven months. For G7 governance, that is a sprint. For the pace of AI development, it was still a slow walk.

What the process produced was a framework for the AI of 2023. The systems it was designed to govern have since been through multiple generations, spawned derivative ecosystems it never considered, and created applications that make the original risk scenarios look quaint.

The framework they had to invent was the best they could build under the constraints they faced: enormous political pressure, a technology moving faster than the meetings, and the necessity of consensus among seven governments with different domestic political situations. It will matter in footnotes, contract clauses, and regulatory preambles. Compliance-minded companies will continue to cite it.

And the systems it was meant to govern will be unrecognizable by the time it matters most.

v · sources

• The Hiroshima AI Process: Leading the Global Challenge to Shape Inclusive Governance for Generative AI — Government of Japan, 2024-02-01
• Shaping Global AI Governance: Enhancements and Next Steps for the G7 Hiroshima AI Process — CSIS, 2024
• The Illusion of International Consensus: What the G7 Code of Conduct Means for Global AI Compliance Programs — Arnold & Porter, 2024-01-01
• G7 Leaders Agree on Guiding Principles and Code of Conduct on Artificial Intelligence — Hunton Andrews Kurth, 2023-11-01