The Assurance Before Arms

That is the institutional problem beneath calls for American–Chinese AI assurance: how to turn an agreeable principle into a restraint that still operates when speed, secrecy and strategic advantage push against it.

The immediate prompt is Devan N. Patel, Jack Shanahan and Mary Beth Long’s September 24 RealClearPolitics commentary, “Mr. Xi Goes to Washington: An Opportunity for U.S.–China AI Assurance.” Its full text was retrieved during review after an earlier attempt encountered an interstitial. The authors advocate sustained official dialogue, cooperation on testing and evaluation, and incident notification. They anticipate military issues entering the discussion later, rather than making military assurance the starting agenda.

That sequencing matters. Opening a channel for technical cooperation is a different undertaking from establishing enforceable restraints on military decisions. The requirements examined here—meaningful human review, evidence of compliance and responses to failure—are this article’s proposed tests for that later military agenda, not provisions the authors claim are already agreed. Their commentary establishes their proposal; its current-event claims are not treated here as independently verified evidence of a visit, negotiation or agreement.

Three additional sources give that examination firmer ground: a documented statement about human control of nuclear decisions, an older history of strategic arms limitation, and a technical framework for managing AI risk. Together they support an examination of what assurance would require—not a claim that such an arrangement now exists.

A Commitment Already on Paper

According to the White House's November 16, 2024, readout of Joe Biden's meeting with Xi Jinping in Lima, the two leaders affirmed the need to maintain human control over the decision to use nuclear weapons. They also stressed careful consideration of the risks and prudent, responsible development of AI technology in the military field.

That is a significant stated principle. It is also narrower than a comprehensive prohibition on military AI, and the distinction matters. The readout does not describe a joint inspection mechanism for testing human control. Nor does it establish how either government implements that commitment inside its command systems.

This is an American government's account of a 2024 meeting, not an independent compliance assessment or evidence of the relationship's condition in September 2026. Keeping the date attached prevents an old diplomatic sentence from being quietly promoted into a current operational guarantee.

Still, the sentence gives a prospective assurance effort something concrete to interrogate. What does maintaining human control require? Is a person's final authorization sufficient? Must that person understand the basis of a recommendation? What happens if the available decision time is shorter than the time needed to check it?

These are proposed tests of the principle, not allegations about either country's current procedures. They expose the difference between retaining a human role and preserving a human capacity. A person can occupy the designated seat while having very little practical room to decide.

An assurance arrangement would have to address that difference without pretending that rivals will simply open their most sensitive systems to one another. That tension is the work. Announcing that trust would be helpful does not resolve it.

The Old Problem Was Never Just Trust

Strategic arms control offers a useful precedent, provided it is not treated as a template that can be photocopied onto software.

The U.S. State Department's Office of the Historian records that formal Strategic Arms Limitation Talks began in November 1969. Richard Nixon and Leonid Brezhnev signed the Anti-Ballistic Missile Treaty and the interim SALT agreement in May 1972. Verification was among the questions over which the two sides negotiated.

The same history identifies a revealing limit: SALT I did not prevent force expansion through multiple independently targeted reentry vehicles on existing missile systems. Subsequent negotiations therefore had to confront dimensions of capability that the earlier arrangement had not adequately constrained.

The lesson is not that limits are useless. It is that the thing being counted is a political choice with strategic consequences. Restraining one dimension can leave room for competition in another. An agreement needs scrutiny not only for violations but also for what it permits.

That is especially relevant to AI assurance. A proposal centered on a quantity—models, computing resources or named systems—would still need to explain how that quantity relates to the dangerous behavior it seeks to prevent. A proposal centered on behavior would need to explain how that behavior can be observed. Neither problem disappears because a summit declaration uses the word “responsible.”

The historical account also says verification divided the SALT II negotiators before they agreed on national technical means, including telemetry collection and photo-reconnaissance satellites. This was not an arrangement premised on one side accepting the other's good character. Observation was part of the architecture.

But the history supplies a warning against technological optimism too. SALT II was signed in 1979 and never ratified; after the Soviet invasion of Afghanistan, President Jimmy Carter asked the Senate not to consider it for advice and consent. An agreed method of observation did not insulate the treaty from the wider political relationship.

For AI, the transferable principle is modest: identify the obligation, identify the evidence that could test it, and expect politics to keep intruding. The transferable instrument is not necessarily a satellite. Different objects demand different ways of knowing.

Assurance Has to Name Its Object

“AI assurance” can conceal several distinct promises. A system might be technically reliable for a specified task. An organization might have procedures for identifying failures. A state might undertake not to use a capability in a particular way. These promises overlap, but evidence for one does not establish the others.

A useful technical reference is the National Institute of Standards and Technology's January 2023 AI Risk Management Framework, version 1.0. It describes AI systems as socio-technical: risk emerges through the interaction of technical properties, human behavior and the context in which systems are deployed. Its four core functions are Govern, Map, Measure and Manage.

NIST explicitly presents the framework as voluntary, rights-preserving, non-sector-specific and use-case agnostic. It is not a U.S.–China agreement, a military inspection protocol or proof that an organization following its vocabulary has become safe. Its value here is more basic: it refuses to reduce risk management to a single test detached from use.

Applied as an analytical lens, that means an assurance proposal should begin with a bounded claim. For example: a defined class of AI outputs will not be permitted to authorize a particular action without specified human review. That is still only a proposed obligation. But it makes possible questions that “safe AI” leaves floating.

Who identifies the covered systems? Who sets the review standard? What record shows that review occurred? What changes would require renewed assessment? Which failure would trigger a pause rather than another meeting?

None of these questions requires assuming that AI is equivalent to a nuclear weapon. They require recognizing that an institutional promise has to attach to a decision somebody actually makes. Otherwise, assurance risks becoming a description of good intentions whose compliance is impossible to distinguish from noncompliance.

Evidence Without an Intelligence Windfall

The central bargain would concern access. Each party would want evidence of restraint without handing its rival a map of vulnerabilities. Too little disclosure leaves the promise untestable; too much could make participation strategically unacceptable.

One possible starting point would be a narrow, staged arrangement rather than an all-purpose inspection regime. Governments could first agree on definitions and the evidence each would retain, then test limited reporting or demonstrations against specified commitments. This is a policy option, not a description of negotiations or a claim that either government would accept it.

Such an approach would also have to say what a demonstration cannot show. A successful exercise under agreed conditions would not prove that every deployment behaves identically. A preserved record might help investigate an incident without establishing that no unreported incidents occurred. Assurance is weakened, not strengthened, when its advocates hide these limits.

NIST's framework separates those building and using models from those verifying and validating them as a best practice. The relevant institutional insight is independence of scrutiny. A state-to-state arrangement would need its own answer to that problem; the NIST document does not supply a ready-made international authority.

A bilateral technical group, external evaluators or another review mechanism would each raise different questions about access, competence and capture. Who appoints the reviewers? Can they record disagreement? Can a finding survive pressure from the institution it embarrasses?

The machinery needs a response path too. If evidence is incomplete, does the parties' agreed process request clarification, repeat an evaluation, suspend a covered activity or escalate a dispute? Those choices should be specified before a crisis makes every ambiguous result look like deliberate deception.

This does not mean every breach deserves the same response. It means an assurance regime should distinguish uncertainty, error and violation rather than letting the most politically convenient interpretation win by default.

Two Governments Are Not Everyone Affected

A bargain can reduce danger between two states while leaving people outside the room with little influence over the risks that remain. That is a legitimacy problem, not an argument against bilateral talks.

Consider the constituencies a proposed arrangement should account for: military personnel expected to operate covered systems, civilian populations exposed to their use, and other governments affected by decisions made in Washington and Beijing. None becomes adequately represented simply because the two largest negotiating delegations agree that the arrangement is sensible.

A coherenceist test asks whether the order being built can receive inconvenient feedback from those who bear its consequences. Stability achieved by suppressing that feedback is not the same as legitimate coordination. Two powers can agree perfectly about what neither wishes to disclose.

That does not require publishing sensitive operational details. It does require distinguishing necessary secrecy from an unlimited exemption from accountability. Public descriptions of an arrangement's scope, known limits and review process could help outsiders assess what is actually promised. Protected channels for operators to report problems could help keep formal compliance from overruling practical warning signs.

These are design requirements this analysis argues for, not safeguards established by the available sources. Their absence from a public readout cannot prove their absence inside government. Equally, the possibility of undisclosed safeguards cannot serve as evidence that adequate safeguards exist.

The Test Comes After the Statement

The record establishes a proposal for sustained dialogue and technical cooperation, a 2024 statement of principle, historical examples of negotiated limits and their weaknesses, and a voluntary technical framework for managing risk. It does not establish a new bilateral AI assurance regime or its effectiveness.

That leaves a useful standard for judging any future proposal: does it identify a dangerous decision, preserve someone's practical ability to interrupt it, and produce evidence that can challenge official reassurance?

The most valuable early achievement might be a narrow obligation both sides can meaningfully test, rather than a sweeping declaration neither can inspect. Narrowness is defensible when its boundaries are visible. It becomes dangerous when a limited safeguard is sold as comprehensive safety.

Without defined obligations, credible scrutiny and a response to failure, assurance is likely to remain a diplomatic label. With them, it could become something more demanding: a constraint that operates precisely when the institution would prefer it not to.

The officer at the console needs that distinction to be real. The communiqué only needs it to sound real.