Why Incumbents Want to Set the Rules

Aidan Gomez, the CEO of Cohere, recently challenged the efforts by major AI labs to shape government policy on safety standards. The concern is that these dominant firms are requesting to bend competition rules to define how safety is audited and enforced. By establishing their internal processes as the industry standard, these companies move the sector toward a structure where market entry is dictated by the ability to comply with incumbent-designed protocols rather than technical innovation.

The Mechanism of Regulatory Capture

When a group of labs synchronizes their auditing processes, they define the industry’s operational baseline. The transition from private coordination to public barrier occurs when these informal agreements are translated into technical requirements for government procurement. If a regulatory body codifies these protocols, the cost of compliance scales based on the intensity of the monitoring infrastructure required.

For a startup, these requirements are not mere administrative tasks. They are engineering mandates. If a procurement law requires vendors to provide proof of safety via the specific auditing infrastructure favored by incumbents, a smaller competitor must either pay the incumbent's fees to use their auditing service or build an identical, multi-million dollar monitoring stack just to qualify. The standard ceases to be a measure of safety and becomes a financial filter. It ensures only those with the capital to maintain the specific overhead of an incumbent-style monitoring pipeline can participate.

Competitive vs. Cartel Models

Centralized authority over safety is distinct from a market-driven process where safety is treated as a performance feature. In an open environment, builders iterate on alignment and reliability under the pressure of competition. If a smaller model outperforms a larger one on safety-related metrics, the market naturally shifts. When safety is managed by a cartel, the standards are set to protect the infrastructure the leaders have already built. Architectural shifts that could make these legacy approaches obsolete are often marginalized because they fail to meet the rigid, checkbox-based compliance criteria required by the established regulatory framework. For instance, if an audit protocol demands a specific, legacy-style verification log that a new, more efficient architecture does not require or produce, that new architecture is excluded from government use even if it is objectively safer.

Consider the practical friction for a developer building a search interface for defense contractors. You typically assess a model based on latency, inference cost, and output reliability. If the incumbents successfully lobby to mandate that only models passing their specific auditing processes can interact with sensitive data, your choice is no longer about capability. It is about compliance. You are forced into the incumbents' ecosystem, not because it provides the best performance for your product, but because it is the only one that carries the required regulatory seal of approval.

The Persistence of Codified Standards

Administrative simplicity often leads to entrenched market structures that are difficult to unwind. Once these frameworks are written into law, they create statutory lock-in. Even if a new, superior model architecture arrives that makes existing safety protocols technically irrelevant, the regulatory hurdle remains. These systems are designed to validate a specific way of working, and the bureaucracy required to change that definition often outlives the relevance of the original technology.

We do not yet know how federal procurement bills will categorize the minimum viable audit for these systems. If the definition remains tied to the specific, heavy-infrastructure methodologies of today's largest models, the barrier to entry for the next generation of architectures is being set in stone. The danger is that we formalize the current state of technology as the only legal way to be safe.