Paris Declaration on AI safety and security: what OpenAI, Anthropic and six governments signed

The Paris Declaration on AI Safety and Security is the most specific multi-company safety text of the autumn, and also one of the softest. Signed on Monday, November 9, 2026, it puts OpenAI, Anthropic, Microsoft and Mistral AI beside a handful of governments on three promises: evaluate frontier models the same way, share incidents, and build ways to shut models down. It does not say what happens if anyone fails.

Who signed, and why the lists differ

The Canadian prime minister's office published the declaration on November 9, 2026, dated Ottawa. It lists six heads of state and government: Bahrain, Canada, Finland, France, Norway and the Netherlands. It lists ten companies: Anthropic, Black Forest Labs, Cohere, Domyn, Hugging Face, Microsoft, Mistral AI, OpenAI, Sakana AI and Synthesia. Four civil society groups also appear: LawZero, SaferAI, AI Safety Connect and Ifri. The page says the statement remains open to new endorsements and is being updated.

The Dutch government's copy, published November 10, 2026, is not identical. It lists nine governments, adding Japan, Sierra Leone and the United Kingdom, and nine companies, without Sakana AI. A commentary by Xenospectrum, citing the list published by the French presidency as of November 11, counts 16 governments and says Germany, the United States, the United Kingdom and Japan are not on it. Those accounts conflict, and we could not reconcile them. Until the signatories settle, treat any count as provisional and check the official page.

The three commitments

The text names three areas of consensus: a clear and predictable regulatory framework, tangible results on transparency and incident reporting, and "the absolute necessity of implementing rigorous evaluation standards." Each becomes a commitment.

The first is a common framework for evaluating and managing frontier risk, with a focus on misuse, including cyber and chemical, biological, radiological and nuclear threats, and on loss of control. Signatories also commit to publishing "the non-sensitive findings of our evaluations in a standardized format." The word non-sensitive carries weight: the labs decide what is sensitive.

The second is accountability. Developers would disclose model capabilities, limitations and known risks, support independent evaluation and implement "fail-safe mechanisms to shut down model operations within their control." Policymakers would clarify liability for large-scale harm, including across borders. The text acknowledges "the risk posed by the removal or circumvention of safeguards, including abliteration," while saying open-weight development should keep its benefits.

The third is information sharing: rapid alert systems, serious incident sharing, and "secure and confidential channels" for whistleblowers raising concerns about systemic risks.

What it does not do

Read the hedges. The Dutch copy uses phrases such as "where appropriate," "as appropriate" and "could" throughout, and several items are framed as explorations, such as whether a cooperation mechanism "would help." Xenospectrum reports that of the five developer provisions only the disclosure of capabilities, limitations and known risks is unconditional, while third-party evaluation applies only where "appropriate and proportionate to risk."

The shutdown pledge is the clearest example. It covers model operations "within their control," so a model whose weights are published and run elsewhere sits outside it. No outside body gains a power to halt anything. The declaration says actors should comply with safety standards set or accredited by national authorities, which could one day make shutdown mechanisms mandatory. As of November 15, 2026, we found no such standards, and neither official text states a legal status.

This is not a new idea. The Seoul Frontier Safety Commitments of 2024, now signed by 20 organizations according to the UK government's page, already asked labs to set thresholds at which risks would be "deemed intolerable" and, in the extreme, "not to develop or deploy a model or system at all." That page does not mention shutdown. The Paris text adds the shutdown language and a shared evaluation framework, but it repeats the Seoul pattern: voluntary pledges with no verifier.

Why it still matters

Three things make it more than a press moment. First, it puts a shared framework for evaluations on the table in writing, signed by labs that normally publish their own incompatible reports. Second, it names loss of control as a risk class beside misuse, which fits the debate in our explainer on AI loss of control. Third, it commits governments to whistleblower channels, a promise that can be tested within a year.

The incident-sharing pledge also lands on top of binding rules that already exist. Our tracker of incident reporting requirements shows California, the EU and a House bill setting hard clocks of 15 days or 48 hours. A voluntary alert system that lags those clocks would add little.

Where it sits among earlier texts

The Canadian page frames the declaration as a continuation, citing the Hiroshima process and the Seoul Frontier Safety Commitments, and argues that frontier AI development and risks are global, so no single actor can manage them alone. That framing matters because each earlier text relied on the same mechanism: companies and governments say what they intend, then publish their own progress. The Paris text keeps that mechanism and adds two ingredients, a shared evaluation format and a shared repository for non-sensitive findings. A repository only helps if labs fill it, and the text sets no schedule for doing so.

The governments' side of the bargain is also thin. Policymakers commit to clarifying liability for large-scale harm, including cross-border harm, and to confidential whistleblower channels. Neither promise comes with a date. For a reader trying to judge the declaration, the useful test is whether any signatory government turns those promises into a bill, a regulator's guidance or a funded office within the next year.

Our take

Credit the signatories for putting shutdown and standardized evaluation results in the same sentence. Do not mistake that for oversight. The test is not the signing, it is what follows: published evaluation formats within months, a named body that receives incident reports, and standards from at least one national authority that make the shutdown pledge enforceable. Absent Google, Meta and xAI on the lists we checked, and with the United States unclear, this is a coalition of the willing. We would watch for three things: the first standardized evaluation report, the first incident shared under the text, and any government adding its name after November 15.