Conference Agenda

Recent AI policy debates have focused on model-level obligations, safety evaluations, export controls, and reporting duties for advanced systems. Yet many of the hardest governance problems arise one level deeper, at the level of compute allocation and monitoring. Frontier model development depends on scarce and highly concentrated compute infrastructure, while the social risks associated with a training run are not determined by raw compute alone but by compute combined with model characteristics, safety practices, and evaluation outcomes. Current regulatory approaches rely predominantly on binary compute thresholds---fixed FLOP cutoffs in the EU AI Act and the former U.S. Executive Order 14110---that create cliff effects, invite threshold-gaming, and ignore heterogeneous risk profiles across applications. This paper asks a question directly relevant to communications and technology policy: how can regulators govern high-risk AI development when compute use is only imperfectly observable, model risk is heterogeneous, and blunt ex ante prohibitions are both over-inclusive and easy to evade?

The paper develops a mechanism-design framework for risk-weighted compute permits. A regulator sets an aggregate cap on risk-weighted compute and requires developers to surrender permits in proportion to metered compute multiplied by a risk weight. The risk weight depends on observable or auditable features: capability evaluations, deployment context, and the presence or absence of specified safety controls. Permits are tradable, allowing scarce compute capacity to flow toward projects with the highest private value subject to a public risk constraint. The central regulatory problem is that developers hold private information about true compute consumption, effort on safety, and the full hazard profile of a given training run. The paper therefore embeds permit trading inside an imperfect-monitoring regime with probabilistic audits, reporting requirements, and convex penalties for under-reporting or non-compliance.

Methodologically, the paper combines formal mechanism design with regulatory-economics analysis of enforcement. Developers choose compute intensity, safety effort, and reporting behavior under incomplete monitoring. The regulator chooses the cap, the risk-weighting rule, the audit schedule, and the penalty structure. The analysis characterizes conditions under which a risk-weighted permit market outperforms simple compute thresholds, licensing based only on firm size, or purely discretionary case-by-case review. The paper also studies when permit prices serve as socially informative signals of scarcity and risk, and when market design must be complemented by non-market guardrails such as mandatory evaluations, cloud-provider reporting obligations, and minimum safety standards. The disciplinary approach draws on mechanism design, industrial organization, information economics, and comparative institutional analysis of existing environmental permit markets (the EU Emissions Trading System and SO2 allowance trading under the U.S. Clean Air Act).

This research contributes to several literatures at once. For communications and Internet policy, it treats compute infrastructure as a governable bottleneck in the digital economy and connects AI oversight to longstanding policy debates about metering, access, compliance costs, and regulated markets. For AI governance, it shifts attention from downstream model outputs alone to the allocative and monitoring problem at the infrastructure layer. For regulatory economics, it shows how tradable rights can be adapted to a setting where the regulated object is not pollution or spectrum but risk-weighted access to computational capacity under uncertainty.

The expected conclusion is not that markets can replace all other forms of AI governance. Rather, the paper argues that a well-designed risk-weighted permit system improves on current approaches by making tradeoffs explicit, decentralizing low-risk innovation, and concentrating regulatory scrutiny where marginal social risk is highest. Under plausible assumptions, the combination of permit trading, random audits, evaluation-contingent risk weights, and escalating penalties yields better compliance and lower welfare loss than uniform compute caps or vague conduct standards alone. The paper closes by outlining practical implementation paths---cloud-provider reporting, chip-level telemetry, procurement-linked compliance, and phased regional adoption---that do not require a fully global regime to generate enforcement value.