A Draft of a Treaty, with Annotations

Article XIII: ISIA Reviews

1. For AI models created via declared training or post‑training within the limits of Article IV, the ISIA may require evaluations and other tests. These tests will inform whether the thresholds set in Article IV, Article V, Article VII, and Article VIII need to be revised. The methods used for reviews will be determined by the ISIA and may be updated.
2. Evaluations shall be conducted at ISIA facilities or monitored CCCs, by ISIA officials. Officials from Treaty Parties may be informed which tests are conducted, and the ISIA may provide a summary of the test results. Parties will not gain access to AI models they did not train, except when granted access by the model owner, and the ISIA will take steps to ensure the security of sensitive information.
3. The ISIA may share detailed information with Parties or the public, if the Director-General deems that this may be necessary to reduce the chance of human extinction from advanced AI.

Precedent

Precedents for ISIA-mandated tests with oversight are shared with precedents around chip use verification discussed under Article VII, with the missile telemetry sharing protocol of START I being particularly relevant. The added component here in our Article XIII is using collected data to inform recommendations for potential threshold adjustments (which could take place under the precedented mechanisms we discuss with Article XIV).

Regarding the inherent tension between disclosures to the public (Paragraph 3) and the information consolidation provisions of our Article X, we note that the Statute of the IAEA’s Article VII confidentiality provision^[1] has not prevented it from publishing regular and detailed reports on major developments in its associated field and their implications for global security.

Notes

The purpose of Article XIII is to ensure the ISIA stays up to date with the state of the field of AI, in case it is advancing. For example, reviewing declared training would allow the ISIA to understand the level of AI capabilities that can be reached with different levels of training FLOP. Even with algorithmic research banned, there may be progress that cannot be effectively stopped, and the ISIA must keep track of it.

Additionally, the ISIA has reason to monitor progress in capabilities elicitation. For example, new prompting methods could be discovered that cause an old AI to perform much better on some critical evaluation metric.

We envision ISIA reviews that also involve capability evaluations to make sure AIs aren’t getting dangerously capable in specific domains. They could also look at the training data to ensure AIs aren’t being trained for specifically dangerous tasks (like automating AI research), or to test for unexpected AI behavior.

When reviews reveal shifts in the AI development landscape, those shifts could necessitate changes to thresholds relevant to Article IV and Article V, and changes to the definitions of Restricted Research in Article VIII, with those changes implemented according to the mechanisms in Article III.