What compute-based AI rules actually ask of labs

When governments started writing rules for frontier AI, they faced an awkward problem: how do you define the thing you're regulating? Capability is hard to measure and harder to agree on. So the rules that emerged — most prominently the EU's obligations for general-purpose models — reached for a proxy that's at least countable: the amount of compute used in training.

A compute threshold is a blunt instrument, and everyone involved knows it. Training FLOPs correlate with capability, but the correlation is noisy and getting noisier as labs squeeze more out of less. Still, blunt instruments have one virtue that matters enormously in law: you can verify them. A number either crossed the line or it didn't.

The obligations behind the threshold

Strip away the legal language and the requirements cluster into three families. Documentation: keep detailed technical records of how the model was trained, on what data, with what compute. Evaluation: test for the specific risks the rules care about and write down what you found. Disclosure: tell the regulator — and in some cases the public — what you built, and report serious incidents when they happen.

For the largest labs, most of this formalizes what internal governance teams already do. The real change is that the paper trail becomes legible to outsiders, on a schedule the lab doesn't control. That shift — from voluntary transparency to auditable obligation — is the substance of the entire regulatory project so far.

Where the friction shows up

The open questions are practical. How do you count compute across mixed hardware and resumed runs? Does fine-tuning an existing model start the clock again? What happens to open-weight releases where the developer can't monitor downstream use? Each of these has provisional answers today and will likely have different ones in five years.

The pattern to watch isn't any single rule. It's whether compute stays the anchor at all. If capability keeps decoupling from raw training scale, regulators will eventually need a better proxy — and the labs' own evaluation science, ironically, is the most likely place they'll find it.