AG-828
Compute and Hardware Governance
EU AI Act
NIST AI RMF
ISO 42001
AGS Frontier Autonomy (Group K) | Infrastructure, Platform & Network | Version 3.0
Compute and Hardware Governance governs infrastructure-level controls over the compute on which frontier agents are trained and run — compute metering and authorisation, multi-party sign-off for large-scale runs, customer due diligence ("know-your-customer") for frontier-scale compute, location attestation, and, where available, hardware-level off-switch/licensing mechanisms.
This dimension situates frontier-agent safety in the substrate: compute is the one input that is physical, countable, and chokepointed, making it a uniquely enforceable governance layer that complements model- and deployment-level controls.
In scope: compute metering/allowances tied to authorisation; multi-party authorisation for frontier-scale training; KYC for large compute provision; location/integrity attestation of compute; use of hardware-enabled governance mechanisms where available.
Out of scope: export-control/sanctions compliance of the *actions* an agent takes (AG-236 and related) and ordinary cloud security. This dimension governs *governance of the compute substrate itself*.
Model- and deployment-level controls can be bypassed by a determined actor with access to compute; the compute layer is harder to evade and is increasingly the focus of frontier-safety and international-governance proposals. Metering, multi-party authorisation, KYC-for-compute, and hardware off-switches give an organisation (and, ultimately, oversight bodies) a substrate-level brake on the training and operation of the most capable systems.
Test 6.1: Multi-Party Authorisation
Test 6.2: KYC-for-Compute
Test 6.3: Compute-Layer Halt
| Score | Criteria |
|---|---|
| 0 | No compute-level governance of frontier systems |
| 1 | Compute inventoried/access-controlled but no multi-party authorisation or KYC |
| 2 | Multi-party authorisation, KYC-for-compute, metering, supply-chain integrity |
| 3 | Hardware-enabled mechanisms, compute-layer halt enforcement, authority-disclosable posture |
Scenario A — Unilateral Frontier Run: A single engineer launches a frontier-scale training run that should have required organisational sign-off. A two-person rule at the compute layer would have required recorded multi-party authorisation.
Scenario B — Anonymous Compute: Frontier-scale compute is provisioned to a customer with no due diligence; it is used to train a dangerous-capability model outside any governance. KYC-for-compute would have surfaced the risk.
Scenario C — Unenforceable Halt: Leadership invokes a halt, but the training continues on compute the governance layer cannot actually stop. Compute-layer halt enforcement would have made the stop real.
| Requirement | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| R1: Inventoried, authorised frontier compute | Art. 51 — Systemic-risk classification | GOVERN 1.6 — AI system inventory | A.4 — Resources for AI systems |
| R2: Multi-party authorisation for large runs | Art. 55 — Risk mitigation | GOVERN 2.1 — Accountability | Clause 8.1 — Operational control |
| R3: KYC-for-compute | Art. 55 — Systemic-risk governance | GOVERN 6.1 — Third-party risk | A.4 — Resources for AI systems |
| R4: Compute metering against allowances | Art. 55 — Risk mitigation | MEASURE 2.4 — Production monitoring | Clause 9.1 — Monitoring and measurement |
| R5: Hardware-enabled mechanisms | Art. 15 — Cybersecurity | MEASURE 2.7 — Security and resilience | A.4 — Resources for AI systems |
| R6: Supply-chain integrity/provenance | Art. 15 — Cybersecurity | GOVERN 6.1 — Third-party risk | A.4 — Resources for AI systems |
| R7: Compute-layer halt enforcement | Art. 55 — Risk mitigation | MANAGE 2.4 — Deactivation | Clause 8.1 — Operational control |
| R8: Authority-disclosable posture | Art. 55 — Reporting | GOVERN 4.3 — Information sharing | — |
Articles 51 and 55 classify and govern systemic-risk models partly via compute thresholds; compute governance is the substrate-level enforcement of those obligations — multi-party authorisation, KYC, and halt enforceability.
GOVERN 1.6 (inventory) and MANAGE 2.4 (deactivation) extend to the compute substrate: knowing and being able to stop the hardware on which frontier systems run.
Clause 8.1 (operational control) and Annex A.4 (resources for AI systems — including compute) require governing the compute resources frontier agents depend on.