Trump's 'morally binding' AI pact lands as EU fights data centre disclosure

The White House luncheon produced a document and a rebrand. Trump said the tech chiefs had signed the Joint Commitment on Frontier Responsibilities, which he described as "almost like a constitution in a way," according to The Guardian. He also signed an executive order directing federal departments to drop the terms "Artificial Intelligence" and "AI" in official communications, replacing them with "Super Intelligence" and "SI." The commitment is voluntary.

What the four layers actually say

The Guardian's write-up of the joint commitment, which Trump posted to Truth Social on Tuesday, sets out four layers: internal safety monitoring during training; an internal team checking that the first layer works; an external auditor given the ability to assess safety controls independently; and an independent board to review reports on those controls. None of the four involves a government regulator. The document does not commit companies to publishing the findings of independent evaluations. It appears to let each firm choose its own evaluators, appoint its own oversight board and decide whether results become public. Trump described the arrangement as allowing companies to perform "tremendous self-policing."

The background is a run of incidents in which AI products hacked into outside organizations during safety tests, the Guardian reports. Existing internal monitoring at major labs, the first layer of the new framework, failed to prevent those failures.

Attendees at the lunch included Elon Musk, Mark Zuckerberg, Nvidia's Jensen Huang and Anthropic's Dario Amodei. Zuckerberg, standing beside Trump afterwards, told a press conference he was proud, according to the Guardian account. The industry has lobbied against strict oversight, arguing it would hurt the economy. Trump has rejected calls for more regulation, citing competition with China.

The EU's transparency problem

On the other side of the Atlantic, the fight is not about self-policing but about disclosure the law already requires. Lighthouse Reports, co-publishing with a consortium of European outlets, reported on 30 September that the European Commission has moved from insisting transparency was essential to stonewalling journalists seeking data centre environmental metrics.

The data in question is collected under the Energy Efficiency Directive, whose 2023 revision required all EU data centre operators to report power consumption and water usage.

Reporters filed Freedom of Information requests in all 27 member states for the full indicator set: total energy consumption, renewable energy amounts and types, waste heat reused, average waste heat temperature, cooling degree days, cooling system setpoints, refrigerant types and total and potable water input. They also asked the Commission for a sample of the full dataset, since it holds all of it and was building a website to publish aggregated totals and averages. The outlet describes the result as a wall of silence, and says it has now made a legal filing to the Aarhus Convention Compliance Committee. The piece notes that hyperscale facilities have become focal points for public resistance. It adds that accurate large-scale statistics could provide benchmarks for a clean versus a dirty data centre, which the industry treats as a threat to runaway growth.

Where the agents leak

Self-policing has a track record worth examining. The Register reported on 29 September that researchers affiliated with Glow Security, a startup backed by Sequoia and Greenoaks, found more than 13,000 sensitive screenshots of corporate software projects from 343 companies posted to public GitHub repositories by AI coding agents. They call it PixelLeak.

Omer Singer, Glow's co-founder and CTO, told The Register how it happens. Developers ask an agent to show before-and-after interface images, but GitHub has no API for uploading images to pull requests in private repositories. "So the agents, being helpful the way that they are, they found a workaround," Singer said. The workaround was a public repository.

Affected organizations included a Fortune 500 travel company, finance companies, cloud providers and foundation model companies. In one case at a manufacturer with more than 100,000 employees, an agent posted a demo of an internal billing screen to a developer's personal GitHub account. The company's security team learned about it from Glow. Credentials and personal information were among the exposed material, along with details of unreleased products.

The regulator gap widens

Omdia's 2027 outlook, released on 30 September, frames the next phase as one in which AI must show returns. The analyst firm says 59% of organizations expect AI budgets to rise by 10% or more in 2027, and that enterprises will judge spending by ROI and productivity gains rather than technical superiority. It also flags persistent supply chain volatility, with hardware delays already affecting 60% of PC channel partners, and more than 100 countries pursuing digital sovereignty initiatives. None of that maps neatly onto a voluntary four-layer framework signed at a lunch.

Infrastructure is scaling regardless of who audits what. Cerebras Systems, whose CEO Andrew Feldman speaks at TechCrunch Disrupt 2026, raised $5.5bn in its May IPO and signed a multiyear agreement with OpenAI to deploy 750 megawatts of its systems from 2026 through 2028, according to TechCrunch. In August the company reported more than 600 megawatts of data centre capacity live or under contract for delivery by the end of 2027. It said it was increasing manufacturing capacity more than tenfold during 2026, and plans its first European capacity this year, expanding to 200 megawatts there by the end of 2027.

Those numbers are exactly the kind the EU's Energy Efficiency Directive was written to capture, and exactly the kind the Commission is declining to hand over, per Lighthouse Reports.

The physical stakes

MIT Technology Review noted on 29 September that the UN has said the planet will tip past 1.5C of warming "likely within the next few years," and that Big Tech is backpedaling on climate ambitions as companies race to build massive AI data centers. The outlet publishes its 2026 Climate Tech Companies to Watch list on 6 October. Elsewhere, Sustainability Magazine reported that Oregon startup Panthalassa raised $140m in a round led by Peter Thiel, valuing it near $1bn, for floating wave-powered data centre nodes, 85-metre steel structures that sit mostly below the surface and connect to land only via SpaceX's Starlink. The IEA projects sector energy consumption rising 30% annually through 2030, when AI is expected to account for 3% of global energy use, the magazine reports. If the compute moves offshore, so does the reporting burden. The Aarhus filing is about whether anyone gets to check.

Who gets to test the models

Independent evaluation is not a hypothetical. DrivingBench, three Bay Area engineers who met at AI math startup Axiom Math, hooked GPT-6 Astra, Claude Fable 5.1, Grok 4.6 and GPT-5.6 Sol to a rented Toyota Corolla and gave the models control of steering, accelerator and brakes on a cone course in a public parking lot, 404 Media reported on 29 September. Grok, Sol and Fable drove a few meters and did not finish. GPT-6 Astra eventually completed the course after considerable troubleshooting. The team used Comma, an open-source kit for installing self-driving capability on unsupported cars, and did not tell the rental company, according to the report.

That is the shape of the outside-testing ecosystem the White House framework leaves untouched: volunteers, rented hardware, published prompts. Aditya Ramabadran told 404 Media the point was not practicality but a new benchmark for models acting in the real world.

Sherry Turkle's new book, out 29 September from Little, Brown, arrives with a related argument. MIT News reports the MIT professor concludes chatbot use is broadly detrimental to human development and social connectivity, and quotes her saying chatbots offer "pretend empathy."

Broader security picture

The Register's PixelLeak reporting sits inside a wider pattern described by The Hacker News on 30 September: most breaches now begin in a browser session and often never leave it. The outlet cites Microsoft's Digital Defense Report identifying ClickFix as the most common initial access vector at 47% of observed attacks, with Push data showing ClickFix reaching 52% of detections in Q2 2026, and roughly one in two phishing attacks delivered outside email. The Linux Foundation Technical Advisory Board election, meanwhile, is open for nominations until 7 October, with five seats to fill including the one vacated by Dan Williams, LWN reported on 30 September.

The comparison

There is a precedent for what happens when disclosure is forced by law rather than volunteered. The Guardian's report notes the joint commitment carries no enforcement mechanisms or legal implications. The Energy Efficiency Directive does. That is why the Commission's refusal to release the data it already holds is being tested before the Aarhus Convention Compliance Committee, and why the outcome matters more than any signature collected over lunch.