Within Governance
Can Cloud Providers Police Frontier AI Training?
Cloud platforms could become enforcement points for tracking large AI training jobs and identifying high-risk activity.
On this page
- Why Clouds Are a Governance Choke Point
- Know Your Customer and Usage Monitoring
- Privacy, Enforcement and Evasion Risks
Page outline Jump by section
Introduction
Cloud providers sit at the centre of many proposals for governing frontier AI. The basic idea is simple: if the most powerful AI systems require enormous amounts of computing power, then the companies that provide that computing power may be one of the few practical places where oversight can occur. Rather than trying to monitor every AI developer directly, governments could require major cloud providers to identify customers, record large training runs, and report activities that cross specified risk thresholds. Supporters see this as a realistic way to reduce the chances of dangerous AI development slipping entirely out of view. Critics question whether such monitoring would work in practice, whether it would be compatible with privacy and commercial confidentiality, and whether determined actors could simply evade it. [cdn.governance. ai]
Within debates about AI doom and existential risk, cloud monitoring is usually presented as a specific implementation mechanism within broader compute governance. The goal is not to prove that advanced AI will become existentially dangerous, but to create visibility and intervention points if highly capable systems begin to emerge. [arXiv]arxiv.orgSource details in endnotes.
Why Clouds Are a Governance Choke Point
A recurring observation in AI governance is that frontier model training is unusually concentrated. Training the largest systems often requires vast clusters of specialised AI chips, extensive engineering support, and access to data-centre infrastructure that only a small number of companies can provide. Researchers have therefore argued that cloud providers occupy a natural “choke point” in the AI ecosystem. [AAAI Publications]ojs.aaai.orgAAAI PublicationsDetecting Compute Structuring in AI Governance Is Likely…by E Seferis · 2026 — A1: There are only a few cloud provide…
For AI doom advocates, this concentration matters because it creates one of the few locations where monitoring may be technically and economically feasible. Instead of tracking millions of users or software projects, regulators could focus on a relatively small number of infrastructure providers. Cloud operators already collect information about workloads for billing, resource allocation, security, and operational management, meaning some of the information needed for oversight may already exist within normal business processes. [robots.ox.ac.uk]robots.ox.ac.ukHeim et al. 2024 Governing Through the Cloud The Intermediary RoleTHE INTERMEDIARY ROLE OF COMPUTE PROVIDERS…26 Mar 2024 — They store and process valuable technical data during large AI deployments an…
Supporters of cloud oversight typically point to three advantages:
- Visibility: large training runs often leave measurable traces in compute usage.
- Leverage: providers can suspend or restrict access if required by law.
- Scalability: monitoring a handful of providers may be easier than monitoring every developer individually. [arXiv]arxiv.orgSource details in endnotes.
From an existential-risk perspective, the attraction is that warning signs of potentially dangerous capability development could become visible before systems are deployed.
Know Your Customer and Usage Monitoring
The most commonly discussed proposal is a “Know Your Customer” (KYC) framework for AI compute. Borrowed from financial regulation, KYC would require cloud providers to verify the identities of customers undertaking large-scale AI development and to maintain records that could support regulatory oversight. [cdn.governance.ai]cdn.governance.aiOversight for Frontier AI through a Know-Your-CustomerOctober 23, 2023 — by J Egan · 2023 · Cited by 19 — This paper recommends that the US government implement a Know-Your-Customer (KYC) sch…
Under typical proposals, cloud providers would not inspect every computation performed on their systems. Instead, oversight would focus on activities above specified thresholds. These thresholds might be defined by the amount of compute consumed, the scale of the hardware cluster involved, or indicators that a training run could produce frontier-level capabilities. [Institute for Law & AI]law-ai.orgInstitute for Law & AIThe Role of Compute Thresholds for AI GovernanceFebruary 20, 2025 — This article discusses the role of training compute thresholds, which use training compute to determine which potenti…
Proposed monitoring schemes often include:
- Verification of customer identities and beneficial ownership.
- Record-keeping for unusually large compute usage.
- Reporting requirements when training runs exceed regulatory thresholds.
- Procedures for responding to suspicious or prohibited activity.
- Cooperation with export-control and national-security investigations. [cdn.governance.ai]cdn.governance.aiAccessing Controlled AI Chips via Infrastructure as a ServiceAccessing Controlled AI Chips via Infrastructure-as-a-…15 Dec 2023 — The implementation of a cohesive KYC scheme will also ensure cons… [cdn.governance.ai]cdn.governance.aiOversight for Frontier AI through a Know-Your-CustomerOctober 23, 2023 — by J Egan · 2023 · Cited by 19 — This paper recommends that the US government implement a Know-Your-Customer (KYC) sch…
Several policy discussions in the United States have moved in this direction. Following Executive Order 14110, the Department of Commerce proposed rules requiring infrastructure-as-a-service providers to establish customer identification procedures and report certain large AI training activities involving foreign actors. The objective was partly to improve visibility into advanced AI development and reduce opportunities for malicious use of American cloud infrastructure. [Federal Register]federalregister.govFederal Register Proposed RuleFederal RegisterProposed RuleJanuary 29, 2024 — 29 Jan 2024 — The Executive order of October 30, 2023, “Safe, Secure, and Trustworthy Dev… [2www.hoganlovells.com]hoganlovells.comwww.hoganlovells.com U.SDept. of Commerce proposes new “Know Your…26 Feb 2024 — Reports on Large AI Model Training. The proposed rules would require U.S. IaaS…
For proponents of AI doom prevention, such reporting systems are valuable less because they stop dangerous AI automatically and more because they create awareness. A regulator cannot react to a frontier training run it does not know exists.
What Could Cloud Providers Actually Detect?
A common misconception is that cloud providers would need to understand the internal workings of every model. Most proposals do not require this.
Instead, researchers have argued that providers can often infer governance-relevant information from operational data they already collect. Examples include the size of computing clusters, the duration of workloads, resource consumption patterns, and whether a workload resembles large-scale training rather than ordinary software operation. [arXiv]arxiv.orgSource details in endnotes.
This distinction matters because AI governance proposals frequently focus on monitoring compute consumption rather than monitoring model content. If a regulatory framework requires notification when training exceeds a specified threshold, providers may only need evidence that a threshold was crossed, not access to the model’s weights, datasets, or proprietary research. [Institute for Law & AI]law-ai.orgInstitute for Law & AIThe Role of Compute Thresholds for AI GovernanceFebruary 20, 2025 — This article discusses the role of training compute thresholds, which use training compute to determine which potenti…
Supporters argue this approach could reduce privacy concerns while still providing useful oversight. The cloud provider becomes an intermediary that verifies activity levels and customer identities rather than a direct reviewer of AI research. [arXiv]arxiv.orgSource details in endnotes.
Why AI Doom Advocates Care About This Mechanism
Many AI doom arguments involve scenarios in which highly capable systems are developed before adequate safety measures exist. In these narratives, one danger is that frontier capabilities emerge unexpectedly, perhaps inside a competitive race dynamic where organisations are incentivised to prioritise capability gains over caution.
Cloud monitoring is attractive to some safety advocates because it could create earlier warning signals. If regulators receive notice that unusually large training runs are occurring, they may be able to require evaluations, audits, or additional safeguards before deployment. [Future of Life Institute]futureoflife.orgbis rule for establishment of reporting requirementsExpand quarterly reporting requirements to include an up-to-date overview of safety and security practices and prior applicable activitie…
This does not solve the core alignment problem. A cloud provider cannot determine whether a model is genuinely aligned with human interests. However, supporters argue that visibility is a prerequisite for almost every other governance tool. Safety testing, incident response, and capability evaluation become difficult if policymakers do not know which systems are being trained in the first place. [Blog - Lennart Heim]blog.heim.xyzLennart HeimThe Intermediary Role of Compute Providers in AI Regulation13 Mar 2024 — We argue that compute providers should have legal ob…
For this reason, cloud oversight is often framed as an enabling mechanism rather than a complete solution to existential risk.
Privacy, Enforcement and Evasion Risks
The strongest objections focus on privacy, enforceability, and the possibility of circumvention.
Privacy concerns arise because monitoring large training runs inevitably creates pressure for cloud providers to collect more information about customers and workloads. Even if providers only report metadata, critics worry about mission creep, commercial confidentiality, and the creation of surveillance infrastructure that extends beyond frontier AI. Researchers working on cloud-based governance generally acknowledge that balancing oversight with confidentiality is one of the central implementation challenges. [arXiv]arxiv.orgSource details in endnotes.
Enforcement is another concern. A reporting requirement only helps if providers can reliably identify the activities being regulated. Recent modelling work suggests that simple compute-threshold reporting may leave important detection gaps. Developers may be able to distribute workloads, alter training methods, or exploit ambiguities in regulatory definitions. Some forms of future AI training could be significantly harder to detect than current assumptions suggest. [RAND Corporation]rand.orgRRA3686 1RAND CorporationStrategies and Detection Gaps in a Game-Theoretic Model…16 Jun 2025 — The authors outline strategies for cloud service…
Evasion is perhaps the most serious challenge from an AI doom perspective. If frontier development increasingly occurs on privately owned clusters, state-supported infrastructure, or hardware outside regulated jurisdictions, cloud monitoring may capture only part of the relevant activity. International coordination therefore becomes important. A system that works only in one country could push activity elsewhere rather than eliminate it. [arXiv]arxiv.orgSource details in endnotes.
Could Cloud Oversight Meaningfully Reduce Existential Risk?
The evidence does not support either extreme position.
Cloud monitoring is unlikely to provide a complete defence against AI-related existential risks. It does not solve alignment, does not guarantee detection of every dangerous project, and may become less effective if compute becomes cheaper and more decentralised. Critics are therefore correct that cloud oversight should not be confused with a comprehensive AI safety strategy. [RAND Corporation]rand.orgRRA3686 1RAND CorporationStrategies and Detection Gaps in a Game-Theoretic Model…16 Jun 2025 — The authors outline strategies for cloud service…
At the same time, many governance researchers view cloud providers as one of the most practical enforcement points currently available. Compared with attempting to monitor algorithms, datasets, or individual researchers directly, cloud infrastructure offers a comparatively concentrated and observable target for regulation. This is why proposals for KYC requirements, training-run reporting, and compute thresholds have received sustained attention in frontier-AI policy discussions. [arXiv]arxiv.orgSource details in endnotes.
The key uncertainty is not whether cloud providers can provide some visibility into frontier AI development. They almost certainly can. The open question is how much visibility they can provide before privacy costs, international coordination problems, and technical evasion strategies begin to undermine the system. For debates about AI doom, that uncertainty is central: cloud oversight may be one of the most realistic governance tools available, yet its ability to prevent loss-of-control scenarios remains unproven. [arXiv]arxiv.orgSource details in endnotes. [RAND]rand.orgRRA3686 1RAND CorporationStrategies and Detection Gaps in a Game-Theoretic Model…16 Jun 2025 — The authors outline strategies for cloud service…
eBay marketplace picks
Marketplace Samples
Example marketplace items related to this page. Use the search link to explore similar finds on eBay.
![Listing image for Dell PowerEdge R730xd 16LFF+2SFF Server /IndigoVision NVR-AS 4000/32GB RAM [16D]](/assets/images/marketplace-covers/18895e58d071ea980a50.jpg)
Endnotes
-
Source: cdn.governance.ai
Title: Oversight for Frontier AI through a Know-Your-Customer
Link: https://cdn.governance.ai/Oversight_for_Frontier_AI_through_a_KYC_Scheme_for_Compute_Providers.pdfSource snippet
October 23, 2023 — by J Egan · 2023 · Cited by 19 — This paper recommends that the US government implement a Know-Your-Customer (KYC) sch...
Published: October 23, 2023
-
Source: arxiv.org
Link: https://arxiv.org/abs/2403.08501 -
Source: arxiv.org
Link: https://arxiv.org/abs/2310.13625Source snippet
arXivOversight for Frontier AI through a Know-Your-Customer Scheme for Compute ProvidersOctober 20, 2023...
Published: October 20, 2023
-
Source: blog.heim.xyz
Link: https://blog.heim.xyz/governing-through-the-cloud/Source snippet
Lennart HeimThe Intermediary Role of Compute Providers in AI Regulation13 Mar 2024 — We argue that compute providers should have legal ob...
-
Source: ojs.aaai.org
Link: https://ojs.aaai.org/index.php/AAAI/article/view/41127/45088Source snippet
AAAI PublicationsDetecting Compute Structuring in AI Governance Is Likely...by E Seferis · 2026 — A1: There are only a few cloud provide...
-
Source: robots.ox.ac.uk
Title: Heim et al. 2024 Governing Through the Cloud The Intermediary Role
Link: https://www.robots.ox.ac.uk/~mosb/public/pdf/3343/Heim%20et%20al.%20-%202024%20-%20Governing%20Through%20the%20Cloud%20The%20Intermediary%20Role.pdfSource snippet
THE INTERMEDIARY ROLE OF COMPUTE PROVIDERS...26 Mar 2024 — They store and process valuable technical data during large AI deployments an...
-
Source: law-ai.org
Title: Institute for Law & AIThe Role of Compute Thresholds for AI Governance
Link: https://law-ai.org/the-role-of-compute-thresholds-for-ai-governance/Source snippet
February 20, 2025 — This article discusses the role of training compute thresholds, which use training compute to determine which potenti...
Published: February 20, 2025
-
Source: cdn.governance.ai
Title: Accessing Controlled AI Chips via Infrastructure as a Service
Link: https://cdn.governance.ai/Accessing_Controlled_AI_Chips_via_Infrastructure-as-a-Service.pdfSource snippet
Accessing Controlled AI Chips via Infrastructure-as-a-...15 Dec 2023 — The implementation of a cohesive KYC scheme will also ensure cons...
-
Source: hoganlovells.com
Title: www.hoganlovells.com U.S
Link: https://www.hoganlovells.com/en/publications/us-dept-of-commerce-proposes-new-know-your-customer-rules-for-cloud-services-and-ai-trainingSource snippet
Dept. of Commerce proposes new “Know Your...26 Feb 2024 — Reports on Large AI Model Training. The proposed rules would require U.S. IaaS...
-
Source: rand.org
Title: RRA3686 1
Link: https://www.rand.org/pubs/research_reports/RRA3686-1.htmlSource snippet
RAND CorporationStrategies and Detection Gaps in a Game-Theoretic Model...16 Jun 2025 — The authors outline strategies for cloud service...
-
Source: arxiv.org
Link: https://arxiv.org/html/2604.04712v1Source snippet
Hardware-Level Governance of AI Compute: A Feasibility...6 Apr 2026 — This paper bridges the gap between AI governance and computer engi...
-
Source: arxiv.org
Link: https://arxiv.org/pdf/2412.03824Source snippet
Towards Data Governance of Frontier AI Modelsby J Hausenloy · 2024 · Cited by 5 — As a key input to the pre-training and fine- tuning of...
-
Source: ai-safety-atlas.com
Title: Compute Governance
Link: https://ai-safety-atlas.com/chapters/v1/governance/compute-governanceSource snippet
Chapter 4The U.S. Executive Order on AI requires companies to notify the government about training runs exceeding 1 0 2 6 operations - a...
-
Source: federalregister.gov
Title: Federal Register Proposed Rule
Link: https://www.federalregister.gov/documents/2024/01/29/2024-01580/taking-additional-steps-to-address-the-national-emergency-with-respect-to-significant-maliciousSource snippet
Federal RegisterProposed RuleJanuary 29, 2024 — 29 Jan 2024 — The Executive order of October 30, 2023, “Safe, Secure, and Trustworthy Dev...
Published: January 29, 2024
-
Source: futureoflife.org
Title: bis rule for establishment of reporting requirements
Link: https://futureoflife.org/document/bis-rule-for-establishment-of-reporting-requirements/Source snippet
Expand quarterly reporting requirements to include an up-to-date overview of safety and security practices and prior applicable activitie...
-
Source: aisecurityandsafety.org
Title: compute governance
Link: https://aisecurityandsafety.org/en/guides/compute-governance/Source snippet
Controlling AI Through Hardware & Compute Access (2026)3 Apr 2026 — Compute governance is an emerging policy approach that seeks to manag...
Additional References
-
Source: frontier-economics.com
Link: https://www.frontier-economics.com/uk/en/news-and-insights/articles/article-i21406-ai-beyond-the-cloud-navigating-competition-innovation-and-regulation/Source snippet
AI beyond the cloud: navigating competition, innovation...However, cloud services will remain crucial for training new models, running l...
-
Source: kelleydrye.com
Link: https://www.kelleydrye.com/viewpoints/blogs/trade-and-manufacturing-monitor/bis-proposes-kyc-and-other-cybersecurity-requirements-on-cloud-services-and-ai-trainingSource snippet
BIS Proposes KYC and Other Cybersecurity…2 Feb 2024 — In accordance with Executive Order, the proposed rule would require reports to the...
-
Source: sidley.com
Title: new know your customer and reporting rules proposed for cloud providers
Link: https://www.sidley.com/en/insights/newsupdates/2024/02/new-know-your-customer-and-reporting-rules-proposed-for-cloud-providersSource snippet
U.S. IaaS providers will be required to report the training of large AI models. The proposed IaaS Rule includes a provision requiring U.S...
-
Source: medium.com
Link: https://medium.com/%40adnanmasood/the-ai-governance-frontier-series-part-4-google-clouds-approach-to-safe-and-responsible-ai-fe4644415e44Source snippet
le AI by embedding fairness, transparency, safety, and accountability into...Read more...
-
Source: aisafetybook.com
Link: https://www.aisafetybook.com/textbook/compute-governanceSource snippet
section, we will discuss how compute governance enables AI...
-
Source: GOV.UK
Link: https://www.gov.uk/government/publications/frontier-ai-capabilities-and-risks-discussion-paper/future-risks-of-frontier-ai-annex-aSource snippet
risks of frontier AI (Annex A)28 Apr 2025 — The risks posed by future Frontier AI will include the risks we see today, but with potential...
-
Source: youtube.com
Link: https://www.youtube.com/watch?v=1CB9dgUlNpgSource snippet
Scaling Laws: Can AI Make AI Regulation Cheaper?, with Cullen O'Keefe and Kevin Frazier...
-
Source: youtube.com
Title: Samuel Hammond on why AI Progress is Accelerating
Link: https://www.youtube.com/watch?v=tcmpaFUSo1gSource snippet
The Existential Risk of AI is Being IGNORED (This is SCARY) – Matthew Syed...
-
Source: aisi.gov.uk
Link: https://www.aisi.gov.uk/frontier-ai-trends-reportSource snippet
AI Security InstituteFrontier AI Trends Report by The AI Security Institute (AISI)Established in 2023, the AI Security Institute (AISI) i...
-
Source: paloaltonetworks.com
Title: frontier ai models real time cloud security
Link: https://www.paloaltonetworks.com/blog/cloud-security/frontier-ai-models-real-time-cloud-security/Source snippet
Learn why real-time cloud runtime protection is essential to stop exploits...
Topic Tree