AI guardrails walked into a trade negotiation with rare earths

01

WHAT ACTUALLY CHANGED

Reuters reported that Bessent, He and Greer began the Manhattan meeting shortly after Bessent arrived around 10:30 a.m. Eastern time on September 20. The talks were expected to run all day. That is a live negotiation, not a completed round, signed arrangement or joint announcement.

The agenda connects a trade truce due to expire on November 10, Chinese rare-earth magnets and critical-mineral flows, tariff questions and possible AI guardrails. Reuters reported that the meeting was intended to prepare potential agreements for the coming Trump-Xi summit rather than finish the entire relationship at one table.

Bessent said before the meeting that he expected focused, fulsome and constructive talks. Reuters separately reported his statement that the United States was open to discussing shared AI risks, avoiding bifurcation of the two countries' systems and covering both open- and closed-weight models. These are US objectives. China had not published a matching definition or commitment in the sources located before publication.

Bessent has described guardrails aimed at keeping powerful models away from malign non-state actors. The public framing does not identify which actors, model capabilities, release methods, jurisdictions or uses trigger a restriction. It also does not say how a violation would be attributed or proven.

Open-weight models make learned numerical parameters available for download and local use. The Commerce Department's Federal Register notice describes potential benefits including competition, research access, transparency and innovation, while also identifying misuse, accountability and monitoring risks. Open weights are not automatically unrestricted, fully open source or unsafe.

Closed-weight models keep the learned parameters with the developer and are commonly accessed through a service. Central operation can support usage monitoring, rate limits, model updates and account controls. It does not guarantee safety because users may route around controls, operators may miss abuse and powerful capabilities can still be exposed through tools or APIs.

NIST's dual-use foundation-model guidance treats misuse management as a lifecycle problem involving evaluation, security, disclosure and actors across the AI supply chain. That is a much larger job than agreeing that bad actors should not receive powerful models. A diplomatic promise needs technical procedures behind it.

Reuters reported a US complaint that China's restoration of critical-mineral flows under the current trade truce had not been sufficient. The article also connected rare earths with advanced semiconductor manufacturing. That supply issue is economically important, but a mineral shipment cannot verify a model safeguard and a model evaluation cannot verify a customs declaration.

No public joint communique, shared glossary, capability threshold, list of covered actors, evaluation suite, audit right, reporting timetable, remedy or result was available before publication. The article therefore describes negotiations and national positions, not an adopted US-China AI safety regime.

02

WHY THIS MATTERS

Safety can gain political priority when it reaches a presidential trade track. Senior economic officials can coordinate agencies, connect technical work with diplomacy and make implementation resources available. The cost is that a safety promise may become bargaining currency rather than a durable rule.

Open and closed weights require different controls. A provider can suspend a hosted account or update a service. It cannot remotely recall every copy of downloadable weights. Negotiators need separate release, distribution, evaluation, monitoring and response arrangements instead of one universal guardrail metaphor.

Non-state actor is too broad to operationalize by itself. It can describe criminal groups, terrorist organizations, companies, researchers, civil-society groups or individuals. A workable rule needs a risk category, evidence standard, designation process, permitted research, appeal mechanism and method for correcting false attribution.

Model power is not a stable label. Capability depends on model version, fine-tuning, tools, compute, data, scaffolding and user expertise. A threshold based only on parameter count or training compute can miss a smaller specialized system or sweep in a model that does not present the negotiated risk.

Verification is harder than agreement. Closed providers can expose controlled logs and evaluations to auditors. Open-weight distribution can be mirrored across borders and private networks. Verification may need signed artifacts, documented evaluations, secure incident sharing and evidence about downstream modification rather than promises to control every copy.

Trade linkage creates asymmetric pressure. One side may care more about mineral access, tariffs, agriculture, aircraft or market access than about a particular AI provision. A package can unlock cooperation, but it can also produce vague technical language accepted mainly to secure a commercial concession.

The two systems already depend on each other in uneven ways. Models, chips, cloud infrastructure, manufacturing equipment, minerals, research and downstream products cross borders through different channels. Bifurcation is not one switch. A narrow safety protocol may be more realistic than a promise to prevent two ecosystems from diverging.

A safety arrangement should not become a back door for industrial protection. Restrictions need published risk logic, comparable treatment and a path for independent review. Otherwise a government can label a competitor's model unsafe while leaving an equivalent domestic capability untouched.

The absence of a result matters. Reporting that talks started is not reporting that guardrails exist. The next evidence is a joint text with definitions, owners, deadlines, tests and consequences. Until then, the meeting is a signal of priority and a container for negotiation.

03

WHERE IT COULD HELP

• Publish a shared glossary separating model weights, source code, training data, open-weight releases, hosted closed models, tools, agents and downstream fine-tunes
• Define the specific harms and actor categories covered instead of treating every non-state actor or every powerful model as one risk class
• Use capability evaluations and deployment context alongside compute or parameter thresholds, and record the exact model version tested
• Create distinct control paths for downloadable weights, hosted services, cloud compute, chips, model interfaces and tool-enabled agents
• Agree on a minimum evaluation packet with methods, limitations, independent reproduction, secure evidence exchange and rules for classified findings
• Establish an incident hotline with severity levels, named national contacts, preservation requirements, notification deadlines and after-action review
• Use cryptographic hashes, signed release records and provenance logs to identify artifacts without pretending they can stop every unauthorized copy
• Protect legitimate research, competition, accessibility and local deployment through clear exemptions, safe-harbor procedures and an appeal path
• Keep technical compliance evidence separate from tariffs and mineral-delivery disputes so one commercial breach does not erase every safety channel
• Publish a versioned joint record showing commitments, owners, dates, verification results, disputes, remedies and changes after each negotiating round