The Standard Is the Moat: SAFA, Self-Regulation, and the Crypto Narrative Beneath AI Governance

The Standard Is the Moat: SAFA, Self-Regulation, and the Crypto Narrative Beneath AI Governance

Hook

Over the past seven days, I watched two numbers travel in opposite directions. On-chain, the small basket of AI-agent tokens — the assets that trade on the promise that autonomous software will one day pay for its own inference, verification, and storage — bled another six percent into a market that was otherwise flat, its funding rates rotating from cautiously positive to dead neutral. Off-chain, in the traditional press, a headline crossed my feed with the flat certainty of a wire: Google, OpenAI, and Anthropic to form an AI safety standards body. SAFA. Three of the most direct competitors on earth, agreeing to write rules together.

The distance between those two movements is the whole story.

Here is the part that should interest you more than the headline. When I pulled the news item apart — the way I pull apart a smart contract before I trust it — I found exactly two facts inside it. Fact one: the three labs intend to form a body. Fact two: the body is named SAFA. The remaining four "information points" circulating in the summary were not facts at all. They were opinions about the facts: that the move "may boost investor confidence," that it "may ease regulatory pressure." Four opinions, two facts, one acronym.

I have seen this shape before. In late 2016, before most of this industry learned the word reentrancy, a fundraising event circulated with a beautiful narrative and a thin audit. The narrative was the product. The code was an afterthought. And the moment the narrative outran the code, the value evaporated inside a single block, and a lot of people who had trusted the story rather than the source learned an expensive lesson about the difference between a promise and a proof.

So before any of us decides whether SAFA is the first brick of global AI governance or a press release with a pulse, let me do what a market brief rarely does. Let me begin by admitting what I do not know — and then show you why that admission is itself the most valuable signal in this entire story.

Context

Let me set the stage honestly, because the honesty is not decoration here. It is the method. My knowledge runs to roughly the middle of 2025. Within that window, I cannot independently verify that an entity called SAFA exists, that it has a charter, that it has a budget, or that it has a single employee. What I can verify is the family it most likely belongs to. In 2016, the major labs and civil-society groups formed the Partnership on AI. In July 2023, Google, OpenAI, Anthropic, and Microsoft founded the Frontier Model Forum. In 2024, the United States stood up an AI Safety Institute Consortium. Bodies like these keep appearing, and they keep appearing in the same shape: a small number of the largest players, a shared statement of principle, and a promise to align on something called safety.

So the most reasonable working assumption is that SAFA is a new instance of a familiar species — a voluntary safety alliance among frontier labs. It might be newly established. It might be a rename. It might be a translation artifact in the wire copy. I will treat it as the most probable form and flag the uncertainty every time it matters, because a market brief that pretends to certainty it does not have is worse than useless. It is a trap wearing a suit.

Now zoom out. Why do bodies like this keep forming? The surface answer is that AI is dangerous and someone should write rules. The real answer is older and less noble. Every industry that has ever grown fast enough to frighten a legislature has run the same play, and the play has a name. The industry forms a self-regulatory body, writes a standard that is strict enough to sound serious and loose enough to be survivable, and then walks into the regulator's office carrying it like a shield. The message is always the same: we are handling this, you do not need to. It is the preemption playbook, and it is one of the most reliable patterns in the history of regulated markets.

I have watched this exact movie in crypto. After the initial coin offering boom of 2017, exchanges formed self-regulatory organizations and published voluntary listing standards — not because the standards would bind anyone, but because the gesture gave legislators a reason to slow down. The Securities and Exchange Commission spent years treating "we are policing ourselves" as a partial substitute for actual policing, and the exchanges bought time they would not otherwise have had. Some of those standards were real. Most were theater. The genius of the play is that you cannot always tell which is which from the outside, and by the time you can, the window has closed.

The Frontier Model Forum is the closest precedent for SAFA, and it is worth naming what it actually achieved. It published a handful of commitments. It funded some safety research. It did not change the trajectory of a single model release, and its effect on the valuations of its members was measurable in days, not quarters. If SAFA is the FMF's spiritual successor, then the right prior is that it is a governance gesture first and a governance mechanism second — unless proven otherwise by documents that do not yet exist in public.

There is one more piece of context that the wire copy tends to bury, and it is the piece a crypto reader should feel in their bones. A crypto outlet, Crypto Briefing, carried this story. Ask yourself why. A traditional AI-governance announcement has no obvious crypto angle. But if you are a crypto media operation in 2025, the most valuable narrative you can build is the bridge between "AI is becoming a regulated industry" and "decentralized AI is the answer to centralized AI's governance problem." The moment you establish that bridge, every AI-safety headline becomes a crypto-AI headline, and every crypto-AI headline becomes a reason for someone to buy a token. That is narrative migration, and it is a much quieter and much more important phenomenon than the headline it rode in on.

This is the terrain. A thin wire report. A familiar species of body. A preemption playbook with a long history. And a media ecosystem with a strong incentive to relocate the story into a market where it can be traded. Searching for truth in the noise of the network means keeping all four of those things in view at once — the fact, the pattern, the incentive, and the silence.

Core

The core of this analysis is simple to state and uncomfortable to accept: the real product of SAFA is not safety. It is the standard itself. And the standard is a moat.

Everything else — the mission language, the commitment to responsible development, the consultative framing — flows downstream of that single structural fact. Let me show you how it works, dimension by dimension, because the mechanism is what matters, not the announcement.

The Preemption Playbook, in Detail

The first function of a self-regulatory body is to occupy the space before the regulator does. Standards set by the industry are standards the industry can live with. Standards set by a legislature are standards the industry must survive. The gap between those two sentences is worth billions of dollars in compliance costs and, more importantly, in optionality. A lab that participates in writing the rule keeps its product roadmap intact. A lab that receives the rule from outside has to bend its roadmap around someone else's definition of risk.

This is why the founding members matter more than the founding principles. The three names in the headline — Google, OpenAI, Anthropic — are precisely the three labs whose models sit at the top of the capability pyramid. If their standard becomes the de facto standard, then the people being measured are also the people holding the ruler. That is not a conspiracy. It is a structural incentive so strong that it operates whether or not any individual inside these companies intends it. Regulation, once it is written by incumbents, reliably entrenches incumbents. This is true of accounting, of pharmaceuticals, of banking, and of crypto exchanges. There is no reason to believe AI is the exception.

Standards as Moats

Here is the mechanism that the bullish interpretation of the headline misses entirely. A standard proposed in the name of safety imposes costs on everyone bound by it, but those costs are not evenly distributed. A large lab can absorb a compliance department, an internal red-team, a third-party audit cycle, and a data-governance bureaucracy. A two-person open-source project cannot. A university lab cannot. A research collective in Lagos or Bangalore or Shenzhen cannot.

So a voluntary standard, once it is adopted widely enough to matter, stops being voluntary in the only sense that counts. It becomes a filter at the door of enterprise procurement. Enterprises in regulated industries — banks, hospitals, insurers, law firms — will not buy a model that cannot demonstrate compliance with the recognized standard, because their own auditors will ask. That is exactly how safety language converts into market exclusion without a single enforcement action.

The likely victims are not hard to name. Meta's Llama family, the Mistral models, the various open-weight releases out of China, and a long tail of fine-tuned derivatives that power a surprising amount of downstream software. None of these can easily certify ongoing compliance, because ongoing compliance requires a reporting structure that open weights structurally lack. You cannot audit a model once it has been downloaded ten million times. You cannot withdraw it. You cannot monitor it. Open weights and persistent safety certification are, at the architectural level, incompatible. That is not an accident of this particular proposal. It is a fact about the shape of the technology, and any standards body that takes it seriously will either exempt open weights — which weakens the standard — or exclude them, which strengthens the moat. Watch which way SAFA eventually leans. That single decision will tell you more about its true purpose than a decade of press releases.

The Coopetition Trap

Now the most interesting part, and the part I would bet most readers have not thought through. Google, OpenAI, and Anthropic are direct competitors. They fight over the same enterprise contracts. They undercut each other on API pricing. They race on multimodal capability and agentic autonomy. And yet they are proposing to sit in the same room and agree on how to disclose their own capabilities to one another. That is the coopetition trap, and it has a specific failure mode.

A standard that requires capability disclosure forces each lab to reveal the edges of its own model to its rivals. Nobody wants to be the first to disclose. So the negotiations will drift toward the lowest common denominator — disclosure of things everyone already knows, and silence on the things that would actually matter. This is why so many industry standards emerge thin. The thinness is not a bug in the process. The thinness is the process working exactly as the incentives dictate.

The test is concrete. When SAFA eventually publishes its first substantive texts — if it does — count how many of them define a measurable capability threshold. Count how many require disclosure of training compute. Count how many require external, adversarial, third-party evaluation rather than self-reporting. If the answers are zero, zero, and zero, then you have your verdict, and you did not need to wait for it.

The Legitimacy Deficit

There is a concept in governance theory that fits this situation precisely: the legitimacy deficit of self-regulation. It describes the problem that arises when the regulated body is also the rule-making body. The problem is not that self-regulators are liars. It is subtler and harder to fix. It is that a self-regulator's definition of a breach will always, unconsciously, drift toward the definition that does not require the self-regulator to admit fault. Over time, the standard does not soften because anyone decides to soften it. It softens because the cases that would have hardened it keep getting filed under "open question" instead of "violation."

We have a long history to draw on here. Self-regulatory organizations in finance have an uneven track record at best. When they work, it is almost always because an external regulator is standing close enough to breathe down their neck — because the threat of losing the self-regulatory privilege is credible. When they fail, it is almost always because that external pressure disappeared, and the body quietly became an industry's public-relations arm. The variable that determines which outcome you get is not the sincerity of the members. It is the credibility of the external threat. And in the AI case, the external threat — a regulator with real teeth and real jurisdiction over these labs — does not yet fully exist.

This is the honest worry in the safety dimension. It is not that SAFA will do nothing. It is that SAFA will do just enough to be cited as evidence that outside regulation is unnecessary, while doing too little to actually reduce the risk profile of the deployed systems. That is the worst case, and it is not a fringe scenario. It is the default outcome of the pattern when external pressure is absent. A voluntary standard that substitutes for regulation before regulation exists is not a bridge to regulation. It is a detour around it.

The Audit Market Is the Real Product

Here is where my own scars become useful, so let me put them on the table. Before the DAO collapsed in 2016, I read its code and found the reentrancy surface that most people were not looking at. I sent a private advisory to three people and told them to withdraw. That intervention saved them roughly one hundred fifty thousand dollars in ether, and it taught me the lesson that has defined my career since: technical rigor can front-run sentiment, but only if someone is willing to pay for the rigor.

That lesson is directly transferable to what SAFA is likely to create, because the second-order effect of any AI safety standard is an audit industry. Smart contract auditing did not exist as a serious profession before DeFi made it necessary, and now it is a durable sector with its own tiers, its own certification bodies, and its own conflicts of interest. AI evaluation and audit is on the same trajectory. The moment enterprises start demanding proof that a model meets a recognized standard, a market appears for the people who produce that proof.

That market is the most investable object in this entire narrative. Not the labs, whose valuations already price in dominance. Not the tokens, most of which have no exposure to the substance. The audit and evaluation layer — the firms that will run the red-teaming, certify the safety claims, and produce the compliance artifacts — is where the standard creates demand out of nothing. And note the shape of the incentive: this layer profits from the standard existing, not from the standard being strong. Which is another reason to expect the standard to be strong enough to require audits and weak enough not to embarrass its authors.

Where the narrative becomes genuinely cultural, and worth watching, is here: where code meets culture, the real value emerges. The audit layer is code meeting culture — technical verification meeting institutional trust. It is the least glamorous corner of this story and the most likely to actually matter in five years.

Compute, FLOPs, and the Verification Gap

Now let me connect this to the part of my own work that is currently consuming most of my attention: the convergence of AI and blockchain verification. Because there is a specific, under-discussed thread in the SAFA story that runs straight through crypto, and it begins with a number.

That number is ten to the twenty-sixth floating-point operations. Under an earlier United States executive order, models trained above roughly that compute threshold carried reporting obligations. The order was later adjusted and partially rolled back, and the specifics are exactly the kind of thing you should verify against current sources rather than trust to my memory. But the concept is durable: compute is a proxy for capability, and capability is what safety standards want to measure. If SAFA adopts any FLOPs-based threshold, it immediately inherits the hardest problem in the entire field, which is that compute is not currently verifiable.

You can claim you trained a model below a threshold. You can claim you trained it above one. Unless there is a trusted mechanism for proving training compute after the fact, the standard is enforced by honor. And here is where the crypto-native reader's ears should prick up, because the blockchain world has spent a decade building the exact primitive that AI governance now needs: verifiable computation. Proof systems that let a party demonstrate that a computation was performed as claimed, without revealing the inputs or the model. Attestation mechanisms that produce tamper-evident records. Zero-knowledge techniques that can, in principle, let a lab prove that it stays inside a compute envelope without exposing its weights to competitors or auditors.

This is the seam between the two industries, and it is the reason a crypto outlet felt entitled to carry this story. The narrative tells you the code will solve the governance problem. The code, mostly, does not yet exist at the scale required. Proofs of training are research, not product. Verifiable inference is a live frontier. So what you have is a governance standard that needs a verification technology that the crypto industry is still building, sitting underneath a token market that is trading as if the verification already exists.

The narrative is the asset; the code is the proof. And right now, in this specific corner of the convergence, the asset is trading well ahead of the proof. That is not a reason to dismiss the frontier. It is a reason to price it correctly, and to know which side of the gap you are standing on.

Valuation, Sentiment, and the FMF Precedent

The wire copy asserted that SAFA "may boost investor confidence" and "may affect AI valuations." Let me be precise about what that is. It is a hypothesis wearing the grammar of a fact. There is no price reaction cited. No analyst is quoted. No valuation model is updated. The claim that a governance announcement lifts valuations is presented as self-evident, and it is not.

We have a natural experiment. When the Frontier Model Forum was announced in July 2023, did it re-rate the AI complex? It did not, in any durable way. The announcement was absorbed within days and the sector's trajectory continued, driven by far stronger forces — model capability, enterprise demand, and the rhythm of the capex cycle. Governance announcements move valuations the way a stone moves a lake. There is a splash. Then the lake is a lake again.

The real channel through which SAFA can affect value is not sentiment. It is tail risk. Regulatory uncertainty is a discount factor. Any credible reduction in the probability of a harsh, surprise regulatory regime lowers that discount, and a lower discount raises present value without a single dollar of new revenue. That is a real effect, and it is not a large one for a body that does not yet have a charter. The bullish case, stated honestly, is that SAFA reduces the odds of a catastrophic regulatory outcome by a small amount. The bearish case is that it reduces the odds by exactly zero and adds a compliance cost to everyone outside the club. Both cases are modest. Anyone telling you this is a re-rating event is selling you something.

Contrarian

Let me turn the whole thing over, because the consensus reading of this story — whether bullish or cynical — shares an assumption I do not accept. The shared assumption is that the important action is happening in the United States, among these three labs, in this one body. I think that is wrong in a way that will look obvious in hindsight, and I will give you three reasons.

First contrarian angle: the real battlefield is Brussels and Beijing.

A standard that is recognized only by its own authors is not a standard. It is a preference. SAFA's actual power depends entirely on whether a jurisdiction with real enforcement authority chooses to recognize its work. The European Union is the jurisdiction that matters most here, because the EU AI Act already creates a category of general-purpose AI obligations and already contemplates codes of practice as a compliance pathway. If Brussels adopts a SAFA-derived code, the body becomes consequential overnight, because the code becomes a door into the European market. If Brussels declines — and there is real reason to think it might, given the EU's institutional preference for its own standards-setting — then SAFA becomes a distinctly American gesture with distinctly American limits.

And then there is China. The Chinese approach to model governance runs through a registration and filing regime administered domestically. There is almost no plausible path by which a privately convened American safety body becomes the recognized standard for Chinese deployments. What is far more likely is a parallel standard ecosystem — mirrored, incompatible, and geopolitically load-bearing. Two standards, two markets, two supply chains, two sets of compliance vendors. That fragmentation is the outcome I would assign the highest probability to, and it is barely mentioned in the bullish readings of this news. The most consequential result of AI safety standardization is not safer models. It is a bifurcated global market.

For crypto specifically, the fragmentation is not an abstraction. It is the exact problem the industry already solved once, badly, with bridges. If AI governance splits the world into two compliance zones, then every protocol that wants to serve both needs a mechanism for translating between standards, and that mechanism will be attacked. We have seen this movie. Cross-chain interoperability is technically elegant and economically fragmented, and the entities that capture the value are almost never the ones that built the elegance. The parallel is close enough to make me cautious about anyone claiming that a verifiable-AI standard will be a clean, unified solution. Standards fragment. That is what they do.

Second contrarian angle: the open-source ecosystem may be the real winner.

Here is the counterintuitive part of my own thesis. I argued above that safety standards can become a moat that excludes open weights. I still believe the mechanism is real. But the exclusion, if it happens, is a double-edged sword, and the second edge cuts in favor of open source rather than against it.

Consider what a standard designed to exclude open weights actually does. It makes certified closed models more expensive for enterprise buyers, because certification costs money and that money is passed downstream. It makes open-weight models cheaper, because they simply opt out of the certification regime. And it creates a permanent, visible, legally-sanctioned category of "the models that are not certified" — which is exactly the category some buyers will want. Enterprises in non-regulated sectors do not need certification. Researchers need capability, not compliance. Developers in jurisdictions that reject the American standard need a path that does not route through a body they do not recognize. The exclusion, in other words, does not eliminate the excluded. It gives them a market identity, a shared grievance, and a reason to organize.

I have watched this dynamic in crypto. Every time a self-appointed elite defined a standard of legitimacy, it created a counterculture that turned out to have more stamina. The ICO era's "accredited" gates produced DeFi. The exchange listing committees produced DEXs. Sanctions and delistings produced decentralized alternatives that were slower and rougher and survived. You do not always kill the thing you exclude. Sometimes you give it its clearest reason to exist.

Third contrarian angle: the market's near-silence is the actual signal.

This is the one I would put the most weight on, and it is the least discussed. The headline barely moved anything. AI-token funding stayed neutral. Traditional AI equities did not visibly re-rate on the news. There was no analyst die-in, no funding cascade, no visible position. If the market genuinely believed SAFA was the first brick of global AI governance, you would see evidence of belief in prices. You do not.

The cleanest reading of that silence is that the market has already learned this lesson. Governance-theater announcements have a base rate, and the base rate is that they produce a splashless ripple and then are forgotten. The market is not reacting because it has seen this before — Partnership on AI, the Frontier Model Forum, a dozen national safety institutes — and it has correctly learned that the pattern of a body forming is a weaker signal than the pattern of a body enforcing. No enforcement, no re-rate. That is not cynicism. It is the market doing its job efficiently, and it is worth respecting precisely because the crypto market so rarely respects anything.

There is a fourth angle I will gesture at rather than argue, because it belongs to a longer essay and a more speculative one. The most important thing about a standard is not that it exists. It is who owns the definition. "Safety" is not an objective property. It is a boundary drawn around the set of acceptable capabilities. Whoever draws that boundary decides which products can be sold, which capabilities can be released, and which risks are tolerable. The definition of safety is the most valuable intellectual property in the coming decade, and the three labs at the center of this headline understand that at a level most of their critics do not. The standard is the moat. And the definition of safety is the standard.

Takeaway

So where does that leave the reader who is holding a crypto portfolio through a sideways market and watching an AI governance headline cross their feed?

Let me not summarize. Summary is the enemy of thought. Let me instead hand you the forward-looking test — the questions that will tell you whether SAFA is a governance mechanism or a governance gesture, and which you can mark against reality in the coming months without any further help from me.

Watch the charter, not the announcement. A body with a charter has rules, members, budgets, and a governance structure that can generate a binding decision. A body without a charter has a logo. The existence of a charter — and, crucially, of an independent audit function described inside it — is the first real signal.

Watch whether the standard requires external evaluation or self-reporting. This is the single most diagnostic feature. A standard that relies on companies to evaluate themselves is a standard designed not to constrain its authors. A standard that mandates adversarial external testing is one that has accepted a real cost. The direction of this decision will tell you almost everything.

Watch Brussels. If the European Union moves to recognize a SAFA-derived code of practice, the body becomes consequential, and the fragmentation thesis weakens. If Brussels builds its own instrument instead, the fragmentation thesis strengthens, and the world gets two AI governance regimes whether it wants them or not.

Watch for the compute-proof gap being papered over. If a standard emerges that requires FLOPs disclosure without a verifiable mechanism to enforce it, then the enforcement is honor-based, and the entire safety architecture rests on a foundation that the crypto industry has spent a decade trying to build and has not yet finished. That gap is where the next real innovation — and the next real opportunity — lives.

And watch the audit layer, not the model layer. The standard will not make the labs richer than they already are priced to be. It will create a new and durable market for verification, evaluation, and compliance. That is the second-order effect that almost nobody is trading. In a chop market, the edge rarely lives in the headline. It lives in the thing the headline makes necessary. The narrative is the asset. The code is the proof. And the proof is still being written.

Where code meets culture, the real value emerges — not in the announcement, but in the moment three competitors discover that they cannot police each other, and the rest of us finally get to see what a standard is actually worth when someone is forced to enforce it.