Hook
Last Tuesday, a handful of people walked into a room in Washington to talk about guardrails. No cameras. No draft text. No bill number. Just a word, repeated often enough that it started to sound like policy.
That word—guardrails—does an enormous amount of work in American AI policy. It sounds like engineering. It sounds like something you could inspect, audit, verify. It carries the promise of a dashboard glowing at three in the morning, a red line that means something, a boundary that holds. None of that is true yet. The meeting was a caucus meeting, which is the political equivalent of a stand-up in a startup where everyone agrees the problem is serious and nobody has written the ticket.
I have spent the last four years building bridges between two worlds that pretend not to need each other: decentralized systems and traditional institutions. In 2024 I ran workshops for two hundred employees at three Nordic banks, translating decentralization into business value. Before that, in 2017, I interviewed 120 first-time investors who lost savings to rug pulls, and I learned something that applies directly here. The technology was almost never the failure point. The verification was.
So when I read that Democratic leadership had convened to discuss AI legislation and anchored the conversation on "guardrails," my first instinct was not political. It was cryptographic. A guardrail you cannot independently verify is not a guardrail. It is a promise. And promises, in every system I have ever audited, are exactly the thing that fails first.
Behind every hash, a heartbeat—and behind every "guardrail," a question nobody in that room appeared to be asking: who checks the checker?
Context
Let me lay out what actually happened, stripped of spin, because the informational density here is remarkably low.
A group of House Democrats gathered for a caucus meeting to discuss AI legislation. The framing was that the technology is developing quickly and carries potential risks, and that some form of safeguard should be enacted "in a timely manner." That is, essentially, the entire signal. No bill name. No timeline. No clause-level detail. A few information points arranged around a single rhetorical word, delivered by party leadership with a stated sense of urgency.
For anyone who has not lived inside policy cycles, this looks like nothing. I would argue it is something—but not the thing most crypto commentators think it is. The interesting move is structural. A caucus meeting is not a committee hearing. It is not a markup. It is an internal alignment mechanism, the moment a party decides that an issue graduates from "we have opinions" to "we have a position." Through 2023 and 2024, AI legislation lived in committees and in the shadow of executive action. It is now being pulled up to the level of party strategy.
That escalation matters because of arithmetic. In the most recent Congresses, House Democrats were the minority. A minority party cannot pass legislation on its own; it can only position. The caucus meeting is therefore best understood as an internal rehearsal for a future in which they might again hold the gavel. The signal value is high. The legislative value, this cycle, is close to zero.
Two more pieces of context make the picture legible. The first is the executive order signed in October 2023, which established a compute threshold of 10^26 floating-point operations as the trigger for heightened reporting obligations on frontier models. The second is Europe's AI Act, which took a different path: risk-based classification, tiered obligations, and a slow, staggered enforcement calendar. Add China's filing-and-registration regime for generative models, and you have three distinct regulatory philosophies competing to become the reference implementation for the world.
When three large jurisdictions write three different rulebooks, the contest is not really about safety. It is about which rulebook becomes the default that everyone else copies. Standards are the softest form of power and the hardest to reverse. And in a sideways market, where price gives no direction, capital chases narrative—and policy signals are the cheapest narrative on the board.
Code is law, but empathy is truth—and the truth here is that Washington is not deciding whether to regulate AI. It is deciding whether it wants to be the one writing the regulation that everyone else adopts.
Core
Now to the part that actually interests me, and the part that almost nobody in either the crypto or the AI commentariat is examining carefully: the enforcement surface.
There are, broadly, three places you can put a regulatory hand on an AI system. You can regulate the model—its weights, its architecture, its training data, its capabilities. You can regulate the outputs—deepfakes, election interference, misinformation, synthetic media. Or you can regulate the inputs—capital, data, and above all compute.
The first is nearly impossible today. The second is legally and technically brittle, because outputs are infinite and attribution is contested. The third is where the leverage actually lives, and it is why the 10^26 FLOPs threshold is the most consequential number in this entire debate.
Here is why the compute anchor fails on its own terms—and why crypto people should care about the failure.
A FLOP threshold is a proxy for capability, not a measurement of it. It says: if you trained a model with this much compute, we assume it is dangerous enough to require scrutiny. It is a tax on the factory floor, not a test of the product. And it measures something that is, by design, a function of hardware procurement. The moment a company knows that crossing a compute line triggers obligations, the rational response is not to stop training. It is to restructure training—distribute it, partition it, rent it across multiple providers, or simply sandbag the reported number. Economic gravity does not care about your regulatory intent. Capital routes around friction, every time, and it has been doing so for longer than any of these legislators have been in office.
This is the same failure mode I watched play out in exchange "Proof of Reserves" reporting. Based on my audit experience with several such exercises, most of them are theater: they prove a snapshot of assets on one side of the balance sheet while leaving liabilities, off-chain positions, and continuous solvency entirely unverified. A point-in-time attestation is not proof. It is a photograph of a moving object. The number looks reassuring precisely because you cannot see what it excludes—the intraday transfers, the rehypothecated collateral, the related-party loans that never touch the audited wallet. An AI "safety attestation" built on self-reported compute is structurally the same artifact. It will be a point-in-time, auditor-blessed number that nobody outside the reporting entity can independently reproduce. We will call it transparency. It will be theater with a PDF attached.
What would actually work—and here is where my two worlds collide—is verifiable attestation at the point of computation, and that is a cryptographic problem, not a legislative one.
Consider what a real guardrail would require. It needs a binding, reproducible record that a given model was trained within declared parameters. It needs an unforgeable link between that model and its weights at inference time. It needs a mechanism to prove properties about a model's behavior without exposing the weights themselves, because no lab will publish weights just to satisfy a regulator, and anyone who thinks otherwise has never sat across a negotiating table from a strong engineer. It needs a way to do all of this continuously, not annually.
Every one of those is a problem my industry has spent a decade building primitives for. Zero-knowledge proofs let you attest to a property without revealing the underlying data. Trusted execution environments and deterministic replay let you prove a computation happened inside an enclave. On-chain registries give you a timestamped, tamper-evident record that no single party controls. Notarized model cards anchored to a public ledger give you provenance for weights and training lineage. None of this is exotic theory anymore; it is a hardened, if young, tooling stack.
None of this is mature either. I want to be honest about that, because the temptation in my field is to sell the future as if it were already shipping. Running a transformer's forward pass inside a fully verifiable circuit is still brutally expensive. Proving inference integrity at frontier scale is, today, not economically viable. The gap between the proof we can generate and the proof regulators would want is measured in orders of magnitude, and it will close on a hardware and cryptography roadmap, not on a legislation timeline. Anyone promising you verifiable frontier inference next quarter is selling a story.
But here is the strategic point that Washington appears not to have internalized, and that most crypto founders have also missed: if the regulation is written at the model layer—vague, unenforceable, unverifiable—the compliance burden does not disappear. It moves. It migrates to the one place regulators actually have leverage: compute procurement.
Which means the practical effect of a "guardrail" regime will not be safer models. It will be a compliance gate on who can afford to train. And that gate has a shape, and the shape is familiar.
Regulatory cost is never symmetric. It is proportional to the fixed cost of demonstrating compliance. Large labs already run red teams, safety teams, policy teams, and legal teams as standing operations. Adding an attestation layer is a line item to them. For a well-funded startup it is a quarter of runway. For an open-source collective in Lagos or Seoul or Buenos Aires, it is an existential tax that can never be paid. This is not a hypothetical; it is the observable pattern of every compliance regime ever written.
This is the same dynamic I watched hollow out the middle of the market in "Real World Assets." For three years, the on-chain RWA narrative promised that trillions of dollars of tokenized treasuries and private credit would flood onto public chains. It has not, and I have argued for two years that it will not, at scale, because the institutions everyone is courting do not need a public chain to move value between themselves. They need certainty, settlement finality, and someone to call when something breaks. A permissioned database with a bank's logo on it does the job. The public chain is a solution in search of a problem the institutions never had, and the storytelling keeps running because admitting it would require writing down the token.
AI regulation is heading into the same trap from the opposite direction. Well-intentioned legislators will write "guardrails" intended to protect the public. The cost of those guardrails will fall hardest on the smallest and most open players—the exact ecosystem that produces the most diverse and most scrutinized models. The incumbents will comply, publicly celebrate the standard, and quietly collect a moat built out of paperwork.
And I want to flag a second, subtler asymmetry, because it is one my DeFi colleagues keep missing. The AI compliance regime will not arrive as AI regulation. It will arrive as a procurement policy, a cloud audit requirement, a sanctions rule, a chip export control, a KYC obligation on inference APIs. I have spent the last year building an AI-agent education pilot managed by a DAO, and the hardest problem was never the model. It was the compliance surface—who is accountable when an autonomous agent acts, and against which jurisdiction's rulebook. That question is trans-jurisdictional by nature, and no single legislature can answer it alone. So the answer will be assembled piecemeal, in procurement documents and model contracts, and the crypto industry's insistence that it is immune because it is decentralized is, frankly, a form of denial. Compute is physical. Cloud providers are centralized. Export controls are territorial. Decentralization is not a shield; it is a different exposure.
There is a deeper layer still, and it is where the crypto and AI worlds genuinely converge rather than just borrow each other's language.
The reason a regulator wants guardrails is trust. The reason the public accepts guardrails is trust. But every centralized trust model in my adult lifetime has eventually been captured, misused, or simply revealed to be a laminated promise. Banks, ratings agencies, exchanges, and now the platforms building superintelligence—the pattern is identical. Centralized trust scales beautifully and fails catastrophically.
Decentralized verification scales badly and fails gracefully. That is its central virtue and its central cost. It is slower, uglier, more expensive, and harder to explain to a legislator in a hearing. But it is the only structure I know of that can answer the question "who checks the checker?" without punting the answer to whoever happens to be holding the pen that week.
There is also an infrastructure clock ticking underneath all of this. Post-Dencun, cheap blob data changed the economics of rollups almost overnight. My read is that the blob market saturates within roughly two years, and when it does, rollup gas fees double again as competition for data availability intensifies. Now layer AI inference attestation and continuous verification traffic on top of that demand curve, and the data availability bill becomes its own constraint on what is economically provable. The verification layer everyone wants is not just a cryptography problem. It is a bandwidth and cost problem, and anyone modeling it should be modeling a market that is about to get more expensive, not less.
This is the reason I wrote The Cognitive Commons. The argument there is not that decentralized AI will beat centralized AI on capability—it almost certainly will not, at first. The argument is that sovereignty over cognition is the defining political question of the coming decade, and that the current regulatory instinct, which concentrates verification in the hands of the same institutions that create the risk, reproduces the failure mode it claims to prevent. Guardrails, in the way Washington is currently using the word, are a trust-me wrapper. The alternative is a verify-me architecture.
And here is where the lessons of the last bear market actually apply, even if nobody wants to hear them. Trust no one, verify everyone, feel everyone. The crypto industry learned this the hard way, in 2022, when counterparties that had passed every audit vaporized over a weekend. We learned that the only meaningful proof is the proof you can run yourself. AI is about to learn the same lesson, and it will be expensive.
Contrarian
Now let me say the thing that will annoy both sides.
The first annoyance is for my own people. Many crypto commentators greeted the news of a Democratic caucus meeting on AI with glee, reading it as the state finally bowing to the decentralized future. That reading is backwards. If AI regulation forces model providers to build continuous, cryptographic, independently verifiable attestation, that is a massive tailwind for my industry and I would welcome it. But that is not what is being proposed. What is being proposed is a point-in-time, self-reported, auditor-mediated compliance regime, and the last decade should have taught us what those become. The AI industry should be terrified of the version of "guardrails" that is easy to write, because the easy version is always the capture version. And the crypto industry should stop pretending it is a spectator. The moment verification becomes a legal requirement, the question of who performs verification becomes the most valuable question in the technology stack—and the answer, if we are not careful, will be the same four accounting firms and the same three cloud providers who already own every other chokepoint.
The second annoyance is for the legislators. A guardrail you cannot independently verify is not a guardrail. It is a press release with a compliance budget. If you want safety, you have to fund the verification layer, you have to make attestation reproducible by third parties, and you have to accept that this means building infrastructure, not just writing obligations. That is harder, slower, and less quotable than convening a caucus. It is also the only version that survives contact with reality.
And the third annoyance is the most uncomfortable, so I will say it plainly. The real risk from this caucus meeting is not that Washington over-regulates AI. It is that it regulates the visible part—the lab, the model, the press conference—while the invisible part, the compute supply chain and the capital flows, continues ungoverned and concentrates. That is the pattern I have watched in crypto for nine years. The exchanges that failed were the ones nobody could see into. The ones that thrived were the ones with real transparency. Regulation aimed at the loudest target almost always misses the load-bearing one.
Surviving the winter to plant the spring is not about waiting patiently for better weather. It is about building the verification infrastructure before the rules arrive, so that when the rules are finally written, the reference implementation already exists and is decentralized.
Takeaway
So where does this leave us, standing at the edge of whatever this cycle becomes?
Watch three signals over the next six months. Whether the caucus produces actual bill text or only a position paper—paper, and nothing has changed. Whether the enforcement architecture lands on models or on compute procurement—compute, and the moat is already being poured while you read this. And whether anyone in the room asks the question that matters: who verifies the verifier, with what proof, continuously, and in public?
My bet is that the first answer will be disappointing and the third question will go unanswered for at least another cycle. That is fine. The winter is for building. The systems that survive will not be the loudest, and they will not be the ones with the best compliance narrative. They will be the ones whose claims you can actually run yourself, on a machine you control, without asking anyone for permission.
Philosophy before protocol, people before profit—and proof before press release. The ledger remembers, and it is time the rest of the world started keeping one.