Secure AI Project (SAIP)

Stated Theory of Change

SAIP's stated mechanism: frontier AI companies have made voluntary safety commitments (publishing RSPs, safety testing, incident reporting), but competitive pressure will erode these commitments unless they are legally mandatory. SAIP's role is to translate these voluntary practices into state-level legislation, creating a legal floor that prevents a race to the bottom. Three pillars: mandatory safety protocols, whistleblower protections, and incentives to mitigate risk.

The causal chain:

1. Voluntary commitments are unstable under competitive pressure (evidenced by xAI launching Grok 4 with no safety documentation, Google delaying Gemini 2.5 Pro safety cards).
2. State legislation codifies these commitments as legal obligations.
3. California and New York effectively function as national standards because all frontier labs operate there.
4. Transparency creates accountability infrastructure: published safety frameworks become evidence in future litigation, establish "industry standard" benchmarks for negligence claims, and inform future stronger legislation.
5. This builds toward a federal standard once political conditions allow.

The intellectual origin is clear: Woodside's Feb 2024 CSET article argued Congress should codify Biden-era AI reporting requirements. When federal legislation failed and Trump rescinded the EO, SAIP implemented the same idea at the state level.

Revealed Theory of Change

SAIP's actions are consistent with their stated mission in important ways, and diverge in others:

Consistent: They do exactly what they say -- push state-level transparency legislation. Nine states, two laws signed, cross-partisan approach. The bills closely match the stated three pillars.

The strategic retreat: The pivot from SB 1047 (liability, kill switches, deployment prohibitions) to SB 53 (transparency only) was driven by political reality, not by a principled belief that disclosure is sufficient. SAIP co-founders worked on SB 1047 at CAIS Action Fund. They accepted the weaker version because the alternative was nothing. This is pragmatic but means the actual mechanism they believe in (enforceable safety standards with teeth) was abandoned in favor of what was politically achievable.

The implementation effort: The LW forum post recruiting for CA AG and NY implementation roles reveals a theory of change that extends beyond passing laws. SAIP is trying to ensure that sympathetic, competent people enforce the laws they helped pass. This is sophisticated -- most advocacy orgs stop at passage.

The opacity problem: SAIP advocates for AI transparency while maintaining total opacity about its own governance, funding, and internal decision-making. No board disclosure, no donors named, no publications explaining their reasoning. This revealed preference for secrecy contradicts the stated principle that transparency creates accountability.

The cross-partisan framing: The 5D/4R sponsor split is genuine but the team's actual background is overwhelmingly EA/left-of-center. Simon Bazelon worked for David Shor's Democratic data firm. The "nonpartisan" framing is a political strategy, not a description of the team's ideological composition. This is standard political practice but creates vulnerability when investigative journalists connect the dots.

Key Assumptions

Assumption 1: State-level transparency legislation meaningfully reduces AI risk.

• Evidence for: It creates a legal floor, establishes precedent, provides whistleblower protection that didn't exist before. Published safety frameworks create legal records for future litigation.
• Evidence against: Stanford Law argues disclosure-only is fundamentally insufficient. Historical precedent is discouraging: financial disclosures didn't prevent 2008, environmental impact statements haven't halted degradation. SB 53 scores 1.75/5 on key governance principles. Third-party audits were removed.
• Testable: Track whether any enforcement action occurs under SB 53 or RAISE Act within 3 years.
• If wrong: SAIP has spent years creating "an appearance of regulatory oversight" that gives the public false confidence while doing nothing to change AI development practices.

Assumption 2: State laws can survive federal preemption.

• Evidence for: The 10-year federal AI moratorium was rejected by the Senate 99-1. Child safety provisions are explicitly carved out from Trump's preemption EO. SB 53's "cooperative federalism" mechanism allows federal compliance to satisfy state requirements.
• Evidence against: Trump EO directs DOJ to challenge state AI laws. White House killed Utah HB 286 with a single letter. Federal preemption has strong constitutional basis (Commerce Clause). The EO threatens to strip federal funding from states with "onerous" AI laws.
• Testable: Will DOJ challenge SB 53 or RAISE Act within 2 years?
• If wrong: SAIP's entire legislative portfolio becomes legally void or unenforceable.

Assumption 3: The no-corporate-funding policy maintains independence.

• Evidence for: SAIP explicitly states no corporate or foreign government funds. This prevents direct industry capture.
• Evidence against: Without disclosure, the claim is unfalsifiable. The EA donor network is small, wealthy, and interconnected. Moskovitz-connected donors could fund SAIP through intermediaries without technically violating the corporate funding ban. The Anthropic-SAIP incentive alignment exists regardless of direct funding.
• If wrong: SAIP's claimed independence becomes a branding exercise that obscures real influence patterns.

Assumption 4: The EA network's political perception won't undermine the legislative strategy.

• Evidence for: SB 53 was signed into law. Two laws passed. Cross-partisan sponsors exist.
• Evidence against: Washington Examiner and Dossier coverage frames SAIP as "dark money." David Sacks (21M view reach) attacked the related Humans First org. CAIS itself said "the less influence EA has on AI safety, the better." Right-wing media successfully killed Utah HB 286 in part by exposing EA connections.
• If wrong: The cross-partisan strategy collapses as Republican sponsors face "liberal dark money" attacks, leaving SAIP effective only in blue states where it's least needed.

Strengths

Legislative output is real and measurable. Two laws signed in 15 months of existence. This is more tangible policy output than most AI safety organizations produce in their lifetimes. SB 53 in particular -- despite its limitations -- is the first enforceable regulatory framework for frontier AI in the United States.

Strategic sophistication. Hiring Republican House Speakers as lobbyists, commissioning polls, deploying celebrity testimony, recruiting for enforcement positions, building cooperative federalism mechanisms -- these are the moves of people who understand political power. This is not naive EA idealism; this is professional-grade political operations.

California as de facto national standard. Because all frontier labs operate in California, SB 53 effectively creates a national compliance floor regardless of federal action. This is a genuine structural advantage of the state-level approach.

First-mover on enforcement infrastructure. Recruiting for CA AG and NY implementation positions shows SAIP understands that law-on-the-books is worthless without competent enforcement. Most advocacy orgs neglect this step.

Cross-partisan approach is genuine if fragile. Four Republican bill sponsors in deep-red states is a real achievement for the AI safety movement. The Utah polling showed 91% Republican support for AI transparency. This is political territory that can be won.

Weaknesses and Risks

The disclosure-only approach may be fundamentally inadequate. Stanford Law's critique is devastating: SB 53 requires companies to describe what they do, not prove it works. No performance standards, no deployment prohibitions, no audits. Historical precedent for disclosure-only regulation is poor. SAIP may be building a Potemkin regulatory infrastructure that creates false confidence.

Federal preemption is an existential risk. The Trump EO directs DOJ to challenge state AI laws. A single successful challenge could invalidate SAIP's entire portfolio. The White House killed the Utah bill with one letter. This risk is structural and cannot be mitigated by better legislation.

Total financial opacity undermines credibility. A transparency advocacy org that won't disclose its own board, donors, or finances invites the exact kind of "dark money" accusations it receives. When the 990 filings eventually become public, they will either validate or devastate SAIP's credibility. If major EA funders are behind SAIP, the failure to disclose will look like deliberate concealment.

Beckstead's FTX exposure is unaddressed. The CEO was personally warned about SBF's dishonesty in 2018, then led SBF's philanthropic arm in 2021. He has never publicly addressed this. His SAIP bio omits FTX entirely. This is a reputational time bomb -- any serious investigative journalist will find the TIME article and draw conclusions about judgment and transparency.

Industry can gut legislation at the implementation stage. Hochul's rewriting of RAISE Act demonstrates that even passed legislation is vulnerable to industry lobbying at the executive level. SAIP got the RAISE Act through the legislature with bipartisan supermajorities, then watched it get eviscerated by the governor's office under VC pressure.

Zero intellectual output. SAIP has some of the most policy-experienced people in the AI safety ecosystem but produces no public analysis, no papers, no blog posts, no responses to criticism. This means no ability to shape the intellectual debate, no response to substantive critiques like Stanford Law's, and no public record of their reasoning that outsiders can evaluate.

Cross-References

CLTC Berkeley: CLTC works on the standards/frameworks that SAIP's legislation references. CLTC develops the technical content (GPAIS Profile, risk thresholds); SAIP pushes the legal obligation to adopt such content. They address complementary parts of the same problem. Key difference: CLTC operates in the open (publications, standards processes, academic credibility) while SAIP operates behind the scenes.

CAIS/CAIS Action Fund: SAIP's organizational parent/sibling. Both co-founders came from CAIS. CAIS AF's policy priorities overlap heavily with SAIP's legislative agenda. Dan Hendrycks endorsed SB 53. The Humans First org was incubated by CAIS and uses a similar cross-partisan strategy. The relationship is not disclosed but the coordination is apparent.

Encode AI: SAIP's legislative partner across all states. Encode brings grassroots credibility and youth advocacy; SAIP brings policy expertise and EA-network connections. They co-sponsor, co-commission polls, and co-lobby.

Anthropic: Not a partner but an aligned actor. SB 53 codifies Anthropic's existing practices, giving Anthropic a competitive advantage. Anthropic's endorsement legitimized SB 53 and likely influenced Newsom's signing decision.

What Would Change This Assessment

Upward revisions:

• First 990 filing shows clean, diversified funding from credible sources
• Beckstead gives a candid interview addressing FTX, explaining SAIP's theory of change
• SAIP publishes substantive policy analysis or responds to Stanford Law critique
• SB 53 enforcement action occurs (AG investigates non-compliance)
• Federal preemption effort fails and more states pass similar laws
• SAIP begins federal advocacy in addition to state-level work
• Board members disclosed and include credible independent voices

Downward revisions:

• DOJ challenges SB 53 or RAISE Act and wins
• 990 reveals single-funder dependence or undisclosed conflicts
• Right-wing media campaign successfully poisons cross-partisan strategy
• No enforcement action under SB 53 or RAISE Act after 3 years
• Additional states fail due to federal pressure (repeating Utah pattern)
• SAIP funding dries up and operations contract

Self-Critique

What sources should I have checked but didn't?

• State lobbying disclosure filings for all 9 states, which would reveal SAIP's lobbying expenditures
• CAIS Action Fund IRS filings, which might reveal funding relationships with SAIP
• Utah legislature hearing transcripts where SAIP testified
• The actual text of SB 53 and RAISE Act (I relied on legal analyses rather than primary legislation)
• Greg Curtis's lobbying registration details in Utah

Where is this analysis potentially biased?

• I may overweight the FTX connection because it's dramatic, when Beckstead's Open Phil experience is more predictive of his current work
• The Stanford Law critique is treated as the strongest counterargument, but this analysis is from a single academic and may not represent scholarly consensus
• I may underweight SAIP's actual legislative achievements because the opacity and FTX issues are more interesting findings
• The right-wing critiques are given more analytical weight than they may deserve as policy arguments (though they matter politically)

What would a thoughtful person who disagrees say? "SAIP got two laws passed in 15 months. The entire rest of the AI safety community spent years writing papers, hosting conferences, and building tools, and the US had zero enforceable frontier AI regulation before SB 53. Disclosure is a stepping stone, not the endpoint -- you build the regulatory infrastructure now, then strengthen it later. The team is deliberately quiet because political operations work better without a public profile. The FTX thing is ancient history -- Beckstead left that role and started doing something constructive. And the funding opacity is standard for new nonprofits that haven't filed 990s yet."

My single weakest claim: That SAIP's disclosure-only approach is likely insufficient to reduce catastrophic AI risk. I draw this from Stanford Law and historical precedent, but SAIP may be correct that transparency creates the foundation for stronger future regulation, and that the alternative (no regulation) is worse. The counterfactual matters: if the choice is between disclosure-only and nothing, disclosure-only wins.

What information would most change my view? SAIP's first 990 filing. If it shows clean, diversified funding and reasonable overhead, many concerns about opacity become less significant. If it shows single-funder dependence or undisclosed relationships, the concerns become fatal.