As they compete for the lead in artificial intelligence, China and the United States are also discussing how to notify each other directly when something goes wrong. The arrangement now under discussion puts competition and risk communication on the same agenda.

On Nov. 10, U.S. time, Treasury Secretary Bessent said at a dinner hosted by the National Committee on U.S.-China Relations in New York that Washington had begun working with Beijing to establish a new dialogue on “superintelligence.” The two sides are expected to exchange views on methods for evaluating and testing advanced models before their release, as well as on ways to ensure that human judgment remains in control. They are also establishing a direct channel through which either side can promptly notify the other of serious incidents involving its own models.

“Superintelligence” is the term currently used by the U.S. government to refer to artificial intelligence. The discussions will focus on testing advanced models, preserving human control and responding to serious incidents.

1. Agreement on Incident Reporting Predates the Shenzhen Talks

The two sides have already publicly agreed to establish an incident-communication channel, although the details of how it will operate have yet to be worked out.

In a statement released on Sept. 26, China’s Foreign Ministry said the two sides had agreed to establish a China-U.S. dialogue on artificial intelligence to exchange views on related risks and benefits. The next round of talks was scheduled for November, and the two sides also agreed to create a channel for communicating about AI-related incidents.

The APEC Economic Leaders’ Informal Meeting will take place in Shenzhen on Nov. 18 and 19. Reuters reported that Bessent said the bilateral dialogue would be advanced during the meeting.

The consensus announced by China in September provided the framework for the talks. Bessent’s latest remarks offered more detail on the issues to be discussed, including testing methods and the purpose of directly reporting serious incidents.

He described the purpose of the dialogue as preventing shared risks and avoiding misunderstandings between the two systems. A speech released by the Treasury Department did not specify the threshold for triggering an incident report, which agencies would receive the notifications or how quickly they would have to be processed. Nor did it say that the channel was already operational.

2. Models May Be Tested Before Release and Still Fail After Deployment

One specific issue the two sides plan to discuss is how to identify dangerous capabilities and potential risks before an advanced model is made available to users.

The answer depends in part on the testing method. Asking a model a fixed question may produce a different result from allowing it to call tools repeatedly, receive feedback and take further action.

Research by the U.S. National Institute of Standards and Technology on evaluating AI agents has identified the detection of test-gaming during repeated tool use as a methodological challenge. A model may exploit vulnerabilities in the testing environment to complete a task, producing a score that does not accurately reflect the capability being measured.

The tests themselves also need to be scrutinized. How questions are designed, how the test environment is configured and how failure is defined will determine whether the two sides understand what the other means when it says a model has been “tested.” The specific materials to be exchanged will depend on the follow-up discussions.

For Chinese companies integrating AI into their operations, as well as ordinary users of AI-powered products, these methods bear directly on the reliability of systems in real-world settings.

A model’s ability to answer a question correctly is different from its ability to use tools and complete a task reliably after deployment. Those are two separate capabilities that must be tested independently.

A post-deployment monitoring report published by NIST in March noted that pre-release evaluations are conducted mainly in controlled environments. In real-world use, inputs, user interactions and system components are more complex, requiring monitoring and repeated verification after deployment.

Passing a test once does not eliminate the need for continued risk assessment.

3. Prevention and Reporting Address Two Different Stages

Pre-release testing is intended to identify problems as early as possible. Serious-incident reporting, by contrast, deals with anomalies that have already emerged.

The more deeply an AI model is integrated into software, business processes and tool use, the more difficult it becomes for pre-release evaluations alone to cover every possible situation.

The direct channel proposed by Bessent would allow the party experiencing an incident to notify the other side proactively. Such a notification would provide a clear source of information. But determining the scale of the impact would depend on what the notification contained, whether the receiving party could verify the information and whether additional updates were provided.

The practical difficulty is deciding what to report before the cause of an incident is known.

Waiting until the investigation is complete could mean missing the window for effective action. But simply reporting that “an anomaly has occurred” would leave the receiving party without enough information to respond.

Incident classification, the minimum information that must be reported, designated points of contact and procedures for ongoing updates will all directly affect whether the channel can work effectively.

These are the operational issues that an incident-reporting mechanism will need to address. The public consensus announced by China and Bessent’s remarks do not yet provide a complete set of operating rules.

4. Keeping Humans in Control Also Means Determining Who Can Shut a System Down

Bessent said the discussions are also expected to cover ways to ensure that human judgment remains in control. A statement issued by China in September following a leaders’ meeting similarly called for maintaining human oversight of AI technology.

In a specific system, however, control depends on whether people have the authority and the time to intervene.

Which actions require prior approval? What anomalies should trigger a pause? Once a problem occurs, can access rights be revoked and the relevant actions traced through system logs?

These decisions are just as concrete as the question of how accurately an AI model can answer questions when it is integrated into business operations.

Competition has not disappeared from the agenda. In the same speech, Bessent made clear that the interests of the two countries would not always align and that their approaches to addressing challenges would not always converge.

How model evaluations are shared, how serious incidents are reported and how humans retain final decision-making authority will be addressed through separate technical and institutional arrangements in the next phase of the dialogue.

Further Discussion: Nuclear Accident Reporting Starts with Facts, Then Adds Detail

Following the 1986 Chernobyl disaster, the international community adopted the Convention on Early Notification of a Nuclear Accident.

The convention requires states to immediately notify countries that may be affected, as well as the International Atomic Energy Agency, of certain accidents that could have cross-border radiological safety implications. They must also provide the information available to them at the time.

Article 2 sets out the obligations concerning notification and the provision of information. Article 5 further lists details such as the time of the accident, its precise location, the facility or activity involved, known or presumed causes, the extent of any release, meteorological conditions and protective measures. It also requires additional information to be provided as appropriate.

Notifications may be issued directly or transmitted through the IAEA.

Article 5 allows a state to report a “presumed cause” based on the information available to it at the time. The cause of an incident may therefore remain undetermined when the initial notification is sent. But the time, location and nature of the accident, as well as subsequent updates, are each covered by specific provisions.

(Shanghai Pudong New Area Zhangjiang Economy Research Institute)