We Taught Sand to Think

Demis Hassabis has spent his whole life building artificial minds, and the sentence he chose to describe the achievement is the best I have read. We have, he writes, essentially found a way to make sand think. It is miraculous, and he is right, and it is also the kind of miracle that raises a very old question. Who checks the work? This month, in A Framework for Frontier AI and the Dawning of a New Age, the Nobel laureate who runs Google DeepMind gave his answer for the most powerful systems on earth. The same week, at a lectern in Sydney, Australia's Prime Minister gave his, announcing that Australian Standards for AI will be legislated in early 2027.

Read together, the two documents describe a world finally getting serious about AI at the top of the stack. Read carefully, they describe a hole. I want to talk about the hole, because most Australian businesses are standing in it, and neither document so much as glances their way.

A FINRA for the frontier

Hassabis proposes an American standards body for frontier AI, modelled on FINRA, the self regulatory organisation that oversees securities firms. It would be a public private partnership with independent technical experts on its board, funded largely by industry. It would set benchmarks that define which models count as frontier class, test them for cybersecurity, biological and other national security risks, and refresh those tests as capabilities move. Labs would share models voluntarily at first, up to thirty days before release. Once the process proves itself, passing would become a condition of deployment in the US market.

Two details in the essay deserve more attention than the coverage gave them. The first is prestige. Being designated a frontier lab, Hassabis writes, would carry real status, open to any organisation that meets the bar. He understands that trust infrastructure works partly through aspiration. The second is who does the checking. The standards body, he suggests, should promote an ecosystem of third party auditors to help with assessments and the development of new evaluations. Not one regulator marking every exam, but a market of independent assessors holding people to a published standard.

And then there is the exemption. Non frontier models, from startups or academia, sit outside the process entirely. Hassabis is explicit about it, and he is right to be. You do not send the corner store through a bank's stress test. But notice what the exemption quietly assumes. Below the frontier, someone else will be checking the homework. He never says who.

Canberra builds from the top down

Now look at what Australia announced the same week. Legislated standards by early 2027. An Office of AI inside the Department of the Prime Minister and Cabinet. Binding obligations on large data centres for energy and water. And what the government calls the strongest possible protection for Australian creators, with a text and data mining exception ruled out.

So the frontier gets a testing regime, the data centres get legal obligations, and the artists get property rights. All of it is welcome, and I mean that without reservation. But lay the two blueprints side by side and run your finger down the middle. The frontier is covered from above. The infrastructure is covered from below. The question I am asked most often by actual Australian businesses sits untouched between them. What about us?

Between the frontier and the footpath

Who verifies the physio clinic using an AI scribe in its consultations? The lender using AI to score credit applications? The school rolling out an AI tutor, the recruiter screening resumes with a model, the retailer whose service chatbot is the only door a customer can find? These businesses are not frontier labs. They will never be assessed by a national security laboratory, and they should not be. Under Hassabis's framework they are exempt. Under Canberra's announcements so far, they are unmentioned.

Yet this is the layer where Australians actually meet AI. Not in a model card or a national security evaluation, but in a rostering system, an automated decision, a confident answer from a chatbot that happens to be wrong. This is the layer our AI Incident Exchange was built for, the ordinary failures rather than the frontier ones. The harms are smaller than the ones Hassabis worries about, and there are far more people standing near them.

Assurance has to exist before it is asked for

Here is the quiet assumption inside both documents. When Hassabis calls for an ecosystem of third party auditors, and when Canberra drafts standards that will one day need assessment, both are assuming that independent assurance bodies exist, with published rules, working registers and track records, on the day they are needed. They do not appear by decree. An assurance ecosystem has to be grown in advance, the way airworthiness inspection grew up alongside aviation long before anyone mandated it.

That is the work we have been doing at the layer the big frameworks skip. A certification trade mark scheme lodged with IP Australia and the ACCC, assessing businesses against the Australian AI Ethics Principles across three tiers. Commit, Embed and Govern. A public register anyone can search. A machine verifiable credential that an AI agent can check without asking a human. An incident exchange where anyone in Australia can report harm. It is small next to a national standards body, and it is real, running, and Australian.

Hassabis understood that a frontier designation would carry prestige. The same psychology holds at every scale. A trust mark that is independently assessed, publicly listed and revocable means something precisely because not everyone has it. That is as true for a Brisbane clinic as it is for a frontier lab in San Francisco.

The layer where you live

The standards arrive in early 2027. The questions arrive every day. Between those two facts sits the most useful eighteen months your business will get, because preparation done now is cheap, calm and compounding, and preparation done under a legislative deadline is none of those things. The frameworks being built above you assume someone will verify the layer you live in. In Australia, someone already does.