A Commerce-Housed AI Review Board Would Favour the Incumbents Who Already Employ Compliance Teams

Why Is "Applies to Everyone" Not the Same as "Costs Everyone the Same"?

The conventional framing treats a Commerce-housed review board as a neutral safety instrument: the duties are written once, they bind every covered developer, and the only live question is whether Washington or the Senate Commerce Committee should hold the pen. That framing describes the legal reach of the bill accurately and says nothing about its economics. A statutory duty is a price list, and a fixed duty is charged per developer, not per dollar of revenue.

A rule that asks every covered developer to open a model to a federal board 45 days before release, publish a safety plan and file incident reports sets an entry price. Whether that price is trivial or prohibitive depends entirely on who is paying it. The pillar article in this cluster sets out what the bill requires and who sits on the Board, and I do not repeat that here. This piece asks only who the design advantages.

I write as a publisher who reads statutes the way an operator reads a contract, not as a lawyer, and this is signed opinion. The test I apply is the one the evidence allows: state the claim so that the bill text can contradict it, then say where the text and the available evidence stop.

The verdict for this section is simple: uniform duties tell us who is bound, and only the cost of meeting them tells us who is burdened.

Which Developers Does the Bill Cover, and Where Is the Line Drawn?

The bill defines a developer as a developer of a frontier artificial intelligence model, and it defines the model by what it can do. A frontier model, in section 2(11), is one that "exhibits or could be modified to exhibit high levels of performance at tasks that pose a serious risk." In the text I read, the definition sets no compute, size or revenue threshold. The line is capability, not corporate scale.

That matters for the thesis in two ways. First, a capability line narrows the covered population, and the strongest argument against my claim is that, on my reasoning, the developers who clear it today are the best-funded in the field, so there may be no small developer to burden. Second, the definition reaches models that could be modified to show the capability, not only those that already do, and the text I read does not say how the performance test is measured. I found no sourced count of covered developers, so I do not assert one.

The duty that follows the developer is wider than the model. Section 4(a) requires "each developer" to "develop, publish, and follow a safety plan" for each AI system or model it creates, substantially modifies, or uses in training or evaluating other models. Because the covered party is defined by one frontier model, the plan duty follows the developer across its whole portfolio. That is my reading of the text, and the clause should be read in full before anyone relies on it.

The verdict: the bill is size-neutral on its face and silent on cost, so the thesis lives or dies on what the duties cost, not on who is covered.

Which Duties Are Fixed, and Which Scale With Size?

The framework below sorts the bill's operative duties by how their cost behaves. The classification is mine; the clause references are the bill's.

One qualification follows from the text. The penalty attaches to violations of section 3(c), which requires each developer to comply with standards adopted under section 3(b)(2). Those standards do not yet exist, so the price of compliance is not yet set. The pillar article covers the timetable for writing them.

The penalty design is the clearest contrast with a scaled regime. This publication's June 2026 comparison of the EU AI Act and the US executive order reports EU fines of up to €35 million or 7% of global annual turnover for the most serious violations. A penalty expressed as a share of turnover scales with the firm. A flat ceiling does not.

A hypothetical, labelled as one: two developers each carry the same fixed annual cost to meet the duties, and one has ten times the revenue of the other. The cost is ten times heavier, as a share of revenue, on the smaller developer. The calculation needs no cost figure to hold; it needs only that the cost does not scale with revenue.

The verdict: three of the four duties are fixed or nearly so, and a fixed cost is an entry price that only the revenue base can absorb.

What Would a Compliance Function Cost, and What Evidence Exists?

No sourced figure exists in anything I read. The bill states no cost estimate. Sen. Mark Warner's 29 September 2026 floor release contains no analysis of small developers or compliance cost, and the reporting on Cruz's objection contains none either. The release does state the incumbency concern in general terms, without a cost analysis: "We need to make sure whatever safety board we put in place doesn't ensconce the already largest frontier labs." I will not invent a number to make the thesis look measured. The claim therefore rests on mechanism, not on a price.

The nearest empirical case is an analogy, and I label it as one. Johnson, Shriver and Goldberg studied the EU's General Data Protection Regulation in Management Science (volume 69, issue 10, October 2023), using panel data on web technology vendors across more than 27,000 websites. The summary reports that sites were more likely to keep top vendors after the regulation, raising vendor market concentration by 17%, mainly among vendors that use personal data. The University of Colorado Leeds School of Business summary also records that the aggregate changes faded by the end of 2018, while the effect persisted in advertising vendors. I read only that summary, not the journal page.

The limits are plain. The study concerns web vendors and privacy law, not frontier AI, and the aggregate effect faded. It supports the mechanism, that a fixed duty can raise concentration among those able to carry it, and it does not support the conclusion that this bill will do so.

Two earlier pieces in this publication bear on the mechanism from different sides. The consolidation argument of July 2026, an opinion piece about African fintech, holds that licensing friction can consume two to three years of runway, a figure the piece gives without a source, and describes acquiring a licensed firm as a way to avoid regulatory delay. That is a barrier-to-entry mechanism, argued in a different sector. Against it, the August 2026 piece on compliance infrastructure argues that compliance is increasingly bought as an interface rather than built. That market concerns identity checks and money-laundering screening, and I found no equivalent vendor market for frontier safety plans or incident reporting.

The verdict: the evidence shows the mechanism operating elsewhere and does not show it operating here at a material price.

Does a Commerce-Housed Board Make Capture More or Less Likely?

Regulatory capture is a regulator's decisions coming to serve the firms it oversees. The design question is where in this bill such a pull could operate. The Board's structure is set out in the pillar article; the one clause that matters here is that the Commerce Secretary chooses its non-government members, among them developer-affiliated experts.

That last category is the one point of Board composition that bears on capture. Developers with policy and compliance staff can supply experts, answer proposed standards and follow rulemaking. A new entrant must buy that capacity before it can use it. This is my reading of how the process favours the resourced, and I read no evidence on how the Board would in practice be staffed.

The same reading carries a limit in the incumbents' disfavour. The standards are unwritten, and the price of compliance is set at that step, not in the statute. Capture risk therefore concentrates in a stage that has not yet happened, which is also the stage where a size-aware design could still be written.

Set against two alternatives, as reasoning rather than a finding: duties graded by developer size would lower the entry price directly, and a court-centred model, which Cruz's stated preference for independent judges points towards, would move decisions to after harm but would not remove the need for a compliance function to defend a case. Neither is in the bill.

The verdict: the Board's design does not make capture certain, but it places the decisive step in a process where the best-resourced developer arrives first.

Where Does Sen. Cruz's Objection Fit?

Warner, joined by Sens. Brian Schatz and Andy Kim, asked for unanimous consent on 29 September 2026, and Cruz objected. Warner described the request as "really simple" and "as pared down as possible." The bill has not passed.

According to reporting by implicator.ai, Cruz said the bill gives the Board and the Commerce Department too much authority, said he preferred a role for independent judges, and said Congress "must not legislate" on artificial intelligence "hastily or in a closed manner." He also said federal standards must address the patchwork of state laws, and that he is working on a catastrophic-risk bill with Majority Leader John Thune and Sen. Amy Klobuchar.

His stated concern is authority and process. It is a different argument from incumbency, and neither argument implies the other. The Board could hold less power, or judges could be added, and a fixed duty would still carry a fixed cost. In what I read, neither Cruz nor Warner analysed small developers or compliance cost, though Warner's release states the incumbency concern in general terms, as quoted above.

The wider push towards oversight is moving on several fronts at once. The Vol. 8 edition of The Upside Crosscurrents tracked a House liability discussion draft and a UK committee evidence session on whether pre-release safety testing should be mandatory, and neither concerns this Board.

The verdict: Cruz objected to who decides; this piece asks who pays, and Warner names the incumbency risk only in general terms, with no cost analysis from either side.

Why This Matters for Founders and Capital Allocators

For a founder building towards the capability line, the planning question is whether the company can staff a safety-plan owner and a 72-hour incident function before it needs them. That is a hiring decision with a lead time, and it belongs in the plan well ahead of the first model that might be covered.

For a capital allocator, the diligence question is whether a frontier developer has a named owner and a working process for each of the three duties, and whether the company's own reading of the capability definition puts it inside or outside the bill. The wider AI regulation playbook gives the compliance context. The revenue-against-fixed-cost arithmetic belongs to a later piece in this cluster on runway and diligence under a 45-day window.

Both readers should watch the standards-writing step, because that is where a fixed duty becomes a specific cost, and where a size-aware design could still be argued.

The verdict: the bill's cost will be set by rules not yet written, so the time to price it is before they are.

What Would Change My Verdict?

A claim that cannot be falsified is not worth publishing. Four findings would weaken or reverse this one: duties graded by developer size, a size or compute threshold written into the definition of a frontier model, a sourced cost showing that meeting the duties is immaterial next to revenue, and evidence that the covered set in practice contains only developers large enough that none could be called an entrant.

I will return to the scaled-duty design in a later piece, setting out what a Board with duties graded by developer size would look like. Until then, the position stands on the evidence above and no further.

Conclusion

The Artificial Intelligence Risk Management and Security Act of 2026 binds every covered developer to the same duties, and the text shows that much with certainty. Whether those duties favour the developers who already employ compliance teams depends on a price the bill does not state and on standards not yet written. The argument rests on mechanism, supported by an analogy and bounded by the limits set out above. The test of the bill is who can afford to pay its entry price.