In the late 2000s and 2010s, factories in eastern China produced large quantities of the ozone-depleting chemical CFC-11 in violation of the Montreal Protocol. The cheating went undetected by the treaty’s compliance machinery. It was discovered only when atmospheric scientists noticed anomalous concentrations of the gas in the global atmosphere. China rapidly stamped down on the dozens of factories openly admitting to using illegal CFC-11 as a “blowing agent” to manufacture polyurethane insulation foam in the provinces of Shandong and Hebei. The Montreal Protocol required national reporting and maintained an Implementation Committee, but it had no routine on-site inspectors for production facilities. Despite these transgressions, it remains the most successful environmental treaty ever negotiated, and the ozone hole is slowly recovering.
Now attention is turning to international treaty options for risks posed by AI agents. Last month, in July 2026 an incident involving OpenAI and Hugging Face exposed weaknesses in containment and monitoring of advanced models. During an internal cybersecurity evaluation, experimental OpenAI models escaped their restricted sandbox, gained internet access, and autonomously breached Hugging Face infrastructure in order to steal answers to the benchmark they were running. The political reaction was swift: renewed calls for international AI controls, verification regimes, and even shutdown mechanisms - a so-called “Kill Switch” bill in the US. The incident did not prove that AI treaties are necessary. It revived the more fundamental question of what would make one possible.
Most analysis treats the problem in game theoretic terms as a multi-player Prisoners’ Dilemma. Collective restraint is better for everyone; unilateral defection is tempting for each. Treaties must therefore change the payoffs through monitoring, inspections, sanctions, and verification. The Biological Weapons Convention is often cited as a cautionary case: negotiations over an inspection protocol collapsed in part because states feared exposing commercial and defence secrets, and determined cheaters could still evade detection. Verification tools clearly matter for certain high-value, low-number activities such as nuclear weapons. From the verification-first perspective, many analysts conclude that AI cannot be effectively verified and therefore cannot be effectively governed by treaty.
Most of the AI treaty current debate is about designing better locks, cameras, and alarm systems (verification, inspections, sanctions) to catch people who break the rules *inside* the house. But the real strategic problem is that the house has no walls. Anyone can stay outside, free-ride on whatever benefits the house provides, and face almost no cost for refusing to join.
The current AI-treaty debate often confuses two different games: compliance after joining and participation before joining. It focuses heavily on the former and comparatively little on the latter.
What the Montreal Protocol actually changed was the cost of staying outside. Article 4 banned trade in controlled substances - and later in products and production technology - with non-parties, making exclusion economically expensive. At the same time the Multilateral Fund lowered the cost of joining for developing countries. China and India entered once the regime had become both more attractive and harder to avoid. There were no routine on-site inspectors and no independent enforcement army. Montreal did not make cheating impossible. It made exclusion costly and participation affordable.
This pattern fits a broader strategic logic. When the gains from cooperation are large, the incentive to free-ride or to stay outside rises. Stable coalitions therefore tend to be either small and deep or large and shallow unless an exclusion device alters the outside option. Trade restrictions combined with financial assistance are the classic example of changing that option.
The conceptual distinction is straightforward. In the compliance game the question is whether a party has kept its promise; monitoring matters. In the participation game the question is whether a state will join at all; exclusion matters. A treaty does not primarily change the payoff to cheating. It changes the payoff to staying outside. Three years of intensive research into AI verification techniques may therefore have been aimed at the wrong strategic problem.
The Chemical Weapons Convention (CWC) offers a useful near-miss. Chemistry is easier to monitor than biology, and the number of declarable facilities is smaller. That is the standard explanation for why the CWC acquired a substantial verification regime while the Biological Weapons Convention did not. The political economy was equally important. Export restrictions on non-signatories, combined with support from the chemical industry itself, made membership commercially advantageous. Verification became the price of entry rather than the primary enforcement tool. Challenge inspections exist on paper and have never been used. The visible machinery of enforcement was not always the operative mechanism.
In August 2026 the landscape of AI governance shows the same pattern in reverse. Initiatives such as the World Artificial Intelligence Cooperation Organization (WAICO), a China-led international intergovernmental body established on July 16, 2026, in Shanghai, Pax Silica, the New Delhi Declaration, and the Council of Europe’s convention with its frontier-model exemptions are either broad and shallow or narrow and non-binding. What is missing is a common compute threshold, a shared registry, or any meaningful reciprocal exclusion mechanism.
Is compute AI’s equivalent of Montreal’s Article 4? Article 4 functioned as a “treaty-club exclusion device”. By cutting non-members off from crucial supply chains, it raised the economic cost of staying outside the agreement, eliminating free-riding and compelling global participation. Restricting access to high-end chips and the tools that make them could serve as AI’s equivalent of Montreal’s Article 4.
However, a compute wall does not end the compliance problem, it relocates it to export-licensing and customs enforcement - itself a capacity-intensive undertaking, as current US compliance attempts show. There have been multiple enforcement lapses on the US AI Diffusion Rule aimed at limiting chip sales to China. Super Micro’s co-founder was indicted in a $2.5bn smuggling scheme and a Taiwan-based Nvidia employee was separately detained; at the same time China’s Huawei Ascend 910C output is ramping toward roughly 600,000 units in 2026. A stronger chokepoint might be upstream of chips in extreme ultraviolet lithography tools (ASML) and electronic design automation software - closer to Montreal’s substitute-patent economics than GPUs are.
Frontier training still depends on constrained high-end chips and the associated infrastructure. Unilateral export controls already have some bite. Chinese domestic alternatives are improving, open-source weights circulate freely, and inference can be distributed. Technical tools for proof-of-training and hardware attestation remain largely undeployed. China is also developing its own lithography champions, although they lag behind ASML by many years. Unilateral export controls are not the same as a treaty-club exclusion device that binds members against free-riding on the outside option. A fence that is technically incomplete can still raise the cost of staying outside; a fence that neither side wishes to maintain cannot. Domestic political constraints reinforce the difficulty: for example, formal international treaties negotiated by the US President require approval by a two-thirds supermajority in the Senate.
Recent events illustrate the deeper difficulty. Export-control relaxations and the Chinese rejection of certain advanced chip shipments show both sides stepping away from a potential fence when short-term commercial or strategic interests dominate. Exclusion requires infrastructure. Infrastructure requires cooperation. That cooperation is itself subject to the same participation problem. Major powers sometimes accept mutual constraint, as they have with nuclear and chemical weapons. The distribution of expected gains and the residual uncertainty about relative advantage make mutual constraint harder for AI.
Exclusion regimes tend to fail from the inside, not the outside. COCOM, the Cold War body that walled off Soviet-bloc access to Western technology, was not defeated by smugglers; its own members dissolved it in 1994 once the strategic rationale for a unified front had gone. The Nuclear Suppliers Group was built in 1974 specifically to deny nuclear trade to states outside the NPT; in 2008 its own members granted India, a state that had never joined, a blanket waiver, because Washington judged the relationship worth more than the exclusion principle it had championed. The Biological Weapons Convention never developed a serious verification regime for the same reason: it was the United States, the treaty’s principal sponsor, that walked away from the 2001 composite text over its own commercial and biodefence secrecy. In each case the wall did not fall to a determined outsider. It was dismantled by an insider who decided that continued enforcement cost more than the exclusion was worth.
Montreal succeeded less by making cheating impossible (locks) than by making exclusion costly and membership valuable (walls). If AI governance is to develop into a durable treaty regime, the central challenge may not be designing perfect verification mechanisms but constructing a coalition in which the major powers judge participation to be preferable to staying outside. At present, that coalition would depend overwhelmingly on the United States and China. Whether they can sustain such a bargain as AI capabilities diffuse is the question that will determine the stability of any future regime.