There is exactly one number in the entire EU AI Act that a forensic auditor can independently verify, and it is not a number about safety. It is 10^25 FLOPs.
That is the cumulative training compute threshold above which a general-purpose AI model is presumed — rebuttably — to carry "systemic risk." Every headline claiming Brussels is "ready to handle rogue AI" rests on that figure and on the procedural scaffolding wrapped around it: model evaluations, adversarial red-teaming, serious-incident reporting, cybersecurity obligations. I have spent the last several weeks decompiling the text of the Act against the same method I used on the 0x Exchange contracts after the Parity multisig collapse in Tokyo. Follow the hash, not the hype. The rogue-AI claim is a claim about control. Control requires a verifiable signal. The only signal the Act actually specifies is a compute count. And a compute count does not measure capability, intent, or alignment. It measures arithmetic. So the question is not whether Brussels believes it can handle rogue AI. The question is whether the mechanism it built can tell a safe high-compute model from a dangerous one. On the evidence, it cannot.
The phrase that should stop every reader cold is this: "the EU AI Act can respond to rogue AI risk." It is a statement of institutional confidence. It is not a statement of technical capability. Those two things are separated by an audit gap wide enough to drive a training cluster through, and the gap is where the money, the policy, and the risk all live.
The architecture Brussels actually built
The AI Act is the first horizontal, legally binding AI statute in a major jurisdiction. It does not regulate AI as a single thing. It sorts systems into risk tiers — unacceptable, high, limited, and minimal — and it layers a separate set of obligations on top for general-purpose AI (GPAI) models, which is the category that matters for the rogue-AI conversation.
The tiering is administrative. The GPAI layer is where the technical claims live. Under the systemic-risk provisions, a provider whose model is presumed to carry systemic risk must perform model evaluations, conduct adversarial testing, report serious incidents, and maintain cybersecurity protections. The trigger for all of it is the 10^25 FLOPs presumption, drawn from a 2023 policy discussion and written into law as a proxy for dangerous capability.
Around this, Brussels constructed a governance apparatus. There is an AI Office inside the Commission. There is a Scientific Panel of Independent Experts intended to supply technical judgment the regulator itself does not possess. There is a Code of Practice for GPAI, published in July 2025, built on a signatory model: sign it, and you receive a presumption of compliance; decline, and you must prove compliance yourself. The signatory list included OpenAI, Google, Microsoft, Amazon, Anthropic, Mistral, and Cohere. Meta publicly refused, arguing the Code exceeded the legal obligation. That single refusal is the most information-dense data point in the entire story, because it shows the industry has not converged on what the rules even require.
The penalty structure is severe and quantified: up to 15 million euros or 3 percent of global annual turnover for GPAI violations, and up to 35 million euros or 7 percent for prohibited practices, whichever is higher. That is calibrated above GDPR's 20 million euros or 4 percent. These are not symbolic numbers. They are large enough to change product roadmaps in Europe.
And then there is the detail that undercuts the whole "we are ready" narrative. Through the second half of 2025, the Commission itself discussed a Digital Omnibus package that would delay parts of the high-risk obligations. The regulator began loosening its own timeline before the first major enforcement cycle even closed. Check the multisig. Always. When the signer starts asking for more time, you learn what the signer actually believes about readiness.
That is the context. Now the teardown.
The proxy metric problem: measuring arithmetic, not capability
Here is the core forensic finding, and everything else follows from it. The AI Act regulates capability by measuring compute. This is a proxy, and a proxy is only as good as its correlation with the thing it stands in for.
A threshold at 10^25 FLOPs assumes that dangerous capability scales monotonically and tightly with training compute. That assumption fails in both directions. It over-includes high-compute models that are benign, and it under-includes low-compute models that are dangerous. The second failure is the one that matters, because the cheapest way to acquire a dangerous capability is not to train a frontier model from scratch. It is to fine-tune an existing open-weight model on a narrow, harmful dataset. Fine-tuning runs at a tiny fraction of the pretraining compute. A model that never approaches 10^25 FLOPs of original training can, through a few thousand dollars of fine-tuning, acquire capabilities the Act was written to catch.
The threshold is a 2023 artifact applied to a 2026 reality. Frontier training runs have already moved past it as a matter of routine. When a regulatory line is drawn below the current state of the art, it stops being a filter and becomes a formality — a checkbox that the largest labs clear without effort while the actual risk migrates to smaller, unmonitored, and harder-to-reach systems.
This is the same category error I documented in my 2020 Uniswap V2 liquidity study. The market told itself that automated market makers distributed risk fairly. My Python back-tests over 2019-2020 data showed a 40 percent average loss for liquidity providers in volatile pairs. The mechanism was not measuring what participants believed it measured. A compute threshold is the AMM invariant of AI regulation: elegant on paper, indifferent to the outcome that actually matters to the people exposed to it.
The undefined variable: nobody has written down what "rogue AI" means
The Act's systemic-risk provisions do not define the thing the whole conversation is supposedly about. "Rogue AI" appears in policy discourse without a technical definition. It could mean autonomous self-replication. It could mean shutdown resistance. It could mean deceptive alignment — a model that behaves well under evaluation and differently in deployment. It could mean uplift in bioweapon or cyberattack capability. It could mean some combination.
These are not the same risk, and they do not share a mitigation. A control that works against shutdown resistance does nothing against deceptive alignment. A control that constrains cyberattack uplift does nothing about self-replication. When a regulator does not define the target, the obligation collapses into process: prove that you evaluated, not that you are safe.
A claim that cannot be falsified is not a safety claim. It is a legitimacy claim wearing a safety claim's clothing. If "rogue AI" has no operational definition, then "the Act can handle rogue AI" cannot be tested, which means it cannot be verified, which means it cannot be audited. In my world, an unauditable claim is not a claim. It is marketing. This is where the "decentralized" language of AI governance meets the same fate as the "decentralized" language of DeFi: a word deployed for legitimacy, decoupled from any verifiable mechanism.
The self-reporting problem: an audit trail nobody can inspect
The Act requires model evaluations and adversarial red-teaming. It does not require any specific alignment technique, any specific safety architecture, or any independent access to model internals. It requires that providers demonstrate they did the work.
That is a disclosure regime, not a verification regime. The difference is the difference between a proof and an attestation. A proof is checkable by anyone with the right inputs. An attestation is a statement by an interested party about itself. When the regulated entity is also the entity producing the evidence, and the regulator lacks the technical capacity to reproduce the result, the "audit" is a formality with a signature block.
The Scientific Panel of Independent Experts is the only body in this architecture that might close the gap. Its members could, in principle, hold the technical judgment to test whether an evaluation was meaningful. But three variables determine whether it can: its resources, its independence, and — critically — its access to model weights. None of these are settled in the text as I read it. If the Panel cannot inspect the internals of a closed model, it is reduced to reading a report written by the party it is supposed to oversee.
Here is the uncomfortable parallel. In my 2022 analysis of reserve proofs following the Terra collapse and the Celsius and FTX contagion, I found that one major platform reported user balances that exceeded its on-chain holdings by a 70 percent BTC shortfall. The disclosure existed. It was published. It was worthless, because nobody could reconcile it against the actual ledger until it was too late. On-chain evidence never sleeps — but off-chain attestations can lie indefinitely, and a self-reported model evaluation is an off-chain attestation. Until a regulator can independently reproduce a red-team result, the EU's AI safety regime has the same structural weakness as a centralized exchange's proof-of-reserves page: it is a document, not a verification.
The compliance industry: a market born from paperwork
The most predictable consequence of the Act is not safer models. It is a new industry. Mandatory evaluation, testing, record-keeping, and technical documentation create demand for third-party evaluators, certification bodies, and AI audit firms. This is a from-zero-to-one market, and its knowledge barrier is high: the text runs to over a hundred articles with complex technical annexes, and reading it requires both legal and machine-learning competence. Supply of that combination is scarce. Pricing power follows scarcity.
I have watched this movie before. Every new compliance regime spawns a service layer that captures value from the obligation rather than from the underlying risk. GDPR did not eliminate data misuse; it built a privacy-consulting economy. The AI Act will not eliminate rogue-AI risk; it will build an AI-governance economy. That economy is a real investment theme and a real business opportunity, but it is not a safety guarantee, and conflating the two is exactly the error the bulls make.
The deeper problem is access. For third-party auditors to be more than notaries, they need to see inside the systems they certify. The Act does not clearly grant that access, particularly for closed models. Without it, the audit industry is a documentation industry. It produces comfort, not verification. And comfort is the most dangerous output a safety regime can ship, because it converts residual uncertainty into false confidence.
The geopolitical layer: three paradigms, one contested throne
The Act is not only a safety instrument. It is a bid for rule-setting dominance, and the bid is contested. Three governance paradigms are now in open competition. The EU runs a horizontal statute with risk tiers, high penalties, and a precautionary posture. The United States, through its 2025 AI action plan, moved decisively toward deregulation, innovation speed, and compute advantage, leaving the federal layer thin and the state layer fragmented. China runs a filing-and-content-security model where regulation serves industrial catch-up rather than risk minimization.
These are not variations on a theme. They are incompatible operating systems for the same technology. And the EU's attempt to export its rules — the so-called Brussels effect — is showing cracks. The Digital Omnibus delay is the clearest signal: when the author of the rules starts scheduling their own obligations further out, the export value of those rules falls. Add to that open American political pressure, with Washington calling the Act burdensome and hinting at trade consequences, and the regulatory regime becomes a bargaining chip rather than a standard.
The strategic bind is structural and, in my read, unresolvable within the current framework: the EU is trying to regulate a technology it does not lead. Its enforcement capacity is limited, its technical base is behind, and its rule export depends on others choosing to comply. A regime that depends on the goodwill of the entities it regulates is not a regime. It is a request. When Meta refuses to sign the Code and loses nothing material, the enforcement premise is exposed. Rules with no teeth at the top of the market are rules that the top of the market has already priced in.
The security-theater risk: a complete architecture with no verification of effectiveness
The most serious failure mode is not that the Act does too little. It is that the Act does something that looks like enough. A governance structure — tiers, thresholds, a scientific panel, a code of practice, incident reporting — can be fully built and still provide no assurance that rogue-AI risk is reduced. This is security theater: the performance of safety without the mechanism of safety.
The danger is behavioral. When institutions and publics believe a risk is handled, they reduce their own vigilance. Attention shifts away from the frontier. The early warning signs that a forecaster would flag — unusual self-replication in an agent, evaluation-aware behavior, capability jumps in fine-tuned open models — get less scrutiny precisely because a regulator has declared the area managed. That is the exact inversion of what a safety regime should do. It should concentrate attention, not diffuse it.
The parallel to NFT mania is exact. In my 2021 investigation into a Bored Ape derivative mint, I traced wallet clusters on Etherscan and found that the top ten wallets controlled 60 percent of supply and were linked to a single developer entity preparing to dump. The project wore the full costume of legitimacy — branding, a roadmap, a community — and the costume was the point. Concentration masqueraded as decentralization, and the people who trusted the surface were the ones who paid. A complete governance architecture can be the same costume at a larger scale: the appearance of control standing in for the substance of it.
The open-weight blind spot: the gap the Act cannot close
The Act has no real answer for open-weight models, and this is not a drafting oversight. It is a structural impossibility. Once weights are published, they cannot be recalled. Anyone can download them, fine-tune them, strip their safety training, and redeploy them outside any jurisdiction. A regulator can require the original provider to file paperwork, but it cannot follow the weights.
This is where AI governance collides with the oldest problem in crypto: you cannot un-broadcast a transaction, and you cannot un-publish a file. The open-weight case is the on-chain case. Distribution is irreversible, verification is impossible without access, and the entity that introduces risk is not the entity the regulator can reach. The Act's transparency obligations may even accelerate the problem: requiring disclosure of capabilities, evaluation methods, and limitations gives fine-tuners a map of exactly which guardrails to remove.
The honest reading is that the largest category of rogue-AI risk — capability diffusion through open weights — is the category the Act barely touches. This is not a criticism of Brussels's intent. It is a description of a boundary. You cannot regulate what you cannot reach, and no statute reaches a downloaded file.
The AI-plus-crypto bridge: where the narrative meets the ledger
There is a reason a crypto outlet carried this story, and the reason is not incidental. The "AI plus crypto" narrative is one of the most aggressive in the current market: decentralized AI, autonomous agent protocols, AI-agent tokens, compute-market tokens. The EU AI Act becomes, in that narrative, a policy catalyst — proof that AI is being taken seriously, which gets repackaged as proof that AI-adjacent tokens deserve a bid.
Treat that with the skepticism it earns. I audited three so-called autonomous agent protocols in 2026, decompiling their core logic to check whether they could actually manage assets without human oversight. Two of them contained hardcoded backdoors that let the developers drain funds under specific conditions. The "autonomy" was a front-end story wrapped around a privileged function. The contract had a key. Check the multisig. Always. The same discipline applies here: a regulation that claims to control autonomous systems, and a token that claims to be an autonomous system, are both making claims about control, and both can be audited against what they actually enforce.
The real signal for anyone trading this narrative is not "the EU says it can handle rogue AI." It is the signatory roster of the Code of Practice and the final text of the Digital Omnibus. Those are the data points with information content. The regulatory headline is background noise dressed as a catalyst. Follow the hash, not the hype.
The inference asymmetry: regulating the wrong end of the pipeline
The Act concentrates its leverage on training compute. Inference — running a model — is largely untouched. This is a significant asymmetry, because the moment a dangerous capability is expressed is at inference, not at training. A model is not dangerous in its weights. It is dangerous when it is queried, deployed, and connected to tools.
By anchoring on training compute, the Act regulates the most capital-intensive, most visible, most concentrated part of the pipeline and leaves the most diffuse, most consequential part — deployment — comparatively light. The compute threshold also creates a verification problem at the infrastructure layer: if a provider self-reports its training compute, the regulator needs a way to confirm the number. That implies demand for compute metering, verifiable training logs, and proof-of-compute primitives — genuinely interesting technical territory, and a real infrastructure theme. But it also means the entire edifice rests on numbers that, absent independent verification, are attestations rather than measurements.
A proof-of-compute for regulatory purposes would need to be as rigorous as a proof-of-reserves done right: independently checkable, tamper-evident, and reconcilable against a ledger. The Act does not require that rigor. It requires a filing. The gap between a filing and a proof is the gap between compliance and control.
What the bulls actually got right
I have spent most of this piece dismantling the rogue-AI claim, so let me be precise about where the optimistic case holds, because a forensic read that only subtracts is as unreliable as one that only adds.
The bulls are right about one thing: process is not nothing. Before the Act, there was no mandatory evaluation, no serious-incident reporting, no requirement that a frontier lab write down what it tested and what it found. A world with structured disclosure is marginally more accountable than a world without it, even if the disclosure is self-reported. The first step to any verification regime is the existence of a record. The Act creates the record.
The second genuine point is that the Code of Practice, for all its voluntary softness, creates a compliance presumption that has real market value. Signatories gain a marketing and procurement advantage. That means the Code operates through incentives, not only through enforcement, and incentive-driven compliance can move faster than litigation-driven compliance. It is a weak lever, but it is a lever.
The third is that the Act has forced a conversation that the industry was avoiding. The existence of a Scientific Panel, however constrained, creates an institutional home for technical judgment inside a regulator. If it ever gains real access and real independence, it becomes the seed of a genuine verification capability. Seeds are not trees, but seeds are not nothing. The bulls are not wrong that something was built. They are wrong to call the something a solution.
The takeaway: what to watch, and what it will prove
The rogue-AI claim is not a technical claim. It is a legitimacy claim, and it should be audited as one. The Act's architecture is real; its grip on the actual risk is not. It regulates capability by proxy, defines its target loosely or not at all, verifies through self-report, and cannot reach the open-weight diffusion that constitutes the largest share of the danger. That is not a scandal. It is the honest boundary of what a statute can do to a technology that outruns its jurisdiction.
So do not watch the speeches. Watch four things. Watch the final Digital Omnibus text and the size of the delay — that number tells you what Brussels privately believes about its own readiness. Watch the first cohort of models presumed to carry systemic risk above 10^25 FLOPs and whether their evaluations are published or hidden. Watch whether the Scientific Panel gets real access to model internals, because that single fact determines whether the audit is real or theater. And watch the signatory roster, because every exit and every addition is a live vote on whether the rules bite.
The honest position is uncomfortable for everyone. The Act is more than theater and less than control. It built the scaffolding of accountability without the mechanism of verification, and it will be judged not by whether it can respond to rogue AI, but by whether it can prove that it did. On-chain evidence never sleeps. The AI Act has not yet produced any.
