The White House AI Accord: What It Means for Companies That Will Never Sign It

By: Scott Sarbey, CPA & Stan Lexow, CISA

On September 29, 2026, six of the most influential AI companies (Google, Anthropic, Meta, OpenAI, xAI and NVIDIA) signed the White House Accord on Super Intelligence. The one-page, voluntary document covers only their most advanced models, so it would be easy for a mid-sized company to conclude it has nothing to do with them. However, we think that is premature. The accord gives boards, customers and regulators a simple vocabulary for asking whether AI is under control, and your business should be prepared to answer those questions.

What The Companies Agreed To

Each signatory committed to four layers of oversight:

1. Internal controls that monitor model capabilities and behavior and prevent unintended access to technical systems.
2. An internal or trusted outsourced team that tests those controls and makes sure issues are fixed.
3. An independent external auditor or evaluator that assesses whether the controls work as intended.
4. An independent board committee that oversees the teams and reviewers.

The accord also notes that these steps may eventually be codified into laws or regulations.

The Impact on the Middle Market

Controls, internal testing, independent assurance, and board oversight make up the same structure behind internal control over financial reporting. Directors already know it, and many will ask management to apply it to AI. Expect questions from boards and management, from customers in vendor due diligence, and about the AI built into the software you buy, whose controls become part of your risk picture. Companies that issue or rely on SOC reports should also understand what those reports do, and do not, say about AI.

The Four Layers, scaled for a mid-sized company

1. Know where AI is used and control it. Build an inventory that includes AI in purchased software, and focus controls on uses that touch financial reporting, sensitive data or customers.
2. Test whether the controls work, through internal audit or an outsourced provider.
3. Get an independent view where others rely on you, using recognized frameworks such as the NIST AI Risk Management Framework or ISO/IEC 42001.
4. Put AI on the board’s agenda by assigning oversight to a specific committee with defined reporting.

Four Questions To Be Prepared to Answer

1. Do we have a current inventory of where AI is used, including inside vendor software?
2. Which of those uses affect financial reporting, customer data or customer-facing decisions?
3. Who owns AI risk, and how do we know the related controls are working?
4. Which board committee oversees AI, and how often does it hear about it?

Standards in this area are still forming, but companies that put proportionate governance in place now will be ready however the rules develop.

LerroSarbey’s Risk Advisory team helps organizations assess AI governance readiness, test AI-related controls, and evaluate how AI affects SOC reporting. To discuss what the four layers might look like for your organization, contact our team here.

This article is for general information only and does not constitute legal, tax, accounting or audit advice. Readers should consult a qualified professional about their specific circumstances.