Voluntary corporate transparency reports cannot substitute for binding international AI governance. Critically examine.

Frontier AI firms increasingly publish self-authored "threat intelligence" reports on misuse of their models. The UN High Commissioner for Human Rights holds such self-regulation "nowhere near sufficient" to prevent advanced AI from bypassing human safeguards [1]. These reports are a useful input, not a governance substitute.

Why voluntary disclosure falls short

• Structural conflict of interest — the developer, the commercial beneficiary and the policing body are a single entity; the UN therefore places responsibility on states hosting major AI firms to enforce accountability [1].
• No independent audit — the misuse cases, harm taxonomy and severity grading all originate from the reporting firm, so "blocked" cannot be distinguished from "detected".
• Metrics chosen by the reporter — disruption counts are published without attempt volumes or time-to-detection, so the disclosure reads as reputation management rather than a safety metric.
• No legal enforceability — India's AI Governance Guidelines (MeitY, IndiaAI Mission) record that voluntary frameworks lack enforceability and that liability across developers, deployers and users remains unsettled [3].

The genuine case for them

• Only the lab holds the logs, model internals and red-team access needed to detect agentic, multi-step misuse; no regulator today possesses that telemetry.
• Identifying state-sponsored groups, commercial spyware vendors and financially motivated actors yields threat intelligence no treaty process generates. India's own Guidelines accordingly ask industry to publish transparency reports and provide grievance redress [3] — as a complement.

But the binding alternative is itself nascent

• The Global Dialogue on AI Governance (UNGA Resolution A/RES/79/325, 26 August 2025) is expressly "not a negotiating forum", closing with co-chair summaries [2].
• Its annual cadence — Geneva, July 2026 to New York, May 2027 [2] — trails a model-release cycle measured in months. The regime has norms but no inspectorate.

The realistic verdict is asymmetric: a firm may legitimately be the reporter, never the adjudicator. The way forward is standardised, mandatory disclosure metrics, statutory auditor access to provider telemetry through bodies like the AI Safety Institute [3], and India's techno-legal approach of embedding governance into system design by default [4] — shifting global AI governance from voluntary disclosure to verifiable accountability.