G7 publishes the Hiroshima Process Code of Conduct for Advanced AI Systems

The Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems is a voluntary set of actions for organizations building the most advanced AI models. It was published on 30 October 2023 after G7 leaders agreed it alongside International Guiding Principles on Artificial Intelligence.

What it is

The code grew out of the Hiroshima AI Process, launched in May 2023 following direction from G7 leaders at the G7 Hiroshima Summit to examine the opportunities and risks of generative AI. It covers organizations developing the most advanced foundation models and generative AI systems, and it is meant to be a living document, reviewed and updated through ongoing multistakeholder consultations. Organizations that may endorse the code include entities from academia, civil society, the private sector and the public sector.

What it requires

The code sets out actions organizations are called on to follow commensurate to risk, including identifying, evaluating and mitigating risks across the AI lifecycle through methods such as red-teaming before deployment. It calls for monitoring and mitigating vulnerabilities and misuse after deployment, publicly reporting capabilities and limitations through transparency reports, and sharing information on incidents across industry, government, civil society and academia. It also asks organizations to invest in robust security controls, including securing model weights and establishing insider threat detection, and to develop content authentication mechanisms such as watermarking.

What security leaders should do

Security leaders at organizations developing advanced AI systems should map the code's eleven actions against existing testing, vulnerability management and incident-reporting programs, since it treats security controls, insider threat safeguards and model-weight protection as lifecycle requirements rather than optional add-ons. Because the code is voluntary, applies in a manner commensurate to risk, and is explicitly described as a living document subject to ongoing multistakeholder review, teams should assign clear ownership for tracking future updates and for deciding how closely their own governance and transparency reporting should mirror its actions.