Research question. If frontier capability increasingly comes from inference-time computation and agentic deployment rather than training scale alone, what happens to compute governance?
The short answer is not that training compute has suddenly ceased to matter. The public evidence does not support that. Training floating-point operations (FLOPs) remain concentrated, costly, and legally salient. The European Union’s Artificial Intelligence Act still uses cumulative training computation as a rebuttable presumption for systemic-risk general-purpose AI models. [1] Recent evidence also indicates that larger clusters remain a major driver of growth in frontier-training compute. [2]
But a training-FLOP figure describes what it took to make a model, not necessarily the computation, permissions, and time through which it becomes consequential after release. Reasoning models can spend more computation on a difficult request. Agent systems can call tools, retain state, and act through many concurrent instances at once (the exact scale of deployed agent fleets is not systematically reported, and is treated as an open question in Section 6 below). A deployment can therefore change the capability and risk exercised by a fixed set of weights without a new frontier training run. OpenAI’s o1 reported improvements from both reinforcement-learning compute and test-time compute. [3]
This creates a governance question, not a preordained policy answer. A regime that sees training but not deployment may offer early warning yet miss where some risks materialize. One that seeks to see every deployment could impose surveillance and compliance burdens without a useful safety signal. The task is to identify which observables answer which question, and where evidence remains inadequate.
1. The old bargain: why training compute became governable
Training compute became central to frontier governance for sensible reasons. A large training run occurs before widespread release and requires capital, specialized accelerators, and a relatively concentrated supply chain. Those qualities fit familiar policy levers. RAND summarizes the relevant features of compute as detectability, excludability, quantifiability, and supply-chain concentration. [4] Training FLOPs are not a complete measure of capability, but they offered a more legible administrative proxy than claimed parameter counts or shifting benchmark scores.
The policy record reflects this logic. The EU AI Act classifies a general-purpose AI model as presenting systemic risk when it has high-impact capabilities, and it presumes that condition when cumulative training computation exceeds 10^25 floating-point operations. The presumption is rebuttable and not the sole route to designation: the Commission may also act on capability or impact grounds using Annex XIII criteria. [1] General-purpose AI obligations have applied since 2 August 2025, and the Commission’s enforcement powers began applying on 2 August 2026. [5] The 10^25 figure is a live legal reference point in the EU framework, not merely a proposal or think-tank convention.
The United States illustrates the opposite lesson: policy status must be separated from historical influence. Executive Order 14179 revoked EO 14110 in January 2025. [6] In May 2025, the Bureau of Industry and Security said it would not enforce the January 2025 AI Diffusion Rule and would issue a replacement. [7] Those instruments belong in the genealogy of compute governance, not in a list of current US reporting obligations.
This old bargain was always a proxy bargain. CSET has cautioned that a compute-only definition is unlikely to remain a complete long-run solution for identifying frontier systems. [8] Training compute may still be useful: it is upstream of later choices, difficult to hide at the largest scale, and tied to the organizational capacity needed to produce a frontier model. The question is whether that indicator can carry the additional burden of describing the capability exercised in deployment.
2. What is changing: capability after the weights are fixed
Three changes pull the answer away from a simple training-only account.
First, reasoning methods can allocate substantially more computation to individual problems. OpenAI reported that o1’s performance improved with both train-time reinforcement learning and more time spent thinking at test time, while cautioning that the constraints on this approach differ from pretraining. [3] This does not show that inference has displaced training. It shows that the same model family can perform differently under different inference budgets.
Second, an agent can combine a task, tools, memory or workspace, permissions, and a loop that observes, plans, acts, and retries. Tool access can turn an output into an external action: a code change, database query, web transaction, cloud configuration change, or message. A model that proposes an action differs materially from one authorized to execute it repeatedly in a sensitive environment. Anthropic and Google Cloud describe production-agent tooling that emits traces and audit events and permits policy enforcement at tool calls. [9] That is evidence that the relevant events are technically recordable in some managed deployments, not evidence that they are routinely reported to regulators or the public.
Third, deployment multiplies a model’s output. Epoch AI distinguishes the cost of a single inference from aggregate inference over a model’s life, which can exceed training because a trained model can be used many times. [10] A training run is generally discrete; deployment is a flow. The weights can stay unchanged while the number of agents, their inference budgets, their tool permissions, or their time on task changes sharply.
None shows that inference-time scaling is now the dominant source of frontier capability. The public evidence cuts both ways. Epoch’s theoretical analysis argues that, where a training-inference tradeoff is available, labs may allocate expenditure of roughly similar order to training and inference rather than abandoning training. [11] Training FLOPs may therefore be an incomplete proxy where performance depends heavily on reasoning budgets, orchestration, tool access, or scale. [12]
3. The measurement problem: unmeasured is not unmeasurable
The central measurement error is to collapse four quantities into one number called compute:
- compute used to train a model;
- compute used by a single inference or agent rollout;
- total compute used by all deployments of that model; and
- the actions enabled by the system’s permissions, tools, and operating environment.
These quantities answer different questions. Training compute describes development resources; per-task inference can affect hard-task performance; aggregate inference can indicate deployed scale. Tool-use logs may say more about an agent’s immediate capacity to cause harm than either FLOP measure. A training threshold is not wrong; it is not interchangeable with the other three measures.
Some of this is hard to measure in principle. Counting FLOPs consistently across sparse architectures, mixtures of experts, custom accelerators, and distributed systems raises real technical questions. Mapping a tool call to its consequence is harder still: a thousand harmless database reads are not equivalent to one credential-rotation request. Open-weight inference on privately owned hardware may leave no provider-level telemetry at all.
Other gaps are institutional rather than technical. The Anthropic and Google Cloud example shows that some managed agent deployments can emit traces and audit events and enforce policies at tool calls. [9] Anthropic says its safeguards team uses detection and monitoring to enforce its usage policy, and OpenAI describes preparedness findings and safeguards around frontier releases. [13] Those disclosures do not establish a common reporting taxonomy, an independent audit channel, or that one provider’s instrumentation describes the wider market.
The distinction has policy consequences. If a quantity is unmeasurable in principle, a reporting mandate will fail or produce false precision. If it is measurable but not reported, targeted logging, retention, audit, or incident-reporting rules might improve visibility. The present public record supports the second conclusion for many managed deployments and the first for some decentralized or open-weight use cases. It does not support a universal inference-monitoring mandate.
4. Three possible futures
Policy should turn on which of three futures the evidence favors. They are competing hypotheses about the frontier’s principal governance lever, not mutually exclusive descriptions of all systems.
Future A: training remains dominant
Under the training-dominant hypothesis, the underlying model remains the binding input. Reasoning, tools, and agent loops improve its usefulness but do not substitute for the research, data, and training scale needed to create the most capable systems. Training thresholds would therefore remain a sufficiently good screen for the small set of developers that require scrutiny. Deployment controls could be reserved for particular dangerous uses rather than becoming a general frontier-governance layer.
There is real evidence for this view. The EU’s use of training computation is not arbitrary: it reflects a period in which scale was strongly associated with the ability to produce general-purpose models with broad downstream reach. [1] Epoch’s 2025 decomposition finds that larger clusters, longer runs, and better hardware have continued to drive the growth of frontier-training compute. [2] And even OpenAI’s o1 account says performance improves with train-time compute as well as test-time compute. [3] Test-time scaling is not evidence that the base model no longer matters.
This hypothesis gains support if measured agent performance tracks training scale more closely than reasoning budget, tool scaffolding, or deployment configuration. It weakens if comparatively modest models repeatedly achieve frontier-level performance on consequential tasks only with large inference budgets and capable harnesses. The public record has no longitudinal, controlled decomposition of those effects.
Future B: training and deployment are jointly informative
The jointly-informative hypothesis holds that training identifies potential capability while deployment observables identify realized capability and exposure. This is the most consistent interpretation of the evidence available today. Training tells regulators where to look. Inference budgets, agent runtime, tool permissions, concurrent instances, and task outcomes tell them what a system can do in a particular environment.
METR’s time-horizon work shows why capability cannot be reduced to one training metric. It estimates the duration of software tasks on which frontier agents succeed at specified reliability levels, using more than one hundred tasks and human-expert completion time. [14] It is an external performance measure, not a census of deployment behavior, but it tests what an agent can accomplish under a defined setup rather than inferring that from training. Similarly, current voluntary frameworks are organized around capabilities and mitigations. Anthropic’s Responsible Scaling Policy is explicitly capability-triggered and iterative, while OpenAI’s Preparedness Framework requires safeguards before deployment of covered systems that reach its High capability threshold. [15]
Neither METR’s evaluation nor a laboratory’s preparedness release measures real-world agent runtime, parallel deployment, or tool use across the industry. The jointly-informative view calls for a basket of observables, not one decisive deployment metric. Its modest prediction is that selected deployment evidence improves on a training-FLOP-only baseline.
Future C: deployment and inference become dominant
The inference-dominant hypothesis is the strongest version of the concern. It predicts that a growing share of economically consequential or dangerous capability will come after training: longer reasoning traces, many parallel agents, tool access, and feedback loops. On this account, training thresholds become a legacy proxy that misses the systems actually exercising the greatest power.
There is a plausible mechanism. Epoch’s work documents techniques that can trade training for inference expenditure, including repeated sampling, verification, and chain-of-thought-style methods. [10] OpenAI’s o1 results show one laboratory finding benefits from increased test-time compute. [3] In agent deployments, a monitor may also face parallel instances, oversight latency, and sequences of individually ambiguous actions; a 2025 control-monitoring paper identifies those as design challenges. [16]
But the leap from possibility to dominance is not justified. The evidence consists mainly of technical demonstrations, theoretical allocation arguments, company disclosures, and benchmarks. It does not establish that aggregate inference is the principal driver of frontier risk, that dangerous agents are broadly deployed at large scale, or that a training threshold cannot identify the relevant developers. Anthropic’s 2025 pilot sabotage report, for example, assessed the risk from its deployed models at the time as very low, though not zero. [17] That does not settle future risk, but it is evidence against treating the abstract availability of agent loops as proof of present catastrophic deployment.
Decisive evidence would be public, independently auditable data showing that inference budgets, runtime, permissions, or fleet size explain a growing share of performance on meaningful tasks after controlling for the base model. No such public data set was identified in this source review. Until it does, inference dominance should be treated as a live hypothesis and a reason to prepare measurement infrastructure, not as an established fact.
5. Policy consequences: proportional visibility, not universal surveillance
Each future implies different priorities. Under Future A, training-run reporting, secure development controls, and capability evaluations may remain central. Under Future C, policy shifts toward inference access, runtime controls, tool permissions, and continuous evaluation. Under Future B, which current evidence supports most strongly, policy preserves training visibility while adding limited, risk-proportionate deployment visibility.
That layer should begin with observables that serve a clear safety purpose. Providers of covered high-capability systems could maintain auditable records of inference consumption at an appropriate aggregation level, agent runtime, high-impact tool categories, permissions, and safety interventions. Regulators need not receive raw prompts or chains of thought by default. A less intrusive approach would require retention, aggregate reporting, and access only after a serious incident, high-risk deployment, or independent audit. The EU model offers a useful principle even though it is not an inference regime: it pairs a compute presumption with capability and impact criteria rather than treating FLOPs as dispositive. [1]
Cloud and application programming interface (API) providers are natural but limited chokepoints. They can observe a managed service better than a regulator can, particularly when agents use provider-hosted tools, identity systems, and logging. Yet visibility is not coverage. Locally run open-weight models, self-hosted hardware, and tools outside a provider’s control create blind spots. The evidence cited here establishes observability in some managed deployments, not coverage of local or open-weight inference. [9] A monitoring policy that assumes a cloud provider sees every relevant agent will produce both gaps and misplaced confidence.
Continuous evaluation is similarly promising but bounded. Pre-deployment evaluations answer whether a model can exhibit a capability under a test protocol. Runtime evaluations and monitoring address whether a deployed agent is operating with risky permissions or producing suspicious action patterns. Both are needed in agentic settings, but they are not substitutes. Laboratory frameworks already move in this direction: Anthropic’s Responsible Scaling Policy is capability-triggered, and OpenAI describes safeguards before deployment of covered systems that reach High capability. [15] Independent evaluators should test not only models in isolation but also defined agent configurations, with disclosed tool access, time budget, and intervention rules.
The costs require equal attention. Detailed prompts, agent traces, or user identities can create surveillance infrastructure with purposes far beyond frontier safety. Small firms may lack a frontier lab’s compliance teams and observability tooling. Broad reporting can also push activity toward less visible channels. The policy objective should not be to make every model interaction legible to the state. It should be to make high-consequence agentic deployments accountable enough to investigate incidents, validate safeguards, and revise thresholds with evidence.
6. What we do not know
Several open empirical questions are central to the policy decision.
First, this source review identified no public, standardized series for the ratio of training compute to inference compute across frontier systems. Epoch’s analyses provide useful models and estimates, not audited system-level data from multiple providers. [10] Second, public evidence does not apportion 2024-2026 improvements among pretraining, post-training, reasoning-time compute, architecture, data, and agent scaffolding. A benchmark gain may arise from any combination.
Third, this source review identified no systematic public reporting of agent runtime distributions, concurrent instances, tool-call volumes, or the rates at which agents receive and use high-impact permissions. Managed systems may log these quantities, but that does not make them comparable, retained, independently auditable, or publicly summarized. [9] Fourth, evaluation results cannot yet be cleanly translated into operational risk. METR’s time horizons are valuable measurements under a specified task suite and setup, but no evidence shows that a given horizon maps mechanically to real-world harm. [14]
Fifth, monitoring itself is an unresolved technical and institutional problem. Lindner et al. identify parallelization, latency, and adversarially composed action sequences as monitoring challenges in conceptual/simulation work, not as a field estimate. [16] More data collection will not automatically solve those failure modes. Finally, researchers have not established which privacy-preserving aggregates would provide enough signal for oversight without collecting sensitive content. That design question should be tested through pilots and independent audits before it becomes a sweeping legal mandate.
These uncertainties argue for reversible policy. CSET’s framework calls for frontier-governance proposals to state their underlying assumptions so policymakers retain flexibility. [18] A monitoring rule should likewise specify what it expects to observe, how failure would be detected, and when it will be reconsidered.
7. A 12-24 month monitoring framework
The near-term goal is a shared evidence base that lets policymakers compare training potential with deployed behavior. The table distinguishes legally or operationally legible quantities from partially visible ones. An unreported value is not zero.
| Governance observable | Today | Agentic/inference-heavy future | Observability |
|---|---|---|---|
| Training FLOPs | EU law uses cumulative training computation above 10^25 FLOP as a systemic-risk presumption; the Commission may also use capability/impact criteria. [1] | Remains a screen for development capacity, but may explain less of realized task performance by itself. This is a hypothesis, not an established trend. [12] | For covered EU providers, training-resource documentation is authority-visible on request; that is not a claim of universal public verification. [5] |
| Accelerator count | Frontier training growth has been driven substantially by larger clusters, alongside longer training and better hardware. [2] | Can indicate available capacity for training and serving, but cannot distinguish a training cluster from dispersed inference use without context. [2][4] | Hardware owners and cloud providers can observe their own capacity. The cited sources do not establish a universal accelerator-count reporting regime. [2][4] |
| Inference FLOPs | Research distinguishes the small cost of one inference from lifetime aggregate inference, which can be large because models are reused. [10] | Per-task reasoning budgets and aggregate serving may become more important for particular capabilities and exposures. Evidence on the aggregate trend is incomplete. [11] | Some managed-agent deployments can emit traces and audit events; this source review identified no standard public inference-FLOP reporting series. [9] |
| Agent runtime | This source review identified no industry-wide public reporting baseline. METR instead measures task time horizons in controlled evaluations, not production runtime. [14] | Longer autonomous task execution could raise the value of continuous safeguards and make individual outputs less informative. [16] | Managed-agent traces can make runtime observable to an operator or provider; the cited evidence does not establish coverage of local or self-hosted systems. [9] |
| Tool/API actions | Some managed agent platforms can emit traces and audit events and enforce policies at tool calls. [9] | Type, permission, and sequence of actions may be more safety-relevant than token volume alone. Mapping an action to harm remains context-dependent. [16] | Observable in the managed deployment described by Anthropic and Google Cloud; no cross-provider reporting standard was identified in this source review. [9] |
| Capability evaluations | EU systemic-risk obligations and lab frameworks use capability/risk assessments; labs disclose selected pre-deployment findings. [1][15] | Pre-deployment evaluation needs complementing with runtime monitoring and incident feedback for defined high-risk agent configurations. [13] | Labs and independent evaluators can measure under a protocol; runtime evidence is mainly operator/provider-held and needs auditable governance. |
Four practical steps follow. First, governments and evaluators should publish a common vocabulary for inference consumption, runtime, concurrency, tool category, permission level, intervention, and incident. The first version should be deliberately narrow and tested against actual provider logs.
Second, regulators should seek aggregated, auditable deployment reports rather than raw interaction data. Reports should identify their boundary: which models, accounts, tools, jurisdictions, and self-hosted uses are included or excluded. Without that boundary, a metric creates false confidence.
Third, independent evaluation should test agent configurations, not only base models. Disclosures should state the model, inference-time budget, tool set, permission scope, human-approval rule, and task horizon. That separates model capability from an orchestration effect.
Fourth, rules should include review triggers. If deployment metrics add little beyond training and capability evaluations, burdens should fall. If particular deployment patterns reliably predict serious incidents or dangerous capability, targeted controls can tighten. This is preferable to freezing governance at training FLOPs or assuming universal runtime surveillance is inevitable.
Conclusion. The inference gap is real as a measurement gap: current public governance and disclosure systems say much more about how some frontier models are trained than about how agentic systems are configured and used after release. It is not yet established as a verdict that inference has replaced training as the principal source of frontier capability. The evidence currently supports a more modest conclusion. Training compute should remain an upstream signal; capability evaluations should test what systems can do; and a carefully bounded set of deployment observables should show how high-consequence agentic systems actually operate. The next 12-24 months should be used to test whether those observables improve decisions, while preserving privacy, competition, and the possibility of correction.
Sources
[1] Primary law. European Union, *Regulation (EU) 2024/1689*, Article 51 and Annex XIII (2024), https://eur-lex.europa.eu/eli/reg/2024/1689/.
[2] Research/data analysis. Luke Emberson and David Owen, “Training compute growth is driven by larger clusters, longer training, and better hardware,” Epoch AI (2025), https://epoch.ai/data-insights/training-compute-decomposition.
[3] Primary laboratory source. OpenAI, “Learning to reason with LLMs” (12 September 2024), https://openai.com/index/learning-to-reason-with-llms/.
[4] Research synthesis. RAND, *Expert Insights* (2025), compute-governance discussion, https://www.rand.org/content/dam/rand/pubs/perspectives/PEA3600/PEA3652-1/RAND_PEA3652-1.pdf.
[5] Primary implementation guidance. European Commission, “Guidelines for providers of general-purpose AI models” (updated 2026), https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers.
[6] Primary executive action. White House, “Removing Barriers to American Leadership in Artificial Intelligence,” Executive Order 14179 (23 January 2025), https://www.whitehouse.gov/presidential-actions/2025/01/removing-barriers-to-american-leadership-in-artificial-intelligence/.
[7] Primary agency statement. U.S. Bureau of Industry and Security, “Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule” (12 May 2025), https://www.bis.gov/sites/default/files/documents/05.07%20Recission%20of%20AI%20Diffusion%20Press%20Release.pdf.
[8] CSET analysis. CSET, “Regulating the AI Frontier: Design Choices and Constraints” (2023), https://cset.georgetown.edu/article/regulating-the-ai-frontier-design-choices-and-constraints/.
[9] Primary operational disclosure. Anthropic and Google Cloud, “Monitoring and Securing Agents at Scale” (24 June 2026), https://www.anthropic.com/webinars/claude-on-google-cloud-monitoring-and-securing-agents-at-scale.
[10] Research report. Pablo Villalobos and David Atkinson, “Trading off compute in training and inference,” Epoch AI (2023), https://epoch.ai/publications/trading-off-compute-in-training-and-inference.
[11] Research analysis. Ege Erdil, “Optimally allocating compute between inference and training,” Epoch AI (2024), https://epoch.ai/publications/optimally-allocating-compute-between-inference-and-training.
[12] Analytical research note. Venkat Somala, Anson Ho, and Seb Krier, “Three challenges facing compute-based AI policies,” Epoch AI / Google DeepMind AI Policy Perspectives (2025), https://epoch.ai/gradient-updates/three-issues-undermining-compute-based-ai-policies.
[13] Primary company frameworks. Anthropic, “Transparency Hub: System Trust and Reporting” (updated 29 January 2026), https://www.anthropic.com/transparency/system-trust-reporting; OpenAI, “Our updated Preparedness Framework” (15 April 2025), https://openai.com/index/updating-our-preparedness-framework/.
[14] Independent evaluation. METR, “Task-Completion Time Horizons of Frontier AI Models” (updated 8 May 2026), https://metr.org/time-horizons/.
[15] Primary company frameworks. Anthropic, “Responsible Scaling Policy” (updated 8 July 2026), https://www.anthropic.com/responsible-scaling-policy?lang=us; OpenAI, “Our updated Preparedness Framework” (15 April 2025), https://openai.com/index/updating-our-preparedness-framework/.
[16] Preprint. David Lindner et al., “Practical challenges of control monitoring in frontier AI deployments” (December 2025), https://arxiv.org/abs/2512.22154.
[17] Laboratory report. Samuel R. Bowman et al., “Anthropic’s Pilot Sabotage Risk Report” (October 2025), https://alignment.anthropic.com/2025/sabotage-risk-report/.
[18] CSET report. Mina Narayanan, Jessica Ji, Vikram Venkatram, and Ngor Luong, *AI Governance at the Frontier: Unpacking Foundational Assumptions* (November 2025), https://cset.georgetown.edu/publication/ai-governance-at-the-frontier/.
Method note: This is a research memo, not a claim that inference-time computation has replaced training as the main frontier-governance lever. All forward-looking statements are framed as hypotheses or monitoring priorities. Sources marked primary are laws, government documents, laboratory disclosures, or company policies; the remaining sources are research, evaluation, or analytical work.