HACCP for AI: A Risk-Based Framework for Global AI Governance

The accelerating capability of frontier AI systems has produced a governance gap that almost everyone acknowledges and almost no one knows how to close. When laboratories and governments reach for a precedent, they reach for nuclear arms control — while conceding that for AI the problem of detection is far harder. This paper argues that a more instructive precedent already exists: HACCP (Hazard Analysis and Critical Control Points), the methodology that has governed world food safety for fifty years, built to manage an invisible hazard across a complex, internationally distributed production chain. The paper maps HACCP's seven principles onto frontier-AI development, proposes four candidate Critical Control Points with measurable limits drawn from instruments already in force, identifies the prerequisite programmes that must exist first, states plainly where the analogy fails, and specifies a minimal voluntary pilot that needs no new treaty to begin. Crucially, the framework is positioned against the instruments that already occupy this territory — ISO/IEC 42001, Article 9 of the EU AI Act, and the NIST AI Risk Management Framework: HACCP is proposed not as their competitor but as the process-control layer their architecture presupposes and does not contain — predetermined control points, measurable critical limits, predefined corrective action, and accredited verification under international mutual recognition. The single most consequential gap identified is infrastructural: AI governance is beginning to accredit the certification of management systems, but has no counterpart to the accredited measurement chain (ISO/IEC 17025 and its mutual-recognition arrangements) on which every food-safety critical limit ultimately rests.