When Donald Trump and Xi Jinping agreed at the recent APEC summit to set a floor under spiraling China-U.S. trade relations, they also agreed to consider cooperation on artificial intelligence (AI) in the year ahead. With Trump and Xi planning an exchange of visits in 2026, now is the time for a “smart agenda” to identify which elements of artificial intelligence make sense for Washington to discuss with its top strategic rival.
Both sides agree that AI will shape their near-term security planning, driving an intense competition over compute, cloud infrastructure, frontier AI models, and the energy needed to fuel them. The Trump administration’s AI Action Plan captures that focus. It is skeptical of multilateral efforts and wary of technological cooperation with Beijing on advanced systems.
China’s new Global AI Governance Action Plan presents itself as a multilateral alternative. It supports Beijing’s ambition to shape global standards and expand its technological influence by proposing to create a new international organization based in Shanghai.
If Washington and Beijing approach AI as nothing more than a zero-sum contest, they may miss the small but crucial spaces for cooperation on protocols, evaluations, and verification that can set a “smart agenda” for future use of AI. These quiet, technical steps can keep a powerful technology from slipping beyond either side’s control or into the hands of criminals or terrorists. Those same steps can also serve as the first moves toward a deeper, risk-reducing relationship.
Trump himself has already cracked the door open on some promising areas for cooperation – most notably at the intersection of AI and biotechnology. In his 2025 United Nations General Assembly speech, he called for an international effort to end “the development of biological weapons once and for all” and proposed using AI to help verify compliance. His AI Action Plan similarly warns that AI and synthetic biology “could create new pathways for malicious actors to synthesize harmful pathogens and other biomolecules” and proposes international screening guidelines to reduce those risks.
To follow up, Washington will need a short, concrete menu of issues that lower shared security risks without handing Beijing a strategic edge. At the same time, the United States can establish a process of continuous expert exchange free from ups and downs in the bilateral relationship – much as the U.S. and Soviet Union allowed expert arms control talks to continue throughout the Cold War.
How Geopolitical Rivals Have Managed Dangerous Technologies Before
History suggests that when rivals manage dangerous technologies, they usually start with tightly bound, low-risk measures that later enable deeper cooperation as confidence slowly builds. During the Cold War, Washington and Moscow built narrow agreements on nuclear testing, incident reporting, and crisis hotlines long before there was anything like trust. They traded limited technical information, set up verification rituals, and created habits of communication that helped both sides avoid worst case misunderstandings and accidents. These talks continued in an insulated expert channel and were not cut off as a vehicle to demonstrate political displeasure. None of that ended the arms race. But it made the arms race less likely to end the world.
Cryptography offers a similar pattern. The U.S. government ran the Advanced Encryption Standard (AES) as an open international competition. Researchers around the world tested, attacked, and improved candidate algorithms. That transparency strengthened civilian security tools while sensitive military systems remained classified. The approach also encouraged wide global adoption and common implementation standards. It shows how modest early steps can grow into more durable forms of technical collaboration. In both cases, cooperation grew first where sharing posed little risk, the threats were global, and both sides feared the same disasters.
AI is now entering that same territory. Neither Washington nor Beijing will want to share secrets about AI applications that could allow the other to identify nuclear-capable submarines or decide the fate of Taiwan. But both are aware that AI poses unknown risks and much remains to be learned. Establishing processes and practices for responsible AI research and use could enable Washington to build the same kind of narrow floor it insisted on in earlier technology races.
The challenge is to find those few narrow openings for AI where limited cooperation with Beijing can keep a dangerous technology from outrunning both countries’ ability to control it.
Shared Concerns About Advanced AI Systems
Even as Washington warns about China’s ambitions in artificial intelligence, official documents on both sides increasingly flag overlapping security dangers. Recent U.S. strategy papers and executive actions, and China’s national plans and regulatory guidance, all stress risks from unsafe or uncontrollable systems and from malicious misuse at scale. The language differs – and Beijing puts more weight on information and social-stability harms – but the underlying fears substantially converge. Loss of control, lowering barriers for malicious actors, misalignment and failure to fix accidents top the list of common concerns.
Three areas merit special focus: dangerous AI capabilities, testing against critical design risks, and preventing attacks involving misuse and deception top the list of overlapping security dangers. U.S. strategy papers, executive actions, and technical standards, and China’s national plans, AI regulations, and emerging safety frameworks, all focus on these three clusters of risks.
First are AI’s dangerous capabilities. Both governments worry that advanced models could lower the barrier for outsiders to plan sophisticated cyber operations or design biological and chemical weapons, and that more autonomous systems could behave unpredictably once deployed.
Second, responsible design is critical to having powerful systems that behave consistently and resist manipulation. Washington and Beijing could agree on rigorous testing requirements before brittle AI is woven into critical infrastructure or financial markets. And they could require investigations – as in the case of airline accidents – if anything goes wrong.
The third risk cluster is deception and opacity. Regulators and tech companies warn about systems that can impersonate humans, develop new pathogens, or flood the information space with synthetic media. Watermarking, labeling, and other disclosure requirements for AI-generated content are being adopted, even as enforcement details remain unsettled.
It is no accident that the areas where both governments worry most – dangerous capabilities, testing, and deception – map directly onto the three cooperation lanes of protocols, evaluations, and verification. Researchers have already begun to map this emerging common ground, highlighting why a focus on these three areas offers some of the most realistic starting points for cooperation between Washington and Beijing.
Three Lanes for Smart, Narrow, Practical Cooperation
Geopolitical rivalry rules out sweeping AI accords, but Washington can stabilize AI competition with China through technical cooperation to build the shared science, testing procedures, and early confidence that past rivals have relied on. Shared protocols, evaluation methods, and verification tools are among the most promising – and least risky – starting points for cooperation between geopolitical rivals on AI.
Safety frameworks and best practices give both sides a shared vocabulary for responsible development. Testing and evaluation methods help them understand whether advanced systems behave safely and reliably outside the lab and can help ensure that fatal accidents do not recur. And verification mechanisms offer ways to check that claims about a system’s safeguards or capabilities are actually true.
None of this requires sharing model weights, proprietary data, or anything close to military applications. But these modest steps can start the slow work of co-developing methods, comparing notes, developing agreed procedures, and trusting each other’s basic measurements – exactly the kind of early scientific cooperation that helped past rivals manage shared risks. Taken together, they lower the chances that powerful systems fail unpredictably or are misused in ways that neither government can fully control.
Lane One: Protocols and Best Practices
The first and least sensitive lane is codified protocols and safety frameworks – the broad, non-binding playbooks that outline how powerful AI systems should be designed, tested, monitored, and halted if something goes wrong. Governments and firms are already gravitating toward these kinds of documents, and many labs now publish their own safety frameworks as a signal of responsible practice.
Building on that momentum would not require sharing model weights or military applications. It would mean quiet technical work: agreeing on a basic glossary of safety terms, sketching out what any credible framework should cover, and developing simple templates or case studies that make expectations easier to compare across institutions. One caveat is that standard-setting can sometimes be used to tilt the playing field at the multilateral level. Even so, the overall opportunity is clear.
A future Trump–Xi meeting could propel a joint commitment to publish and periodically update national safety frameworks that cover a few shared elements – pre-deployment testing, incident response, and basic transparency about high-risk uses. These early steps help establish a shared understanding of the risks that advanced systems create and a process for addressing accidents – foundations that any deeper cooperation will ultimately depend on.
Lane Two: Evaluations
The second area for potential cooperation involves testing and investigation protocols and model evaluations. Model evaluations reveal what advanced systems can do, how reliably they behave, and where failure could create national-security risks. Even in the current climate, Washington and Beijing could publicly identify reliable evaluations as a shared priority and compare a small number of technical methods that do not expose model internals.
In practice, this would involve small expert delegations exchanging short technical notes and presentations, and occasionally running the same evaluation procedures in parallel on their own systems so they can compare only high-level results rather than any underlying data or models. This could include comparing methods for spotting benchmark contamination, which occurs when a model has already encountered parts of the test and looks safer and more capable than it really is. It could also involve improving multilingual test suites, so evaluations cover more than English and catch risks that appear only in other languages. A third area is developing and sharing simple checks to see whether an evaluation score actually predicts how a system behaves outside the lab, where models often act less reliably.
Governments could also commit to supporting parallel research programs that strengthen and share improvements to these tests, allowing universities on both sides to develop better tools without any joint access to sensitive systems. At the diplomatic level, that translates to modest commitments: naming reliable evaluations as a shared priority, asking national AI institutes to compare contamination-detection methods and multilingual tests, and encouraging parallel research grants that push universities and industry toward better tools.
Most importantly, Washington and Beijing can agree on processes for AI testing and evaluation, even if they keep the content of their systems secret. Agreements could discuss appropriate error rates and, most importantly, remediation. After a fatal airline crash, international standards require investigation and remediation so that the underlying safety flaws do not recur. Similarly with AI, the major powers should agree now on the process by which they will test and remediate errors that will inevitably arise as this new technology is deployed into increasingly sophisticated and potentially dangerous systems.
None of this requires shared red-teaming or cooperation in high-risk domains. It simply offers a limited path for each government to better understand the risks in its own country’s models while keeping political and security concerns manageable. Even the act of recognizing improving the science of AI evaluations as a legitimate goal has value in a relationship where safety is often overshadowed by competition.
Lane Three: Verification
The third area where the United States and China might be able to collaborate now is verification, likely the most sensitive of the three pathways. Verification does not ask what a system can do; it asks whether the claims made about that system are actually true. Verifying model capabilities is likely essential for any future agreement that hopes to be trusted.
There is value in simply naming verification research as a shared priority, which would push industry, universities, and standards bodies to develop better techniques for model identity, secure training records, and other building blocks of credible oversight.
A second step is cooperation on verifiable audits of public or low-risk models. Each side could run the same audit procedures on its own systems and share only the method and aggregated findings. That would help verify whether the safeguards they claim to use are actually in place and functioning to a minimum agreed standard, without revealing sensitive data or model internals.
A final area, and one with clear shared incentives on both sides, is content provenance. C2PA-style standards can help confirm when text or images were generated or altered by AI, which matters because both governments want to prevent third parties from using synthetic media to destabilize their own nations. Even here, however, both sides may hesitate if improvements in provenance appear to enhance the other’s capabilities. U.S. officials, for example, will be wary of sharing tools that could be repurposed to strengthen Beijing’s control over information flows inside China. That is why any early work on verification should remain tightly scoped, focused on output-level tools, and treated as groundwork for the more demanding cooperation that may come later.
In a leader-level meeting, the thing that is most plausible in the near term is for both sides to endorse verification research as a shared goal and to invite their experts to launch small pilots on verifiable audits of public models and basic output provenance, including narrowly scoped pilot programs that stress-test confidentiality-preserving verification tools.
A more ambitious objective might combine a focus on the most dangerous capabilities with an interest in verification, as foreshadowed by Trump’s U.N. speech on verification of high-risk biological weapons applications of AI. Some best practices to reduce risks from AI and biotechnology were publicized at the December 2025 U.N. Biological Weapons Convention meetings, where Trump’s Undersecretary for Non-Proliferation encouraged international AI cooperation to prevent abuses of biotechnology.
Building a Floor Under a Sharper Rivalry
As artificial intelligence becomes more capable, the costs of getting AI security wrong will grow faster than the benefits of keeping every idea to ourselves. Washington and Beijing are already locked into a long-term competition over chips, data, and models. That competition will not vanish, and the next administration is unlikely to embrace broad new forms of technology cooperation with China. The question is whether the United States insists on competition without any shared guardrails, or whether it is willing to shape a thin layer of basic security practices that serve its own interests even when relations sour.
Starting with low-risk, narrowly technical cooperation is the most realistic way to do that. Work on protocols and best practices, evaluation methods, and early verification tools will not resolve deeper political disagreements. But it can create a small set of shared expectations about how powerful systems should be managed, how serious incidents are handled, and what kinds of failures both sides agree are simply too dangerous to ignore. Biotechnology is an important place to start.
This proposal is not a grand bargain. It is a floor. In a future crisis involving advanced AI, American officials will want to know that at least some of the language, tools, and habits for managing those risks were built in advance. Treating AI as nothing but a race risks leaving both sides to improvise in the dark.
Building a thin floor of shared practice is how rivals have handled dangerous technologies before, and AI should be no exception.
