Can AI Be Made Safer Without Missing a Development Deadline?

Two promises, one unknown

A regulator might promise that frontier AI will never exceed a specified danger level, while also promising that development will not fall too far behind schedule. In Risk Ceilings and Development Deadlines: Pacing AI under Uncertain Safety Productivity, economist Li Gan asks when those commitments can coexist.

The answer is conditional: safety research must be productive enough. Extra time cannot guarantee adequate protection if research might accomplish arbitrarily little. The paper, an arXiv preprint revised to version 3 on November 5, 2026, establishes theoretical bounds and explores numerical scenarios. Its figures are not empirical estimates of AI danger or research effectiveness.

What slowing down changes

Gan models a laboratory dividing its growing computing resources among capability research, safety research and customer services. Stronger models accelerate capability research. Safety research accumulates knowledge that reduces the danger of current and later models.

The model distinguishes two sources of catastrophe hazard, meaning the instantaneous rate of danger conditional on catastrophe not having occurred. “State hazard” comes from operating a model: spending longer with it creates more exposure. “Step hazard” comes from advancing capabilities. In the baseline formulation, spreading the same capability gains over more months does not itself eliminate that second source.

This distinction explains why slower development is not automatically safer. Waiting can add exposure, while research conducted during the wait can reduce future danger. Their balance determines whether a pause helps.

The deadline also has a demanding definition. Every capability milestone must arrive within the allowed delay—not merely the final milestone. It represents a lead over a rival, although the rival’s decisions are outside the model.

A minimum stock of protection

The central feasibility argument is straightforward. If the final model would be too dangerous without protection, the laboratory must accumulate enough safety knowledge before reaching it. Research has a maximum learning rate, and the deadline limits the available time. Together, these constraints impose a minimum productivity requirement that no policy can evade.

In the main illustrative scenario, full-speed development takes 18 months and the regulator permits at most 12 months of delay. The final model’s unprotected state hazard is roughly 57 times the ceiling. Meeting that ceiling therefore requires about 5.8 halvings of danger.

Even allowing maximal learning throughout the available 30 months, the paper finds that productivity must reach approximately 0.57 times its fitted benchmark. Below that level, no policy in the model can keep both promises. Passing this test is necessary, not sufficient: real development within the model also consumes compute.

Learn first, then advance

Gan constructs a feasible alternative called “learn-then-replay.” The laboratory initially assigns all compute to safety research, then follows the original capability-development path on a delayed schedule.

The crucial assumption is that compute keeps growing during the wait. With compute doubling every six months, a laboratory starting a year late can reproduce the original research path using 12.5 percent of its compute rather than 50 percent. The remaining capacity can support safety research or customers.

Putting all spare compute into safety makes this policy work at productivity of about 0.69 times the fitted benchmark—21 percent above the necessary bound. The interval between 0.57 and 0.69 remains unresolved: the paper neither rules out every policy there nor supplies one that works.

The landing-page abstract’s smaller, 3.3 percent gap concerns a more restrictive case: only state hazard, constant safety yield and full knowledge transfer, under an additional hazard-shape condition. It is not the gap in the main mixed-hazard scenario.

Customers pay for the guarantee

The most safety-intensive replay supplies no customer services until development finishes at month 30. The model assigns it a loss of roughly 13 percent of discounted five-year service value, and all service value over the first two years.

At its minimum qualifying productivity, its simulated catastrophe probability is about 8 percent; at fitted productivity, about 2 percent. The fitted full-speed benchmark is 75 percent. These are scenario outputs, not forecasts.

With fitted productivity established as a lower bound, the cheapest policy within the replay class learns for 7.5 months and loses 4.1 percent of five-year service value. The paper reports services and catastrophe risk separately rather than combining them into a welfare calculation.

Conditional guidance, not a prescription

The conclusions rely on idealized compliance and hazard assessment, externally growing compute, and a fixed deadline instead of strategic competition. Baseline danger ends when development finishes. Early research is less useful when its knowledge transfers poorly to stronger models, and later research can be preferable when its yield rises sufficiently.

Gan’s policy message is therefore about evidence: credible guarantees require a defensible lower bound on safety productivity. Fixed compute allocations can make development dates predictable, but they leave risk dependent on how much protection the research actually produces.