A recent idea for governing frontier artificial intelligence (AI) has moved quickly. In April, I proposed that the federal government regulate AI through a federally supervised self-regulatory organization akin to the Financial Industry Regulatory Authority (FINRA). In June, Anthropic, OpenAI, and Google each published a framework for federal AI governance; Google adopted the FINRA structure and branded it a “FARO.” In July, Google DeepMind Chief Executive Officer Demis Hassabis published a personal essay calling for an industry-funded, FINRA-style standards body with federal supervision, and told Axios he wanted it operational before year-end. Days later, Bloomberg reported that Treasury Secretary Scott Bessent had helped develop a proposal—now under review by White House Chief of Staff Susie Wiles—for an independent frontier AI regulator modeled on FINRA and reporting to the Securities and Exchange Commission (SEC).Such a formal regime would replace the recent, ad hoc approach to AI regulation. When Anthropic released Fable 5, the Commerce Department imposed export controls and forced the company to disable it; then the White House applied similar pressure on OpenAI. Both restrictions have since been lifted, through informal negotiations. Neither the developers nor, it now appears, the government thinks this improvised approach is working.A supervised self-regulatory organization (SRO), like FINRA, is a private industry body that writes and enforces rules for that industry, under the supervision of a government agency. FINRA is composed of broker-dealers, and it writes and enforces rules for the securities industry under the supervision of the SEC. Congress has used this model for other domains where technical complexity and speed of innovation outpace federal bureaucratic capacity, such as futures trading, grid reliability, and even horse racing. The key features are mandatory membership, industry funding, and a supervising agency with authority to direct or veto the SRO’s actions. SRO rules bind members with the force of law, and the SRO enforces them directly, subject to appeal to the supervisor and then to federal court.With an SRO for AI now under active consideration inside the executive branch, the essential question is how to build one. The proposals to date have said little about the institutional details that will determine whether such an entity effectively regulates AI. The primary critiques of the SRO model—that it will be captured by industry or produce stifling regulation—are best addressed through careful design of the SRO’s governance and its relationship with the supervising agency. Every regulatory scheme faces these hazards, but the SRO’s structure is distinctive in offering mechanisms that check each.MembershipAll frontier AI developers would be bound by the SRO’s rules, creating an incentive to participate in writing them. Not every regulated entity will share in governance, however. Foreign AI firms would have to comply with SRO requirements without holding voting rights or board seats, and companies deploying open-weight models would answer to the supervisor’s rules without participating in the SRO at all.Defining “frontier developer” is a perennial threshold problem. Approaches range from a model-focused compute floor (as in the European Union’s AI Act) to compound financial triggers at the firm level (Anthropic’s white paper). Each has trade-offs, but the criteria should capture startups developing new models so that their interests are represented; any participation costs pale beside frontier-scale compute.The threshold should be usable now but designed to change. For now, membership should extend to any entity maintaining an AI model trained on 1026 or more floating point operations (FLOPs), a threshold only a handful of models on the market today clear. FLOPs measure training scale rather than capability, an imprecision to be corrected as models and testing evolve. Responsibility for updating the threshold and eventually replacing it with a capability-based test belongs with the supervisor, not the SRO, though the SRO could provide expert advice. Case-by-case designation should also be available to account for entrants plainly structured to evade the rules. Because membership determines both who bears compliance costs and who votes on the rules, incumbents would have an interest in setting the boundary to their own advantage.