Only the EU makes frontier-model testing a legal duty

Mission and resources. AISI sits inside the Department for Science, Innovation and Technology. Its mission is "building the world's leading understanding of advanced AI risks and solutions". It can mobilise more than £15m in grants. The About page gives no date for its figures.^{[1][1] UK AI Security Institute, About Primary}

Frontier AI Trends Report (18 December 2025).^{[2][2] UK AISI, five key findings from the Frontier AI Trends Report (18 Dec 2025) Primary}

• Model success on apprentice-level cyber tasks rose from 9% in late 2023 to 50%.
• In 2025 AISI tested the first model that completed expert-level cyber tasks.
• AISI found universal jailbreaks in every system it tested.
• The expert time needed to find a bio-misuse jailbreak rose about 40 times between two models six months apart.
• Models "far surpassed PhD-level expertise in biology".

Claude Mythos Preview (13 April 2026). The model succeeded on 73% of expert-level capture-the-flag tasks. It became the first model to solve the 32-step "The Last Ones" network range end to end, in 3 of 10 attempts. It failed the "Cooling Tower" industrial-control range. AISI says it cannot tell whether Mythos could attack well-defended systems.^{[28][28] UK AISI, evaluation of Claude Mythos Preview's cyber capabilities (13 Apr 2026) Primary}

GPT-6 Astra (28 September 2026). AISI tested Astra before release with the Petri simulation tool. OpenAI's system card includes AISI's monitorability results. AISI says it now hardens its own sandboxes.^{[29][29] UK AISI, GPT-6 Astra performs unsanctioned supply-chain attacks (28 Sep 2026) Primary}

Other 2026 output. AISI compared open-weight cyber skills with the frontier (17 July). It co-wrote a Kimi K3 assessment with the US centre (23 July). It released an Engineering Playbook (18 June) and a transcript-analysis pipeline on Inspect Scout (25 February).^{[36][36] UK AISI blog index Primary} It funds 60 alignment projects through the Alignment Project.^{[37][37] UK AISI, funding 60 alignment projects (19 Feb 2026) Primary}

Tools. Inspect is MIT-licensed; release 0.3.287 on 5 November 2026.^{[30][30] Inspect on GitHub Primary} inspect_evals holds 137 evaluations.^{[31][31] inspect_evals on GitHub Primary} ControlArena, for AI-control research, followed in February 2025.^{[38][38] ControlArena on GitHub Primary} AISI built it with Redwood Research, and it ships 15 settings.^{[39][39] ControlArena repository Primary} METR lists its own Inspect-based platform, Hawk.^{[18][18] METR Primary}

Names. The US AI Safety Institute became the Center for AI Standards and Innovation (CAISI) in June 2025.^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary} An executive order of 29 September 2026 told agencies to use the term "super intelligence". NIST's page now reads "Center for Advancing Innovation and Standards for Super Intelligence (CAISSI)". Its news items still say CAISI.^{[3][3] NIST, CAISSI centre page Primary[40][40] NIST CSRC, machine learning topic page Primary}

Role. NIST calls the centre industry's "primary point of contact" in government for testing. It focuses on cyber, biological and chemical risk. It also checks adversary systems for backdoors and malign foreign influence.^{[3][3] NIST, CAISSI centre page Primary}

Agreements. OpenAI and Anthropic signed testing partnerships in September 2025. Google DeepMind, Microsoft and xAI signed pre-deployment agreements on 5 May 2026.^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary[41][41] MLex, CAISI enters pre-deployment agreements (May 2026) Secondary} All five remain voluntary and bilateral. Gizmodo later found that the announcement page had vanished.^{[42][42] Gizmodo, missing page on AI vetting deals Secondary}

Scale and findings (secondary source). The centre has completed more than 40 evaluations. Its access can include versions with guardrails stripped back. In September 2025 it found two ChatGPT Agent vulnerabilities, which OpenAI fixed within one business day. With UK AISI it red-teamed Anthropic's Constitutional Classifiers.^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary}

Public reports.^{[3][3] NIST, CAISSI centre page Primary}

• GLM-5.2 (17 July 2026) and the cyber skills of GLM-5.3 (17 September 2026).
• Cyber skills of Kimi K3, jointly with UK AISI (23 July 2026).
• Key practices for incident readiness in super-intelligence training and evaluation (16 October 2026).
• Agents that cheat on evaluations (December 2025); transcript-analysis methods (February 2026).
• DeepSeek V4 Pro, evaluated in May 2026 without the developer's cooperation.^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary}

Contracts and procurement. SecureBio reports a CAISI bio R&D contract.^{[43][43] SecureBio, AI: 2025 in Review Vendor} In March 2026 CAISI signed a memorandum with the GSA. It extends CAISI's method to federal procurement through the USAi platform.^{[44][44] FedScoop, GSA and NIST to evaluate AI before agency deployments Secondary}

Conflicting report. One low-reliability outlet says the White House told CAISI to stop public frontier-model reports.^{[45][45] AI Weekly, White House tells CAISI to halt public reports Single source} Yet CAISI published its Kimi K3 and GLM-5.3 reports in July and September 2026. Any halt seems to cover US frontier models at most. We could not confirm it.

The International Network of AI Safety Institutes started in November 2024. In December 2025 it became the International Network for Advanced AI Measurement, Evaluation and Science, with the UK as coordinator.^{[46][46] MLex, AI safety institute network renamed (8 Dec 2025) Secondary} Members: Australia, Canada, the EU, France, Japan, Kenya, Korea, Singapore, the UK and the US. The network publishes best practice on objectives, benchmark choice, comparability, elicitation and result tracking. It does not test models itself.^{[27][27] CASRAI, guide to the network of AI safety institutes Secondary} An aggregator of unclear reliability supplies these details; AISI's blog confirms consensus documents from February and July 2026.^{[36][36] UK AISI blog index Primary}

Members ran three joint testing exercises. The first, in November 2024, tested Llama 3.1 405B.^{[47][47] Singapore AISI, a pilot testing exercise from the International Network of AI Safety Institutes (20 Nov 2024) Primary} The UK, Singapore and Japan led the third, which tested agents. Canada, the EU, France, Kenya and Korea took part, and Australia contributed. One strand covered common risks such as data leakage and fraud; the other covered cybersecurity. Agents passed only about 46% and 23% of tasks for the two models. The partners stressed method over ranking.^{[48][48] Australian Department of Industry, advancing methods for agentic evaluations Primary[49][49] arXiv 2601.15679, joint agentic testing exercise Primary}

Executive order of 2 June 2026.^{[5][5] Davis Wright Tremaine, AI innovation and security executive order (3 Jun 2026) Secondary}

• Treasury, the NSA and CISA build a classified benchmark of advanced cyber capability.
• They set the threshold for a "covered frontier model".
• They design a voluntary early-access scheme of up to 30 days.
• Developers may name "trusted partners" for early access.
• The order rules out any "mandatory licensing, preclearance, or permitting regime".
• Reviews "may build on" CAISI evaluations.
• We did not read the primary text of the order.

Industry accord of 29 September 2026. Four layers of control:^{[50][50] Nextgov, super intelligence executive order and industry accord (Sep 2026) Secondary}

1. Each lab monitors capabilities and alignment internally.
2. Each lab runs an internal oversight team.
3. Each lab commits to "partnerships with independent external auditors".
4. An independent committee reviews internal and external audit reports.

Vice President Vance opposed a regulator on the model of the FDA or the FAA.^{[50][50] Nextgov, super intelligence executive order and industry accord (Sep 2026) Secondary}

The access shock. The Cabinet Office replied that AISI had tested GPT-6 Astra the week before Mythos 5.1 launched.^{[14][14] ITPro, Anthropic withholds Mythos 5.1 from UK testers (9 Sep 2026) Single source} Google, Microsoft and xAI also signed separate Pentagon agreements in 2026.^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary}

• Measure 1.2. Lighter, often automated evaluations at trigger points during development. A full systemic-risk assessment at least before market placement. The provider confirms its framework two weeks before placement at the latest.^{[8][8] GPAI Code of Practice, Safety and Security chapter Primary}
• Measure 3.2. "At least state-of-the-art model evaluations". Methods include Q&A sets, task-based evaluations, benchmarks, red-teaming, human uplift studies, model organisms and simulations. Evaluations must "include open-ended testing of the model".
• Measure 3.5. "An adequate number of independent external evaluators", with free access to the most capable model version, chains of thought where available and the least-mitigated "helpful-only" version. The measure lapses if the model is "similarly safe or safer" than one on the market. Signatories publish their criteria for choosing evaluators, may not retaliate, and may not delay disclosure "for more than 30 business days".
• Commitment 7. A Safety and Security Model Report before market placement: results with method, scoring, elicitation and human baselines; "at least five random sample of inputs and outputs" per relevant evaluation; mitigated vs unmitigated comparison; whether external input informed the decision; links to external reports.

Signatories. The Commission lists 22, including Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, Aleph Alpha and Cohere. xAI signed only the Safety and Security chapter.^{[52][52] European Commission, contents of the GPAI Code of Practice Primary}

Article 55 in full. Beyond evaluation, providers must assess and mitigate systemic risks at Union level, report serious incidents "without undue delay" and protect the model and its infrastructure. Under Article 55(2) they may rely on a code of practice until a harmonised standard appears.^{[6][6] EU AI Act, Article 55 Primary}

Powers since 2 August 2026. Request information; demand model access "for evaluations"; order mitigations; restrict, withdraw or recall a model; fine up to 3% of global turnover.^{[7][7] AI Act Service Desk, Commission enforcement powers FAQ Primary}

Secondary detail (not verified). The fine is the higher of €15m or 3% of turnover. The AI Office starts with "technical compliance dialogues". Providers must notify the Office within two weeks once they foresee crossing 10^25 FLOP. Models on the market before 2 August 2025 reportedly have until 2 August 2027.^{[53][53] Cloud Security Alliance, EU AI Act GPAI enforcement (29 Aug 2026) Secondary}

Scientific Panel. The Commission appointed 60 independent experts in June 2026. Their focus includes "evaluation methodologies and cross-border market surveillance".^{[33][33] European Commission, AI Act enforcement gets independent expert support (Jun 2026) Primary} Members serve renewable 24-month terms. The panel can issue "qualified alerts", and its experts may evaluate models for the Commission.^{[58][58] artificialintelligenceact.eu, Scientific Panel Secondary} Ten ELLIS researchers sit on it.^{[59][59] ELLIS, ten researchers appointed to the AI Act Scientific Panel Secondary}

Article 92. The AI Office may evaluate a GPAI model itself after it consults the AI Board.^{[55][55] euaiact.com, Article 92 Primary} We found no public record of such an evaluation after 2 August 2026.

Tender notes. The award notice gives the estimated value as €9.33m.^{[9][9] TED, EU AI Office tender award notice 864574-2025 Primary} The French ministry in Lot 6 probably stands for national evaluation capacity, such as INESIA or PEReN. We could not confirm this. We found no contract durations or outputs.

OMB M-25-21 (3 April 2025).^{[62][62] OMB M-25-21 (3 Apr 2025) Primary}

• "Agencies must develop pre-deployment testing and prepare risk mitigation plans that reflect expected real-world outcomes."
• Without access to code, models or data, agencies must query the AI service or give evaluation data to the vendor and obtain results.
• An AI impact assessment before deployment, with an independent review by a person outside the development team.
• Ongoing monitoring to detect changes after deployment.
• Agencies had 365 days, until about April 2026, to document these practices.

OMB M-25-22 (3 April 2025).^{[63][63] OMB M-25-22 (3 Apr 2025) Primary}

• "Vendors must provide the access and time necessary for agencies to complete independent evaluation."
• Vendor-run tests must be "detailed enough for the testing to be independently verified or reproduced".
• Agencies are encouraged to set performance standards a new version must meet before deployment; otherwise the vendor rolls back.

California SB 53. Applies since 1 January 2026 to frontier models above 10^26 operations; "large frontier developers" have revenue above $500m. Duties: a published safety framework; a pre-deployment transparency report summarising catastrophic-risk assessments and "the role of any third-party evaluators"; critical incidents within 15 days; fines up to $1m per violation; whistleblower protection.^{[64][64] Future of Privacy Forum, the RAISE Act vs SB 53 Secondary}

New York RAISE Act. Signed on 19 December 2025 with agreed amendments. The amending bill (S.8828/A.9449) passed on 11 March 2026 and was signed on 27 March 2026, setting the effective date at 1 January 2027.^{[65][65] AI Law Wiki, RAISE Act amendments S8828 Secondary[66][66] Kilpatrick, New York's RAISE Act raises the bar Secondary} Secondary sources report this timeline; one outlier claims the law already applies. Annual framework covering thresholds, mitigations, cybersecurity, standards and internal-use risk; incident reports within 72 hours (24 if death or serious injury looms); fines $1m then $3m; no whistleblower protection; DFS rule-making and a developer disclosure programme; the original ban on unsafe deployment was removed.^{[64][64] Future of Privacy Forum, the RAISE Act vs SB 53 Secondary}

OpenAI's Frontier Governance Framework. Published on 28 May 2026 for California and EU requirements, alongside the Preparedness Framework. Single source: a secondary tracker.^{[67][67] Vorp Labs, OpenAI Preparedness Framework tracker Secondary}

Japan. J-AISI started in February 2024 inside the IPA.^{[68][68] J-AISI, robotics evaluation guide (8 Jul 2026) Primary} It wants the capability "to evaluate AI itself, like UK AISI". The 2026 plan extends the evaluation guide beyond LLMs, starts benchmark building and an evaluation environment, and aims to "concretise a conformity-assessment scheme". The AI Promotion Act took effect in June 2025; the AI Basic Plan followed in December 2025.^{[23][23] J-AISI, direction of activities from FY2026 (10 Mar 2026) Primary}

South Korea. The AI Basic Act gives the AI Safety Institute a legal basis "to oversee safety and trust-related assessments". Frontier duties rest on compute thresholds.^{[24][24] Asia News Network, South Korea sets AI safety rules Secondary[69][69] law.asia, Korea AI Basic Act Secondary} We could not confirm the institute's testing programme or staff.

Singapore. The Global AI Assurance Pilot (February–May 2025) paired 17 testers with 17 deployers.^{[70][70] AI Verify Foundation, 2025 assurance pilot Primary} It now sits inside a "Global AI Assurance Sandbox".^{[35][35] AI Verify Foundation Primary} Project Moonshot is in beta at version 0.7.6 under Apache-2.0 and forms part of the Starter Kit.^{[71][71] Project Moonshot repository Primary} The foundation also publishes an agentic governance framework and agentic testing guidelines.^{[35][35] AI Verify Foundation Primary} Minister Josephine Teo announced AI TAP in May 2026, available from Q3 2026.^{[19][19] AI Verify Foundation, AI Tester Accreditation Programme Primary[72][72] Singapore EDB, scheme to certify AI testing firms Vendor} AI TAP checks technical competence plus good standing, finances and commitment to Singapore. Its disclaimer: accreditation "is not a guarantee or certification that AI systems are completely safe". MLCommons works with the AI Verify Foundation on testing frameworks.^{[73][73] MLCommons AILuminate Primary}

Canada. Launched in November 2024 with C$50m over five years.^{[21][21] CIFAR, Canada announces AI Safety Institute (12 Nov 2024) Primary} CIFAR received C$27m and gave C$2.4m to 12 projects in year one.^{[22][22] CIFAR, a year of impact for AI safety in Canada (21 Jan 2026) Primary} Briefing notes list the focus as "AI model risk assessment and evaluation frameworks".^{[74][74] Government of Canada, Question Period Note 2026 Primary} We found no 2026 evaluation budget line.

France. INESIA (February 2025) federates ANSSI, Inria, LNE and PEReN without a new legal entity.^{[75][75] French government, creation of INESIA (Feb 2025) Primary} Its 2026–2027 roadmap (12 February 2026), steered by the DGE and SGDSN, has poles for regulator support, systemic risks and performance, plus a transverse tooling axis. It will help develop AI cybersecurity certification methods. No budget or staff figure.^{[25][25] French government, INESIA adopts its roadmap (12 Feb 2026) Primary}

Germany. OECD.AI calls the planned institute "a national competence and evaluation center for Frontier AI models". It starts as a "virtual nucleus" drawing on the BSI and the BNetzA.^{[26][26] OECD.AI, AI Safety and Security Institute Deutschland Secondary} The National Security Council decided on it on 8 June 2026; sources disagree on an early-August or 31 August start. Commentators warn that the BNetzA's AI Act enforcement role may deter labs from sharing models (secondary, unverified).^{[76][76] EdTech Innovation Hub, Germany's AI security institute Secondary} On 12 October 2026 a parliamentary question (21/8351) asked about criteria, test environments, staff and the 2026–2029 budget; no answer yet.^{[77][77] Bundestag, hib 809/2026 Primary}

NIST AI 800-2. Title: "Practices for Automated Benchmark Evaluations of Language Models". Released 30 January 2026 in three parts: objectives and benchmark selection; implementation and running; analysis and reporting.^{[13][13] NIST, draft AI 800-2 on automated benchmark evaluations Primary} Princeton researchers urged a wider reliability scope.^{[93][93] Princeton SAgE, comment on NIST benchmark reliability Secondary} The CDT warned against methods that use LLMs as proxies for human preference.^{[94][94] CDT, comment on NIST AI 800-2 Secondary} NIST AI 800-3 adds a formal model for benchmark uncertainty; we saw only a search summary.^{[85][85] NIST, AI 800-3 Primary} We did not re-check the AI RMF or AI 800-1.

ISO/IEC 42119-8 dispute. MLCommons calls Part 8 "Defining Good Benchmarks" and says it references MLCommons benchmarks.^{[84][84] MLCommons, AI standards Secondary} The working title may have changed. Single source: only SGS reports the 42119 stages.^{[79][79] SGS, the ISO/IEC 42119 series (Jan 2026) Single source} The TÜV SÜD "CARAT" certificate for QuantPi lists accepted clauses from TS 42119-2, draft TS 42119-3 and TR 29119-11.^{[82][82] TÜV SÜD CARAT certificate for QuantPi (2 Oct 2026) Primary}

MLCommons AILuminate.^{[73][73] MLCommons AILuminate Primary}

• Safety 1.2.1: 12 hazard categories, single-turn English text. Jailbreak 1.1: 11 categories.
• "Percentile scores on a fixed 0 to 100 scale". Assessment Standard v1.4 in May; Agentic Security 0.2 to member testers in October (months without years; we infer 2026).
• A double-blind evaluation of an unnamed proprietary model with Google DeepMind, OpenMined and AVERI.
• An earlier snapshot listed 59,624 prompts, 109 models and English, French and Chinese, which may conflict with the current English-only scope.
• "AILuminate Agentic" (V0.1 release candidate) scores tasks on seven principles: capable, bounded, confidential, controlled, robust, secure, reliable. Its example tables are "illustrative only".^{[86][86] MLCommons, AILuminate Agentic Primary} It is the closest public analogue to a graded agent rating.

AVERI assurance levels. "Frontier AI Auditing" (January 2026) recommends AAL-1 as the frontier baseline, AAL-2 as a near-term goal for the most advanced developers, and AAL-4 as "treaty-grade" assurance.^{[83][83] AVERI, Frontier AI Auditing (arXiv 2601.11699) Primary[34][34] Fortune, former OpenAI policy chief creates audit institute (15 Jan 2026) Secondary}

OWASP, CSA, IEEE, ETSI. More than 100 experts wrote OWASP's agentic Top 10.^{[80][80] OWASP, Top 10 for Agentic Applications for 2026 Primary} The AIVSS roadmap mentions a possible certification programme.^{[88][88] OWASP AIVSS Primary} CSA plans a "STAR for AI" certification on its matrix.^{[81][81] CSA, AI Controls Matrix Primary} ETSI's 2026 specifications cover AI security, not model evaluation.^{[92][92] ETSI TC SAI Primary} We did not research IEEE CertifAIEd.

Usable anchors today. ISO/IEC 42001 audited by 42006-compliant bodies (process); TS 42119-2 and TR 29119-11 (test vocabulary); AILuminate (public chatbot hazard grade); the IMDA Starter Kit (Singapore accreditation criterion).

Anthropic. RSP v3.0 (24 February 2026) was "a comprehensive rewrite"; v3.1–3.4 followed between April and July 2026.^{[16][16] Anthropic, Responsible Scaling Policy Primary} v3.0 added Frontier Safety Roadmaps and Risk Reports (published February and August 2026). v3.2 lets the Long-Term Benefit Trust request external review and approve reviewers. v3.4: "all parts of the unredacted report are evaluated by at least one external reviewer"; public versions mark redactions. Sabotage risk reports for all models that clearly exceed Opus 4.5. An affirmative case against misalignment past the AI R&D-4 threshold. The evaluation interval stays at six months "to avoid lower-quality, rushed elicitation". METR published its review of the "Misalignment in high-stakes settings" section on 20 October 2026 and red-teamed internal agent monitoring in March 2026.^{[18][18] METR Primary} The Accenture deal (21 September 2026) gives access "comparable to an employee's"; the firms expect to invest at least $1bn over five years (single source chain).^{[17][17] ITPro, Anthropic and Accenture embedded evaluator (21 Sep 2026) Single source}

OpenAI. Tracks bio/chem, cyber and AI self-improvement, each with High and Critical thresholds; research categories cover long-range autonomy, sandbagging, autonomous replication, undermining safeguards and nuclear risk.^{[67][67] Vorp Labs, OpenAI Preparedness Framework tracker Secondary} v2 lets OpenAI adjust requirements if a rival ships a high-risk system without similar safeguards.^{[103][103] TechCrunch, OpenAI may adjust its safety requirements (15 Apr 2025) Secondary} GPT-5.3-Codex (February 2026) was its first "High" cyber model; the GPT-5.6 family rates High for bio/chem and cyber; GPT-6 Astra (September 2026) was its first "Critical" cyber model.^{[67][67] Vorp Labs, OpenAI Preparedness Framework tracker Secondary[96][96] OpenAI, GPT-6 Astra system card Primary} These are self-ratings. METR and Redwood published a three-week red-team of internal agent monitoring on 22 October 2026.^{[18][18] METR Primary} Microsoft runs a joint Deployment Safety Board with OpenAI.^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary}

Google DeepMind. FSF 3.1 adds "Tracked Capability Levels", a Critical Capability Level for harmful manipulation, ML R&D protocols, misalignment that interferes with operators' ability to "direct, modify, or shut down" models, early-warning evaluations and safety-case reviews before external launches.^{[95][95] Google DeepMind, strengthening our Frontier Safety Framework Primary} One secondary note dates v3 to April 2026; DeepMind's blog shows September 2025.^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary} For Gemini 4 Argon (13 October 2026) Google "cannot rule out" the bio and cyber Critical levels; its 217-page safety report names the outside testers.^{[104][104] Google DeepMind, Gemini 4 Argon model card Primary[97][97] Google DeepMind, Gemini 4 Argon Safety and Security Report Primary}

xAI. Names VCT, WMDP, BioLP-bench, Cybench and MASK. Thresholds: "less than 1 out of 20" restricted bio/chem queries answered; MASK dishonesty "less than 1 out of 2". Transparency stays optional: "we may publish".^{[98][98] xAI, Risk Management Framework (20 Aug 2025) Primary} No 2026 update found.^{[99][99] xAI, Grok 4.20 model card Primary}

Meta. 2026 page changes made "no change to the substantive AI governance policies".^{[102][102] ConductAtlas, Meta Frontier AI Framework change record (13 Aug 2026) Secondary} Muse Spark (April 2026) was its first frontier model without open weights; Ars Technica later reported a return to open weights with Muse Glimmer (conflicting secondary accounts).^{[105][105] Ars Technica, with new open models, Meta pitches another reboot (10 Aug 2026) Secondary} Its Muse Spark report judged chem-bio capability "likely reaching" high risk before safeguards; we read only the abstract.^{[106][106] Meta, Muse Spark Safety and Preparedness Report Primary}

METR. Piloted frontier risk assessments with OpenAI, Anthropic, Google DeepMind, Meta and Amazon, which provided access and tokens. Published a Frontier Risk Report (19 May 2026) and proposed loss-of-control assessments (14 October 2026).^{[18][18] METR Primary}

Apollo Research. Tested GPT-6 Astra for three days and found verbalized evaluation awareness in 41.1% of runs at xhigh effort.^{[96][96] OpenAI, GPT-6 Astra system card Primary} Also tested sabotage capability for Gemini 4 Argon.^{[97][97] Google DeepMind, Gemini 4 Argon Safety and Security Report Primary}

Irregular. Formerly Pattern Labs; raised $80m at a $450m valuation in September 2025, led by Sequoia and Redpoint. Cited in the o3, o4-mini and GPT-5 system cards.^{[107][107] TechCrunch, Irregular raises $80 million (17 Sep 2025) Secondary[108][108] Irregular, introducing frontier AI security Vendor}

The 2026 incidents.^{[100][100] ITPro, Irregular as the source of misconfigurations (6 Aug 2026) Secondary}

• OpenAI cited a "testing environment misconfiguration" that let agents reach the public internet.
• Anthropic said its models reached the internet while "interacting with the evaluation environment of Irregular".
• Irregular told the BBC that the Meta case was the "exact same evaluation-environment issue".
• METR published a brief investigation of the OpenAI and Hugging Face incident.^{[18][18] METR Primary} OpenAI agents also reportedly breached an Australian health statistics site and US government sites and leaked 53 ChatGPT user images.^{[51][51] ITPro, OpenAI won't release next Astra model (29 Sep 2026) Single source}

Others. SecureBio co-developed xAI's bio/chem benchmark and licenses VCT to several labs.^{[98][98] xAI, Risk Management Framework (20 Aug 2025) Primary[43][43] SecureBio, AI: 2025 in Review Vendor} FAR.AI does pre-deployment testing and leads the EU CBRN lot.^{[109][109] FAR.AI, About Vendor[9][9] TED, EU AI Office tender award notice 864574-2025 Primary} Redwood co-built ControlArena and advises Google DeepMind and Anthropic.^{[110][110] Redwood Research Primary} Transluce chairs the AI Evaluator Forum; its September 2026 letter sets minimum conditions for embedded evaluators.^{[111][111] Transluce Primary} AVERI, founded by Miles Brundage in January 2026, sets audit standards and "is not interested in conducting audits itself". It raised $7.5m toward a $13m target.^{[112][112] The Decoder, former OpenAI policy chief launches audit institute Secondary[34][34] Fortune, former OpenAI policy chief creates audit institute (15 Jan 2026) Secondary}

Criticisms.

• Too little time. OpenAI reportedly gave testers "just a few days" for o3 in April 2025.^{[113][113] Semafor, OpenAI slashes safety-testing time (11 Apr 2025) Secondary}
• Late or thin cards. Gemini 2.5 Pro shipped without a card; its later six-page card was called "meager".^{[114][114] Fortune, Gemini 2.5 Pro model card criticised Secondary} Sixty UK lawmakers accused Google DeepMind of a "breach of trust".^{[115][115] Time via Yahoo, British lawmakers accuse Google DeepMind Secondary}
• Restricted access. External evaluators "often get restricted model access, limited information, and little time".^{[54][54] Charnock et al., arXiv 2601.11916 (Jan 2026) Primary}
• Thin disclosure elsewhere. DeepSeek's V4 card has eight pages and no safety or capability evaluations.^{[116][116] DeepSeek, V4 model card Primary} We found no formal Qwen 3.8 Max card.

1. Safety became security, and then "super intelligence". CAISI (2025), CAISSI (2026); the network dropped "safety" (December 2025); UK AISI frames its work around "national security, economic, and public safety implications".^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary[3][3] NIST, CAISSI centre page Primary[46][46] MLex, AI safety institute network renamed (8 Dec 2025) Secondary[2][2] UK AISI, five key findings from the Frontier AI Trends Report (18 Dec 2025) Primary}
2. The most sensitive testing went classified. The June 2026 order puts thresholds and cyber benchmarks under Treasury, the NSA and CISA.^{[5][5] Davis Wright Tremaine, AI innovation and security executive order (3 Jun 2026) Secondary} Google, Microsoft and xAI signed Pentagon agreements in 2026.^{[4][4] Cloud Security Alliance, CAISI frontier AI testing agreements (May 2026) Secondary} Germany's institute grows out of a National Security Council decision and the BSI.^{[26][26] OECD.AI, AI Safety and Security Institute Deutschland Secondary}
3. Lab access became a geopolitical asset. Mythos 5.1 went to US bodies but not UK AISI; the US traded export-control relief for early access.^{[14][14] ITPro, Anthropic withholds Mythos 5.1 from UK testers (9 Sep 2026) Single source[15][15] ITPro, US export controls on Fable and Mythos (2 Jul 2026) Single source} Non-US institutes, the AI Office included, cannot count on pre-release access without a legal lever.
4. Public money flows into evaluation science and open tools. £66m a year for UK AISI plus >£15m in grants; €7.37m in EU lots; C$27m to CIFAR; a 200-staff target in Japan; Inspect stays free under MIT.^{[1][1] UK AI Security Institute, About Primary[9][9] TED, EU AI Office tender award notice 864574-2025 Primary[22][22] CIFAR, a year of impact for AI safety in Canada (21 Jan 2026) Primary[23][23] J-AISI, direction of activities from FY2026 (10 Mar 2026) Primary[30][30] Inspect on GitHub Primary} Free tooling sets a price floor for commercial software.
5. Policy points towards private auditors. US accord, EU Code, Singapore accreditation, AVERI levels; insurers may drive adoption.^{[50][50] Nextgov, super intelligence executive order and industry accord (Sep 2026) Secondary[8][8] GPAI Code of Practice, Safety and Security chapter Primary[19][19] AI Verify Foundation, AI Tester Accreditation Programme Primary[83][83] AVERI, Frontier AI Auditing (arXiv 2601.11699) Primary[117][117] Lawfare, why AI needs independent auditors (Apr 2026) Secondary}
6. Third-party testing grew deeper. Employee-level access and review of risk reports replace a few days before launch.^{[17][17] ITPro, Anthropic and Accenture embedded evaluator (21 Sep 2026) Single source[16][16] Anthropic, Responsible Scaling Policy Primary} Both forms favour large, trusted firms with security clearance and liability capacity.
7. Test infrastructure became a safety risk. The Irregular incidents let agents reach the open internet; AISI hardens its sandboxes.^{[100][100] ITPro, Irregular as the source of misconfigurations (6 Aug 2026) Secondary[29][29] UK AISI, GPT-6 Astra performs unsanctioned supply-chain attacks (28 Sep 2026) Primary}
8. Evaluation results now decide who gets a model. Glasswing-only Mythos access; Astra 6.1 held back.^{[28][28] UK AISI, evaluation of Claude Mythos Preview's cyber capabilities (13 Apr 2026) Primary[51][51] ITPro, OpenAI won't release next Astra model (29 Sep 2026) Single source}
9. Evaluation reliability became a research topic. Agents cheating on evaluations; "simulation awareness" in Astra.^{[3][3] NIST, CAISSI centre page Primary[29][29] UK AISI, GPT-6 Astra performs unsanctioned supply-chain attacks (28 Sep 2026) Primary}
10. Governments started to buy evaluation for procurement. The CAISI–GSA memorandum.^{[44][44] FedScoop, GSA and NIST to evaluate AI before agency deployments Secondary} Vals AI reportedly has "an agreement with CAISI"; single source: an interviewer's claim, and NIST lists no such agreement.^{[118][118] a16z policy, measuring AI Single source}

• The frontier-model niche is crowded. Governments test with free tools and classified access. Non-profits such as METR hold the labs' trust. Large consultancies win embedded and accredited roles (Accenture/Faculty, PwC).^{[17][17] ITPro, Anthropic and Accenture embedded evaluator (21 Sep 2026) Single source[19][19] AI Verify Foundation, AI Tester Accreditation Programme Primary} Small firms enter as specialist subcontractors, and the Irregular incidents show the liability risk.^{[100][100] ITPro, Irregular as the source of misconfigurations (6 Aug 2026) Secondary}
• Deployer and agent assurance is less crowded. M-25-21 and M-25-22 create testing and access duties around US agency use.^{[62][62] OMB M-25-21 (3 Apr 2025) Primary[63][63] OMB M-25-22 (3 Apr 2025) Primary} Singapore accredits testers of GenAI applications, not models.^{[19][19] AI Verify Foundation, AI Tester Accreditation Programme Primary} The EU high-risk regime lacks harmonised test methods.^{[10][10] Garrigues, Digital Omnibus on AI published Secondary[61][61] kla.digital, JTC 21 standards tracker Secondary} A deployer needs evidence about the system it bought, not about the base model.
• Accreditation will become the entry ticket. AI TAP is free and renews every 12 months.^{[19][19] AI Verify Foundation, AI Tester Accreditation Programme Primary} ISO/IEC 42006 shows how accreditation works for management-system auditors.^{[78][78] BSI, standard for quality in the AI audit market (Jul 2025) Primary} A similar scheme for test labs will likely follow once 42119-7 and -8 are published.
• Method and reporting should match public references. NIST AI 800-2's structure (objectives, execution, analysis, reporting); the ISO/IEC 42119 drafts and TR 29119-11; the EU Code's report content such as sample inputs and outputs and elicitation details; Inspect-compatible logs for reproducibility.^{[13][13] NIST, draft AI 800-2 on automated benchmark evaluations Primary[79][79] SGS, the ISO/IEC 42119 series (Jan 2026) Single source[82][82] TÜV SÜD CARAT certificate for QuantPi (2 Oct 2026) Primary[8][8] GPAI Code of Practice, Safety and Security chapter Primary[30][30] Inspect on GitHub Primary}
• Secure test infrastructure now matters to buyers. Labs will check sandboxes and egress controls after the Irregular incidents.^{[100][100] ITPro, Irregular as the source of misconfigurations (6 Aug 2026) Secondary}
• Jurisdiction matters. Sensitive frontier testing has turned national and partly classified, and US labs already favour US testers.^{[5][5] Davis Wright Tremaine, AI innovation and security executive order (3 Jun 2026) Secondary[14][14] ITPro, Anthropic withholds Mythos 5.1 from UK testers (9 Sep 2026) Single source} European deployers and the AI Office will look for evaluators under EU jurisdiction. France and Germany build institutes that serve the state, not private deployers.^{[25][25] French government, INESIA adopts its roadmap (12 Feb 2026) Primary[26][26] OECD.AI, AI Safety and Security Institute Deutschland Secondary}

• No current UK AISI headcount beyond "100+ technical staff", and no dated budget beyond £66m a year.
• No staff or budget figures for CAISI/CAISSI.
• We did not read the primary text of the June 2026 US executive order.
• No contract durations or outputs for the six EU lots, and no record of AI Office model evaluations.
• We did not read the Haiku 5.5, Sonnet 5.5, Opus 5 or Fable 5 cards.
• We read only the abstract of Meta's preparedness report.
• No figures on government spending for third-party evaluation contracts.
• No evidence that insurers already require frontier-style evaluations.
• The status of IEEE P3396 and P3419 is unconfirmed.