Priorities and principles for effective third party assessments
Published September 22, 2026
Not law. This is a company's own public position on AI regulation. It is not law, and it carries no legal force.
What it argues for
OpenAI’s agenda for independent technical safety assessments sets out four priority areas and seven principles for work with private and non-profit assessors. It argues that external scrutiny should test whether evidence supports labs’ safety claims, whether evaluations measure the intended risks, and whether safeguards work in practice. OpenAI supports assessors having “deep levels of access across training, evaluation, and deployment”, while describing this programme as “generally longer-term and launch-agnostic” rather than primarily a release checkpoint. Its priorities are assessing safety cases across the model lifecycle; testing safeguards in internal and external deployments; reviewing capability and alignment evaluations; and investigating critical misalignment incidents. Specific questions include whether training rewards deception, whether monitoring can be disabled, whether chain-of-thought monitoring remains reliable, and whether evaluations keep pace with improving capabilities. The proposed process starts with “clearly defined safety claims that are pre-registered”, within a scope agreed between the lab and assessor. Access would remain bounded by legal, security and intellectual-property constraints, with indirect access or company-controlled environments available where necessary. Assessors should disclose and address conflicts, explain methods and uncertainty, and retain “editorial independence”. Labs could receive time to remediate before publication and request redactions of sensitive information; assessors could record substantive redactions and their effect on the report. When full publication is impossible, confidential reporting to oversight bodies or company boards could support accountability. OpenAI calls for shared international standards through future law and private governance, while stressing that “No one third party can or should comprehensively cover urgent frontier safety questions.”
Stated positions (10)
- Independent assessments should examine the full model lifecycle, supported by “deep levels of access across training, evaluation, and deployment”.
- The proposed programme is not principally a launch approval process: it is “generally longer-term and launch-agnostic”, although assessments can also inform deployment decisions.
- Assessors should test safety cases and their supporting evidence, including whether “the safety claims support the overall safety case”.
- Safeguard testing should cover real operating conditions and internal deployments, asking whether monitoring is implemented “in a way that cannot easily be disabled”.
- Capability and alignment evaluations should keep pace with model progress: OpenAI asks whether new tests “meaningfully measure more advanced capabilities”.
- Independent incident investigations should be used selectively, particularly for misalignment involving models “acting without authorization or evading oversight”.
- Assessment scope should be agreed in advance, with “clearly defined safety claims that are pre-registered before assessment activities begin” and a process for considering significant risks discovered outside that scope.
- Assessor access should be proportionate and remain “within the bounds of legal, security, and IP constraints”; indirect access and company-managed environments can be alternatives.
- Independence requires assessors to “identify, disclose, and address organizational and individual conflicts of interest”, with safeguards against commercial pressures affecting findings.
- Publication should combine accountability with confidentiality: assessors should maintain “editorial independence”, while labs may receive “a reasonable period to remediate issues before publication” and request sensitive-information redactions.
About this document
An OpenAI web article dated September 22, 2026, filed under Safety and credited to Lama Ahmad. It presents four assessment priorities, seven principles, definitions of safety claims and safety cases, and a concluding section on developing the independent assessment ecosystem.
How this sits against AI law
Each stance compared with what EU and US instruments actually require. Where no instrument addresses a theme, that gap is shown rather than hidden.
Independent assessment across the lifecycle
Independent assessors should examine safety cases across training, evaluation, internal deployment and external deployment. Multiple specialists should work in parallel rather than one assessor attempting comprehensive coverage.
Article 55(1)(a) and (b) requires systemic-risk model providers to conduct model evaluations and assess and mitigate systemic risks. It does not generally require providers to commission independent private assessments across all these stages, so OpenAI adds an external scrutiny process to the statutory evaluation duties.
The adopted Illinois Artificial Intelligence Safety Measures Act would require independent third-party audits of frontier AI safety protocols. OpenAI supports the same core mechanism, although its agenda is not a mandatory audit regime; the Illinois measure is not yet binding and is scheduled to take effect on January 1, 2027.
Agreed scope and transparent methods
Assessments should start with mutually agreed scope and pre-registered claims, while allowing consideration of significant risks discovered outside that scope. Reports should explain methods, criteria, uncertainties and the limits of their conclusions.
Article 55(1)(a) requires model evaluation using standardised protocols and tools reflecting the state of the art, while Article 53(1)(a) and Annex XI require technical documentation that includes evaluation information. These provisions do not establish OpenAI’s specific process of mutually agreed, pre-registered claims for private assessments.
The voluntary NIST AI RMF’s MEASURE 1.1 and MEASURE 2.1 address selecting risk-measurement approaches and documenting test sets, metrics and evaluation tools. This supports OpenAI’s emphasis on explicit methods and assessment limits, but the framework imposes no enforceable assessment or pre-registration duty.
Deep access with security limits
Assessors should receive access sufficient to test agreed claims, subject to legal, security and intellectual-property constraints. Sensitive work may use indirect access, designated company representatives, or company-managed devices and premises.
Articles 91 and 92 give the Commission information-gathering and model-evaluation powers, including access needed for evaluation, while Article 78 protects confidential information. The Act does not establish a comparable general access entitlement for independent private assessors; OpenAI proposes an additional, negotiated access channel rather than a substitute for regulatory access.
SB 53’s frontier safety framework and transparency provisions do not give private assessors a general right to inspect internal systems, confidential data or model reasoning. OpenAI proposes deeper access for agreed assessments, although its conditions do not create an enforceable access right.
Testing safeguards and updating evaluations
Assessors should test safeguards under realistic adversarial conditions and examine whether capability and alignment evaluations cover the relevant risks. Tests should be refreshed when models saturate them, including for chemical and biological risks, cybersecurity, AI self-improvement and severe misalignment.
Article 55(1)(a) requires state-of-the-art model evaluation, including documented adversarial testing, and Article 55(1)(b) requires systemic-risk assessment and mitigation. OpenAI’s proposed scrutiny serves those same purposes, while adding specific questions about evaluation saturation, monitoring and internal safeguards.
SB 53 requires covered large frontier developers to publish frontier AI frameworks describing their approaches to assessing and mitigating catastrophic risks. OpenAI’s evaluation and safeguard priorities address the same risk-management function, but its proposed third-party testing is more detailed than that general framework obligation.
Independent misalignment incident investigations
Independent specialists should investigate critical misalignment incidents in selected circumstances, including unauthorized model actions and evasion of oversight. Findings should test whether remediation would prevent similar incidents and inform the model’s safety case.
Article 55(1)(c) requires systemic-risk model providers to track, document and report serious incidents and possible corrective measures to the AI Office and, where appropriate, national competent authorities. It does not generally require providers to appoint independent investigators, which is the additional mechanism OpenAI proposes.
SB 53 establishes critical safety incident reporting duties, including for specified failures involving a model evading developer control. It does not generally require an independent third-party investigation; OpenAI adds that option selectively, without proposing to replace mandatory reporting.
Publication, remediation and editorial control
Reports should be shared as openly as possible, with time for appropriate remediation and protections for sensitive information. Assessors should retain editorial independence, disclose the effect of substantive redactions where appropriate, and use confidential oversight reporting when full publication is impossible.
Article 78 establishes confidentiality protections, while Articles 53 and 55 require documentation and reporting to specified recipients rather than general publication of independent assessment reports. OpenAI proposes a separate publication process with assessor editorial control, lab-requested redactions and disclosure of redactions’ effects.
SB 53 requires public frontier safety frameworks and transparency reporting, with protections for sensitive information. It does not establish editorial independence or redaction procedures for privately commissioned assessment reports, which are the additional publication safeguards OpenAI advocates.
The EU AI Act already requires providers of general-purpose AI models with systemic risk to evaluate models and assess and mitigate systemic risks under Article 55, but it does not generally require those providers to commission independent private audits. OpenAI’s proposal adds a detailed model for external scrutiny without making it a universal pre-deployment checkpoint. Its mutually agreed scope and negotiated access also differ from the Commission’s statutory powers to obtain information and model access under Articles 91 and 92, which are not conditional on agreement between a lab and a private assessor.
Source
https://openai.com/index/priorities-principles-third-party-assessments/- Date on the page:
- "September 22, 2026" printed in the article header, category Safety, author Lama Ahmad.
- Source checked:
- opened and confirmed on 2026-10-30