AI Policy Wiki
Dashboard
⚲
AI Policy Wiki › Concepts & Frameworks

Third-Party AI Assessment

medium confidence · updated 2026-09-25

Examination by an organization independent of a frontier AI developer of whether the evidence supports the developer's specific safety or security claims — about capabilities, safeguards, evaluations or incidents. Distinguished by OpenAI from audits of process compliance; the subject of developer-published principles in August and September 2026 and of statutory proposals for accredited or licensed assessors.

Contents

A third-party AI assessment is an examination, by an organization independent of an AI developer, of whether the evidence supports a specific claim the developer makes about a model's safety or security — for example, that a model lacks a dangerous capability, that a safeguard withstands adversarial testing, or that an evaluation measures the risk it is meant to measure. OpenAI distinguishes assessments from audits: audits "examine whether an organization follows applicable requirements, governance processes, and safety or security commitments," while independent third-party assessments "examine whether evidence supports a specific safety or security claim" (Making AI Audits and Assessments Work (OpenAI Global Affairs, August 2026)). The practice sits between developers' internal testing and government evaluation; the institutional designs proposed for it are compared at Who Verifies the Frontier: Competing Architectures for Third-Party AI Assessment.

Practice

Frontier developers have commissioned external testing for several years, typically from specialist organizations covering particular risk domains. OpenAI stated in August 2026 that it had "long collaborated with organizations including METR, SecureBio, Apollo Research, and Irregular" on long-horizon autonomy, biological threats, cybersecurity, scheming, deception and oversight subversion (Making AI Audits and Assessments Work (OpenAI Global Affairs, August 2026)). Government institutes perform comparable work under separate arrangements (CAISI, UK AI Security Institute; see AI Pre-Release Vetting).

Two developments in 2026 widened the object of assessment from finished models to incidents and development processes. The independent investigation by METR and Redwood Research of agent behaviour in the OpenAI–Hugging Face incident, published August 26, 2026, was conducted on premises at OpenAI (Brief Independent Investigation of Agents' Behavior in the OpenAI / Hugging Face Incident (METR and Redwood Research, August 2026)). Dario Amodei's September 12, 2026 essay committed Anthropic to embedded third-party evaluators with employee-like access assessing "not just completed AI models but training pipelines and processes" (We Must Pace the Frontier (Amodei, September 2026)).

The evaluation environments used by assessors have themselves been a source of incidents: OpenAI disclosed in August 2026 that its models reached the public internet during third-party cyber evaluations at the UK AI Security Institute and at Irregular (Third-party cyber evaluations involving OpenAI models (OpenAI, August 2026)).

Developer-published principles

OpenAI has published two sets of principles.

  • August 7, 2026 — audits and assessments in a statutory system (Making AI Audits and Assessments Work (OpenAI Global Affairs, August 2026)). Six principles: scope defined in advance and matched to risk; the right kind of review; common interoperable standards; accredited reviewers selected on documented criteria, with a warning against "assessor shopping"; secure, proportionate evidence access with complete reports to regulators and targeted redactions in public summaries; and time-bound remediation of material findings.
  • September 22, 2026 — voluntary engagements with private and non-profit assessors (Priorities and Principles for Effective Third Party Assessments (OpenAI, September 2026)). Four priority areas — safety cases, critical safeguards across internal and external deployment, Preparedness and alignment evaluations, and investigation of critical misalignment incidents — and seven principles: pre-registered, mutually agreed claims; proportionate access; transparent methodology; expertise and conflict-of-interest disclosure with possible recusal or exclusion periods; security and confidentiality, including access on company-managed devices or premises; a reasonable remediation period before publication; and editorial independence with lab-requested redactions that assessors may flag.

The September post defines a safety claim as "a specific assertion about a model or system's capabilities, behavior, or safeguards that bears on its safety and can be assessed against evidence," making the claim the unit of assessment and the safety case the structure that connects claims to evidence.

Recurring design questions

Independence and selection. Who selects and pays the assessor is the main point of difference among proposals. OpenAI's August principles accept developer choice among accredited assessors while guarding against assessor shopping; its September principles rely on conflict-of-interest disclosure, recusal and exclusion periods. Proposals for government-licensed private verifiers are described at Independent Verification Organizations (IVOs), including the developer-pays criticism.

Access. OpenAI's September principles call for "proportionate access" within "legal, security, and IP constraints," with indirect or privacy-preserving mechanisms where direct access is impractical. METR's July 2026 proposal set out the access an incident investigator needs (How independent researchers could investigate AI propensities after misalignment incidents (METR, July 2026)), and a Google DeepMind–led double-blind framework uses hardware enclaves so that neither side sees the other's assets (Double-Blind Evaluation).

Publication. The September principles give labs a remediation period before publication and allow confidential reporting to governance bodies or company boards where full disclosure is not possible; the August principles route complete reports to regulators.

Standards. Both OpenAI documents presuppose common standards against which assessments are made. The September 21, 2026 paper proposes that such standards be developed internationally through CAISI and the network of AI safety institutes (Building Standards for the Next Phase of AI (OpenAI, September 2026); International AI Standards), and the Appia Foundation was founded to translate standards into assessment criteria.

Relation to policy

Statutory proposals would require third-party assessment rather than leave it voluntary. Illinois SB 315 mandates independent third-party audits of frontier safety frameworks; California's SB 813 and AB 1405 would designate qualified independent assessors and regulate AI auditors; and OpenAI said on September 15, 2026 that it supports the independent verification organizations provision of the FRONTIER Act (Frontier Act / Great American AI Act (Obernolte–Trahan); Source: politico.com). OpenAI's June 2026 blueprint proposed that CAISI certify third-party assessors (Democratic Governance of Frontier AI: A blueprint for a federal framework (OpenAI, June 2026)).

An intergovernmental statement of September 21, 2026, "A Call for Control of Frontier AI Models," asks companies to include "independent evaluation, with qualified evaluators granted sufficient access to assess risks" in their safety protocols, and asks governments to ensure that countries in all regions have access to "trusted evaluation." It does not define a qualified evaluator or sufficient access (A Call for Control of Frontier AI Models (joint statement, September 2026)).

Relationships

Categories: Concepts & Frameworks | us | global | framework | safety | alignment | frontier-models | regulation | technical
What links here (12)