"Priorities and principles for effective third party assessments" is a post published by OpenAI on September 22, 2026 under its Safety heading, bylined Lama Ahmad. It proposes four priority areas in which OpenAI would support deeper independent assessment of its safety work and seven principles for how such assessments should be conducted. Its scope is limited to "engagement with independent assessment organizations in the private and non-profit sector on technical safety assessments"; it describes government testing and evaluation as complementary work in which "distinct roles and responsibilities may call for different approaches."
It is the third OpenAI governance document in a week on related questions, after the misalignment reporting framework of September 16 (Our Framework for Reporting Model Misalignment (OpenAI, September 2026)) and "Building standards for the next phase of AI" of September 21 (Building Standards for the Next Phase of AI (OpenAI, September 2026)); the post links both, stating that labs and assessors "should be operating with shared international standards for safety and security practices." It follows OpenAI's August 7, 2026 principles for audits and assessments (Making AI Audits and Assessments Work (OpenAI Global Affairs, August 2026)), which addressed the design of a legally mandated review system; the September post addresses the company's own voluntary engagements with assessors.
Stated commitments and prior practice
The post opens with OpenAI's characterisation of third-party assessments as "a critical part" of balancing labs' responsibility, "expanding opportunities for input on AI safety, keeping the world informed, and keeping labs accountable to clear and independently supported safety claims." As "part of our efforts to pace the frontier," linking chief scientist Jakub Pachocki's essay (An Alien Mind (Jakub Pachocki, OpenAI, September 2026)), OpenAI states that it "is committed to supporting independent assessments with deep levels of access across training, evaluation, and deployment," access that "should enable assessors to challenge our assumptions, identify risks we may have missed, and reach their own conclusions about the effectiveness of our safeguards."
It describes prior practice: work with third-party assessors "at various stages of the model development and deployment process," incorporation of third-party assessments into Preparedness Framework practices, and support for organizations and legislation advocating "a more rigorous and accountable process," linking the June 2026 blueprint (Democratic Governance of Frontier AI: A blueprint for a federal framework (OpenAI, June 2026)). OpenAI states it has provided "information about our technical safeguards, visible chain of thought access, and unprecedented levels of confidential data and internal deployment access for incident response and monitor red teaming"; the characterisation is the company's own.
Defined terms
The post defines two terms it uses throughout.
- Safety claim: "A specific assertion about a model or system's capabilities, behavior, or safeguards that bears on its safety and can be assessed against evidence." A claim "should identify the risks and conditions it addresses, along with relevant assumptions and limitations."
- Safety case: "A structured argument, supported by evidence, explaining why a model or system's risks are adequately managed for a specified activity, such as training, evaluation, or deployment." It "connects individual safety claims to the evidence supporting them and makes explicit the assumptions, uncertainties, and remaining risks that could affect its conclusions."
The safety-case definition differs in two respects from the one used by the Centre for the Governance of AI paper Safety Cases for Frontier AI, which takes from the UK Ministry of Defence "a structured argument, supported by evidence, that a system is safe enough in a given operational context." OpenAI's standard is that risks are "adequately managed" rather than that the system is "safe enough," and it scopes a case to an activity — training, evaluation or deployment — rather than to an operational context. It also makes the safety claim a named unit from which a case is built. See Safety Cases (Frontier AI).
Four priority areas
The post frames third-party assessment as most useful when it addresses specific questions: whether the evidence supports a lab's safety case and claims, whether evaluations test the risks they are meant to measure, and whether safeguards work under realistic conditions. The work described is "generally longer-term and launch-agnostic," with assessments running in parallel and lasting from weeks to several months, although third-party assessment "can also be part of pre-deployment work and may inform deployment decisions."
- Independent assessment of safety cases, spanning training, evaluation, internal deployment and external deployment. The post states that this requires expertise in alignment, control methods such as monitoring, cybersecurity, biological and chemical misuse, and red teaming, and that multiple assessors will likely examine different parts of a case. Questions include whether the evidence for safety cases is substantiated and their conditions followed; whether they cover the most urgent risks identified during assessment; and whether effective methods are used to identify and reduce training incentives "that could reward deception, reward hacking, destructive actions, or circumventing restrictions."
- Assessment of critical safeguards, across internal and external deployments. OpenAI describes its safeguards as spanning training, internal deployment and external deployment, and currently including "model-level safeguards, enforcement safeguards, and security safeguards, as well as misalignment monitors," covering loss of control and misuse in cyber, biological and chemical risk. It states that standards for internal deployments "are still nascent." Questions include whether safeguards withstand adversarial testing under "grey box" access and protect against uplift in high-risk domains; how agents interact with cyber defenses such as access controls, sandboxing and detection-and-response systems in authorized testing under realistic conditions; whether misalignment monitors have critical gaps and "how reliable is chain-of-thought monitoring as a source of evidence for safety or alignment as model capabilities improve" (see Chain-of-Thought Monitorability); whether monitoring covers training, evaluation and deployment "in a way that cannot easily be disabled"; and whether safeguards are commensurate with capabilities.
- Assessment of capability evaluations covering the Preparedness risk categories (Chemical and Biological Risks, Cybersecurity, AI Self-Improvement) and of alignment evaluations for misalignment risks. The post states that "as thresholds are surpassed and evaluations saturate," evaluations need refreshing. Questions include whether evaluations cover the Preparedness threshold definitions and whether thresholds are set correctly; whether evaluations are updated "when models consistently achieve the highest scores"; and whether alignment evaluations cover severe misalignment risks.
- Independent investigation of critical misalignment incidents, including "models acting without authorization or evading oversight." The post cites "the OpenAI Hugging Face incident" as a case where bringing in an independent third party was beneficial (OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation (OpenAI, July 2026); The Hugging Face Incident and the Road Ahead (OpenAI, August 2026)); that investigation was conducted by METR and Redwood Research (Brief Independent Investigation of Agents' Behavior in the OpenAI / Hugging Face Incident (METR and Redwood Research, August 2026)), although the post does not name them. It lists the expertise investigators need — cyber forensics, alignment, "large-scale chain of thought analysis," and staff and resources to investigate in a timely manner — notes that incident response may involve sensitive internal and third-party data, and states that findings can inform a model's safety case. The questions it prioritises are what misalignment occurred and its primary contributing factors, and whether safeguards and remediation would mitigate similar incidents. See AI Incident Reporting.
Seven principles
The principles are listed in the order the post gives them.
| Principle | Content |
|---|---|
| Clearly scoped and mutually agreed upon claims | Assessments begin with a mutually agreed scope and clearly defined safety claims "pre-registered before assessment activities begin." The parties should state whether a claim is one the company puts forward or one the assessor chooses to test and the lab agrees to be assessed against. Claims may be out of scope because data is inaccessible, the assessor lacks expertise, or time is short in an urgent assessment. A process should exist for significant risks found outside scope, and conclusions should state what was and was not assessed. |
| Proportionate access | Access proportionate to the agreed claims "within the bounds of legal, security, and IP constraints"; where direct access is impractical, work through a designated company representative or "indirect or privacy preserving access mechanisms." |
| Transparent methodology and standards | Assessors explain methods, criteria and uncertainties, drawing on established standards where they exist and justifying criteria where they do not; reports distinguish direct findings from interpretation. |
| Expertise and independence | Assessors demonstrate technical expertise and "identify, disclose, and address" organizational and individual conflicts of interest, "including financial incentives, relationships with developers, and prior involvement in the work being assessed." Safeguards against commercial pressure and compensation arrangements "may include recusal or appropriate exclusion periods." |
| Security and confidentiality | Assessors demonstrate information-security practices and enforceable confidentiality protections for personnel, covering IP, sensitive information and assessment records; where they cannot meet requirements in their own environments or data is especially sensitive, "access on company-managed devices or premises may be appropriate." |
| Actionable findings and time to remediate | Findings specific enough to act on; "where appropriate, labs should have a reasonable period to remediate issues before publication"; reports may carry lessons for agent developers, deployers and defenders. |
| Responsible publication practices | Reports shared "as openly as possible" while protecting sensitive information; where full public disclosure is not possible, "confidential reporting to appropriate oversight bodies (such as governance bodies or boards of companies)." Assessors keep editorial independence; labs may request redactions of sensitive information, and assessors "can note where substantive redactions have been made and the impact on their assessment report." |
Comparison with the August 2026 principles
The September principles overlap with the six OpenAI published on August 7, 2026 (Making AI Audits and Assessments Work (OpenAI Global Affairs, August 2026)) on scope defined in advance, proportionate access, conflict-of-interest management and time-bound remediation, and differ on three points. The August post called for reviewers to be "accredited and selected through documented, consistently applied criteria" and warned against "assessor shopping"; the September post asks assessors to "demonstrate relevant technical expertise" and does not mention accreditation or assessor selection. The August post said regulators "should receive complete reports and supporting evidence through protected channels"; the September post, confined to non-governmental assessors, names governance bodies or company boards as the recipients of confidential reports. The September post adds pre-registration of claims, a remediation period before publication, and lab-requested redactions that assessors may flag. The two documents address different settings — a statutory review system in August, voluntary engagements in September — and neither refers to the other.
The road ahead
The post closes by committing OpenAI to supporting independent assessors and to "establishing clearer, shared international standards — both through future laws and private governance institutions — for effective third party assessments." It states that "no one third party can or should comprehensively cover urgent frontier safety questions," that OpenAI will support "a diverse community of independent assessors," and that "we are in conversation with multiple third parties about proposals that align with the priority areas above." It names no assessor, budget or timetable.
The commitment follows reporting of September 14, 2026 that Sam Altman had committed OpenAI to giving independent evaluators employee-like access after Dario Amodei's pacing essay, without a named reviewer or start date (Source: theinformation.com; We Must Pace the Frontier (Amodei, September 2026)). The post does not use the term employee-like access.
Reception
PYMNTS reported the post on its publication day under the headline "OpenAI Recruits External Watchdogs to Police AI Risk," quoting its closing commitment (Source: Raw Sources/OpenAI - Priorities and principles for effective third party assessments (2026-09-22).md, verification record). No detailed independent assessment of the priorities or principles had been located as of September 23, 2026.
Provenance
Published at openai.com/index/priorities-principles-third-party-assessments/ on September 22, 2026, Safety tag, byline Lama Ahmad. Retrieved September 23, 2026 by the gap scan; the passage "We are in conversation with multiple third parties about proposals that align with the priority areas above" was confirmed in the fetched text, and OpenAI's misalignment-reporting-framework page lists the post under "Keep reading" with the same date. Confidence is medium: a first-party statement of intended practice, reported by one trade outlet, with no assessment yet conducted under it.
Relationships
- depends-on: Building Standards for the Next Phase of AI (OpenAI, September 2026) — linked as the shared international standards labs and assessors should operate under.
- related: Making AI Audits and Assessments Work (OpenAI Global Affairs, August 2026) — OpenAI's August 2026 principles for statutory audits and assessments, compared above.
- related: Our Framework for Reporting Model Misalignment (OpenAI, September 2026) — linked for misalignment incident investigations.
- related: OpenAI Preparedness Framework V.2 — the risk categories and thresholds priority area 3 would have assessed.
- related: Democratic Governance of Frontier AI: A blueprint for a federal framework (OpenAI, June 2026) — linked as the legislation OpenAI supports.
- related: Brief Independent Investigation of Agents' Behavior in the OpenAI / Hugging Face Incident (METR and Redwood Research, August 2026) — the independent incident investigation the post cites as a model without naming its authors.
- related: Safety Cases for Frontier AI — the safety-case definition the post's differs from.
- related: We Must Pace the Frontier (Amodei, September 2026) — the embedded-evaluator proposal to which OpenAI's access commitment was reported as a response.
- instance-of: Third-Party AI Assessment
- related: Safety Cases (Frontier AI), AI Incident Reporting, Chain-of-Thought Monitorability, Independent Verification Organizations (IVOs), Alignment Auditing
- related: Who Verifies the Frontier: Competing Architectures for Third-Party AI Assessment
- related: Lama Ahmad, METR, Redwood Research