The Containment Board

A published frontier safety framework: which severe risks it covers (chemical, biological, radiological and nuclear, cyber, loss of control, automated research), how specific its capability thresholds are, what safeguards each threshold requires, who decides, and who checks.

• A

  Published framework covering all major severe risk domains with measurable thresholds, pre-committed safeguards at each level, clear risk acceptance criteria, named decision authority with independent oversight, outside audit of compliance, and regular updates.

• B

  Detailed published framework covering most major domains with defined thresholds and required safeguards, but thresholds are largely qualitative, some commitments are discretionary or depend on competitors, or independent oversight is limited.

• C

  Published framework with narrow scope, few or vague thresholds, mostly discretionary language, or commitments weakened from earlier versions.

• D

  No framework of its own; the lab has only signed voluntary pledges such as the Seoul Frontier AI Safety Commitments, the EU General-Purpose AI Code of Practice or China's CAICT commitments.

• F

  No framework and no signed safety commitments found.

Testing of the latest flagship model before release by government institutes (US CAISSI, the UK AI Security Institute) and independent third parties (such as METR, Apollo Research, SecureBio, Irregular), the depth of their access, and whether results are published.

• A

  Flagship tested before release by a government institute and by independent third parties with deep access (unmitigated or helpful-only checkpoints), with findings published in the evaluators' own words and freedom to publish.

• B

  Pre-release testing by a government institute or by several named independent third parties with direct model access, documented with results, but with company-written summaries, limited access detail or short testing windows.

• C

  Limited outside pre-release testing or review (unnamed red teamers, a single contracted study, review of company results rather than model access), or thin reporting.

• D

  A commitment to outside testing exists (own framework or signed pledge), but no evidence of pre-release outside testing of the flagship.

• F

  No commitment and no evidence of pre-release outside testing. Government testing after release without the lab's involvement is noted but earns no credit.

Public commitments and evidence on shutdown: pausing training or deployment when thresholds are crossed, kill switches and the authority to stop workloads, control evaluations and monitoring of internal deployment, and the record when something went wrong.

• A

  Unconditional public commitment to pause development and deployment when thresholds are crossed without adequate safeguards, published control evaluations and internal monitoring with authority to halt, and a public record of using it.

• B

  Firm deployment gates plus either an unconditional pause pledge or published internal monitoring and control measures, but the pause pledge depends on competitors, was weakened, or has never been tested in public.

• C

  Deployment gate only (will not deploy until mitigated), with no development pause and no control evaluations, or a pause commitment replaced with 'develop with mitigations'.

• D

  Discretionary language only ('may shut down', 'as appropriate'), or a signed pledge not to develop or deploy with no published thresholds that would trigger it.

• F

  No public commitment found.

Whether the lab tells the public what goes wrong: system cards that report misbehavior (deception, sabotage, reward hacking, evaluation awareness), public incident reports, misuse and transparency reports, and a documented process for reporting critical incidents to government under California SB 53, the EU AI Act or similar rules.

• A

  Detailed system cards for each frontier release that report misbehavior and outside findings, prompt public technical reports on serious incidents, regular misuse or threat reports, and a documented government reporting process.

• B

  Detailed system cards and a stated incident process, with gaps such as no incident write-ups, late disclosure or summaries only.

• C

  Model cards or technical reports with limited safety content and a general incident process.

• D

  Minimal safety documentation; incident reporting only where the law requires it.

• F

  No safety documentation or incident disclosure found.

A published whistleblower policy that covers safety concerns, anonymous channels, escalation outside management, anti-retaliation terms, use of non-disparagement agreements, published outcomes, and any credible controversies in the last 24 months.

• A

  Public standalone policy covering safety and framework noncompliance, anonymous two-way channel, escalation to the board or an outside ombudsperson, anti-retaliation, no non-disparagement terms that block safety disclosures, published outcome statistics, and no credible retaliation controversy in 24 months.

• B

  Public policy covering safety concerns with anonymous reporting and anti-retaliation, missing one or two A elements, and no unresolved credible controversy in 24 months.

• C

  Only a general corporate code of conduct or framework clause with a reporting channel and anti-retaliation language, or a B-level policy weighed down by a credible recent controversy.

• D

  A policy is said to exist but is not public, or there is a credible recent controversy involving suppression of disclosures, such as enforcing a non-disparagement agreement against a former employee.

• F

  No whistleblower policy or reporting channel found in public sources.