Practices
What do standards and provider frameworks expect of a frontier model, and who documents it?
Each practice opens to show what names it, which providers document it and whether an outside party does. A provider count is out of the providers we read. "Emerging" marks a practice that providers document and no standard we store names; "not yet matched" marks one we have not matched against the standards' items, so we cannot say whether a standard names it.
Governance
Framework · 5 of 20 providers; no outside party
The provider publishes a safety or preparedness framework that defines capability thresholds or levels.
What names it: required by EU GPAI Code of Practice
- Google DeepMind: 32 of the 50 versions we read in full state it
- OpenAI: 32 of the 33 versions we read in full state it
- Anthropic: 21 of the 21 versions we read in full state it
- Meta: 6 of the 8 versions we read in full state it
- xAI: 3 of the 4 versions we read in full state it
No outside party's own document that we read states it; only provider documents do.
Thresholds not yet matched to the standards · 5 of 20 providers; no outside party
The release's documentation states, for this model version, whether a capability threshold level is crossed, not crossed or undetermined.
- Google DeepMind: 15 of the 50 versions we read in full state it
- OpenAI: 14 of the 33 versions we read in full state it
- Anthropic: 20 of the 21 versions we read in full state it
- Meta: 4 of the 8 versions we read in full state it
- xAI: 2 of the 4 versions we read in full state it
No outside party's own document that we read states it; only provider documents do.
Incident disclosure · no provider document we read states it
A stated commitment to report or publish serious safety incidents, to a regulator or publicly.
What names it: required by EU GPAI Code of Practice, NIST AI RMF
Pre-release access · 3 of 20 providers; 2 outside parties
A government body or independent third party had access to the model before release.
What names it: required by EU GPAI Code of Practice
- OpenAI: 1 of the 33 versions we read in full states it; 1 stated by an outside party
- Anthropic: 6 of the 21 versions we read in full state it; 2 stated by an outside party
- Moonshot AI: 1 of the 4 versions we read in full states it; 1 stated by an outside party
Outside parties whose own documents state it: SecureBio, US CAISI (NIST).
Testing
Chemical, biological, radiological and nuclear · 8 of 20 providers; 5 outside parties
A named test, evaluation or exercise on this version in the CBRN domain was carried out or its result reported.
What names it: named by EU GPAI Code of Practice
- Google DeepMind: 4 of the 50 versions we read in full state it; 2 stated by an outside party
- OpenAI: 10 of the 33 versions we read in full state it; 6 stated by an outside party
- Anthropic: 17 of the 21 versions we read in full state it; 3 stated by an outside party
- DeepSeek: 1 of the 10 versions we read in full states it; 1 stated by an outside party
- Meta: 3 of the 8 versions we read in full state it
- Z.ai (Zhipu AI): 1 of the 7 versions we read in full states it; 1 stated by an outside party
- Moonshot AI: 1 of the 4 versions we read in full states it; 1 stated by an outside party
- xAI: 1 of the 4 versions we read in full states it
Outside parties whose own documents state it: FAR.AI, RAND (CAST / Project Canary), SaferAI, SecureBio, US CAISI (NIST).
Cyber · 8 of 20 providers; 6 outside parties
A named test, evaluation or exercise on this version in the cyber domain was carried out or its result reported.
What names it: named by EU GPAI Code of Practice
- Google DeepMind: 4 of the 50 versions we read in full state it
- OpenAI: 9 of the 33 versions we read in full state it; 3 stated by an outside party
- Anthropic: 16 of the 21 versions we read in full state it; 4 stated by an outside party
- DeepSeek: 1 of the 10 versions we read in full states it; 1 stated by an outside party
- Meta: 3 of the 8 versions we read in full state it
- Z.ai (Zhipu AI): 1 of the 7 versions we read in full states it; 1 stated by an outside party
- Moonshot AI: 1 of the 4 versions we read in full states it; 1 stated by an outside party
- xAI: 1 of the 4 versions we read in full states it
Outside parties whose own documents state it: Epoch AI, METR, Redwood Research, SaferAI, UK AI Security Institute, US CAISI (NIST).
Autonomy not yet matched to the standards · 7 of 20 providers; 3 outside parties
A named test, evaluation or exercise on this version in autonomy and replication was carried out or its result reported.
- Google DeepMind: 3 of the 50 versions we read in full state it
- OpenAI: 4 of the 33 versions we read in full state it; 2 stated by an outside party
- Anthropic: 14 of the 21 versions we read in full state it; 2 stated by an outside party
- Meta: 2 of the 8 versions we read in full state it
- MiniMax: 1 of the 7 versions we read in full states it
- Z.ai (Zhipu AI): 1 of the 7 versions we read in full states it; 1 stated by an outside party
- Thinking Machines Lab: 2 of the 3 versions we read in full state it
Outside parties whose own documents state it: METR, Redwood Research, SaferAI.
Deception not yet matched to the standards · 8 of 20 providers; 7 outside parties
A named test, evaluation or exercise on this version in deception and sabotage was carried out or its result reported.
- Google DeepMind: 6 of the 50 versions we read in full state it; 3 stated by an outside party
- OpenAI: 6 of the 33 versions we read in full state it; 3 stated by an outside party
- Anthropic: 18 of the 21 versions we read in full state it; 7 stated by an outside party
- DeepSeek: 1 of the 10 versions we read in full states it; 1 stated by an outside party
- Meta: 3 of the 8 versions we read in full state it; 1 stated by an outside party
- Z.ai (Zhipu AI): 1 of the 7 versions we read in full states it; 1 stated by an outside party
- xAI: 3 of the 4 versions we read in full state it
- Thinking Machines Lab: 2 of the 3 versions we read in full state it
Outside parties whose own documents state it: Apollo Research, METR, RAND (CAST / Project Canary), Redwood Research, SaferAI, Transluce, UK AI Security Institute.
Misuse not yet matched to the standards · 9 of 20 providers; 6 outside parties
A named test, evaluation or exercise on this version in misuse and jailbreak was carried out or its result reported.
- Google DeepMind: 13 of the 50 versions we read in full state it
- OpenAI: 5 of the 33 versions we read in full state it; 3 stated by an outside party
- Anthropic: 13 of the 21 versions we read in full state it; 3 stated by an outside party
- InclusionAI (Ant Group): 1 of the 18 versions we read in full states it
- DeepSeek: 1 of the 10 versions we read in full states it; 1 stated by an outside party
- Meta: 3 of the 8 versions we read in full state it
- Z.ai (Zhipu AI): 1 of the 7 versions we read in full states it; 1 stated by an outside party
- Moonshot AI: 1 of the 4 versions we read in full states it; 1 stated by an outside party
- xAI: 1 of the 4 versions we read in full states it; 1 stated by an outside party
Outside parties whose own documents state it: FAR.AI, RAND (CAST / Project Canary), SaferAI, SecureBio, UK AI Security Institute, US CAISI (NIST).
Harmful content not yet matched to the standards · 4 of 20 providers; 2 outside parties
A named test, evaluation or exercise on this version in harmful content was carried out or its result reported.
- Google DeepMind: 14 of the 50 versions we read in full state it
- OpenAI: 2 of the 33 versions we read in full state it; 1 stated by an outside party
- Anthropic: 16 of the 21 versions we read in full state it; 1 stated by an outside party
- Meta: 1 of the 8 versions we read in full states it
Outside parties whose own documents state it: SaferAI, Transluce.
Prompt injection not yet matched to the standards · 3 of 20 providers; 1 outside party
A named test, evaluation or exercise on this version in injection and agentic risks was carried out or its result reported.
- OpenAI: 5 of the 33 versions we read in full state it; 1 stated by an outside party
- Anthropic: 13 of the 21 versions we read in full state it
- Meta: 3 of the 8 versions we read in full state it
Outside parties whose own documents state it: UK AI Security Institute.
Bias not yet matched to the standards · 3 of 20 providers; no outside party
A named test, evaluation or exercise on this version in bias was carried out or its result reported.
- OpenAI: 2 of the 33 versions we read in full state it
- Anthropic: 12 of the 21 versions we read in full state it
- Meta: 1 of the 8 versions we read in full states it
No outside party's own document that we read states it; only provider documents do.
Privacy not yet matched to the standards · 4 of 20 providers; 2 outside parties
A named test, evaluation or exercise on this version in privacy was carried out or its result reported.
- Google DeepMind: 2 of the 50 versions we read in full state it; 2 stated by an outside party
- OpenAI: 1 of the 33 versions we read in full states it
- Anthropic: 1 of the 21 versions we read in full states it
- Meta: 1 of the 8 versions we read in full states it
Outside parties whose own documents state it: Apollo Research, Transluce.
Safeguards
Safety training · 2 of 20 providers; no outside party
Training that changes the model itself so that it declines requests the provider's policy forbids.
What names it: recommended by EU GPAI Code of Practice; named by MITRE ATLAS, OWASP Top 10 for LLM
- OpenAI: 3 of the 33 versions we read in full state it
- Anthropic: 2 of the 21 versions we read in full state it
No outside party's own document that we read states it; only provider documents do.
Agent limits · no provider document we read states it
Limits on what an agent may do: tools it can call, systems it can reach, actions it can take, usually in an isolated environment.
What names it: required by EU GPAI Code of Practice; named by MITRE ATLAS, OWASP Top 10 for LLM
Human approval · 1 of 20 providers; no outside party
A requirement that a person confirm before an agent takes an action the provider classes as high-risk.
What names it: named by MITRE ATLAS, OWASP Top 10 for LLM
- InclusionAI (Ant Group): 1 of the 18 versions we read in full states it
No outside party's own document that we read states it; only provider documents do.
Misuse monitoring · 1 of 20 providers; no outside party
Watching how a deployed model is used for patterns the usage policy forbids, and acting on what is found.
What names it: required by EU GPAI Code of Practice; named by MITRE ATLAS
- Google DeepMind: 1 of the 50 versions we read in full states it
No outside party's own document that we read states it; only provider documents do.
Reasoning monitor · no provider document we read states it
Reading a model's intermediate reasoning, by people or another model, for signs of deception or misbehaviour.
What names it: recommended by EU GPAI Code of Practice
Staged access · 1 of 20 providers; no outside party
Releasing a model in stages or to vetted users only: limited preview, identity checks, trusted-access programmes.
What names it: recommended by EU GPAI Code of Practice; named by MITRE ATLAS
- Anthropic: 2 of the 21 versions we read in full state it
No outside party's own document that we read states it; only provider documents do.
Provenance · no provider document we read states it
Marking or signing what a model produces so it can later be identified as machine-made.
What names it: recommended by EU GPAI Code of Practice; named by OWASP Top 10 for LLM
Telemetry · no provider document we read states it
Recording model and agent activity in a form that supports investigation and audit.
What names it: recommended by EU GPAI Code of Practice; named by MITRE ATLAS, OWASP Top 10 for LLM
Vulnerability disclosure · no provider document we read states it
A programme for outsiders to report safety or security flaws, with rewards or protections.
What names it: required by EU GPAI Code of Practice
Third-party review · no provider document we read states it
Outside parties are given access to attack or test the model during development.
What names it: required by EU GPAI Code of Practice
No standard we store and no provider document we read names: Domain safeguards.
Standards we store
We do not store the text of: MITRE ATLAS, NIST AI RMF, EU GPAI Code of Practice, OWASP Top 10 for LLM.
Not shown for now: Input and output classifiers, Prompt-injection defence, Weight and model security. A second, blind reading of which sentences belong to these practices disagreed with the first too often, so their counts are held back until the matching is reviewed.
Compiled from MITRE ATLAS, NIST AI RMF, EU GPAI Code of Practice, OWASP Top 10 for LLM and the safety frameworks providers publish. A practice is attached to a standard where the standard's own stored text names it; for safeguards, the sentence is shown on the control's page. The match was made by a model reading those sentences and is shown as made, not reviewed by a person. "Documented by" counts providers whose model documents state the practice; a practice a provider's documents do not state is not shown as absent.
Every item of each stored standard is listed here or matched above. An unmatched item may be outside the scope of model documentation (for example an organisation's own governance), or a practice we do not yet track.