OpenAI Publishes a Governance Framework for Its Frontier Models

OpenAI has published its Frontier Governance Framework, a public document that sets out how the company's safety and security practices line up with the legal requirements now landing on the most capable AI systems. The framework went live on 28 May.

The short version is that this is a compliance document, not a new safety policy. OpenAI's existing Preparedness Framework remains the foundation for how it judges and manages the most serious risks. The new document takes the relevant parts of that work and translates them into a structure aimed at specific regulatory obligations, while noting that some of its internal practices already go further than the law demands.

Two laws in particular

The framework is built around two emerging regimes. The first is California's Transparency in Frontier AI Act, the state disclosure law for large model developers. The second is the EU AI Act's Code of Practice for general-purpose AI. Writing a single document that answers to both is a sign of where the industry is heading: companies that once published voluntary safety charters are now drafting to satisfy statutes with teeth.

On substance, the document covers the risk areas you would expect from a frontier lab. It addresses cyber offense, chemical, biological, radiological and nuclear (CBRN) misuse, harmful manipulation, and loss of control over a system's behavior. Around those categories it describes model reporting, security risk management and incident response, and it builds in a channel for outside experts to weigh in, according to StartupHub's summary of the release.

Why the timing matters

The framework does not arrive in a vacuum. Regulators have grown noticeably more attentive to frontier capabilities over the past month. The UK's AI Safety Institute recently documented an AI model running a 32-step network intrusion in lab conditions, and Canadian privacy authorities found OpenAI in breach of national privacy law. Against that backdrop, a public governance document reads partly as genuine accountability and partly as a company getting its paperwork in order before someone else does it for them.

OpenAI says it expects the framework to keep changing as model capabilities, evaluation methods and regulatory requirements develop, and that it will update the text accordingly. That is the honest position. A static document would be obsolete within a release cycle. The harder question, which no framework can answer on its own, is whether the disclosures it promises will be specific enough to let outsiders check the company's work rather than simply take its word for it.