Risk Reporting for Developers' Internal AI Model Use
Oscar Delaney, Sambhav Maheshwari, Joe O'Brien, Theo Bearman, Oliver Guest
Why It Matters
What makes this one worth your time
As AI models become more capable, understanding and managing the risks associated with their internal deployment is crucial for safety and compliance.
A guide for developers to manage risks of internal AI model use through standardized reporting.
Summary
The paper proposes a standardized framework for risk reporting related to the internal use of advanced AI models by developers, addressing regulatory requirements and safety concerns.
Key contributions
- Development of a harmonized standard for internal use risk reports.
- Identification of key threat vectors and risk factors relevant to internal AI model use.
- Guidance for evaluation and safety teams on effective risk management.
Notable insights
- The framework focuses on two specific threat vectors: autonomous AI misbehavior and insider threats, which are often overlooked in traditional risk assessments.
- The emphasis on harmonizing reporting standards across multiple regulatory frameworks could facilitate better compliance and risk management practices.
Possible limitations
- Not stated in the abstract.
Abstract
arXiv:2604.24966v1 Announce Type: cross Abstract: Frontier AI companies first deploy their most advanced models internally, for weeks or months of safety testing, evaluation, and iteration, before a possible public release. For example, Anthropic recently developed a new class of model with advanced cyberoffense-relevant capabilities, Mythos Preview, which was available internally for at least six weeks before it was publicly announced. This internal use creates risks that external deployment frameworks may fail to address. Legal frameworks, notably California's Transparency in Frontier Artificial Intelligence Act (SB 53), New York's Responsible AI Safety And Education (RAISE) Act, and the EU's General-Purpose AI Code of Practice, all discuss risks from internal AI use. They require frontier developers to make and implement plans for how to manage risks from internal use, and to produce internal use risk reports describing their safeguards and any residual risks. This guide provides a harmonized standard for companies to produce internal use risk reports suitable for all three regulatory frameworks. It is addressed primarily to evaluation and safety teams at frontier AI developers, and secondarily to regulators and auditors seeking to understand what good reporting looks like. Given the pace of AI R&D automation and the limited external visibility into how companies use their most capable models internally, regular and detailed risk reporting may be one of the few mechanisms available to ensure that the risks from internal AI use are identified and managed before they materialize. Whenever a substantially more capable or riskier model is deployed internally, the developer should create a risk report and argue why the model is safe to deploy. We structure the reporting framework around two threat vectors -- autonomous AI misbehavior and insider threats -- and three risk factors for each: means, motive, and opportunity.