Regulation & Policy
Preparedness Framework
Also known as: OpenAI Preparedness Framework
The Preparedness Framework is OpenAI's published approach to identifying, measuring and mitigating severe risks from its frontier models. It sets out tracked risk categories, capability thresholds that trigger safeguards, and the internal governance process for deciding whether a model can be developed or deployed. It is a voluntary company policy rather than a legal requirement.
What it is
The framework describes how OpenAI evaluates models for dangerous capabilities in areas such as biological and chemical uplift, cybersecurity and self improvement or autonomy. Models are assessed against defined capability levels, and reaching a level obliges the company to have specific safeguards in place before further development or release. Decision rights sit with internal safety bodies and leadership, with oversight by the board.
Why it matters
Frontier safety policies shape what models can do in public, which features are gated, and how quickly capabilities reach customers. If you build products on a provider's API, these policies help explain refusals, usage restrictions, staged rollouts and regional differences. They also feed into enterprise procurement, because buyers increasingly ask suppliers to show how model risks are assessed.
How it works
Teams run evaluations and red teaming against the tracked categories, document findings in system or model cards, and compare results with the thresholds in the framework. Where a threshold is met, safeguards such as refusal training, monitoring, access controls or deployment limits are required before proceeding. External readers use the published framework and accompanying system cards to compare providers and to inform their own risk registers.
When it applies
It applies when you are assessing or procuring frontier models, writing internal AI risk documentation, or explaining why a model's behaviour and availability are constrained in certain domains.
Examples
- A procurement team maps a supplier's system card against its own risk register before approving an AI feature for launch.
- A product manager traces a persistent refusal in a chemistry use case back to a documented high risk category and designs a human review step instead.
- A policy analyst compares several frontier safety policies to see which risk categories each provider tracks.
How it is measured
- Coverage of tracked risk categories evaluated before each model release
- Presence and completeness of published system or model cards for models you depend on
- Time between an internal capability finding and the corresponding safeguard being live
- Number of deployment restrictions or feature gates affecting your own use cases
Insights on Preparedness Framework
Related terms in Regulation & Policy
- AI complianceAI compliance is the work of making sure AI systems meet the laws, regulations, standards and internal policies that apply to them. It spans data protection, transparency, risk classification, documentation, human oversight and record keeping across the life of a system. In practice it combines legal interpretation, engineering controls and ongoing evidence gathering.
- AI governanceAI governance is the set of policies, roles, controls and review processes an organisation uses to manage how AI systems are built, bought and used. It covers risk assessment, documentation, human oversight, data handling and accountability. It applies both to AI a company develops and to third-party AI tools used by staff.
- AI privacyAI privacy is the set of practices, rights and obligations that govern how personal data is collected, used, stored and exposed when building or using AI systems. It covers training data, prompts and outputs, retention by AI vendors, and the transparency and control offered to the people whose data is involved. For marketing teams it shapes what customer data can safely be put into AI tools and what must be disclosed.
- AI safetyAI safety is the practice of designing, testing and operating AI systems so they cause less harm, behave predictably and resist misuse. It covers alignment with intended behaviour, evaluation and red teaming, content guardrails, and monitoring once a system is live. For marketers it shapes what models will say, how assistants handle brands, and what compliance teams expect before AI tools go into production.
- AI transparencyAI transparency is the practice of making clear how an AI system works, what sits behind it, and when content or an interaction involves AI. It covers regulatory disclosure duties as well as voluntary explanations such as model cards, labels on synthetic media and citations in AI generated answers. For publishers and marketers it sets expectations about when AI involvement should be declared and how clearly.
- Competition and Markets AuthorityThe Competition and Markets Authority (CMA) is the United Kingdom's competition and consumer protection regulator. It investigates mergers, anti-competitive conduct and market practices, and it holds specific powers over large digital firms under the Digital Markets, Competition and Consumers Act 2024. Its decisions shape how search engines, app stores and AI assistants operate in the UK market.
Primary research · August 2026
How ChatGPT Shortlists Software Brands
An audit across 10 categories and 60 buying questions. I recorded what ChatGPT reads, throws away and links to when a buyer asks it which software to buy, and what that decides.
- 60
- Questions asked
- 10
- Software markets
- 2,680
- Results read
- 367
- Links shown
Free download
Get the full report
35 pages · PDF · 536 KB. Enter your details and it downloads straight away.