OpenAI and Anthropic Agree on Safety Disclosure. Authority Is the Harder Question.

The proposal is not simply a call for tougher requirements. OpenAI argues that an inconsistent state patchwork could divert resources, particularly at startups and small companies, and slow deployment of advanced tools to government, critical-infrastructure defenders, allies and other trusted partners. That competitive and national-security rationale limits any claim that the company is advocating a single-purpose safety regime.

Anthropic’s Advanced AI Framework is more explicit about scope and enforcement. It proposes obligations only for developers whose models require more than 10²⁵ training FLOP and who either earn more than $500 million in annual AI-derived revenue or spend more than $1 billion annually on AI research and development. The thresholds are meant to reach very large developers, not every business that uses or builds AI; the framework says the capability threshold may need to change if dangerous capabilities become cheaper to train.

Those covered developers would test and describe risks in four categories: biological weapons, offensive cyber operations, loss of control and automated research and development. The company proposes a public safety framework, a risk report at least every six months, and a system card when a covered model released for general access is materially more capable—or released with materially weaker safeguards—than comparable prior models. It would require reporting a defined critical safety incident to the designated agency within 15 days of discovery or facts that give the developer reasonable grounds to believe one occurred.

Anthropic’s proposed conditions for agency review and remedies. Source: Anthropic.

Outside review is proposed, not yet a settled institution

Anthropic says self-assessment is insufficient, but it also writes that “a mature independent evaluation ecosystem does not yet exist.” Within six months of a regulation taking effect, it proposes that covered developers regularly engage at least one qualified independent evaluator.

The proposed evaluator would receive unredacted risk reports and system cards, access to the developer’s most capable models, and the opportunity to ask questions. It would publish a review addressing the quality of the developer’s analysis, the materiality of public redactions and any disagreement with its risk conclusions. The framework also recognizes the incentives that can defeat that design: it suggests standards or licensing, pooled or public funding, conflict disclosures, and even random assignment of highly rated evaluators in high-stakes cases to reduce evaluator shopping.

That is a material constraint, not a procedural footnote. A rule can require comparable disclosures, but the disclosures do not independently establish whether safeguards are adequate. The proposal’s credibility depends on reviewers having access, technical competence and financial independence from the companies they examine.

Anthropic goes further than a disclosure-only model by outlining possible enforcement. An agency could review missing or inadequate reports, an evaluator’s independence and access, or a finding that a deployed model poses significant catastrophic risk even after safeguards. Possible remedies include fines, a bar on deploying further covered models until violations are corrected, and—in extreme cases—restrictions on models already deployed. But the framework presents those as options and pairs them with limits such as court enforcement, defined grounds for action, consistent treatment and judicial review. It does not resolve the tradeoff between weak enforcement and overly broad regulatory power.

Illinois tests compliance, not deployment readiness

Illinois’ law, as reported at the signing, applies to large model developers that generate more than $500 million in annual revenue and use massive computing power. It requires a published framework for identifying and assessing “catastrophic risk,” defined in the report as the likelihood of incidents causing death or serious injury to more than 50 people or more than $1 million in property damage.

Qualifying developers must report an incident that could harm Illinois within 72 hours of identifying it, or within 24 hours when it presents an imminent risk of death or serious physical injury. The attorney general can seek civil penalties of up to $1 million for a first violation and up to $3 million for subsequent violations. The law takes effect Jan. 1, 2028.

Its annual third-party audit requirement is the distinguishing feature among the state measures discussed in the report: New York’s comparable law required a single independent audit once developers became large enough to qualify. But annual review does not turn the Illinois audit into an assessment of whether a model should be in the world. Scott Wisor, policy director at Secure AI, which helped shape the Illinois bill, described the present test this way:

“Right now, the evaluation in this bill is, are you complying with your safety framework?”

Wisor’s point was that a developer could follow its stated steps and still release a risky system. TechNet, a coalition of technology executives, raised a different implementation concern during legislative debate: the law would ask private actors to make subjective safety-compliance determinations without established national standards, certifications or clear regulatory guardrails.

The state law therefore supplies a test of disclosure, timelines and audit practice—not evidence that either an audit or a published framework can settle the deployment decision. Its broader influence is also an estimate, not a measured national share: lawmakers said California, New York and Illinois represent roughly 40% of the U.S. AI market while accounting for roughly 20% of the population.

The federal choice is about consequences

OpenAI and Anthropic do share a federal-state boundary. OpenAI wants national capacity for the most demanding frontier-model testing. Anthropic says Congress should not preempt state law unless it enacts a rigorous federal regime that meets or exceeds the framework’s strongest catastrophic-risk measures; even then, it recommends narrow preemption limited to specified frontier-governance functions, including testing, evaluator licensing and closely related reporting. Outside those functions, it says states should retain authority.

The next evidence to watch is more concrete than competing statements of principle: the scope, testing standards, timelines and consequences in the promised federal cyber-testing framework; whether evaluators can obtain and protect the access they need; and whether lawmakers give an agency authority to act when an evaluation finds inadequately mitigated risk. Until those decisions are made, disclosures and compliance audits can make safety claims easier to examine, but they cannot answer who is empowered to prevent deployment.