The framework establishes a four-tier risk scoring system applied to each frontier model before deployment, assessing cybersecurity, CBRN, persuasion, and autonomous replication risk; models classified as critical in any category are stated to be ineligible for deployment.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a pre-deployment gate that determines which model capabilities are made available to API operators and end users; a critical classification in any of the four assessed domains would result in that model being withheld from deployment under the stated policy.
Interpretive note: The document does not specify the methodology or verification process for risk classification, creating ambiguity about how consistently the tiered system is applied across model versions.
Under this provision, the capabilities of any OpenAI frontier model made available to users are subject to a pre-deployment risk assessment that may result in model features or entire models being withheld if classified as critical risk in cybersecurity, CBRN, persuasion, or autonomous replication domains.
Cross-platform context
See how other platforms handle Tiered Model Risk Classification System and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We assess each new model we develop using our Preparedness Framework, which evaluates risk across four categories: cybersecurity, chemical/biological/nuclear/radiological (CBRN) threats, persuasion, and autonomous replication and adaptation (ARA). Models are scored as low, medium, high, or critical risk in each category. We will not deploy a model that scores 'critical' in any category.— Excerpt from OpenAI's OpenAI Frontier Governance Framework
REGULATORY LANDSCAPE: This provision engages the EU AI Act's requirements for general-purpose AI models with systemic risk, which mandate risk assessments and adversarial testing before deployment for covered models. The European AI Office is the primary enforcement authority for GPAI systemic risk obligations. The provision also references alignment with California SB 1047 frameworks, though that legislation's applicability depends on whether successor measures are enacted. GOVERNANCE EXPOSURE: Medium. The risk classification system is an internal governance mechanism; its legal enforceability as a commitment to regulators or users is not established by this document. Compliance exposure arises if the framework's stated thresholds are not operationally implemented consistently or if the classification methodology is not subject to independent verification. JURISDICTION FLAGS: EU/EEA operators using OpenAI API services face the highest regulatory exposure as the EU AI Act's GPAI systemic risk provisions enter into force. California exposure depends on legislative developments. US federal exposure is currently limited to voluntary commitments. CONTRACT AND VENDOR IMPLICATIONS: Enterprise API operators should assess whether OpenAI's stated pre-deployment risk classification creates implicit representations about the safety properties of deployed models. Vendor due diligence should include review of how classification decisions are communicated to operators and what remedies exist if a previously available model is reclassified. COMPLIANCE CONSIDERATIONS: Compliance teams should map this classification system against their own AI risk assessment obligations under applicable law, particularly for EU-regulated entities. Contract review should assess whether API terms of service incorporate or reference these classification commitments and what obligations arise if a model's risk classification changes post-deployment.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a pre-deployment gate that determines which model capabilities are made available to API operators and end users; a critical classification in any of the four assessed domains would result in that model being withheld from deployment under the stated policy.
Under this provision, the capabilities of any OpenAI frontier model made available to users are subject to a pre-deployment risk assessment that may result in model features or entire models being withheld if classified as critical risk in cybersecurity, CBRN, persuasion, or autonomous replication domains.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.