OpenAI Proposes Mandatory Federal Pre-Release Evaluations for Frontier Models via CAISI, With Annual Audits and Incident Reporting Requirements

What happened

Why it matters

• ·If adopted, the mandatory pre-release evaluation and annual third-party audit requirements would create a new compliance obligation for frontier model developers and, indirectly, for enterprise buyers who will need to verify that procured models have cleared federal evaluation before deployment in regulated contexts.
• ·The mandatory critical incident reporting element introduces a structured federal disclosure obligation that sits alongside and may conflict with state-level requirements such as those under the California SB 53 Foundation Model Safety and Security Protocol, forcing compliance teams in multi-jurisdiction environments to reconcile overlapping incident notification timelines and thresholds.
• ·Because OpenAI's proposal explicitly limits regulatory authority to block deployments, enterprise risk teams cannot assume that a CAISI-evaluated model is government-approved for all use cases; internal risk classification and pre-deployment vetting controls remain the primary safeguard against deploying models in contexts where harms could materialize.

Governance controls affected

What to do now

• ☐Map your current frontier model procurement process against the proposed CAISI pre-release evaluation requirement and identify which models in active use or pipeline would fall within scope of a mandatory federal evaluation regime.
• ☐Review your incident severity classification thresholds and disclosure workflows to assess whether your existing IRC-003 Incident Disclosure and Notification control can satisfy a mandatory federal critical incident reporting obligation as proposed, and identify any gaps in notification timelines or recipient scope.
• ☐Audit third-party AI vendor contracts to determine whether they currently require vendors to disclose pre-release evaluation status, audit outcomes, and transparency report findings, and update vendor contract requirements where those terms are absent.
• ☐Establish a regulatory monitoring workflow to track CAISI rulemaking activity, NIST standard updates, and any formal notice-and-comment processes that follow from this executive order response, assigning a named owner within the compliance function.
• ☐Brief the board AI risk committee on the emerging federal evaluation framework and the distinction between evaluation clearance and deployment authorization, clarifying that internal risk classification controls remain operative regardless of any federal pre-release process.

What to watch next

Compliance teams should monitor CAISI and NIST for any formal rulemaking, guidance documents, or pilot evaluation program announcements that follow from this executive order response, as those instruments will determine the binding scope and timeline of any pre-release evaluation obligation. The interaction between a federal evaluation framework and state-level requirements under the California SB 53 Foundation Model Safety and Security Protocol and the California Transparency in Frontier AI Act warrants close attention, particularly for organizations operating across jurisdictions. Congress may also respond with competing or complementary legislative proposals, and enforcement posture at the federal level on incident reporting will signal how quickly voluntary frameworks are likely to harden into binding obligations.