Risk Reporting for Developers' Internal AI Model Use

Internal AI testing poses distinct risks that public deployment frameworks don't address. The paper notes that frontier AI companies deploy advanced models internally for weeks or months before public release—citing Anthropic's Mythos Preview as an example that was available internally for at least six weeks before announcement—creating a gap in existing safety oversight.

Multiple jurisdictions now legally require internal use risk reporting. California's SB 53, New York's RAISE Act, and the EU's General-Purpose AI Code of Practice all mandate that frontier developers create plans to manage internal risks and produce detailed risk reports documenting their safeguards and remaining hazards.

A unified reporting standard can help companies comply across different regulatory frameworks. The paper provides a harmonized standard for internal use risk reports that satisfies requirements across three major regulatory regimes, reducing compliance burden while maintaining consistent safety documentation.

Limited external visibility into internal model use makes risk reporting critical. Given the rapid pace of AI R&D automation and the opacity surrounding how companies use their most capable models internally, detailed and regular risk reporting may be one of the few available mechanisms to ensure risks are properly managed and monitored.

The guide targets both companies and regulators. It's designed primarily for evaluation and safety teams at frontier AI developers, but also serves regulators and auditors seeking to understand what adequate internal use risk reporting should look like.