OpenAI’s new priorities for third-party assessments are a fine start, but they lack teeth

OpenAI has released a list of priorities and principles aimed at governing its third-party model assessors, but industry experts caution that the guidelines lack any enforceable controls to ensure safety. This omission may hinder OpenAI's efforts to build trust with enterprise CIOs, as the goal may instead be to facilitate cooperation with competitors and regulators.

OpenAI's statement emphasizes its commitment to independent assessments, stating that they should challenge assumptions, identify risks, and reach independent conclusions about the effectiveness of safeguards. However, the document does not outline any enforcement mechanisms. Experts argue that while the guidelines establish useful expectations for independence and rigor, they do not compel OpenAI to adhere to specific scopes, publish adverse findings, or change deployment decisions.

The lack of enforceability makes the rules somewhat ineffective. Despite these concerns, Samantha Gloede, global head of risk services at KPMG, views the document as the beginning of a process that should transition toward accountability. Long-term trust in AI will ultimately depend on how companies respond when material risks are identified, and stakeholders will demand not only the ability to find issues but also clear evidence of corrective actions taken, independently validated and reflected in governance and deployment decisions.