International AI Safety Report 2026

Key information

• General-purpose AI risk management comprises a range of practices used to identify, assess, and reduce risks from general-purpose AI. These include model-level testing and evaluation (such as ‘red-teaming’), organisational processes guiding development and release decisions, conditional safeguards (such as ‘if-then’ commitments), and incident reporting.

• Several AI developers have produced Frontier AI Safety Frameworks. These frameworks include information about risk assessments and specify conditional measures such as access restrictions companies plan to implement for more capable models. They vary in the risks they cover, how they define capability thresholds, and what actions are triggered when thresholds are reached.

• Evidence on the real-world effectiveness of AI risk management practices remains limited. Lack of incident reporting and monitoring makes it difficult to assess how well current practices reduce risks or how consistently they are implemented.

• Since the publication of the last Report (January 2025), risk management has become more structured through new industry and governance initiatives. New instruments such as the EU’s General-Purpose AI Code of Practice, China’s AI Safety Governance Framework 2.0, and the G7’s Hiroshima AI Process Reporting Framework, together with company-led initiatives, illustrate the trend towards more standardised approaches to transparency, evaluation, and incident reporting.

• Key challenges for policymakers include prioritising among the diverse risks posed by general-purpose AI, and clarifying which actors across the AI value chain are best positioned to mitigate them. These challenges are compounded by limited visibility into how risks are identified, evaluated, and managed in practice, as well as fragmented information sharing between developers, deployers, and infrastructure providers.

AI risk management comprises a range of practices that aim to identify, assess, and reduce the likelihood and severity of risks associated with AI systems. These practices can be implemented by AI developers, deployers, evaluators, and regulators. Examples include threat modelling, risk tiering, red-teaming, auditing, and incident reporting. This section outlines current risk management practices, new developments, and remaining limitations.

Since the start of 2025, several new international initiatives for general-purpose AI risk management have developed, including organisational transparency and risk reporting frameworks as well as regulatory and governance frameworks. Remaining challenges include limited standardisation, which complicates compliance and assessment, and limited evidence regarding real-world effectiveness. Further, institutional, cultural, and political contexts differ globally, which implies that approaches to identifying and managing risks, including acceptable risk thresholds, may vary across regions.

This section’s discussion of risk management approaches is descriptive: it aims to inform actors in the AI ecosystem about current global approaches to risk management. Where available, evidence on the effectiveness and limitations of these approaches is discussed, but policy recommendations are outside the scope of this work.

Components of risk management

Risk management is an iterative process with practices and methods that span the entire AI development and deployment cycle, but which work together coherently. Risk management for general-purpose AI can include roles for a wide range of actors including data scientists, model engineers, auditors, domain experts, executives, end users, impacted communities, third-party suppliers, policymakers, governments, standards organisations, and civil society organisations. Leading risk management standards are often interoperable, but use different terminology to describe the elements of risk management. They typically have four interconnected components (Figure 3.4): identifying; analysing and evaluating; mitigating; and governing risk. The tables below provide illustrative examples of relevant methods, techniques, and tools. Practices continue to evolve, so the tables are not exhaustive, and applicability will vary across contexts.

Risk identification

Risk identification is the process of finding, recognising, and describing risks. Comprehensive risk identification typically encompasses capability-driven assessments, which test whether models possess specific dangerous capabilities, as well as risk modelling and forecasting, which are used to explore existing and emerging risks. Table 3.1 provides various examples of risk identification practices. Risk identification also draws on engagement with relevant experts and communities to understand the broader context of how risks emerge. Mechanisms such as bug bounty programmes can support this process by incentivising the identification of previously unknown vulnerabilities (Table 3.1). A key goal of risk identification is to account for both well-known, well-understood risks and potential future risks that remain uncertain or poorly characterised. This is particularly important for general-purpose AI, where many risks may not yet be fully understood or observable.

Threat modelling and risk taxonomies are prominent risk identification methods

Two prominent methods for identifying the risks from general-purpose AI are threat modelling (a structured process for mapping how AI-related risks may materialise) and risk taxonomies. Meta, for example, uses threat modelling exercises to anticipate potential misuse scenarios of its AI models, and Anthropic includes threat modelling as part of its ASL-3 Deployment Standard. AI risk and hazard taxonomies, which list risk categories and examples, can equally serve as a starting point to conceptualise, identify, and specify the salient risks associated with general-purpose AI in specific application domains.

Risk analysis and evaluation

Risk analysis and evaluation is the process of determining the level of risk of an AI model or system and comparing it against established criteria to assess acceptability or the need for mitigation. It includes practices such as measuring model performance on benchmarks and evaluations. conducting red-teaming exercises, impact assessments, and audits. See Table 3.2 for examples of general-purpose AI risk analysis and evaluation. The methods are designed to support analysis and evaluation for many different risk types simultaneously.

Key goals of risk analysis and evaluation are carrying out evaluations of model capabilities and vulnerabilities, leveraging robust risk modelling to inform decisions about risk thresholds, and understanding how AI systems are used in practice in order to assess downstream societal impacts. Risk analysis and evaluation processes are often considered to be more likely to identify risks when they incorporate independent review, draw on cross-sector expertise, and include diverse perspectives from multiple domains and disciplines, as well as from impacted communities.

Common risk analysis tools include benchmarks and model evaluations

Benchmarks and model evaluations are standardised tests to assess general-purpose AI systems’ performance on specific tasks. Researchers have developed a broad range of benchmarks and evaluations, including sets of challenging multiple choice questions, software engineering problems, and work-related tasks in simulated office environments. Harmful capability evaluations are used to assess whether a general-purpose AI model or system has particularly dangerous knowledge or skills, such as the ability to aid in cyberattacks (see §2.1.3. Cyberattacks).

Highly consequential decisions by companies and governments about model releases partially rely on these evaluations. However, benchmarks significantly vary in quality and scope, and it can be difficult to judge their validity due to numerous shortcomings in benchmarking practices. For example, benchmarks can become ‘saturated’ – when many models’ scores approach the top score – meaning they no longer strongly distinguish between models. Models are also increasingly likely to identify certain tasks as evaluations and display different behaviours than they would on similar tasks in deployment contexts due to ‘situational awareness’ (see §2.2.2. Loss of control). Finally, benchmarks and evaluations have well-documented limitations: notably, they fail to capture risks associated with general-purpose AI use in new domains and for novel tasks, as test conditions differ from real-world usage to varying degrees (see §1.2. Current capabilities and §3.1. Technical and institutional challenges).

Red-teaming allows for more domain-specific assessments of risk

Another common method for assessing risks is red-teaming. A ‘red team’ is a group of evaluators tasked with searching for vulnerabilities, limitations, or potential for misuse. Red-teaming can be domain-specific and performed by domain experts, or open-ended to explore new risk factors. For example, a red team might explore ‘jailbreaking’ attacks that subvert the model’s safety restrictions. In contrast to benchmarks, a key advantage of red-teaming is that red teams can adapt their evaluations to the specific system being tested. For example, red teams can design custom inputs to identify worst-case behaviours, malicious use opportunities, and unexpected failures. However, it can require special access to models and may fail to surface important classes of risks.

Importantly, the absence of identified risks does not imply that those risks are low: prior work shows that bugs frequently evade detection, particularly when red teams have limited access or resources. Research has also called into question whether red-teaming can produce reliable and reproducible results. The composition of the red team and the instructions provided to red-teamers, the number of attack rounds, and the model’s access to tools can significantly influence the outcomes, including the risk surface covered. Comprehensive guidelines on red-teaming aim to address some of these challenges.

Risk mitigation

Risk mitigation is the process of prioritising, evaluating, and implementing controls and countermeasures to reduce identified risks. Examples are access controls, continuous monitoring, and if-then commitments. Mitigating risk raises a key question: what is the acceptable level of risk? Recent frameworks and company policies have begun to formalise ‘risk acceptance’ criteria. However, setting appropriate thresholds remains challenging especially for risks with wide societal impacts. No established mechanism currently exists for validating risk acceptance decisions made by developers prior to release.

The risk mitigation methods described in Table 3.3 below are adaptable and can mitigate a range of risks, including some unexpected risks. The table does not include technical mitigation methods such as adversarial training, content filters, and chain-of-thought monitoring. These are covered in §3.3. Technical safeguards and monitoring, as well as throughout the Report in the ‘Mitigations’ paragraphs for each risk in §2. Risks.

Defence-in-depth and release strategies are important mitigation tools

A ‘defence-in-depth’ model can support general-purpose AI risk management. In this context, ‘defence-in-depth’ refers to a combination of technical, organisational, and societal measures applied across different stages of development and deployment (Figure 3.5). This means creating layers of independent safeguards, so that if one layer fails, other layers can still prevent harm. A commonly cited example of a defence-in-depth model is the range of preventative measures that are deployed to prevent infectious diseases. Vaccines, masks, and hand-washing, among other measures, can reduce the risk of infection substantially in combination, even though none of these methods are 100% effective on their own. For general-purpose AI, defence-in-depth will include controls that are not on the AI model itself, but on the broader ecosystem. This includes (for example) controls on the materials needed to execute a biological attack such as reagents. However, defence-in-depth measures primarily address risks related to accidents, malfunction, and malicious use, and may play less of a role in managing systemic risks (see §3.5. Building societal resilience).

A company’s release and deployment strategy is an important component of risk mitigation. Decisions about how models are made available to users can substantially affect risk exposure. Different release and deployment options include staged release to limited user groups, access through controlled online services (such as APIs), and the use of licensing agreements and acceptable use policies that legally prohibit certain harmful applications. §3.4. Open-weight models discusses in more detail how releasing model weights affects risks.

Risk governance

Risk governance is the process by which risk management evaluations, decisions, and actions are connected to the strategy and objectives of an organisation or other entity. Table 3.4 provides an overview of common risk governance techniques. As shown in Figure 3.4, risk governance can be understood as the core of risk management as it facilitates the effective operation of other components of risk management. It provides accountability, transparency, and clarity that support informed risk management decisions. Risk governance can include practices such as incident reporting, risk responsibility allocation, and whistleblower protection. More broadly, risk governance may include guidance, frameworks, legislation, regulation, national and international standards, as well as training and educational initiatives. A key purpose of risk governance is to establish organisational policies and mechanisms that clarify how risk management responsibilities are allocated across an organisation or other entity, in order to support appropriate oversight and accountability.

Documentation and transparency are components of risk governance

Documentation and institutional transparency mechanisms, together with information-sharing practices, facilitate external scrutiny and support efforts to manage risks associated with general-purpose AI. It has become common practice to publish the results of pre-deployment tests in a ‘model card’ or ‘system card’, along with basic details about the model or system, including how it was trained and what its potential limitations are. Some developers also publish transparency reports that include details about their risk management practices more broadly. Other elements of documentation and transparency include monitoring and incident reporting and information sharing, which can be facilitated by third parties such as the Frontier Model Forum. Some regulatory frameworks, such as the EU AI Act or California’s Transparency in Frontier Artificial Intelligence Act - Senate Bill No. 53 (SB 53), mandate information sharing about general-purpose AI risks in some cases.

Leadership commitment and incentives shape risk management practices

Organisational culture, leadership structure, and incentives affect risk management efforts in various ways. Leadership commitment and incentive structures are often relevant to how risk management policies operate in practice. Some developers have internal decision-making panels that deliberate on how to safely and responsibly design, develop, and review new AI systems. Oversight and advisory committees, trusts, or AI ethics boards can also serve as mechanisms for risk management guidance and organisational oversight. Researchers have argued that challenges with voluntary self-governance mean that third-party auditing, verification, and standardisation could help strengthen general-purpose AI risk management.

Organisational risk management, transparency, and risk reporting frameworks

Several new initiatives focus on risk management processes, documentation, and transparency. In its current form, the EU General-Purpose AI Code of Practice functions as a voluntary framework to guide transparency, copyright, and safety and security practices to support compliance with the EU AI Act’s provisions for general-purpose AI. As of December 2025, more than two dozen companies have signed. The G7 Hiroshima AI Process (HAIP) Reporting Framework is the first international framework for voluntary public reporting of organisational risk management practices for advanced AI systems. At least 20 developers have published public transparency reports covering risk identification, evaluation metrics, mitigation strategies, and data security processes.

AI developers have adopted voluntary transparency commitments. In China, pledges by 17 Chinese AI companies, coordinated by the AI Industry Alliance of China, were released in December 2024 and updated in 2025. At the May 2024 AI Seoul Summit in South Korea, 16 AI developers from multiple countries signed voluntary commitments to publish Frontier AI Safety Frameworks for their most capable models and systems, and to adopt risk management practices across model development and deployment stages.

Frontier AI Safety Frameworks have become a prominent organisational approach to AI risk management

Since 2023, several frontier AI developers have voluntarily published documents describing how they plan to identify and respond to serious risks from their most advanced systems. These Frontier AI Safety Frameworks describe how an AI developer plans to evaluate, monitor, and control its most advanced AI models and systems before and during deployment. These frameworks share many similarities, but differ in key respects. Most focus on risks associated with chemical, biological, radiological, and nuclear (CBRN) threats, advanced cyber capabilities, and advanced autonomous behaviour. A minority of frameworks address additional risk domains such as unlawful discrimination at scale and child sexual exploitation.

Several developers updated their frameworks in 2025, adding new sections on harmful manipulation, misalignment risk, and autonomous replication and adaptation. While many frameworks describe similar risk management approaches – including threat modelling, red-teaming, and dangerous capability evaluations – they vary in their definitions of risk tiers and thresholds, the frequency of evaluations, buffers between evaluations and thresholds, and the comprehensiveness of their mitigation commitments (for example, whether they include deleting model weights versus just pausing development). See Table 3.5 for more information.

Many actions in Frontier AI Safety Frameworks are based on if-then commitments

A key part of Frontier AI Safety Frameworks are ‘if-then commitments’. These are conditional protocols that trigger specific responses when AI models and systems reach predefined capability thresholds. For example, an if-then commitment might state that if a model is found to have the ability to meaningfully assist novices in creating and deploying CBRN weapons, then the developer will implement enhanced security measures, deployment controls, and real-time monitoring.

In 2025, several AI developers announced that new models triggered early warning alerts or that they could not rule out the possibility that further evaluation would show that models have crossed capability thresholds. This prompted them to apply heightened safeguards as a precautionary measure. Frontier AI Safety Frameworks commonly require an initial capabilities evaluation prior to risk mitigation, as well as a residual risk analysis or a safety case, often informed by red-teaming, after mitigation. See Table 3.5 for detailed information.

The effectiveness of Frontier AI Safety Frameworks is uncertain

Frontier AI Safety Frameworks can serve as risk management tools under specific conditions and for certain risk categories that have a credible pathway to harm. At the same time, several analyses discuss questions regarding their clarity and scope and about the robustness of AI capability and risk thresholds. Existing frameworks tend to focus on a subset of risk domains. As a result, some prominent risks, such as unlawful surveillance and non-consensual intimate imagery, receive less emphasis. Unlike risk management approaches from other sectors, such as aviation or nuclear power, Frontier AI Safety Frameworks typically do not use explicit quantitative risk thresholds.

External assessments of developers’ compliance with their Frontier AI Safety Frameworks so far remain limited, in part because most frameworks are recent, publicly available information is scarce, and there are no standardised external audits. Their effectiveness will also be shaped on how well – and to what extent – commitments are implemented in practice. On their own, these frameworks may not ensure effective risk management, since their practical impact depends on how well and to what extent they are implemented. To date, they do not fully align with international risk management standards. A study on prior voluntary commitments found uneven fulfilment across measures, suggesting that adherence to voluntary commitments is likely to vary between companies and domains.

Taken together, Frontier AI Safety Frameworks represent the most detailed form of voluntary organisational risk management currently in use, but vary substantially in scope, thresholds, and enforceability.

Regulatory and governance initiatives

Several jurisdictions have introduced laws with transparency requirements

Several early regulatory approaches introduce legal requirements intended to increase standardisation and transparency in risk management. The EU AI Act, which entered into force in 2024, establishes requirements related to transparency, copyright, and safety for general-purpose AI models. In 2025, the EU General-Purpose AI Code of Practice was published to support compliance with these obligations by providing guidance on model documentation and copyright, as well as – for the most advanced models – risk management practices such as evaluations, risk assessment and mitigation, information security and serious incident reporting.

Other examples of new regulatory requirements include South Korea’s Framework Act on the Development of Artificial Intelligence and Establishment of Trust, which introduces requirements for ‘high-impact’ AI systems in critical sectors, and California’s SB 53, which sets transparency requirements on safety frameworks and incident reporting. Given how recently these requirements were established, it is too early to assess in detail how they will affect risk management practices or actual risk outcomes.

Broader governance initiatives offer voluntary guidance

Several regional and interregional governance frameworks now articulate shared expectations for managing risks from general-purpose AI by providing non-binding guidance for policymakers and organisations. China’s AI Safety Governance Framework 2.0, published in 2025, provides structured guidance on risk categorisation and countermeasures across the AI development and deployment process. ASEAN Member States published the ‘ASEAN Expanded Guide on AI Governance and Ethics (Generative AI)’, which provides guidance on general-purpose AI governance and ethics and is intended to support greater policy alignment across ASEAN Member States. In addition, expert-led initiatives such as the Singapore Consensus, developed by AI scientists from multiple countries, outline research priorities for general-purpose AI safety across risk assessment, development, and control.

Updates

Since the publication of the last Report (January 2025), the risk management landscape for general-purpose AI has evolved, with the publication of new resources such as the EU’s General-Purpose AI Code of Practice, the G7 HAIP Reporting Framework, China’s national AI Safety Governance Framework 2.0 and various AI developers’ Frontier AI Safety Frameworks. These initiatives describe approaches and practices used by AI developers to manage the risks associated with general-purpose AI systems. There is substantial variation across the Frontier AI Safety Frameworks and across HAIP transparency reports, reflecting differences in organisational practices, risk prioritisation, and the early stage of the general-purpose AI risk management ecosystem. A trusted ecosystem where different AI actors contribute complementary risk management practices across the lifecycle may contribute to effective risk management.

Evidence gaps

There is a lack of evidence on: how to measure the severity, prevalence, and timeframe of emerging risks; the extent to which these risks can be mitigated in real-world contexts; and how to effectively encourage or enforce mitigation adoption across diverse actors. More research is needed to understand how prevalent different risks are and how much they vary across different regions of the world, especially for regions such as Asia, Africa, and Latin America that are rapidly digitising. As AI models are given increasing agency and authority and the state of the science of general-purpose AI risks advances, risk management approaches will also need to evolve.

Certain risk mitigations are growing in popularity, but more research is needed to understand how robust risk mitigations and safeguards are in practice for different communities and AI actors (including for small and medium-sized enterprises). Greater access to data on real-life deployment and usage of models is relevant to such assessments. Further, risk management efforts currently vary highly across leading AI companies. It has been argued that developers’ incentives are not well-aligned with thorough risk assessment and management. There is still an evidence gap around the degree to which different voluntary commitments are being met, what obstacles companies face in adhering fully to commitments, and how they are integrating Frontier AI Safety Frameworks into broader AI risk management practices.

Challenges for policymakers

Key challenges include determining how to prioritise the diverse risks posed by general-purpose AI, clarifying which actors are best positioned to mitigate them, and understanding the incentives and constraints that shape their actions. Evidence indicates that policymakers currently have limited access to information about how AI developers and deployers are testing, evaluating, and monitoring emerging risks, and about the effectiveness of different mitigation practices. Researchers and policymakers have discussed transparency efforts and more systematic incident reporting as possible ways to inform risk prioritisation, promote trust, and incentivise responsible development. In practice, risk management involves multiple actors across the AI value chain – such as data and cloud providers, model developers, and model hosting platforms – each with distinct opportunities to assess and manage different risks. Limited information sharing between these actors makes it difficult to determine which risks are most likely or impactful, particularly when downstream societal effects are considered.