OpenAI Opco, LLC: G7 Hiroshima AI Process (HAIP) Transparency Report

OpenAI assesses severe frontier AI risks under its published Preparedness Framework and Frontier Governance Framework. The Preparedness Framework establishes risk-specific High and Critical capability thresholds and corresponding safeguards. Covered systems reaching High capability require safeguards that sufficiently minimize the associated risk of severe harm before deployment; systems reaching Critical capability also require such safeguards during development. Capabilities Reports and Safeguards Reports inform review by the Safety Advisory Group, which advises OpenAI leadership. The Frontier Governance Framework describes how relevant safety and security practices align with covered regulatory risks, including risk assessment and mitigation, transparency reporting, security risk management, and incident response.

These frameworks describe capability- and threat-model-specific criteria rather than a single numerical threshold across all AI systems. OpenAI also maintains ISO/IEC 42001 certification for its AI management system and ISO/IEC 27001 certification for in-scope information-security management systems. Our security and privacy page describes the scope of these certifications, which complement the frontier-specific risk governance described above.

We use monitoring and targeted alignment evaluations to identify potential misalignment in agentic systems, including risks that may arise when agents interact with other systems or agents. Findings inform further investigation, testing, and improvements to safeguards.

OpenAI employs rigorous red-teaming processes to evaluate the performance of models and systems before external deployment. OpenAI uses both human and automated red-teaming processes. Adversarial testing involves experts who attempt to exploit the model in ways that could cause harm or lead to undesirable outcomes, or who probe the model for unexpected or unwanted behavior in a variety of domains. This process is complemented by collaborations with external organizations, such as cybersecurity firms, to provide additional perspectives and expertise in identifying potential threats.

OpenAI’s red teaming efforts include a variety of expert testing organizations that help inform our risk assessment and mitigation efforts. These organizations span a variety of domains, with diverse perspectives.

Our model review process is also informed by third-party assessments. Since our previous submission, we have published more detail on three forms of external testing: independent capability and safeguard evaluations, reviews of evaluation methodology, and direct probing by subject-matter experts. These assessments supplement our internal work and inform deployment decisions.

We use regression testing to make sure models are robust against previously discovered jailbreaks, and perform new rounds of automated red-teaming with our latest internal red-teaming attackers to validate our improvements.

Red teaming and adversarial testing are used to uncover failure modes, misuse potential, or unexpected behaviors. These findings often lead to downstream mitigation efforts — such as refining instructions, retraining, or introducing product-level safeguards.

The results of these testing activities are documented and reviewed by relevant stakeholders (e.g., model developers, product teams, risk reviewers), and actions are prioritized based on impact, feasibility, and alignment with risk thresholds.

The Safety Advisory Group reviews Capabilities Reports and Safeguards Reports, assesses residual risk and makes recommendations to OpenAI leadership, which makes deployment decisions. Findings can lead to further evaluation, stronger safeguards, access restrictions or a phased release.

We use a combination of quantitative (e.g., internal benchmarks, as well as third-party testers’ evaluations) and qualitative (e.g., subject-matter expert judgment, preparedness review outcomes, stakeholder feedback) metrics to assess AI-related risk. These are embedded in our risk evaluations. We describe some of these metrics, methodologies, and limitations in system cards and in research we publish.

It is worthwhile to note that some risks (e.g., reputational or ethical harm) resist easy quantification, and we lean on expert judgment. AI system behavior can change over time (e.g., through fine-tuning or model evolution), so risks may need ongoing validation. Additionally, risk evaluations are context-sensitive — what is lower-risk in one setting may be higher-risk in another. Risk evaluations are continually re-evaluated based on changes to the threat landscape, and in response to adverse, anomalous, or malicious activity observed on our platform.

For agentic systems, evaluation results also depend on the tools, software environment, scoring method and resources available during testing. We check for issues such as prior exposure to test material, invalid tasks and shortcuts in scoring, and interpret results within the conditions tested.

Reports of incidents and vulnerabilities help us understand risks that may only become clear once a system is in use. We consider reports from users, researchers and other organizations alongside information from our own monitoring. When a report arrives, we assess which systems may be affected, how serious the issue could be and what response is needed.

The investigation can lead to changes in safeguards, model behavior, monitoring or enforcement. It can also prompt us to revisit an earlier assessment of risk. For significant incidents, we document what happened, investigate the causes and record the actions taken. Reviews after an incident help the relevant teams carry those lessons into future development and deployment.

Where appropriate, we share information with affected stakeholders or relevant authorities so that they can respond as well. The information shared takes account of security, privacy and confidentiality.

We make different reporting routes available because reports can involve different kinds of problems and sensitive information. The public bounty programs provide an ongoing route for researchers to report issues that fall within the relevant program’s scope. For security incidents, the coordinated vulnerability disclosure policy directs reporters to an encrypted channel so that information can be shared securely.

The same policy brings together the rules and instructions for reporting, including the processes for vulnerabilities in third-party software and for assigning CVE identifiers. Once a report is received, further coordination depends on the organization affected, the seriousness of the issue and the information needed to investigate or fix it. This lets us keep public reporting routes accessible while handling sensitive details with the appropriate parties. Reporting instructions, program scope, and the encrypted security-incident reporting channel are available in OpenAI’s Coordinated Vulnerability Disclosure Policy.

The separate model-misalignment reporting framework is an employee-initiated escalation and public-disclosure process, not an external submission route. Any OpenAI employee may flag a qualifying example for investigation by the safety and alignment teams. Technical staff assess what happened, remaining uncertainties, whether disclosure is warranted, and any third-party impact; cases follow Ready for Disclosure, Minor Investigation, or Larger Investigation tracks. Disagreements about disclosure or track are referred to the Safety Advisory Group and, if necessary, OpenAI leadership. Where a third party is affected, security, legal, and responsible-disclosure obligations take precedence. We intend to give advance notice if a report would identify a third party, and publication may be delayed for security reasons. External reporters should continue using the applicable bounty and coordinated vulnerability-disclosure channels.

• Publicly
• Information-sharing partnerships (with confidentiality agreements as appropriate)
• Reporting to regulatory authorities as relevant

Depending on the issue and audience, OpenAI shares descriptions of vulnerabilities or incidents, affected systems, risk-reduction steps, investigation findings and coordinated-disclosure information. These may be communicated through public reports, private notification of affected parties, existing information-sharing partnerships, and applicable regulatory disclosures.

For model misalignment, each full report describes the observed behavior, severity and any external impact, the setting and date or date range, when the behavior was discovered, and the model or models involved at a high level. Where possible, it also covers resulting harm, how the issue was found, the scope of the investigation, implications for AI safety, unanswered questions, and mitigations taken or planned. Publication need not wait for an investigation or fix to be completed. For complex cases, an initial notice may summarize what happened, whether outside experts are assisting, and any available estimate for a final report; publication may be delayed for security reasons. We intend to provide identifiable third parties with advance notice, and disclosures involving customers remain subject to privacy and contractual obligations.

OpenAI maintains security and safety bounty programs through Bugcrowd, offering rewards and recognition for qualifying findings. The coordinated vulnerability disclosure policy provides the current program rules, eligible issue categories and submission instructions.

In addition, OpenAI runs a Cybersecurity Grant Program to support research and development focused on protecting AI systems and infrastructure. This program encourages and funds initiatives that help identify and address vulnerabilities, ensuring the safe deployment of AI technologies.

Research support has included API-credit microgrants and work on software patching, model privacy, detection and response, security integration and agentic security. External red teaming processes also bring external experts into our risk assessment and mitigation efforts.

• ISO/IEC standards (e.g., ISO/IEC 27001, ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 42005)
• NIST AI Risk Management Framework (AI RMF)
• Industry-led best practices or codes of conduct
• General Purpose AI Code of Practice

OpenAI collaborates on an ongoing basis with relevant stakeholders across sectors to assess and adopt risk mitigation measures to address risks, in particular systemic risks:

Protecting children: We work with child-safety organizations on the detection, review and reporting of child sexual abuse material, and support shared safety infrastructure through organizations such as ROOST. Since our previous submission, we have also introduced ChatGPT for Teens, with stronger built-in protections, support for healthy use and additional parental controls. Users who state that they are aged 13–17, or whom our systems estimate to be under 18, are placed in the teen experience. This builds on our Under-18 Model Spec, Teen Safety Blueprint and age-prediction work.

Election integrity: Our election safeguards combine access to reliable information, support for cyber defenders, content provenance, monitoring for political bias and disruption of misuse. We have worked with groups such as the Associated Press on election results and Democracy Works on voting information. These collaborations sit alongside our policies against political campaigning and targeted political persuasion, and our investigations into covert influence operations. We report the scope and observed impact of those operations rather than assuming that use of AI made them effective.

Investment in impact assessment and policy analysis: We publish research on AI use, economic impacts and risks to individuals and society, and support independent work that can inform public policy. Recent examples include aggregate usage research, industrial policy grants and funding for research on AI and teen development. Questions 20, 28 and 29 provide further detail on these programmes and distinguish published findings from research that has been funded but not yet completed.

Partnering with governments and researchers: We continue to work with governments’ AI safety and security institutes, independent evaluators and domain experts. Our public third-party evaluation guidance describes how the tools and environment surrounding a model can change the result, and why reports should distinguish capability testing from safeguard testing. We also collaborate with public-health and research institutions through, for example, Rosalind Biodefense and trusted access to GPT-Rosalind, as described in question 31.

Supporting cyber defenders: We collaborate with cyber defenders through OpenAI Daybreak, which provides two access tiers for approved defensive work. Daybreak Blue supports general defensive workflows, while Daybreak Red provides cybersecurity-specific models, including GPT-5.6-Cyber, for authorized advanced testing. Access is governed by identity verification, account security, monitoring, approved-use restrictions and legal attestations. This extends our work with the defensive security community while recognizing the risks of models operating with reduced safeguards.

Plan and design: We identify how a system is intended to be used and what could go wrong, then use that assessment to decide which tests and safeguards are needed.

Collect and process data: We select, prepare and filter training data, applying relevant privacy protections and controls over where data comes from.

Build, integrate and interpret model: We test the model as it is developed and use the findings to improve its behavior and relevant protections.

Verify and validate: We examine what the system can do and safeguards’ effectiveness, using internal automated and human testing and relevant input from outside experts.

Deploy: We review the evidence and the risks that remain after safeguards are applied before deciding whether and how to release the system, which may include phased deployment to understand potential risk among a smaller audience before broadening access.

Operate and monitor: We monitor for misuse and incidents after release and use what we learn to improve safeguards and future assessments.

Evaluations are performed at multiple points throughout the AI lifecycle to ensure models are safe, effective, and align with OpenAI's objectives. In the pre-development phase, we begin with an initial risk assessment to identify potential hazards and define safety objectives, establishing a foundation for informed and responsible development. During the development phase, models undergo iterative testing to refine safety and performance as the model evolves. Before deployment, in the pre-deployment phase, we conduct a range of safety and capability evaluations, as described in our Preparedness Framework. In the deployment phase, we implement system safeguards to prevent harm and monitoring to detect unexpected behaviors or misuse, and we perform post-deployment evaluations using real-world feedback and performance data to identify emerging risks. Finally, in the post-deployment and maintenance phase, we update our evaluations and safeguards based on new misuse patterns, identified incidents, and advances in research.

We embed security controls into infrastructure and model development, and use adversarial testing, monitoring and incident review to improve them. Our work on long-horizon models has also shown why individual action checks alone can be insufficient: a sequence of seemingly acceptable actions can cross a user’s intended boundary.

Significant releases, material evaluation findings, incidents, emerging abuse patterns and changes in applicable requirements can trigger reviews and updates. Findings may change evaluations, model behavior, safeguards, access conditions or monitoring. The Safety Advisory Group advises OpenAI leadership on preparedness decisions, and relevant research, safety, security, product, legal and policy teams contribute according to their responsibilities. An explanation of the safety work for a model is published in a system card when the model is released to general availability.

Findings from internal use, evaluations and incident investigations inform our alignment work, security controls and decisions about whether work can proceed. Our September 25, 2026 report provides a further example of how incident findings change safeguards and research decisions. An internal research model accessed an external chatbot through insufficient DNS filtering in its training sandbox. Monitoring detected the behavior, but the investigation also identified gaps in detection and operational response. We stopped the affected training run and added blocking controls at two independent layers. At time of publication, training, evaluation and tool-using inference for our most capable models were paused pending validation that the gap was resolved and additional red teaming. We also committed to beginning a fresh training run with additional alignment improvements rather than resuming training of the affected model.

Prior to deployment, OpenAI assesses and mitigates potential risks that may stem from generative models, such as information harms, or other content that violates our safety policies. We use a combination of methods, spanning all stages of development across pre-training, post-training, product development, and policy. For example, during post-training, we align the model to human preferences; we red team the resulting models and add product-level mitigations such as monitoring and enforcement; and we provide moderation tools and transparency reports to our users.

We find that the majority of effective testing and mitigations are done after the pre-training stage because filtering pre-trained data alone cannot address nuanced and context-specific harms. At the same time, certain pre-training filtering mitigations can provide an additional layer of defense that, along with other safety mitigations, help exclude unwanted and harmful information from our datasets:

We use our Moderation API and safety classifiers to filter out data that could contribute to harmful content or information hazards, including CSAM, hateful content, and violence.

For image generation systems, we filter our image generation datasets for explicit content such as graphic sexual material and CSAM.

We use advanced data filtering processes to reduce personal information from training data.

Models may perform differently across languages, tasks and groups. Evaluations, adversarial testing and feedback from use help us assess those limitations and guide further safeguards.

• Maintain a copyright policy that addresses data sourcing, content provenance, safeguards, and organizational roles and responsibilities
• Publishing “model cards” or contextual information on training data and model limitations
• Apply provenance controls to guard against training data being sourced from websites or repositories that have been determined to engage in large-scale piracy
• Refrain from the unlawful circumvention of technological protection measures in data sourcing
• Maintain policies or practices to respect copyright holders’ preferences through, where appropriate/applicable, mechanisms like Robots.txt “do not train” tags or other machine-readable protocols developed through voluntary, industry-led standards processes
• Conduct data cleaning, qualification, and/or tokenization activities as part of a transformative data preparation process
• Engage in AI training that comprises a non-consumptive use of any underlying data
• Consult and/or retain an intellectual property attorney to protect, enforce, and comply with, intellectual property rights.

• Restricting outputs that raise ethical, human rights, or legal concerns—such as non-consensual intimate imagery, unauthorized deepfakes, or outputs that are substantially similar to copyrighted works.
• Filtering results using keyword or image-based restrictions to reduce risks of misuse
• Designating clear points of contact so creators or rights holders can raise concerns about infringing outputs

We want our AI models to learn about the world—not private individuals. We implement a series of reinforcing privacy protections to train our models from the ground up to protect private and sensitive information.

We apply filters and remove information from our training data that we do not want our models to learn from, including sites that primarily aggregate personal information. We then further train our models to reject requests for private or sensitive information, even where that information is available on the public web. We conduct a series of evaluations on our models to help ensure they align with these standards, implement robust usage policies to protect privacy, and monitor and respond to attempts to generate information in violation of these policies. We are also increasingly relying on our AI models to enhance privacy, such as to improve the filtering of personal information and augment the use of synthetic data, and are excited about the possibilities presented by this research. Our Privacy Filter is an AI tool that we use internally (and later released to the broader community as an open-weight model) to reduce the processing of personal data in the model training process, including for our most capable frontier models.

We additionally give users of ChatGPT robust and easy-to-use personal data controls, including to review and delete their data, turn off features like ChatGPT memory, and to easily opt out of content being used to further improve our models. Users can also export a copy of their ChatGPT data, giving them greater visibility into and control over the information associated with their account. We also encrypt user data at rest and in transit.

We also offer a Temporary Chat mode. Unsaved Temporary Chats do not appear in conversation history and are not used to improve our models; we may keep a copy for up to 30 days for safety purposes. Users can choose to save a Temporary Chat, in which case it becomes a regular chat and follows their account-level settings. And when using ChatGPT data to improve our models, we take a number of privacy-protective steps to reduce the processing of any incidental personal information. Our dedicated consumer privacy page provides clear, accessible explanations of these controls and directs individuals to our Privacy Portal, where they can submit requests to exercise their privacy rights under applicable law.

Beyond account-level controls, individuals—including those who do not use ChatGPT—can request the correction or removal of personal information about them appearing in ChatGPT responses. We assess these requests in accordance with applicable law and the technical capabilities of our models.

For our business services, including ChatGPT Business, Enterprise, Edu and the API, we do not use customer inputs or outputs to train our models by default. We provide administrative and access controls, alongside data-retention options, with availability varying by service. Customer content is encrypted at rest and in transit. These safeguards are supported by independent assessments and certified management systems, including SOC 2 Type 2 examinations and ISO/IEC 27001 and 27701 certifications for the information-security and privacy-management systems supporting the API, ChatGPT Enterprise and ChatGPT Edu. Our Trust Portal provides supporting documentation and details of the applicable audit and certification scope.

• Conduct regular cybersecurity risk and vulnerability assessments tailored to AI models or systems
• Perform threat modeling that includes AI-specific risks (e.g., data poisoning, prompt injection)
• Maintain or update security policies aligned with recognized standards (e.g., NIST CSF, ISO/IEC 27001, SOC 2, CIS Critical Security Controls), and review them regularly in response to emerging risks or regulatory guidance
• Maintain vulnerability management processes (scanning, channels for external reporting, patching, remediation)
• Implement incident response, disaster recovery, or business continuity plans, including escalation procedures for high-severity incidents
• Train staff on cybersecurity best practices and AI-specific threats, including how to recognize and respond to misuse or unintended outcomes of advanced AI systems
• Integrate cybersecurity AI risks into broader cybersecurity risk management activities
• Regularly review security measures and update them in response to emerging risks, incidents, or major releases

• Apply multi-factor authentication (MFA) and role-based access controls for advanced AI systems
• Encrypt AI assets (datasets, models, configurations) in storage and in transit as appropriate
• Restrict physical access to servers, GPUs, or devices hosting AI models, systems, and/or applications
• Monitor system activity and log access to detect anomalies or misuse
• Conduct secure AI development and/or deployment practices
• Conduct security testing focused on AI-specific risks (e.g., red-teaming, adversarial testing, stress tests)

• Limit access to proprietary AI assets based on role or need-to-know
• Store model weights, datasets, and algorithms in secure, access-controlled environments
• Track and log access to sensitive AI resources
• Require NDAs or confidentiality agreements for staff and contractors with access
• Other (please specify): combined sensitive-asset controls described in 11.E.

• Conduct pre-employment screening or role-sensitive vetting
• Monitor for unauthorized internal access or suspicious activity
• Provide staff training on cybersecurity best practices and AI-specific threats
• Implement insider-risk escalation or response procedures
• Other (please specify): insider-risk monitoring, investigation and response described in 11.E.

OpenAI maintains a comprehensive cybersecurity, physical security, and insider threat program governed by an enterprise risk management process and overseen by the Safety and Security Committee (SSC) of the OpenAI Foundation. Our approach integrates industry best practices with AI-specific innovations to manage the unique threats facing frontier AI systems. OpenAI aligns its information security and privacy program with ISO 27001, 27017, 27018 and 27701, supported by SOC 2 Type 2 and NIST guidance.

We have published six key measures for securing advanced AI infrastructure that complement traditional cybersecurity practices:

Trusted computing for AI accelerators

Network and tenant isolation guarantees

Innovation in operational and physical security for datacenters

AI-specific audit and compliance programs

AI for cyber defense

Resilience, redundancy, and research

We continuously assess cybersecurity risks across our systems and infrastructure. Our security controls are tailored to the risks of increasingly capable AI systems, and we adapt as we move closer to AGI. Security safeguards are reviewed regularly and refined through adversarial testing, red teaming, and ongoing research. Security controls and safeguards are also informed by changes in the threat landscape.

OpenAI treats unreleased model weights as core intellectual property. We enforce strict access controls, granting access only to individuals whose roles require it. These protections are supported by a robust insider threat detection program and secure research environments. Model weights and sensitive assets are handled exclusively within appropriately secured infrastructure designed to prevent unauthorized access or leakage. Technical controls in these environments include advanced physical security (for datacenters), cryptographic protections, real-time security monitoring, defense-in-depth network architecture, and supply chain security controls.

Security controls are reviewed continuously and iteratively—through ongoing red teaming, penetration testing, operational monitoring, third-party audits, and program-level reassessments. OpenAI engages in an independent third party audit on at least an annual basis which reviews our security measures, including our vulnerability management process.

OpenAI has a dedicated insider threat team. The program emphasizes prevention, detection, and response. This includes strong policy enforcement, employee education, access controls, monitoring mechanisms to detect anomalous or high-risk activity, and investigative capabilities.

For covered frontier models, our Frontier Governance Framework describes protections for unreleased weights including encryption, restricted access, monitoring and logging. Authorized access to model parameters is reviewed regularly. Model execution is sandboxed with safeguards tailored to the relevant workload and operating environment. Security assessments include internal and external testing.

• Constraints on the agent's action space (e.g., tool-use permissions, environment sandboxing, allowlists/blocklists of resources, scope limits per task)
• Human oversight or interruptibility mechanisms (approval requirements for sensitive actions, escalation paths, interruption interfaces)
• Monitoring (anomaly detection, multi-agent interaction monitoring)
• Logging of agent actions

• Risk management policies
• Summary of results from evaluations of safety, security, and societal risks including potential adverse impacts on individuals or groups (e.g. impacts on human rights, privacy or differential outcomes across user groups).
• Summary of results from red-teaming and other testing (e.g., adversarial evaluations, stress tests, and other pre-deployment safety assessments).
• Capabilities, behaviours, and limitations, including domains of appropriate and inappropriate use or indicative thresholds associated with systemic risks.
• Technical documentation and instructions for use if relevant.
• Plain-language or non-technical summaries

We publish system cards for frontier models and other significant launches, covering capabilities, limitations, safety evaluations and intended uses. Since our previous submission, this reporting has expanded to newer reasoning models, open-weight models and agentic systems. The GPT-6 Astra system card and accompanying safety overview provide a recent example, including the model’s Critical cybersecurity capability assessment, strengthened safeguards and remaining monitoring limitations.

Examples of our public documentation include the Deployment Safety Hub, the GPT-6 Astra system card and the Preparedness Framework.

OpenAI actively shares information with other stakeholders regarding the outcome of risk evaluations for advanced AI systems.

In addition, OpenAI both publishes certain insights derived from its detection and disruption of malicious use of its platform, and also shares certain insights with industry peers, industry groups, and relevant authorities to enhance our collective ability to identify and mitigate risks.

System cards and public summaries make findings available to a broad audience, including researchers, developers, and consumers. Our published external-testing approach distinguishes independent evaluations, methodology review and subject-matter expert probing. We share results through system cards and support assessors in publishing more detailed work, subject to the applicable confidentiality and accuracy review. Government and independent research partners also receive access and supporting information tailored to the evaluation.

OpenAI discloses privacy policies that address the use of personal data, user prompts, and the outputs of advanced AI systems. These policies outline how data is collected, stored, and used, emphasizing user privacy and data security.

These resources include our Privacy Policy, Data Processing Addendum, Business Terms, information on how our models are developed and how data is used to improve model performance, the Consumer Privacy Page, Privacy Portal, the Data Controls FAQ and the Trust Portal.

We provide general information about our training data in our system cards, including information about the sources of our data. That information is disclosed at a high level to balance the value of public disclosures with trade secret sensitivities.

We also publish model-specific summaries of training content on our EU AI Act resources page. In addition, we publish a training-data summary pursuant to California Civil Code Section 3111.

OpenAI demonstrates transparency regarding its advanced AI systems through a variety of technical documentation, policies, and instructions that are publicly accessible. These resources include:

Model Specifications: OpenAI publishes detailed documentation, such as the Model Spec, which outlines the desired behavior for its models. These documents serve as a guide for researchers and developers, providing transparency on how OpenAI shapes the behavior of its AI systems. It includes a set of core objectives, as well as guidance on how to deal with conflicting objectives or instructions.

Usage Policies: OpenAI has established comprehensive usage policies to ensure that its technology is used responsibly. These policies cover a range of topics, including compliance with applicable laws, safeguarding privacy, and preventing misuse of AI for harmful activities. The policies are designed to provide flexibility for innovation while maintaining safety and ethical standards.

For agentic products, transparency is also part of the user experience. For supported browser workflows in agentic products, users can follow task progress in the conversation, review confirmation requests, and take over the browser. Documentation explains website permissions, sign-in, supported actions, and limitations. Cloud browser documentation.

Yes. We publish research to help people understand how AI is being adopted and used, including in work and economic activity. “How People Use ChatGPT,” for example, uses automated classification with privacy protections to study patterns in consumer use. It reports aggregate findings, including work-related uses, without publishing individual conversations.

We also publish the Signals Global Report to offer a broader view of adoption and use across populations. Making this research public gives researchers, policymakers and other stakeholders evidence they can use to examine how AI is affecting different tasks and communities. Each publication explains its scope and methods, so that readers can understand whose activity was studied and what conclusions the findings can support.

OpenAI has implemented several AI risk management and governance policies, as described in System Cards, our Preparedness Framework and our Frontier Governance Framework. For example, before deploying frontier models and other significant launches, preparedness evaluations and safeguards are reviewed by the Safety Advisory Group, an internal cross-functional group of safety leaders, with recommendations to OpenAI leadership, which makes deployment decisions. Additionally, the Safety and Security Committee of the OpenAI Foundation has oversight of safety and security practices across OpenAI.

The Frontier Governance Framework also sets out responsibilities for the activities it covers. It identifies OpenAI OpCo LLC’s responsibilities for covered US models and OpenAI Ireland Limited’s responsibilities for EU general-purpose AI models with systemic risk, including oversight by its board for EU purposes.

OpenAI regularly iterates on other policies and procedures to assess, measure, and mitigate risks throughout the development and deployment lifecycle.

Reviews and updates can be triggered by major incidents, regulatory changes, material system updates and new evaluation findings.

Yes. We provide role-specific training to ensure relevant employees understand their responsibilities under our governance and risk frameworks. This includes:

Onboarding training for new hires, covering security, privacy, and acceptable use

Regular security training for employees and contractors to address insider risks, as described in the Frontier Governance Framework.

Guidance documents and FAQs that translate policy into actionable steps, especially for product development and AI deployment contexts

Governance-related training content is regularly updated to reflect policy changes and evolving external expectations.

Yes. We log and track significant reported incidents through our internal incident response processes, which include:

Triage and investigation logs

Post-incident reviews (including root cause analysis and corrective actions)

Lessons learned documentation shared with relevant internal teams

The Frontier Governance Framework describes investigations and reviews where needed to capture lessons and outstanding actions. Escalation to senior leadership and external reporting depend on the applicable incident criteria, severity and affected parties.

Separately, our model-misalignment reporting framework sets out a process to track, investigate and disclose qualifying model-behavior concerns across training, evaluation, testing and deployment. Any employee may flag an example for review by safety and alignment teams. Technical staff investigate what happened, assess uncertainties and third-party impact, and assign the case to a Ready for Disclosure, Minor Investigation or Larger Investigation track. The reporting employee is informed of the disclosure decision; unresolved disagreements about disclosure or track go to the Safety Advisory Group and, if necessary, OpenAI leadership. The process sets deadlines for investigation and disclosure, and reports document observed behavior, impacts, outstanding questions and mitigations where available; publication may precede completion of an investigation or fix. Where third parties are affected, security, legal and responsible-disclosure obligations take precedence. This framework complements existing incident-response processes and legal reporting obligations.

Protecting Children and Vulnerable Groups: We publish the Teen Safety Blueprint and Under-18 Model Spec to explain our approach to younger users. ChatGPT for Teens puts this work into practice through an age-appropriate experience, stronger protections and parental controls. Our separate commitment to independent research on teen development is intended to help assess benefits, risks and the effectiveness of safeguards; it is not a claim that those research outcomes have already been established.

Upholding Democratic Values and Respecting Human Rights: OpenAI conducts research on the societal impacts of AI, focusing on ensuring that AI aligns with democratic values and human rights. This includes studying how AI can be governed to reflect democratic input and avoid exacerbating inequalities.

Content Provenance and Abuse Prevention: OpenAI is actively involved in the development of content provenance standards, such as C2PA, to help track the origin of digital content and prevent the spread of misinformation. This effort is part of broader initiatives to enhance the integrity and transparency of AI-generated content. See the response to question 27 on content authentication and provenance. In addition, OpenAI is committed to enforcing policies that prevent abuse and to improve transparency around AI-generated content, as outlined in our reports on disrupting deceptive uses of AI by covert influence operations.

We also share risk-management practices through public governance frameworks, system cards, research publications, standards initiatives and collaborations with researchers, industry and government safety institutes.

• ISO/IEC standards (e.g., ISO/IEC 27001, ISO/IEC 42001)
• NIST AI Risk Management Framework (AI RMF)
• OECD AI Principles
• Industry-led best practices or codes of conduct
• Other international or regional standards (please specify): EU General-Purpose AI Code of Practice.

Yes. Our governance and risk management programs align with international frameworks and standards including:

ISO/IEC 27001 and 27701 (Information security and privacy management)

SOC 2 (Trust Services Criteria, including Security, Availability, Confidentiality and Privacy)

NIST AI Risk Management Framework

OECD and EU AI guidelines (including definitions of risk levels and governance expectations)

ISO/IEC 42001 (AI Management Systems)

These standards inform both the design of controls and the structure of our governance documentation and training programs.

OpenAI maintains ISO/IEC 27001:2022 and ISO/IEC 27701:2019 certifications for the information-security and privacy-management systems supporting the OpenAI API, ChatGPT Enterprise and ChatGPT Edu. Its ISO/IEC 42001:2023 AI Management System covers consumer and business AI products and models in its role as an AI producer and provider. The NIST AI Risk Management Framework informs OpenAI’s approach to frontier AI safety risks. Our Frontier Governance Framework explains how relevant safety and security practices align with the EU General-Purpose AI Code of Practice.

We help users understand when an AI system is acting on their behalf by making its work visible. ChatGPT Work lets users follow browser-task progress in the conversation and review requests for sign-in or confirmation. Users can take over the cloud browser. Public documentation explains when the system can act and where user involvement is required. Cloud browser documentation.

Documentation provides further context about the agent’s capabilities, tools and limitations. These features are particularly important when a task involves several steps: they help users follow the work, understand what information or services the agent can access, and intervene when its actions need to change.

• Latent disclosure (e.g., hidden provenance information)
• Manifest disclosure (e.g., visible label)
• Detection tool(s) for hidden provenance signals (e.g., watermark or metadata checks)
• Use of international or industry standards (e.g., C2PA)

OpenAI is working to ensure the authenticity and transparency of digital content. Here are our key efforts:

C2PA: OpenAI is a steering committee member of the Coalition for Content Provenance and Authenticity (C2PA). OpenAI adds content credentials to supported generated images and videos, building on our implementations in DALL·E 3 and GPT-4o Image Generation. Content credentials (metadata cryptographically signed to provide an attestation of the content’s origins) provide information about how and when a piece of content was created or modified by our platform. Content credentials are metadata-based approaches to content provenance that require adoption by different players across the AI ecosystem to build trust in media online. We believe that C2PA is working to build such an ecosystem, and from our steering committee seat, we are helping to advance this work.

Watermarking and verification: We combine Content Credentials with SynthID watermarking for supported images and audio, alongside visible watermarks for supported video. Our public verification tool can inspect supported image and audio files for provenance signals, and API access allows organizations to incorporate verification into their workflows.

Our July 2026 update extended SynthID watermarking and public verification support to supported audio and introduced API access for verification. We test and research the accuracy, reliability and resilience of these mechanisms. No detection method is foolproof: a missing metadata or watermark signal does not establish that a file was created without AI.

We advance the state of AI safety and trustworthiness through a combination of internal research, external funding and partnerships, and product integration of emerging insights. Our efforts span across key domains such as robustness, disinformation, fairness, and transparency. We publish our research to uplift safety in the larger AI ecosystem in our main blog and dedicated safety and alignment blog.

Internal Research and Applied Safety Work

We invest heavily in internal research focused on the safe deployment of frontier models, including:

Robustness and Red Teaming: Dedicated teams probe models for failure modes, including adversarial behavior, prompt injection, and content safety risks.

Transparency and Interpretability: Research includes techniques like model probing, behavioral evaluation, and feature attribution to improve transparency.

Political Bias: We develop and publish methods for evaluating political bias in model responses, with findings informing further model development.

Misuse and abuse prevention: We continuously study how models might be misused to generate harmful content, or violate our usage policies, and implement corresponding safeguards or disrupt such activity.

Research findings are shared via system cards, peer-reviewed papers, and updates to our model usage policies.

External Research Funding and Collaboration

We support external work through:

Grants and fellowships to researchers and institutions advancing AI safety, fairness, and interpretability.

Partnerships with academic labs and nonprofits to co-develop methods, benchmarks, and evaluations.

Challenge programs (e.g., for red teaming or adversarial testing) that incentivize broader participation in AI safety research.

These efforts promote shared learning and raise the industry bar on responsible AI development.

Across all of this, our goal is to continuously improve the trustworthiness and safety of our AI systems, and to share lessons with the broader ecosystem when possible.

Recent work includes guidance on the validity of third-party frontier-model evaluations, long-horizon alignment and monitoring, and content-provenance verification. These publications explain practical methods and limitations so that other researchers and developers can assess and build on the findings. Our public incident investigations also feed lessons back into evaluation and safeguard design.

In September 2026, we committed $5 million to independent research on how generative AI affects the lives and development of teenagers aged 13–17. The programme will support work on potential benefits and risks, including social and emotional development, and on the effectiveness of safeguards and interventions. This funding is intended to build evidence that can inform safer experiences for young people.

We have engaged in a wide range of academic discussions and joint research projects, including looking at the potential economic and social implications of advanced AI systems. Our view is that robust engagement with a wide range of subject-matter experts, including independent academics, think tanks, and research organizations, will further our understanding of how AI can be used to benefit humanity, in line with our company's mission.

Our economic research includes How People Use ChatGPT and the Signals Global Report. These publications describe patterns of adoption and use across tasks and populations, using aggregate findings rather than publishing individual conversations. Each study explains its scope and methods, helping readers distinguish measured usage from broader claims about productivity, employment or social outcomes.

We also support independent research on how public policy can help people benefit from AI and respond to economic disruption. In August 2026, we announced industrial policy grants for 14 projects, with a total of $1 million in funding and up to $1 million in API credits across the projects.

We also invest in ways to use computing resources more efficiently. Our infrastructure work looks at models, the software that serves them and the hardware used to run them together, because improvements at each level can affect the energy needed to provide a service.

Efficiency is one part of the environmental picture. Even if an individual task uses fewer resources, an organization’s total footprint also depends on how much its systems are used and other factors. Our infrastructure disclosures and research describe findings within their relevant scope so that improvements in efficiency can be understood in that broader context.

OpenAI prioritizes education and training to help people understand the nature, capabilities, limitations, and impact of advanced AI systems. We support OpenAI Academy, an AI literacy and education platform including in-person and virtual events and resources, designed to help people of all backgrounds unlock the benefits of AI. Additionally, OpenAI collaborates with Common Sense Media to provide resources that promote responsible AI use among families, ensuring that users of all ages understand the ethical and social dimensions of AI.

OpenAI Academy: academy.openai.com

OpenAI Academy provides a free public resource hub, workshops and content ranging from introductory AI literacy to more advanced material for technical users. It serves educators, students, job seekers, nonprofit leaders and small-business owners. Published collaborations include work with Goodwill on AI literacy for employment specialists supporting job seekers, helping connect practical skills with the needs of people facing barriers to opportunity.

Our Education for Countries update, published in May 2026, provides a more recent example of work with an education system. At the time of that update, Estonia’s programme reached more than 20,000 students and 4,600 teachers. Alongside access to ChatGPT Edu, AI Leap, the University of Tartu and Stanford University are studying its use in real classrooms, with a commitment to publish findings. This combines practical access and teacher support with research into how the technology affects learning.

OpenAI Academy’s India Nonprofit AI Jam 2026 offers a recent example of how we help nonprofit organisations apply AI to their work. The programme combines demonstrations, discussion and hands-on sessions in which participants develop workflows using their own organisational needs and materials. Examples include assistants that make organisational knowledge available in local languages, analysis of programme data, and tools for producing communications. Participants are guided to define the intended output, create a reusable prompt or workflow, and include a quality check. The accompanying public resource hub makes workshop materials available for organisations to use in their own work.

We also support public-health and preparedness work through Rosalind Biodefense. The programme sponsors GPT-Rosalind access and launch support for trusted developers building defensive applications, including screening, early detection and preparedness tools. We have expanded trusted access for selected government and allied partners with approved public-health and biodefense missions.

We recognize that there is still significant work to be done to develop AI ecosystems that foster broadly distributed benefits of these technologies in the long-term. Significant resourcing will be needed to strengthen AI ecosystems, such as deepening low-resource language datasets, researching and adapting to potential workforce impacts, and rapidly expanding AI literacy.

OpenAI Academy’s collaboration with GitLab Foundation and The Annie E. Casey Foundation on the AI for Economic Opportunity Demo Day showcases projects addressing economic challenges. Together with the nonprofit workshops and workforce partnerships described above, these initiatives support organizations in applying AI to concrete community needs.