The last independent frontier-model evaluator just became a US policy variable

Politico reported on 24 September 2026 that the White House Office of the National Cyber Director asked OpenAI and Anthropic to withhold new frontier models from the UK AI Security Institute until the US government completes its own security review. The request is not a legal instruction — there is no statutory authority compelling a private company to route pre-release access through Washington — and it sits on top of the voluntary framework established by the June 2026 executive order, which explicitly prohibited mandatory licensing or preclearance. A senior administration official gave the rationale as: 'Because they're American companies and this has been our policy with every new frontier model that comes out.' The White House framing is that US systems should be verified secure before models are shared with any partner, foreign institutes included. Neither company issued a substantive public response at the time of the report; OpenAI declined to comment.

It has already taken effect at one vendor. Claude Mythos 5.1, released on 1 September 2026, went to a US-only slate of organisations under Project Glasswing rather than to the usual pre-release evaluation set. AI Weekly's reporting describes this as the first time AISI has been left out of a pre-release Anthropic evaluation — a meaningful break, because AISI had evaluated the predecessor. Anthropic said it intends to 'expand access to a broader set of domestic and international partners as quickly as possible' but attached no timeline. On the OpenAI side, AISI director Henry de Zoete confirmed the institute still holds pre-release access to some of the most capable models, naming GPT-6 Astra specifically. So the current state is partial: one frontier model confirmed withheld, one confirmed still in scope, and no published rule for which future releases fall on which side.

Because it changes the quality of the evidence available when you do vendor due diligence, and most buyers have not noticed how thin that evidence base already was. There are broadly four sources of frontier-model safety evidence: the vendor's own system card, vendor-commissioned third-party red teams, academic and non-profit indices, and state-backed institutes with pre-release access. The first is self-reported. The second has a structural funding problem we covered when Anthropic's Accenture arrangement and OpenAI's red-team panel were announced — the evaluator is paid and selected by the evaluated. The third, including the Future of Life Institute's safety index, works largely from public information and cannot test a model before release. The fourth is the only category with both independence and pre-release access, and AISI is the best-resourced example of it. Narrowing that category by jurisdiction does not make models less safe. It makes their safety less externally checkable, which is a different problem and one that lands on whoever has to write the risk assessment.

Not directly, but it affects how easily you evidence them. For general-purpose AI models with systemic risk, the Act places evaluation and adversarial-testing duties on the model provider, not on you as a deployer or downstream integrator. Nothing in the Politico report changes that allocation. Where it bites is practical: enterprise AI risk assessments and vendor questionnaires very commonly cite independent third-party evaluation as a control, and a growing number name AISI or an equivalent institute specifically. If your documentation contains a sentence to the effect of 'this model family is subject to independent pre-release evaluation by a national safety institute,' that sentence is now model-specific rather than family-specific, and for at least one Anthropic release it is no longer true. The fix is not complicated — name the model version and the evaluator, and re-check at each upgrade — but it does require someone to actually do it. Our [Article 50 explainer](/news/eu-ai-act-article-50-live-what-changes-for-ai-tool-users-2026-08-02/) covers the transparency side of the same regime.

No, and any vendor pitching that framing is selling you something. The models in question are the same models they were a week ago; what changed is who got to look at them first. There is also no clean alternative — the open-weight Chinese frontier has its own evaluation gaps, its own jurisdictional exposure, and a documented history of mid-flight licence changes. The reasonable response is narrower and duller. First, stop treating 'independently evaluated' as a stable property of a vendor and start treating it as a property of a specific model version with a specific evaluator and date. Second, if you are in UK or EU public-sector procurement, ask the vendor directly whether the version you are buying was reviewed by AISI or an equivalent, and get the answer in writing rather than inferring it from the vendor's general safety posture. Third, weight your own evaluations higher, because the external ones just got less predictable.

Two threads converged. The first is the US frontier-review posture that has been building since the June 2026 executive order, which set up a voluntary 30-day federal review window while explicitly ruling out mandatory licensing, and which was followed by a completed frontier-model framework the administration has declined to publish. Pre-release access has been a controlled resource in US policy for over a year — the June 2026 Mythos 5 episode, where Commerce cleared roughly 100 trusted partners for a cyber-scoped release while a public model stayed offline, established the template. The second thread is capability evidence. Reporting around the request references tests in which systems were able to break into external targets, including an Australian government portal, and both companies have briefed the UN Security Council on rising capability. Those are exactly the results that make a government want first look. The tension is that they are also exactly the results that make independent verification most valuable.

Three things, none of them urgent but all of them cheap. Audit your AI vendor documentation for claims about third-party or institute evaluation and pin each one to a named model version and date — if a claim cannot survive that, delete it rather than leaving a stale assurance in a risk file. Add a question to your standard vendor questionnaire asking which external bodies received pre-release access to the specific version being supplied. And if you rely on a frontier model for anything where an unexpected agentic behaviour would be expensive, invest the marginal hour in your own evaluation harness rather than waiting for someone else's report; that was good advice before this week and it is slightly better advice now.