OpenAI

Framework

Preparedness Framework since 2023

Its own scale

Capability thresholds: High and Critical

Risk domains

CBRN, cyber, AI R&D

External evaluation

committed to

Commits to stop

yes: Commits to not deploying, or not continuing, until mitigations are in place.

Version 2, April 2025, is still the published version. OpenAI's Frontier Governance Framework of May 2026 sets out how it meets EU and Californian law and leaves this as its own standard. Three tracked categories at two thresholds: persuasion was dropped in 2025, and long-range autonomy and nuclear risk are research categories without thresholds. At a Critical threshold it commits to halt further development until safeguards are specified.

• 22 of 30 with a system card on the day
• 8 that no card names
• 4 naming a government institute that tested before release
• 18 stated to have reached a threshold in its own framework

Earlier releases 20

OpenAI releases since January 2025, earlier, with the card published for each.

Released	Model	Card	Results	Government tested	Threshold
2026-03-05	GPT-5.4 Pro The linked GPT-5.4 Thinking card does not name GPT-5.4 Pro.	none	-	-	-
2026-03-05	GPT-5.4	at release	results	none named	reached Treated as High in biological and chemical and in cybersecurity
2026-02-12	GPT-5.3-Codex-Spark A research preview. No card names it.	none	-	-	-
2026-02-05	GPT-5.3 Codex	at release	results	US CAISI, UK AISI	reached Treated as High in biology and, as a precaution, in cybersecurity
2025-12-18	GPT-5.2 Codex	at release	results	none named	reached Treated as High in biology; below High in cybersecurity
2025-12-11	GPT-5.2 Pro The linked GPT-5.2 card covers GPT-5.2 Instant and GPT-5.2 Thinking and does not name GPT-5.2 Pro.	none	-	-	-
2025-12-11	GPT-5.2	at release	results	none named	reached Treated as High in biological and chemical
2025-11-19	GPT-5.1-Codex-Max	at release	results	none named	reached Treated as High in biology; below High in cybersecurity
2025-11-13	GPT-5.1 Instant	at release	summary only	none named	reached Treated as High in biological and chemical, as GPT-5 was
2025-11-13	GPT-5.1	at release	summary only	none named	reached Treated as High in biological and chemical, as GPT-5 was
2025-11-12	GPT-5.1-Codex No card names it. The GPT-5.1-Codex-Max card of the following week uses it as a baseline.	none	-	-	-
2025-10-07	GPT-5 Pro The GPT-5 card, published two months before the API release, names it as gpt-5-thinking-pro.	at release	another model's	none named	reached Treated as High in biological and chemical, as part of the GPT-5 launch
2025-08-07	GPT-5 nano	at release	another model's	none named	reached Treated as High in biological and chemical, as part of the GPT-5 launch
2025-08-07	GPT-5 mini	at release	results	none named	reached Treated as High in biological and chemical, as part of the GPT-5 launch
2025-08-07	GPT-5	at release	results	US CAISI, UK AISI	reached Treated as High in biological and chemical
2025-08-05	gpt-oss-20b	at release	results	none named	below Below High in every tracked category, including after adversarial fine-tuning
2025-08-05	gpt-oss-120b	at release	results	none named	below Below High in every tracked category, including after adversarial fine-tuning
2025-03-19	o1-pro The linked o1 system card of December 2024 does not name o1-pro, and no card accompanied its API release.	none	-	-	-
2025-02-27	GPT-4.5	at release	results	none named	below Medium risk overall
2025-01-31	o3-mini	at release	results	none named	below Medium risk overall before mitigations

Every entry is OpenAI's own statement about its own models under its own framework. The rules behind each column are on the alignment page. Frontier Safety Framework Index This site Licence MIT Updated quarterly Retrieved 2026-10-18, 10 days ago Data JSON CSV Our own reading of each developer's published safety framework and model cards. Every field is what the developer says about itself: these are self-assessments under self-written frameworks with no common scale and no external audit, and they are indexed here for exactly that reason. Not a ranking, and not a verification. Cite AI Safety Tracker, "Frontier Safety Framework Index". https://aisafetytracker.org/alignment/#frameworks. Retrieved 18 October 2026. Release Safety Disclosure Index This site Licence MIT Updated monthly Retrieved 2026-10-18, 10 days ago Data JSON CSV Our own reading of the system card, model card or safety report each developer published for each release Epoch AI lists from 2025, joined to Epoch's list. Every cell is what a developer says about its own model under its own framework: whether a card came out with the release, whether it reports dangerous-capability results, which government institutes it names as pre-release testers, and whether it says a risk threshold was reached. None of it is verified. A release Epoch adds after the last review is shown as awaiting review. Cite AI Safety Tracker, "Release Safety Disclosure Index". https://aisafetytracker.org/alignment/#releases. Retrieved 18 October 2026. Notable AI Models Epoch AI Licence CC-BY-4.0 Updated weekly Retrieved 2026-10-18, 10 days ago Inclusion is editorial ("notability criteria"), not exhaustive. Compute figures are frequently estimates; check the per-row confidence and notes columns before treating any value as measured. Cite Epoch AI, "Notable AI Models". https://epoch.ai/data/ai-models. Retrieved 18 October 2026 via AI Safety Tracker, https://aisafetytracker.org/developers/openai/.

Also named as tenant at NEXTDC S7 Sydney (proposed, non-binding memorandum of understanding, December 2025), from the developers' statements in the AI Datacentre Index.

Power is Epoch's estimate from imagery and permits, IT power where it states one. Confidence is Epoch's own label for each owner or user. AI Data Centers Epoch AI Licence CC-BY-4.0 Updated several times a week Retrieved 2026-10-28, today The largest AI sites Epoch has found, mostly in the United States. Epoch estimated in September 2026 that they hold 44% of the world's deployed AI compute, with a 90% interval of 23% to 81%. Power, compute and cost are Epoch's estimates from satellite imagery, permits and company statements; four in five IT power estimates fall within a factor of 1.4 of the true value. The owner is the owner of the chips, not necessarily of the building. Capacity after the date of retrieval is Epoch's projection. Coordinates are read from the hub's map page, which publishes them; the downloads do not. Cite Epoch AI, "AI Data Centers". https://epoch.ai/data/ai-data-centers. Retrieved 28 October 2026 via AI Safety Tracker, https://aisafetytracker.org/developers/openai/. AI Datacentre Index This site Licence MIT Updated quarterly Retrieved 2026-10-28, today Data JSON AI datacentre sites that Epoch AI's hub does not hold, recorded from the statements of developers, named tenants and planning authorities. Australia only so far. A site is included only where a primary source says it is built for AI compute or names the AI deployment inside it. Capacity is as the developer states it, IT or facility power as labelled, and is not an estimate; most of it is proposed and not yet approved. Coordinates are this site's placement of each stated address or area. Cite AI Safety Tracker, "AI Datacentre Index". https://aisafetytracker.org/datacentres/#added. Retrieved 28 October 2026.

• 657 trillion tokens a month, OpenAI, API only, as of March 2026 source
• 1.2 billion weekly users, ChatGPT, as of September 2026 source

Volumes are normalised to a month and are comparable only within one company's own scope. Every series with its scope is on the usage page. AI Usage Disclosure Index This site Licence MIT Updated quarterly Retrieved 2026-10-23, 5 days ago Data 3 datasets Our own compilation of the token volumes, user counts and shares of use that companies and studies have put on the record, each linked to where it was stated. Scopes, units and token definitions differ between companies, so no two figures are comparable without the scope printed beside each. Figures known only through press reporting are marked as such. Not a market share estimate, and not a measure of any company's actual volume beyond what it chose to state. Cite AI Safety Tracker, "AI Usage Disclosure Index". https://aisafetytracker.org/usage/. Retrieved 23 October 2026. AI Usage Disclosure Index This site Licence MIT Updated quarterly Retrieved 2026-10-23, 5 days ago Data 3 datasets Our own compilation of the token volumes, user counts and shares of use that companies and studies have put on the record, each linked to where it was stated. Scopes, units and token definitions differ between companies, so no two figures are comparable without the scope printed beside each. Figures known only through press reporting are marked as such. Not a market share estimate, and not a measure of any company's actual volume beyond what it chose to state. Cite AI Safety Tracker, "AI Usage Disclosure Index". https://aisafetytracker.org/usage/. Retrieved 23 October 2026.