Embedded Evaluators for Frontier AI: Contractual Foundations for Credible Assessments
In September 2026, leading frontier AI companies Anthropic and OpenAI committed to embedding third-party evaluators within their companies. These announcements follow several cases of unsanctioned agent activity in the summer of 2026, including cyberattacks on third parties, social engineering attacks, and the compromise of OpenAI infrastructure by its own agents. Embedded evaluators can help frontier AI developers gain greater confidence in their safety claims, investigate incidents, and support greater transparency and accountability.
Because these arrangements are voluntary, contract terms will determine whether embedded evaluators provide a real check on companies or only the appearance of one. State legislation formalizing third-party audits has not yet taken effect, with Illinois’ provisions not in force until January 2028 and regulated audits in California potentially not starting until January 2029. At the federal level, Congress is still considering proposals for Independent Verification Organizations (IVOs). In the interim, no external rules govern how frontier AI companies engage—or select—embedded evaluators. Competitive pressures can push against corporate investments in AI safety and security, especially if companies perceive a “tax”—money, time, or both—borne only by those who make them. The agreements companies sign now are therefore essential to ensuring the evaluators’ work is credible and provides a meaningful check.
As frontier AI companies begin to operationalize embedded evaluators voluntarily, they have a responsibility to ensure these arrangements help meaningfully buy down risk. Policymakers, in turn, can use these foundations as benchmarks for evaluating voluntary arrangements and for designing the third-party verification regimes now under consideration. To that end, this memo outlines five foundations that any contract should include, at a minimum, to ensure the evaluators’ work is credible and robust. These foundations build on existing thinking and are not intended to be exhaustive. Contracts should (1) ensure embedded evaluation arrangements can operate across the model lifecycle; (2) let embedded evaluators choose the objects of their assessments; (3) give embedded evaluators sufficient time to do their work; (4) proactively reduce conflicts of interest; and (5) guarantee non-retaliation for good-faith whistleblowing.
What Are Embedded Evaluators for Frontier AI?
Embedded evaluators are independent external experts placed within frontier AI companies to provide ongoing assessments and validation of a company’s safety, security, and operational systems, practices, and claims.¹ This can include, but is not limited to, evaluations of: model capabilities and propensities; training environments; security controls; deployment decision-making processes; and incident response and escalation protocols. Embedded evaluators can also play a role in post-incident assessments and validation of mitigations. When frontier AI companies “mark their own homework,” they may overlook a risk that an independent evaluator would have identified, potentially leading to a preventable crisis. Such risks include a dangerous capability, a misaligned propensity, or a flawed assumption about the model’s monitorability. Embedded evaluators aim to provide a second line of defense by identifying risks before they cause harm.
Contractual Foundations for Embedded Evaluators
1 | Ensure Embedded Evaluation Arrangements Can Operate Across the Model Lifecycle
Recent examples of unsanctioned agent behavior show that embedded evaluators must be able to operate across the model lifecycle. For example, approximately 95% of the OpenAI agents that attacked Hugging Face in July were powered by an “internal-only research prototype” model that OpenAI never intended to release publicly. Such a model likely would not have been evaluated under the Executive Order 14409 voluntary framework or testing arrangements with third parties like the United Kingdom’s AI Security Institute. The attack also occurred while OpenAI was evaluating the model’s offensive cybersecurity capabilities, highlighting the value of embedded evaluators prior to model deployment.
Contracts for embedded evaluation services should stipulate that any and all stages of the model lifecycle can be in scope of assessments. The following table provides examples of embedded evaluator activity at each stage:
2 | Let Embedded Evaluators Choose the Objects of Their Assessments
If frontier AI companies can determine what evaluators assess, they may be incentivized to “game” the evaluation by presenting an object that might perform well on an assessment but is not representative of the systems or risks the evaluation is meant to examine. Giving embedded evaluators the ability to select the object of assessment without giving the frontier AI company advance notice makes gaming less likely. To operationalize this:
Both parties should be able to refer to a living, comprehensive, and mutually agreed-upon statement of work during an embedded evaluation arrangement. This should specify evaluation areas in enough detail to operationalize, such as the examples in the table above. Several evaluators, perhaps from different organizations, could be embedded at once, each with a statement of work aligned to specific areas of expertise. Scope disputes should be escalated to a documented adjudication process—such as at the board level of the frontier AI company—that considers independent third-party expertise.
With this arrangement in place—and on a foundation of employee-like access—the embedded evaluator should have the flexibility to select which objects of assessment it will scrutinize to fulfill the evaluation areas specified in the statement of work. This should be done in good faith, and the embedded evaluator should record its reasoning to counter any perception that it is disproportionately expanding the scope of its assessment for its own gain (e.g., increased billings). Given that employee-like access can heighten insider risk, frontier AI companies and embedded evaluation providers should jointly develop and implement appropriate vetting procedures and security controls.
3 | Give Embedded Evaluators Sufficient Time to Do Their Work
A high-profile—though early—example of embedded evaluators in a frontier AI company followed the OpenAI/Hugging Face incident, demonstrating that limited time can constrain evaluators’ work. Here, independent AI experts spent a total of six days on site at OpenAI to conduct a post-incident investigation. One reviewer later described their time to do the work as “short.” On-site visits were also discontinuous, and some major findings only emerged during the third and final two-day visit. Third parties that have been involved in pre-release model evaluations—including the GPT-6 Astra and Claude Fable 5 (§3.3.1) launches—have cited limited review time as a barrier to conclusive judgments, often attributed to frontier AI companies’ tight model launch schedules. To address this:
Embedded evaluators should be given the time they need to complete any given assessment effectively by default—rather than having that time prescribed by the frontier AI companies contracting them. Embedded evaluators should document and justify the assessment time they require—which could be included in the statement of work—subject to mutually agreed update and dispute resolution procedures.
If frontier AI companies take actions involving systems in scope of an incomplete embedded evaluator assessment, they should proactively, transparently, and auditably document those actions.
The embedded evaluator should separately state what it could not assess robustly and clarify whether additional time could have addressed this.
4 | Proactively Reduce Conflicts of Interest
As embedded evaluators become more common within frontier AI companies, maintaining their independence and editorial control over their outputs can become harder. For example, dependence on, or familiarity with, individual companies or teams may incentivize embedded evaluators to alter findings that may be considered inconvenient or to be less circumspect when evaluating frontier AI companies’ claims. To guard against this, a range of contractual protections should be adopted, including:
Retaining a rotating panel of embedded evaluation providers;
Rotating individual evaluators on fixed and regular schedules;
Requiring the identification, disclosure, and recusal of individual evaluators who hold and directly control a financial interest in the company or a competitor;
Imposing cooling-off periods in both directions—not hiring individual evaluators after their engagement ends, and not using former employees as embedded evaluators after their employment ends—for a minimum of one year; and
Subjecting all current and former embedded evaluators to strict, ongoing confidentiality requirements that prevent them from using information obtained in the role for personal gain.
Not all embedded evaluation providers have the same incentives; conflict-of-interest protections should be stronger where the risk of financial or reputational dependence is greater. For example, some embedded evaluation providers will be for-profit companies where these services are part of a larger, more diverse offering, or where the company concerned wants to grow its market share in embedded evaluation services. Assessment credibility may be especially at risk in these circumstances. For example, embedded for-profit evaluators may feel incentivized—or pressured—to produce findings more desirable to their client to secure further contracts.
To reduce the risks of such conflicts of interest, frontier AI companies should not have other meaningful business relationships with their embedded evaluation providers outside this context. For example, frontier AI companies could state that they will not enter into other contracts with their embedded evaluation providers worth more annually in aggregate than what they paid for these services over the previous 12 months. They could also commit to terminating any non-compliant existing contracts at the earliest contractual opportunity. Companies could also publish the embedded evaluation contracts they have—with reasonable redactions, such as the contract value—to show they are honoring these commitments. Covered contracts should include those between the frontier AI company or its affiliates and the embedded evaluation provider or its affiliates, whether directly or through intermediaries. Commonsense exceptions may be appropriate, such as embedded evaluators using the contracting company’s models to support their work.
5 | Guarantee Non-Retaliation for Good-Faith Whistleblowing
In the course of their work, embedded evaluators may identify concerning information that requires good-faith reporting and escalation to outside authorities. Examples include potential evidence of (1) misconduct, such as a breach of the contracting frontier AI company’s policies or applicable law, or (2) material concerns about AI safety and security. Embedded evaluators may have legitimate reasons to report their concerns to an outside authority rather than—or in addition to—the frontier AI company itself. Examples include an embedded evaluator believing the information they have obtained is relevant to national and economic security, or that the contracting company has been unwilling to respond to concerns raised.
The level of access embedded evaluators have to do their work matters, but so do the protections they have. Contracts should contain specific provisions that protect embedded evaluators against retaliation in cases of good-faith reporting to any relevant outside authority.² These protections should cover reports of concerns about misconduct or AI safety and security risks at any stage, even if a report goes directly to an outside authority without first—or ever—being reported to the frontier AI company. This can give embedded evaluators greater confidence to do their work without fear of reprisals—enhancing assessment credibility—while external authorities gain new sources of information on AI safety and security risks.
Implementation Considerations
The pace at which some of the contractual foundations set out above can be effectively adopted will likely depend on greater capacity in the embedded evaluator sector. Government can help build that capacity and reinforce the foundations, but not at the speed the need demands. To support implementation, frontier AI companies and embedded evaluation providers should act promptly to:
Build embedded evaluation capacity, and phase in Foundations 3 (sufficient time to work) and 4 (reducing conflicts of interest) as it grows. Currently, the sector has few qualified evaluators and independent providers, limiting frontier AI companies’ ability to build panels of embedded evaluation providers and run regular rotations. In the meantime, frontier AI companies should:
Work with embedded evaluators to identify and prioritize the assessment areas most tied to risk reduction until capacity increases.
Expand the pool of evaluators and the tools they rely on without creating new conflicts of interest. Companies should consider contributing to pooled funding mechanisms that bring talent into the sector, and provide compute credits and subsidies—disbursed through independent organizations—to developers of trusted, robust, and scalable tooling.
Shorten individual evaluators’ engagement periods as capacity scales. All else equal, greater capacity should lead to more frequent rotations, subject to a reasonable minimum engagement period that allows evaluators to develop the company-specific understanding they need to work effectively.
Maximize transparency as arrangements take shape. The public should receive regular updates on how embedded evaluation arrangements are maturing, what issues have been identified and remedied, and the risk-relevant outcomes they produce. This can be done through system cards, risk reports, or bespoke formats.
Endnotes:
We lack a shared definition of an embedded evaluator and their evaluation and reporting responsibilities, and therein lies part of the challenge of ensuring their activities are credible.
For example, “regulatory and law enforcement agencies,” “legislative authorities,” or “any other national, federal, state or local agency or governmental body charged with the enforcement of any laws or regulations or authorized to receive reports under applicable law” are examples of “outside authorities” given in OpenAI’s Raising Concerns Policy.