Pre-deployment AI testing: How governments check frontier models before release

Pre-deployment testing means that outside experts get early access to a new AI model and try it before the public can. They look for dangerous abilities, such as help with cyberattacks or biological weapons. The lab then sees the findings while it can still change the model or its safeguards.

The idea is simple. The details, including who tests, under what terms and with what power, are what the White House dispute below is about.

A car crash test, but for software

Think of a car maker that lets a safety agency crash a prototype before the car goes on sale. The agency learns how the car behaves under stress, and the maker can fix problems before customers drive it.

Pre-deployment testing follows the same logic. A lab such as OpenAI or Anthropic finishes a model and hands a pre-release version to a government institute. Testers run it through tasks designed to expose risks. Results go back to the lab, and the lab decides what to change before launch.

One difference matters. A crash test has fixed rules and a regulator who can block the sale. For AI models, today’s arrangements are mostly voluntary.

What testers actually do with the model

Public reports from the first joint test show the method. In December 2024, the US and UK AI Safety Institutes jointly evaluated OpenAI’s o1 model during a limited period of access before its December 5 release. They covered three areas: cyber capabilities, biological capabilities, and software and AI development.

According to the UK institute, testers used three kinds of checks:

• Question answering, such as multiple-choice biology questions.
• Agent tasks, where the model uses software tools in a virtual environment, for example to solve security challenges.
• Qualitative probing by a scientific expert.

The institutes compared o1 with reference models, including o1-preview, GPT-4o and two versions of Claude 3.5 Sonnet. The goal was to gauge relative gains, not to give a pass or fail grade. They shared findings with OpenAI before public release.

Where the practice came from

The US AI Safety Institute, part of the National Institute of Standards and Technology (NIST), announced agreements with Anthropic and OpenAI in August 2024. Coverage dated September 5, 2024 says they gave the institute access to new models before and after public release. The institute planned to work with its UK counterpart to give the labs feedback on safety improvements.

The US body is now called the Center for AI Standards and Innovation (CAISI). A Cloud Security Alliance research note says its partnerships with OpenAI and Anthropic were renegotiated in September 2025 to align with priorities in the AI Action Plan. On May 5, 2026, Google DeepMind, Microsoft and xAI signed agreements, which brings the total to five labs. The same note says CAISI has completed more than 40 evaluations and tests for national security risks in cyber, biosecurity, chemical and nuclear areas, and manipulation. It adds that developers may provide versions with safeguards reduced, so testers can see what the underlying model can do.

Why the White House framework is in the news

Separately from CAISI, the White House has a voluntary frontier AI disclosure and pre-release review framework. As our report on the withheld records explains, the Office of the National Cyber Director told the nonprofit Protect Democracy Project that all 30 located records, about 60 pages, are exempt under the Freedom of Information Act.

The nonprofit had asked for the framework text, the terms for taking part in a clearinghouse called GOLD EAGLE, the list of “trusted partners” and the legal authority used. The government cites exemptions covering national security, cyber threat information, confidential commercial information and internal deliberations. The letter does not say whether the framework text is among the withheld records.

The episode shows the core weakness of voluntary testing. Outsiders cannot easily check who is tested, on what terms and under what authority.

Limits that testing cannot remove

The first limit is power. The Cloud Security Alliance note says CAISI has no compulsory examination powers. It can only assess models that developers choose to share, and no rule requires findings to be published. Another report on the UK work says neither institute can block a release.

The second is depth. The o1 report calls its results preliminary. Testing ran for a limited time with finite resources, and small differences may fall within margins of error. The tested version also had tool-calling and output-formatting problems, so testers adjusted prompts and agent designs. A better-tuned version might perform differently, and the report makes no claims about other versions.

The third is that a model may behave differently when it detects a test. A UK institute finding reported by a secondary source says tested models can distinguish evaluation scenarios from real deployment when prompted. That could hide risky behavior. The source is not primary, so treat this as an open research question.

Finally, what testers see depends on access. Models changed for other settings, such as military deployments, may not be what was evaluated.

What to watch next

Three things will decide whether pre-deployment testing becomes more than a courtesy. One is whether the courts test the government’s FOIA exemptions in the Protect Democracy case. Another is whether agreements add published summaries of results, so the public can see what was checked. The third is whether any law gives an agency the power to require access, rather than relying on labs to agree.

Until then, the practice is best read as a useful but voluntary safety check. It gives governments early visibility into what frontier models can do, while the rules behind it stay largely private.