Comparison table

presenting our findings

Our methodology allows for extensive, apples-to-apples comparisons between companies on over 65 different risk management criteria.

The table below shows both overall assessment scores, and scores for each criterion. We also present the best in class score for each criterion, to encourage other companies to adopt these industry-leading risk management practices. 

For more detail on the rationale behind each assessment score, you can click on the score itself to see a detailed explanation with supporting quotes. To see a company's full breakdown, you can click on the company icon.

For more detail on how scores are calculated, you can click to see our methodology at the button below.

See our methodology

Filter:
  • All
  • Frontier Companies
Click logos to visit company pages
Overall score
35%
34%
33%
33%
24%
20%
18%
18%
16%
11%
10%
8%
1. Risk Identification
41%
33%
62%
49%
17%
27%
22%
11%
14%
12%
7%
7%
1.1 Classification of Applicable Known Risks (40%)
63%
63%
90%
50%
25%
50%
25%
13%
18%
25%
13%
10%
1.1.1 Risks from literature and taxonomies are well covered (50%)
75%
75%
90%
75%
25%
75%
50%
25%
25%
50%
25%
10%
1.1.2 Exclusions are clearly justified and documented (50%)
50%
50%
90%
25%
25%
25%
0%
0%
10%
0%
0%
10%
1.2 Identification of Unknown Risks (Open-ended red teaming) (20%)
10%
0%
35%
43%
7%
7%
0%
10%
7%
0%
0%
0%
1.2.1 Internal open-ended red teaming (70%)
10%
0%
50%
50%
10%
10%
0%
10%
10%
0%
0%
0%
1.2.2 Third party open-ended red teaming (30%)
10%
0%
0%
25%
0%
0%
0%
10%
0%
0%
0%
0%
1.3 Risk modeling (40%)
35%
19%
47%
52%
15%
13%
31%
11%
14%
4%
4%
9%
1.3.1 The company uses risk models for all the risk domains identified
and the risk models are published (with potentially dangerous
information redacted) (40%)
50%
25%
75%
50%
10%
25%
50%
10%
25%
10%
10%
10%
1.3.2 Risk modeling methodology (40%)
12%
11%
30%
43%
2%
9%
2%
4%
9%
0%
0%
11%
1.3.2.1 Methodology precisely defined (70%)
10%
10%
25%
50%
0%
10%
0%
0%
0%
0%
0%
0%
1.3.2.2 Mechanism to incorporate red teaming findings (15%)
10%
0%
10%
25%
0%
0%
0%
0%
10%
0%
0%
0%
1.3.2.3 Prioritization of severe and probable risks (15%)
25%
25%
75%
25%
10%
10%
10%
25%
50%
0%
0%
75%
1.3.3 Third party validation of risk models (20%)
50%
25%
25%
25%
50%
0%
50%
25%
0%
0%
0%
0%
2. Risk Analysis and Evaluation
19%
28%
12%
36%
18%
21%
20%
16%
11%
14%
7%
5%
2.1 Setting a Risk Tolerance (35%)
7%
16%
7%
22%
7%
5%
13%
7%
3%
9%
3%
3%
2.1.1 Risk tolerance is defined (80%)
8%
20%
8%
28%
8%
3%
17%
8%
3%
12%
3%
3%
2.1.1.1 Risk tolerance is at least qualitatively defined for all risks (33%)
25%
50%
25%
75%
25%
10%
50%
25%
10%
25%
10%
10%
2.1.1.2 Risk tolerance is expressed at least partly quantitatively as a combination of scenarios (qualitative) and probabilities (quantitative) for all risks (33%)
0%
10%
0%
10%
0%
0%
0%
0%
0%
10%
0%
0%
2.1.1.3 Risk tolerance is expressed fully quantitatively as a product of severity (quantitative) and probability (quantitative) for all risks (33%)
None
0%
0%
0%
0%
0%
0%
0%
0%
0%
0%
0%
0%
2.1.2 Process to define the tolerance (20%)
0%
0%
0%
0%
0%
10%
0%
0%
0%
0%
0%
0%
2.1.2.1 AI developers engage in public consultations or seek guidance from regulators where available (50%)
0%
0%
0%
0%
0%
10%
0%
0%
0%
0%
0%
0%
2.1.2.2 Any significant deviations from risk tolerance norms established in other industries is justified and documented (e.g., cost-benefit analyses) (50%)
0%
0%
0%
0%
0%
10%
0%
0%
0%
0%
0%
0%
2.2 Operationalizing Risk Tolerance (65%)
26%
35%
16%
44%
24%
30%
24%
22%
16%
17%
9%
6%
2.2.1 Key Risk Indicators (KRI) (30%)
35%
35%
18%
59%
22%
41%
16%
21%
15%
21%
15%
15%
2.2.1.1 KRI thresholds are at least qualitatively defined for all risks (45%)
50%
50%
25%
75%
25%
75%
25%
25%
10%
25%
10%
10%
2.2.1.2 KRI thresholds are quantitatively defined for all risks (45%)
25%
25%
10%
50%
10%
10%
10%
25%
0%
25%
0%
0%
2.2.1.3 KRIs also identify and monitor changes in the level of risk in the external environment (10%)
10%
10%
25%
25%
10%
25%
0%
0%
10%
0%
0%
10%
2.2.2 Key Control Indicators (KCI) (30%)
18%
32%
11%
37%
25%
37%
25%
18%
6%
13%
4%
6%
2.2.2.1 Containment KCIs (35%)
18%
5%
25%
38%
45%
43%
25%
25%
13%
25%
5%
13%
2.2.2.1.1 All KRI thresholds have corresponding qualitative containment KCI thresholds (50%)
25%
10%
50%
75%
90%
75%
50%
50%
25%
50%
10%
25%
2.2.2.1.2 All KRI thresholds have corresponding quantitative containment KCI thresholds (50%)
10%
0%
0%
0%
0%
10%
0%
0%
0%
0%
0%
0%
2.2.2.2 Deployment KCIs (35%)
13%
43%
5%
25%
25%
43%
25%
25%
5%
13%
5%
5%
2.2.2.2.1 All KRI thresholds have corresponding qualitative deployment KCI thresholds (50%)
25%
75%
10%
25%
50%
75%
50%
50%
10%
25%
10%
10%
2.2.2.2.2 All KRI thresholds have corresponding quantitative deployment KCI thresholds (50%)
0%
10%
0%
25%
0%
10%
0%
0%
0%
0%
0%
0%
2.2.2.3 For advanced KRIs, assurance process KCIs are defined (30%)
25%
50%
0%
50%
0%
25%
25%
0%
0%
0%
0%
0%
2.2.3 Pairs of thresholds are grounded in risk modeling to show that risks remain below the tolerance (20%)
25%
25%
10%
25%
25%
25%
10%
25%
25%
10%
10%
0%
2.2.4 Policy to put development on hold if the required KCI threshold cannot be achieved, until sufficient controls are implemented to meet the threshold (20%)
25%
50%
25%
50%
25%
10%
50%
25%
25%
25%
10%
0%
3. Risk Treatment
30%
38%
28%
20%
24%
20%
6%
23%
14%
8%
8%
12%
3.1 Implementing Mitigation Measures (50%)
30%
37%
27%
15%
23%
24%
8%
38%
19%
9%
4%
12%
3.1.1 Containment measures (35%)
25%
40%
49%
6%
34%
19%
0%
74%
30%
6%
0%
19%
3.1.1.1 Containment measures are precisely defined for all KCI thresholds (60%)
25%
50%
75%
10%
50%
25%
0%
90%
50%
10%
0%
25%
3.1.1.2 Proof that containment measures are sufficient to meet the thresholds (40%)
25%
25%
10%
0%
10%
10%
0%
50%
0%
0%
0%
10%
3.1.1.3 Strong third party verification process to verify that the containment measures meet the threshold (100% if 3.1.1.3 > [60% x 3.1.1.1 + 40% x 3.1.1.2])
25%
25%
10%
0%
10%
0%
0%
0%
0%
0%
0%
10%
3.1.2 Deployment measures (35%)
25%
40%
25%
19%
30%
40%
19%
25%
19%
15%
10%
15%
3.1.2.1 Deployment measures are precisely defined for all KCI thresholds (60%)
25%
50%
25%
25%
50%
50%
25%
25%
25%
25%
10%
25%
3.1.2.2 Proof that deployment measures are sufficient to meet the thresholds (40%)
25%
25%
25%
100%
0%
25%
10%
25%
10%
0%
10%
0%
3.1.2.3 Strong third party verification process to verify that the deployment measures meet the threshold (100% if 3.1.2.3 > [60% x 3.1.2.1 + 40% x 3.1.2.2])
25%
25%
0%
0%
25%
0%
0%
0%
0%
0%
0%
0%
3.1.3 Assurance processes (30%)
43%
30%
5%
22%
2%
10%
4%
10%
7%
5%
0%
0%
3.1.3.1 Credible plans towards the development of assurance processes (40%)
25%
25%
10%
25%
0%
25%
0%
25%
10%
10%
0%
0%
3.1.3.2 Evidence that the assurance processes are enough to achieve their corresponding KCI thresholds (40%)
50%
50%
0%
10%
0%
0%
10%
0%
10%
0%
0%
0%
3.1.3.3 The underlying assumptions that are essential for their effective implementation and success are clearly outlined (20%)
75%
10%
10%
50%
10%
10%
0%
10%
0%
10%
0%
0%
3.2 Continuous Monitoring and Comparing Results with Pre-determined Thresholds (50%)
29%
40%
29%
25%
25%
17%
3%
8%
9%
7%
13%
12%
3.2.1 Monitoring of KRIs (40%)
24%
39%
50%
30%
31%
19%
2%
13%
2%
16%
23%
0%
3.2.1.1 Justification that elicitation methods used during the evaluations are comprehensive enough to match the elicitation efforts of potential threat actors (30%)
50%
90%
75%
50%
50%
25%
0%
25%
0%
0%
0%
0%
3.2.1.2 Evaluation frequency (25%)
10%
10%
75%
25%
50%
25%
0%
0%
0%
50%
90%
0%
3.2.1.3 Description of how post-training enhancements are factored into capability assessments (15%)
10%
25%
50%
50%
0%
25%
0%
0%
10%
0%
0%
0%
3.2.1.4 Vetting of protocols by third parties (15%)
25%
10%
0%
10%
25%
10%
0%
10%
0%
25%
0%
0%
3.2.1.5 Replication of evaluations by third parties (15%)
10%
25%
10%
10%
0%
0%
10%
25%
0%
0%
0%
0%
3.2.2 Monitoring of KCIs (40%)
35%
43%
4%
13%
21%
10%
0%
0%
10%
0%
10%
13%
3.2.2.1 Detailed description of evaluation methodology and justification that KCI thresholds will not be crossed unnoticed (40%)
50%
50%
10%
25%
25%
25%
0%
0%
25%
0%
25%
25%
3.2.2.2 Vetting of protocols by third parties (30%)
25%
50%
0%
0%
25%
0%
0%
0%
0%
0%
0%
0%
3.2.2.3 Replication of evaluations by third parties (30%)
25%
25%
0%
10%
10%
0%
0%
0%
0%
0%
0%
10%
3.2.3 Transparency of evaluation results (10%)
43%
64%
64%
43%
21%
21%
21%
21%
43%
0%
0%
43%
3.2.3.1 Sharing of evaluation results with relevant stakeholders as appropriate (85%)
50%
75%
75%
50%
25%
25%
25%
25%
50%
0%
0%
50%
3.2.3.2 Commitment to non-interference with findings (15%)
None
0%
0%
0%
0%
0%
0%
0%
0%
0%
0%
0%
0%
3.2.4 Monitoring for novel risks (10%)
10%
10%
10%
30%
25%
38%
5%
5%
5%
0%
0%
25%
3.2.4.1 Identifying novel risks post-deployment: engages in some process (post deployment) explicitly for identifying novel risk domains or novel risk models within known risk domains (50%)
10%
10%
10%
10%
25%
50%
10%
10%
10%
0%
0%
50%
3.2.4.2 Mechanism to incorporate novel risks identified post-deployment (50%)
10%
10%
10%
50%
25%
25%
0%
0%
0%
0%
0%
0%
4. Risk Governance
50%
39%
33%
28%
38%
12%
23%
21%
23%
10%
18%
7%
4.1 Decision-making (25%)
44%
40%
56%
36%
54%
15%
44%
34%
44%
19%
13%
5%
4.1.1 The company has clearly defined risk owners for every key risk identified and tracked (25%)
50%
10%
75%
50%
0%
0%
75%
25%
50%
0%
0%
10%
4.1.2 The company has a dedicated risk committee at the management level that meets regularly (25%)
0%
0%
0%
10%
90%
0%
0%
10%
0%
0%
0%
0%
4.1.3 The company has defined protocols for how to make go/no-go decisions (25%)
50%
75%
75%
75%
75%
50%
50%
75%
50%
50%
50%
10%
4.1.4 The company has defined escalation procedures in case of incidents (25%)
75%
75%
75%
10%
50%
10%
50%
25%
75%
25%
0%
0%
4.2. Advisory and Challenge (20%)
50%
48%
17%
75%
25%
14%
4%
14%
35%
5%
12%
6%
4.2.1 The company has an executive risk officer with sufficient resources (16.7%)
75%
0%
25%
75%
25%
0%
0%
0%
0%
0%
0%
25%
4.2.2 The company has a committee advising management on decisions involving risk (16.7%)
50%
90%
0%
10%
0%
10%
0%
0%
25%
0%
25%
0%
4.2.3 The company has an established system for tracking and monitoring risks (16.7%)
75%
75%
25%
25%
25%
50%
25%
25%
75%
10%
0%
10%
4.2.4 The company has designated people that can advise and challenge management on decisions involving risk (16.7%)
10%
50%
25%
10%
50%
0%
0%
10%
50%
0%
10%
0%
4.2.5 The company has an established system for aggregating risk data and reporting on risk to senior management and the Board (16.7%)
90%
75%
25%
25%
50%
25%
0%
50%
10%
10%
10%
0%
4.2.6 The company has an established central risk function (16.7%)
0%
0%
0%
50%
0%
0%
0%
0%
50%
10%
25%
0%
4.3 Audit (20%)
38%
25%
38%
30%
58%
10%
10%
25%
0%
5%
5%
13%
4.3.1 The company has an internal audit function involved in AI governance (50%)
25%
0%
50%
50%
25%
10%
25%
0%
0%
0%
0%
0%
4.3.2 The company involves external auditors (50%)
50%
50%
25%
10%
90%
10%
10%
50%
0%
10%
10%
25%
4.4 Oversight (20%)
58%
45%
5%
5%
0%
5%
0%
0%
0%
5%
45%
0%
4.4.1 The Board of Directors of the company has a committee that provides oversight over all decisions involving risk (50%)
25%
90%
10%
10%
0%
0%
0%
0%
0%
10%
90%
0%
4.4.2 The company has other governing bodies outside of the Board of Directors that provide oversight over decisions (50%)
90%
0%
0%
0%
0%
10%
0%
0%
0%
0%
0%
0%
4.5 Culture (10%)
67%
20%
37%
28%
47%
7%
58%
17%
37%
12%
8%
7%
4.5.1 The company has a strong tone from the top (33.3%)
50%
25%
10%
10%
50%
10%
50%
50%
25%
25%
25%
10%
4.5.2 The company has a strong risk culture (33.3%)
50%
10%
10%
0%
0%
10%
50%
0%
75%
10%
0%
10%
4.5.3 The company has a strong speak-up culture (33.3%)
100%
25%
90%
75%
90%
0%
75%
0%
10%
0%
0%
0%
4.6 Transparency (5%)
63%
58%
75%
50%
72%
28%
37%
67%
37%
20%
32%
28%
4.6.1 The company reports externally on what their risks are (33.3%)
90%
75%
75%
50%
50%
10%
75%
50%
10%
50%
10%
50%
4.6.2 The company reports externally on what their governance structure looks like (33.3%)
90%
75%
90%
75%
75%
25%
10%
75%
50%
10%
75%
10%
4.6.3 The company shares information with industry peers and government bodies (33.3%)
10%
25%
50%
25%
90%
50%
25%
75%
50%
0%
10%
25%
Up to date as of July 2026