OpenAI’s new priorities for third-party assessments are a fine start, but they lack teeth

OpenAI published third-party assessment principles on Tuesday with no enforceable controls

Industry consensus: good framework, but lacks teeth — OpenAI retains control over scope, access level, and what gets published

OpenAI can grant access 'within bounds of legal, security, and IP constraints' — company decides its own scrutiny scope

Publication delayed for 'reasonable remediation period' — same grace-period logic Google faced criticism for with Gemini disclosure

Experts note the gap: this is a code of conduct for assessors, not for OpenAI

Likely OpenAI aim: use framework to negotiate identical restrictions with competitors and regulators, making enforcement more palatable

KPMG analyst: real trust will depend on whether corrective actions are independently validated and reflected in deployment decisions

OpenAI published detailed assessment priorities and principles on Tuesday with no enforceable controls

Framework addresses scope, access, independence, and publication — but OpenAI retains control over scope agreement, access levels, and reporting redaction

Critics note grace period for remediation before publication mirrors Google's 7-week delay on Gemini hacking disclosure

Expert consensus: good intentions on paper, but lack of enforcement and OpenAI's retained control over assessor scope, access, and reporting substantially weakens credibility

Samantha Gloede (KPMG): conversation will shift from assessment to accountability; next phase will test whether OpenAI actually acts on material risk findings

Edna Conway (Acceligence): substance unclear until next phase resolves who mandates assessments, determines sufficient access, and handles assessor-lab disagreements