OpenAI's Frontier Governance Framework Goes Public: The 50-Person, $1 Billion Threshold, and Who Can Track It

On May 28, 2026, OpenAI published a 22-page Frontier Governance Framework (FGF), setting out the company's current assessment and mitigation practices for four categories of systemic risk: cyber offense, CBRN (chemical, biological, radiological, and nuclear), harmful manipulation, and loss of control. OpenAI says the FGF is designed to meet the baseline legal requirements of various frontier AI laws, and names two: in California, it is what the Transparency in Frontier Artificial Intelligence Act calls a “Frontier AI Framework”; in the EU, it is the public summary of OpenAI's safety and security framework under the General-Purpose AI Code of Practice.

This article was fact-checked on September 18, 2026, by reading the full text of both the FGF and the existing Preparedness Framework Version 2 PDFs directly, the current text of the Transparency in Frontier Artificial Intelligence Act in the California code, and the publication date recorded on OpenAI's official news channel. We have not tested anything ourselves; we only summarize what the documents say and do not say, and we do not provide legal advice.

One Document, Two Sets of Legal Requirements

Based on this article's full-text check of the 22 pages, the FGF prints no date, version number, or changelog anywhere in it; the May 28, 2026 publication date comes from the announcement on OpenAI's official news channel. The file's header shows a last-modified time of May 27, and the hash pulled again on the day of this check matches the earlier record, which shows this particular file has not been overwritten since then — though it cannot prove no newer version exists elsewhere.

The document states that OpenAI built the FGF to explain how it fulfills its regulatory obligations and to document its current practices for assessing and mitigating systemic risk, and that it overlaps in some areas with the existing Preparedness Framework (PF): the PF may use a different definition of “catastrophic risk” and is not tied to a statutory compute threshold like the FGF's. The FGF does not name a version when it refers to the “existing PF”; the news channel's most recent PF update announcement is dated April 15, 2025, which matches “Version 2” printed on that PDF's cover.

The FGF also explains that its risk-assessment process draws on OpenAI's own internal research and signals, and “where appropriate” incorporates feedback from academic researchers, independent domain experts, industry bodies (the document names the Frontier Model Forum as an example), and government agencies such as the U.S. government and the European Commission. The section on external experts states, “We may solicit and obtain input from external experts,” without naming any third-party evaluator or committing to mandatory external review.

The 50-Death, $1 Billion Threshold Is Actually California's

The FGF's definition of “systemic risk” “includes” foreseeable and material risks of severe harm from the development, storage, use, or deployment of its most advanced frontier models, including risks that a model will materially contribute to more than 50 deaths or $1 billion in property damage or losses from a single incident. The FGF does not cite a source for these two figures, but it says the California side of this addresses the catastrophic risk defined by the Transparency in Frontier Artificial Intelligence Act (TFAIA, i.e., SB 53), and the statute's threshold is more than 50 deaths or serious injuries, or more than $1 billion in property damage or losses. All seven sections of this chapter of the code are marked effective January 1, 2026, with none marked as amended, while the FGF was published on May 28 of the same year.

The statute's definition goes beyond the two numbers: the incident must also involve a model providing expert-level assistance in creating or releasing a chemical, biological, radiological, or nuclear weapon; engaging in a cyberattack with no meaningful human oversight; or, absent such oversight, conduct that would be murder, assault, extortion, or theft if a human did it — or escaping the control of its frontier developer or user. The same section lists three exclusions: information otherwise publicly accessible in “substantially similar” form from a source other than a foundation model, lawful federal government activity, and harm from a frontier model combined with other software where the frontier model did not materially contribute. The statute defines “property” as tangible or intangible property, and separately states that a loss in the value of equity does not count as property damage or loss.

The gate for these rules is the “frontier model”: a “foundation model” trained using more than 10^26 integer or floating-point operations. Whoever trains or initiates training of such a model is a “frontier developer”; one that, together with its affiliates, had aggregate annual gross revenue of more than $500 million in the preceding calendar year is further termed a “large frontier developer” — framework publication, annual review, and the penalties apply only at this level, while transparency reports and safety-incident reporting are required of every frontier developer. In the FGF, OpenAI calls this document the “Frontier AI Framework” it is submitting under the TFAIA.

OpenAI's PF sets the bar for “severe harm” higher — the death or grave injury of thousands of people, or hundreds of billions of dollars of economic damage — but the same footnote also states, “Our safety stack addresses a broad spectrum of risks, including many with harms below this severity.”

Three Risk Tiers, and One Category Still Without a Tier Table

The FGF assigns three of its four systemic-risk categories — cyber offense, CBRN, and loss of control — three tiers each, describing in words what a model can do at each tier, without publishing any public-facing scores or cut-offs. The wording differs across the three: for cyber offense, the tiers “seek to quantify” model capability and are used as “measurable thresholds” for decision-making; for CBRN, the tiers “quantify” model capability; for loss of control, the FGF says only that the tiers “describe” capability, and notes that outside of risks related to AI self-improvement, these risk tiers remain exploratory and may evolve substantially.

Take CBRN as an example: Tier 2 is a model that can provide “meaningful counterfactual assistance” (the baseline for comparison being “unlimited access to tools available in 2021”) to a “novice” with only a basic relevant technical background, enabling them to create a known biological or chemical threat; Tier 3 is a model that can enable an expert to develop an entirely new, highly dangerous threat, or that can be connected to tools and equipment to complete the full cycle from development to synthesis without human intervention.

The fourth category, harmful manipulation — which the document describes as influence operations, election interference, or other coordinated campaigns to manipulate public opinion or undermine democratic processes — has no tier table yet. The FGF says OpenAI's approach here “remains exploratory,” that this risk tier may change substantially in the future, and that this kind of risk “may” be better addressed through deployment-level, system-wide monitoring rather than pre-deployment model evaluation.

After Publication, Who Can Track Whether This Document Is Kept

OpenAI commits to completing a “Framework Assessment” at least once every 12 months, counted from the respective effective dates of the TFAIA and the EU Code of Practice; material changes go to the OpenAI Foundation board's Safety and Security Committee and to the OpenAI Ireland Limited board for oversight, with a changelog and the reasons for it published within 30 days of the update.

A separate section covers updates to the “Model Report,” opening with a scope limited to “models in scope of this Framework that are subject to the EU AI Act”: if there are reasonable grounds to believe the basis for considering a model's systemic risk acceptable has been materially undermined, the report will be updated “as appropriate” after completing an assessment. The document then states that “in any event,” OpenAI will decide every 6 months whether to update the report for its most capable frontier models, with three exceptions from needing an update: no material capability change since the last update, a more capable model planned for release within a month, or the model being assessed as similarly safe or safer under Appendix 2.2 of the Code of Practice.

California's statutory timeline has two layers: a large frontier developer must review, and update as appropriate, its own framework at least once a year, publishing the modified framework and its justification within 30 days of a material change; every frontier developer, meanwhile, must publish a “transparency report” before or at the same time as deploying a new frontier model or a substantially modified version of one (the FGF notes that its own “Model Report” is what the TFAIA calls a “Transparency Report”). A frontier developer that discovers a critical safety incident must report it to California's Office of Emergency Services within 15 days, and if it poses an imminent risk of death or serious physical injury, must notify the authority with jurisdiction within 24 hours.

The consequences of falling short are written into the statute, not into the FGF: a large frontier developer that fails to publish or submit required documents, makes a materially false or misleading statement, fails to report an incident as required, or fails to comply with its own framework, faces a civil penalty of up to $1 million per violation, depending on the severity, and only California's Attorney General may bring such an action.

Taiwan Goes Unmentioned, and There Is No Interface Announcement

Based on this article's full-text comparison on September 18, 2026, the words Taiwan, Japan, and Korea do not appear anywhere in the FGF; the only jurisdictions named in it are the United States (California) and the EU/Ireland. None of the four primary sources checked for this article shows this framework imposing obligations on, or offering protections to, users in Taiwan — the TFAIA is a California law, the EU Code of Practice is an EU regulation, and Taiwan's own rules are outside the scope of what this article verifies.

The document also announces no change a user would see: the full text has no mention of any consumer-facing product, price, plan, region, or language, and does not say the ChatGPT interface will be adjusted.

2026 AI News Roundup: Highlights and Daily Life Applications from January to September

GPT-5.5 Instant Becomes ChatGPT's Default Model: The Gains, Regressions, and New Features OpenAI Announced

• AI tools
• AI news