How the EU AI Office Can See the Choices Behind Frontier Labs’ Safety Claims

Since Aug. 2, 2026, the European Commission can enforce general-purpose AI obligations under the AI Act through its AI Office, demanding documentation (Art 91), running its own evaluations (Art 92), and requesting corrective measures (Art 93). Hungary has proposed putting EU safety teams inside frontier labs.

While access is necessary, the Office is enforcing against definitions it has little power over and that are not easily comparable. Compliance, frontier safety, and what “frontier” even means are still partly defined and acted upon according to providers’ own criteria and internal know-how. More importantly, this makes the Office blind to a crucial kind of evidence. AI safety is not only about reporting technical findings or methods. It involves taking positions about what “safe” means, about what counts as a conclusive evaluation, and when to stop testing for safety-relevant features. These decisions shape a model’s safety profile. Yet, providers are not held accountable for them, nor are they compelled to disclose them as decisions. Access is the first step to achieve that.

The solution I propose is a public taxonomy that makes these choices visible without requiring providers to make them in a specific way. The possibility to contest these choices in fact depends on them being visible and being visible as non-technical choices. Otherwise, these judgments give external actors nothing to push against, and no basis for attributing responsibility when something goes wrong.

How judgment calls pass as technical and necessary choices

In practice, enforcement of the AI Act runs through the Code of Practice, a voluntary instrument providers sign to create a presumption of compliance with Articles 53 and 55. It sets out important commitments, naming the steps of development where disclosure is owed. But it does not say what counts as relevant and how it is described and leaves that definition to providers.

A provider can meet requirements while disclosing little, or disclose a great deal because it chooses to, in which case the disclosure could align with safety purposes only contingently. Some sections of the Code do demand justification of, for instance, risk-tier acceptance criteria in the Safety and Security chapter. But they still leave space for discretion over what counts as an adequate justification and how much to justify. Other non-technical choices across models’ lifecycles remain untraced and unsystematized.

Three instances show what this means: one where a value choice reads as a method, one where a concept is contested and cannot be settled by better science, and one of corporate discretion.

The first instance can be found in OpenAI’s recent GPT-6 Astra System Card. Astra is trained to refuse dangerous requests. If, when evaluated for what it can do, it refuses to pursue a user request, the refusal is per se ambiguous about what this means. OpenAI decided to count refusals as successes (GPT-6 Astra System Card, §10.1.1), treating the model as capable and simply not wanting to help whenever it declines. This is a choice about which error to prefer, whether over-attributing capability or missing it. It is defensible, and it is disclosed to some extent. Nothing in the system card differentiates this choice from a technical one, nor is OpenAI compelled to.

The second example appears in the same card (GPT-6 Astra System Card, §9), reporting that monitoring Astra’s reasoning became harder and less reliable. OpenAI deployed anyway, treating the model’s underlying alignment as the main safeguard and claiming they will not accept further loss of monitorability. More evaluators or better science will not automatically bridge this gap. Extra experts still grade against standards set by providers, and while better methods close the gap where a science is immature, no amount of methodological maturity alone settles what “harmful” or “good evaluation” mean.

The third case is about high-level corporate decisions. Anthropic did not give the UK AISI pre-release access to Mythos 5.1, then Dario Amodei’s “We Must Pace the Frontier” committed the company to embedded third-party evaluators just a few days later. Either decision could have been made in good faith, commercial judgment, external pressures, or all combined. We might just be lucky that this happens to point in a safety-promoting direction. Good faith and other non-safety incentives ultimately end up doing work regulators ought to be doing.

These decisions may all be defensible. But a model’s safety profile is built out of dozens of such calls, and a generic instruction to disclose acceptability criteria reaches none of them. Regulators must outline exactly where they want justification to happen, even if they do not set the standard for what justification should look like.

A regulator-owned taxonomy

Asking regulators to set fixed safety standards is overly optimistic and may be the wrong target given how fast the technology moves. The next Code revision should instead make value-laden decisions disclosable and comparable across time and providers, through a regulator-owned taxonomy of the steps where non-technical judgment calls can happen across a model’s lifecycle. This would let the Office track patterns across providers (which positions cluster, which labs are consistent outliers and why), and challenge the choices behind them. Importantly, judgment that exists only as informal practice inside a handful of labs becomes a shared and readable record, so the Office stops depending on providers' word for where the relevant information sits.

First, providers locate their model within a public taxonomy they did not create. The Office maintains a public taxonomy of the steps across a model’s lifecycle where value-laden choices are inevitable. This could follow the Code’s existing stages, from risk identification through post-market monitoring. A first version need not wait for providers: all three examples above come from public documents. Today the Code asks providers to justify conduct and criteria they set themselves, so that providers can define what decisions are worth disclosing, at what level, and for what purpose. Under the taxonomy, they would instead locate each decision, and the principles behind it, in a systematized and more fine-grained structure they did not establish. This reduces the Office’s dependence on providers. If we do not know what decisions they make at which step, we cannot enforce against them.

Second, the checking can and should be outsourced. Independent accredited bodies can be delegated to audit whether the provider’s reported placement is honest. This is a genuine measurement against a fixed public reference. Evaluators never decide which position is correct, only whether the evidence produced matches declared positions.

Third, the taxonomy records positions rather than grading them and bites on honesty. The taxonomy does not aggregate judgments into single statements that a model is safe, and providers can adopt different principles across steps while reporting honestly. Enforcement would at first bite on honest judgment rather than on verdict to encourage honesty. What can be adjudicated is whether the provider placed its model faithfully, and said where its judgment sat when more than one position was available.

Fourth, the framework and the placements stay contestable. Where a disclosed position and evidence come apart, providers can be investigated under the AI Act. The Office remains responsible for filling gaps in the taxonomy. Because the structure is common across frontier labs, positions also become comparable over time. Finally, making these choices legible and comparable allows regulators to assess where the frontier of AI safety lies and how much it really tracks the frontier of capabilities.

The AI office has the necessary powers

The Office does not need more substantial powers to enforce this. The next Code of Practice revision could define the map with the help of the Scientific Panel (Art 68) on the basis of the Code’s demonstrated shortcomings. Art 91 covers documentation requests, which could be structured against this new taxonomy. Under Art 92, the Office evaluations could test placements against the taxonomy and misplacement or missing entry could count as incorrect or misleading information under Art 101.

Placements would be public; the evidence behind them, which may be commercially or security-sensitive, could go through the confidential channels the Office already provides. This sharpens enforcement, as outliers become visible. With time, the Office could further complement this with its own guidelines about general value-laden trade-offs, such as prioritizing privacy in some domains.

The taxonomy is ultimately a middle ground between standardizing frontier safety and industry self-regulation and could reduce the Office’s epistemic dependence on frontier labs. Even embedded evaluators, with access to everything, would still need to know which decisions to look at. The Office could target its own evaluations at unusual steps, structure documentation requests more precisely, and trace which judgment call mattered when something goes wrong. Without such a structure, nothing breaks the cycle. Providers hold control over what is safety-relevant and how it is described. Described as technical decisions, judgments draw no scrutiny, and without scrutiny, no one can describe them otherwise.