Pre-IPO labs buy independent assurance with real access and publication rights

Setting the norms and standards is already crowded. AVERI is building auditing standards, the AI Evaluator Forum has published conditions covering editorial control, disclosure and redaction that more than 200 people signed, CASRAI has drafted publication rights and access attestation records, and Brookings and FAR.AI are writing up the same diagnosis. A new entrant writing yet another evaluator independence standard would struggle to stand out unless an existing standards body (ISO/IEC JTC 1/SC 42, NIST, CEN-CENELEC or a procurement office) adopted it, or it plugged into accreditation the way Schellman's AIUC-1 accreditation does. A better role there is to be the accreditation and certification body that enforces AEF- or AVERI-style conditions, not another author of the rules. The commercial audit firm idea is less occupied. AVERI is a nonprofit doing pilots, METR, Apollo and the government safety institutes do capability and behaviour testing more than pipeline, provenance and release-control audits, and AIUC is the only well-funded company tying audits to insurance, but it targets agent deployers and has an obvious conflict because it writes the standard, runs the tests, certifies and insures. That leaves room for a buyer-paid, for-profit audit firm. It would review weights provenance, data lineage and release controls under contracts that fix publication rights, sell to safety institutes, EU AI Act GPAI enforcement, insurers and regulated enterprises, and use enclave-based confidential evaluation so labs agree to grant access. The main risks are that frontier labs may simply refuse weight-level access unless regulation forces it, that AVERI or a Big Four firm could move into commercial work, and that insurers may prefer to build this capability through AIUC-type partners.

• AVERI (AI Verification and Evaluation Research Institute)

  Nonprofit founded by Miles Brundage and launched in January 2026 with reportedly $7.5M. Its stated goal is frontier AI auditing with deep, secure access to non-public information. It is drafting auditing standards, runs pilot audits with labs, and in August 2026 reported a double-blind evaluation of Gemini 2.5 Flash-Lite inside a hardware enclave. It is the closest match to both ideas, but it presents itself as a think tank and standards developer, not a commercial audit firm.

• Frontier AI Auditing paper (arXiv 2601.11699)

  Framework paper by Brundage and more than 30 co-authors, published in January 2026. It sets out a rigorous third-party assessment of lab safety and security practices, including assurance levels and access needs. It is effectively the intellectual blueprint for the training-pipeline audit idea.

• AI Evaluator Forum (AEF-1 / September 2026 letter)

  Group of evaluators that proposed minimum operating conditions for evaluators: substantive independence, editorial control, disclosure of access and terms, narrow and time-limited redactions, and protection from retaliation. The letter reportedly had more than 200 signatories. This overlaps directly with the evaluator independence standard idea. I only saw secondary coverage, not the Forum's own page.

• CASRAI NIKOLAI Track N8

  Independent, unendorsed proposal for records on evaluator independence and conflicts of interest, a publication rights clause, and a jointly signed access attestation stating what the evaluator could see (for example, weights). No lab or regulator has adopted it, but it covers much of the same ground as the standard idea.

• AIUC (Artificial Intelligence Underwriting Company) / AIUC-1

  Commercial company that combines a certification standard with insurance. It has raised about $55M, Schellman is accredited to perform its audits, its coverage is backed by Lloyd's, and it wrote a $50M policy for ElevenLabs. It is aimed at agent deployers, not frontier weights or training pipelines. Critics point out that it writes the standard, runs the tests, issues the certificate and sells the insurance.

• Zeltser critique of AIUC-1

  Not a competitor but evidence of demand. It argues that issuer-pays certification resembles the credit-rating conflict of interest, which is exactly the independence problem the standard idea targets.

• FAR.AI / Center for AI Safety AViD workshop

  Research community working on verifying AI development and on confidential, verified auditing without handing over weights. FAR.AI has said publicly that it turned down evaluation contracts because developers would control what got published.

• Brookings: In AI evaluation, access is not evidence

  Policy analysis arguing that an external evaluator working under restrictive access or publication terms may be less independent than it looks. It supports the thesis, and shows the framing is already circulating in policy circles.

• Tinfoil

  Confidential computing company writing about auditing frontier models without weight access. It is an adjacent enabling-technology player and could compete with or supply a weight-level audit firm.

Checked 2026-10-13