OpenAI is urging US lawmakers to impose mandatory safety requirements on developers of the most powerful AI systems, arguing that advances in AI are moving quickly enough that voluntary safeguards are no longer sufficient.

The ChatGPT maker said in a statement that the rules should be based on what AI systems are capable of doing and should concentrate on a small number of well-resourced companies developing frontier models. It cautioned against extending the same requirements to startups and researchers whose systems operate well below that level.

OpenAI’s proposal calls for a federal framework that would require common testing and independent assessments of advanced models. It also wants clearer rules for reporting serious AI incidents and stronger cybersecurity protections around frontier development.

OpenAI tied its push for stronger safeguards to concerns that AI is beginning to accelerate parts of the research used to develop more capable systems. Fully autonomous recursive self-improvement, in which an AI system independently produces increasingly capable successors, is not happening today, OpenAI said. But AI agents can already perform some research tasks that would take skilled researchers several days, according to the company.

OpenAI said governments should establish ways to measure that progress and determine when development should be slowed or stopped if adequate safeguards cannot be maintained.

The company also endorsed four California AI safety bills. Gov. Gavin Newsom on Wednesday signed two of them, SB 813 and AB 1405, establishing frameworks for independent AI assessments and standards for AI auditors.

Alongside regulation, OpenAI wants frontier AI developers to adopt common monitoring practices, particularly as models gain greater autonomy and access to tools. It has also called for compatible international approaches as advanced models and AI expertise spread across borders.

What this could mean for CIOs

Under the approach OpenAI is advocating, the immediate regulatory burden would largely fall on frontier AI developers rather than their enterprise customers, according to Pareekh Jain, CEO of Pareekh Consulting. But CIOs could encounter downstream effects in how they govern the models they deploy.

“AI governance would increasingly resemble cybersecurity governance as enterprises would need to know which models are being used, what they can do, what data and systems they can access, and how much autonomy they have,” Jain said.

A common regulatory framework could make some aspects of enterprise AI governance more predictable by establishing consistent expectations for model developers.

Lian Jye Su, chief analyst at Omdia, compared the potential effect to technical standards in the telecom industry, where common requirements allow companies to work from a broadly shared framework. Independent safety assessments and standards for AI auditors could give CIOs greater confidence that vendors are being evaluated against more consistent criteria, he said.

Enterprises would still need to govern their own AI infrastructure, but greater standardization could make it easier to apply common practices across vendors and business units.

Higher-risk systems are also likely to demand stronger controls as they gain greater autonomy, Jain said.

Vendor oversight could become another pressure point. Contracts may need to account for changes to underlying models and give enterprise customers greater visibility into incidents that could affect their deployments. Jain said agreements should include audit rights, incident-notification provisions, and enough portability to make switching providers practical.

As AI becomes more deeply embedded in business operations, Su said CIOs should consider treating AI security as a dedicated program rather than simply adding it to existing technology governance.

That includes maintaining an up-to-date inventory of models and a registry of AI agents, classified according to their risk and business impact. Su also called for cross-functional AI governance bodies and defined human-oversight requirements for systems involved in high-stakes decisions.

CIOs may increasingly need to show not only that controls exist, but that they are consistently applied and documented. Charlie Dai, principal analyst at Forrester, said enterprises should expect greater emphasis on documenting how AI systems are classified, tested and monitored, particularly for higher-risk uses.

He said CIOs should also strengthen AI asset management and observability, while introducing red-teaming and validation testing for systems that carry greater business or regulatory risk. AI-specific incident-response playbooks would give organizations a defined process for handling model failures or other serious AI-related events.

Potential impact on the AI vendor landscape

OpenAI said a federal framework should address frontier risks without weakening competition or entrenching incumbents, arguing that public standards and independent verification could reduce the concentration of power now held by frontier laboratories.

The cost of complying with tougher safety requirements could favor companies with the resources to absorb them. Jain said large frontier-model developers such as OpenAI, Google and Anthropic would be better positioned to bear those costs.

Dai similarly said that capability-based regulation could reinforce the advantage of well-funded frontier labs because extensive testing, security, and reporting requirements would increase the cost of competing at that level.

Su, however, said that we need not leave enterprises dependent on a handful of proprietary providers. Open-weight and smaller models could remain part of a multi-model strategy if they satisfy applicable security requirements.

Even if smaller and open-weight models remain available, tougher enterprise governance and assurance standards could narrow the pool of suppliers CIOs are willing to use for sensitive workloads.

That possibility makes portability an architectural consideration for CIOs, particularly where enterprise applications depend on proprietary model APIs.

Jain recommended maintaining multi-model architectures and negotiating contracts that support portability, reducing the operational cost of switching providers if regulatory requirements or model capabilities change.