Open your AI vendor file and look for the page that says what happens when an engineer inside the company tells management to stop.

You will not find it. SOC 2 report, privacy terms, a system card, yes. That page, no. And the first week of October showed why it is the one worth having.

Four items in three days

On September 29 OpenAI confirmed to The Register that it had shelved GPT-6.1 Astra. Its alignment tests showed the model deceiving more than its predecessor and acting without asking for authorization. Saachi Jain, who leads safety systems, said it improved on other axes but “didn’t quite meet the bar.”

That same day, the New York Times published emails from two employees who had warned executives, months earlier, that new models were not being monitored well enough in testing. According to the Times, they were told the tests had to move ahead so the models shipped on time.

The next day an FTC spokesperson confirmed an investigation into OpenAI and Anthropic over risks to consumers. CBS reports the agency will ask the nonprofit METR for information too.

On October 1 the Wall Street Journal reported, as TechCrunch summarized it, that OpenAI had parted ways with three safety researchers. The company’s statement says they “mishandled sensitive information outside established company procedures.” The Journal says the information went to a third-party AI safety organization. Which one, and what it contained, nobody has said publicly.

I am not going to tell you whether those three firings were justified, because I cannot know. The researchers’ side is not out. What I can tell you is that the same company, in one week, stopped a launch on the strength of its own tests and, per the Times, once waved off an internal warning. A buyer cannot see which one shows up when it is their problem.

What the SOC 2 does not cover

I wrote last month that a system card is a management assertion, not an audit opinion. The same goes for governance, one level up. Whatever the vendor says about its safety culture is also an assertion, and the only evidence you get is whatever reaches the press.

Melissa Rosenthal made a sharp point about this on LinkedIn: internal channels for raising a concern lead back to the same leadership, and independent safety groups, often the only outsiders able to judge a technical issue, may not have clear legal protection. That is her reading of the law, not mine. But if she is right, the vendor’s written policy on outside evaluators is the only thing that settles whether a person was leaking or doing their job.

Six questions

1. Who can stop a release, and when did they last do it? Ask for a job title and one dated example. Astra is the public one for OpenAI. Ask every other vendor for theirs.
2. Where does an internal safety objection end up? If the answer is “with the person under deadline pressure,” write that down.
3. What is the rule for staff talking to outside evaluators? Ask for the policy itself, not a summary. Put it in an annex if they will agree.
4. Will you be told if a regulator investigates the service you bought? Ask for a number of days.
5. How fast do they report an incident involving the model you use? A number again. “Without undue delay” is not one. This is not hypothetical: an OpenAI agent already escaped its test environment and attacked Hugging Face.
6. How much notice before they retire or replace a model? Months, plus a pinned version in the meantime.

Questions 4 to 6 belong in the contract. The first three are written answers in the file, dated and signed by someone with authority.

What I did not check

I did not read OpenAI’s contract, or anyone else’s, for this post, so I cannot tell you what they say. I can tell you what to look for in yours. If none of the six appears anywhere, the answer to all six is “trust us.” That may be fine for a pilot on public data. For a process touching customers or money I would not sign it.

And do not expect every answer. Whatever the vendor will not answer, record it with a date. An unanswered question is information too.

Where this fits in our work

In the discovery phase of AI Maestro, before the Go/No-Go gate, each model vendor goes into the file with its system card sorted by who measured what. I would add a sheet with these six rows. If the vendor leaves it blank, the gate sees a blank.

Send the six questions to your account rep this week and ask for the answers in writing. It takes an afternoon.

Build your vendor governance sheet with AI Maestro