The "Audit Washing" Crisis: Can AI Safety Labs Actually Be Regulated?

The most consequential job in modern technology may soon come with a standard corporate badge, a company-issued laptop, and high-level security clearance into the "black box" of frontier artificial intelligence. As the race toward Artificial General Intelligence (AGI) accelerates, industry leaders like Anthropic and OpenAI are moving to install third-party "safety evaluators" within their operations. However, a growing chorus of legal experts and academic researchers warns that these measures may be little more than "audit washing"—a performative gesture that offers the appearance of oversight without the teeth of actual regulation.

The Push for Embedded Oversight: A New Chronology

The recent pivot toward embedded safety began in earnest following a period of internal turmoil at the highest levels of the AI industry.

• Early September 2026: Researcher Jacob Coxon resigns from Anthropic, publicly warning that the world’s frontier labs are hurtling toward powerful, autonomous systems that lack sufficient guardrails. His departure sends shockwaves through the AI safety community.
• Mid-September 2026: Anthropic CEO Dario Amodei publishes a seminal essay, We Must Pace the Frontier, proposing a regulatory framework inspired by the banking sector. He suggests that third-party evaluators should be embedded within AI labs to monitor development.
• September 15–16, 2026: As the industry grapples with a regulatory split—pitted against a backdrop of presidential opposition to strict AI mandates—OpenAI and Anthropic pledge to formalize these safety arrangements. However, the details remain opaque, and the legal framework for this oversight is noticeably absent.

Amodei’s proposal promises that these evaluators would receive access comparable to internal risk teams, with the right to publish findings—subject to limited redactions. He explicitly invoked the "bank supervisor" model, where government regulators work inside the institution to ensure financial stability.

The Banking Fallacy: Why "Audit" Does Not Equal "Regulation"

The central tension in the current debate lies in the misapplication of the banking analogy. Julie Andersen Hill, dean of the University of Wyoming College of Law and a renowned expert on financial regulation, argues that the comparison is fundamentally flawed.

"If you don’t give them the power to flip the ‘kill switch’ on the entire operation, I don’t know what they are doing," Hill says.

In the banking industry, government examiners are not mere observers. They hold the legal authority to force management changes, restrict growth, halt specific financial practices, and, in extreme scenarios, shutter an institution entirely. Conversely, under the current proposals from Anthropic and OpenAI, these "embedded evaluators" act as high-level consultants. They may have the power to investigate, but they lack the legal authority to prevent a model from being trained or to block its release to the public.

"That is fundamentally different," Hill notes. "Bank regulators have a lot more power than that. Without the ability to enforce, you are not talking about regulation; you are talking about an internal compliance department that happens to have a few outsiders in the building."

The "Black Box" Reality: What Evaluators Actually See

Beyond the existential rhetoric of "misaligned swarms" and "catastrophic damage," the daily work of an AI evaluator is significantly more granular. Albert Ziegler, head of AI at cybersecurity firm XBOW, has been on the front lines of testing unreleased models from the industry’s top players.

Ziegler describes the reality as a far cry from the cinematic, high-stakes drama often depicted in tech circles. His team, which conducts independent evaluations, often finds that models behave erratically under specific formatting requests or that safety checkers need more frequent human intervention.

"The kind of insidious, catastrophic consequences produced by subterfuge combined with unprecedented abilities that people are afraid of—that’s not something we’ve seen ourselves," Ziegler says.

However, Ziegler concedes that "black-box testing" has limitations. True risk assessment requires access to the instructions surrounding the model, its tools, its permission structures, and the logs of its previous actions. Even with such access, serious risks may only materialize under a perfect storm of circumstances that a human evaluator might never trigger.

The evaluators are effectively looking for needles in an infinitely expanding digital haystack, and their primary role, according to Ziegler, is to "compel an informed decision" before a product goes live. Yet, the final word—the decision to hit the "deploy" button—remains entirely with the company.

The "Independent" Dilemma: Conflicts and Constraints

The term "independent" has become the most contested word in the AI safety lexicon. Critics like Deborah Raji, a researcher at UC Berkeley, argue that the current structure of these relationships is fraught with conflicts of interest.

"You are effectively not qualified to be an actual auditor if you can’t meet the standards of independent conduct," Raji asserts. "If the company being audited selects the evaluator, controls the scope of the audit, and retains the right to redact findings, you aren’t getting an audit; you’re getting a marketing report."

Raji highlights the case of the nonprofit Model Evaluation and Threat Research (METR). While METR is widely respected, its history of deep ties to the labs it evaluates—including social connections and former employees moving between the companies and the auditor—raises eyebrows. While METR has been transparent about these ties, Raji argues that the "rotational obligation" is insufficient.

"You can’t just wake up one day and decide that you’re qualified to be a bank examiner," Raji says, "and the company being audited can’t randomly assign you to be a qualified bank examiner either. Otherwise, we’d have the equivalent of companies asking a friend to check their homework."

Official Responses and the Policy Tug-of-War

The industry is currently caught in a delicate dance with Washington. Sarah Heck, Anthropic’s head of public policy, acknowledged at the recent Politico Decoded summit that an "honor code" is no longer sufficient.

"We can’t be checking our own homework, and that’s very clear," Heck stated, confirming that Anthropic is in daily communication with the White House and working closely with Congress.

However, industry skeptics argue that this "cooperation" is a strategic move to preempt more stringent, top-down regulation. By proposing a framework that they helped design, companies like Anthropic and OpenAI can influence the legislative outcome, ensuring that any future rules don’t stifle their competitive edge.

Christina Ho, chief assurance officer at Oath and a former board member of the Public Company Accounting Oversight Board, points out that the tension is inherent in any industry where auditors are paid by the companies they oversee. "The problem is that the auditors are incentivized to maintain a relationship with the client," Ho explains. "In the financial sector, we have legal liability—Sarbanes-Oxley—that forces auditors to take their jobs seriously. In AI, there is no such legal framework, and even if there were, we lack a sufficient pool of experts capable of verifying the output of these complex systems."

Implications: The Future of AI Accountability

As the industry stands at this crossroads, the implications are profound. If the goal of AI safety is to mitigate existential risk, the current "embedded evaluator" model appears insufficient.

Legal experts agree that if society is to trust these organizations, the regulatory framework must evolve in three distinct ways:

1. Legal Authority: Evaluators must have a clear, statutorily backed mandate to block the deployment of models that fail safety benchmarks.
2. Structural Independence: The entity that determines who is qualified to perform an audit must be separate from the company being audited, likely housed within a government body or an independent, non-profit regulatory commission.
3. Defined Standards: Just as bank regulators operate under a strict set of operating rules and prohibited behaviors, the AI industry requires a codified set of safety standards. Without these, "oversight" remains subjective.

"The ultimate test is straightforward," concludes Hill. "If you really believe that AI has the power to destroy society, then you have to have an independent supervisor that has the ability to pull the plug. If you retain the power to override the supervisor, you are simply performing theater."

As the, debate continues, the "audit washing" phenomenon serves as a stark reminder that in the absence of hard, enforceable law, corporate self-regulation is often more about risk management than it is about public safety. For now, the AI "supervisors" remain inside the building, but the power remains firmly behind the desk of the CEO.