What it is
Pre-release testing (also called pre-deployment testing) is an arrangement in which an AI developer gives a government safety body access to a model — either by handing over a version of it or letting the body’s researchers query it remotely — before that model is released to the public. The point is to let evaluators probe a system for dangerous capabilities while there is still time to add safeguards or delay the release, rather than discovering problems after millions of people are already using it.
The practice traces to the Bletchley Park AI Safety Summit in November 2023, where the UK announced the creation of what was then called the AI Safety Institute (renamed the AI Security Institute in February 2025) and eight AI companies committed to giving it early access to their models. The United States followed with an equivalent body, now called the Center for AI Standards and Innovation (CAISI, formerly the US AI Safety Institute), which runs its own evaluation program through an interagency effort called the TRAINS Taskforce.
Crucially, these arrangements are voluntary on both sides. Neither the UK nor the US institute has legal authority to block a model’s release based on what its testing finds. A developer can decline to share a model, and a government can instruct its own companies not to share models with a foreign counterpart — which is exactly what happened in September 2026, when the Trump administration’s Office of the National Cyber Director told US developers to withhold new models from UK testers until Washington’s own national security review was complete.
Why it matters for AI governance and narratives
Pre-release testing sits at the center of a framing contest over who gets to define AI safety and on what terms. Proponents present it as the practical alternative to binding regulation: rather than legislating capability thresholds, governments embed evaluators inside the release pipeline itself, relying on voluntary cooperation from the same companies being evaluated. Critics, including some UK-based policy researchers, have questioned whether an institute that depends entirely on developer goodwill for access can function as independent oversight rather than as an extension of the companies’ own safety theater.
The September–October 2026 episode sharpened that question by exposing a dependency the voluntary model had left implicit: access to frontier models is, in practice, a privilege the exporting country can revoke. When Washington froze UK access for seventeen days — reportedly including Anthropic’s refusal to share one of its newer models with the institute — it demonstrated that pre-release testing functions less as an independent safety check than as an instrument of bilateral diplomacy, available “at the pleasure of the exporting state,” as the observatory’s own editorial put it. The access was restored on October 11, 2026, after UK AI minister Kanishka Narayan negotiated its return, but the episode will likely be cited by advocates of binding international testing regimes as evidence that voluntary arrangements are too fragile to anchor global AI safety governance.
Key facts and dates
The UK’s institute was established in November 2023 following the Bletchley Park Summit, where OpenAI, Anthropic, Google DeepMind, Meta, and others agreed to provide pre-deployment access. The US counterpart (CAISI) secured pre-deployment access from OpenAI and Anthropic by August 2024, and by May 2026 had been joined by Google DeepMind, Microsoft, and xAI, bringing its total to five participating developers and more than 40 completed model evaluations. Testing in both institutes concentrates on security-relevant harms: cyberattack capability, biosecurity and chemical-weapons misuse, autonomous-agent behavior, and the robustness of safeguards against jailbreaking — the UK institute’s own evaluations have reported that safeguards in tested models were vulnerable to “even basic” jailbreak attempts.
The most recent disruption to the arrangement began around September 24, 2026, when the White House’s Office of the National Cyber Director asked US developers to hold back new models from the UK pending its own review. Access was restored on or around October 11–12, 2026, with UK minister Kanishka Narayan announcing that the AI Security Institute had regained pre-release access to models including Google’s newest frontier system. Narayan also acknowledged the structural vulnerability this episode exposed, noting that reliance on another country’s technology means being “clear-eyed about the permanence” of any such access arrangement.
Where to learn more
- UK AI Security Institute — Fourth progress report — primary source; the institute’s own account of its pre-deployment testing exercises and findings
- UK AI Security Institute blog — ongoing primary-source updates on testing methodology and results
- CASRAI guide: Pre-Deployment AI Testing — CAISI and UK AISI — clear comparative explainer with sourced timeline for both institutes
- The Next Web: UK says it will again test OpenAI and Anthropic models before release — reporting on the September–October 2026 freeze and restoration