The Country That Built the Worlds AI Watchdog Has a Problem: Its Own Reports Show the Methods Are Two Years Behind

Britain is winning at AI governance. The question is whether the thing it's winning at works.

The UK AI Security Institute has spent two and a half years becoming the closest thing the world has to an AI watchdog capable of evaluating frontier models before they ship. It has 100 technical staff, a £100 million budget roughly ten times that of its US counterpart, and agreements with Google DeepMind to test its most capable models including Gemini 3. Nine countries and the European Union have joined the AISI International Network launched at the 2024 Seoul Summit, with CSIS noting the group includes Kenya but notably excludes Germany and Italy. Britain is exporting the model.

It is also, by the admission of its own researchers, two years behind.

That is the gap at the center of this story. The AISI has become a diplomatic object: other nations want to copy it, labs want to be seen partnering with it, and the White House is considering an executive order that would formalize pre-release AI vetting along roughly the same lines. The celebration is real. So is the critique from inside the building.

The Institute's own Frontier AI Trends Report, published late last year, documents capabilities that are advancing faster than the evaluative framework designed to catch them. The length of cyber tasks AI models can complete unassisted has been doubling roughly every eight months since late 2024, according to AISI's own internal estimates, published in February. On chemistry and biology, AI models now exceed the PhD-level expert baseline AISI uses by up to 60 percent. Success rates on AISI's self-replication evaluations went from 5 percent in 2023 to 60 percent in 2025.

The numbers are not disputed. What they mean for safety is.

The Ada Lovelace Institute, which has studied the AISI model closely, published a direct critique last year that remains the most systematic challenge to the evaluation methodology. The safety of an AI system, the Institute noted, is not an inherent property that can be evaluated in a vacuum. Current evaluations are insufficient to determine whether a model is safe, because safety depends on deployment context, and context changes. A test of one model version, run before release, may have little bearing on the safety of the version that ships to billions of users six months later.

There is also the gaming problem. AI firms can train on evaluation datasets, effectively studying for the test they will be graded on. They can strategically choose which evaluations to submit to, presenting their best face to the regulator and declining access when they know the result will be unflattering. Three of the four major foundation model developers have failed to provide the requested pre-release access to the UK AISI for their latest cutting edge models, according to the Ada Lovelace Institute's analysis. The voluntary nature of the regime means there is no enforcement mechanism when a lab declines.

AISI researchers know this. The Institute's own cyber capability blog acknowledges the limitation: evaluations measure what models can do at a point in time, not what they will do when deployed at scale in novel contexts. The AISI has published more than 30 frontier AI evaluations since November 2023. It has not published the scoring rubrics that would tell a lab whether their model passes or fails.

The deals signed in May 2026 between the US Commerce Department's AI Safety Institute and Microsoft, xAI, and Google DeepMind were presented as a milestone. They were also, the timing suggests, a response to a threat: the same week, AISI published data showing autonomous cyber capability doubling every 4.7 months, with Claude Mythos Preview solving both AISI cyber ranges for the first time, completing The Last Ones in 6 of 10 attempts and Cooling Tower in 3 of 10. The lab that declines to be tested is the lab that looks most concerning.

Britain's pitch to the world is straightforward: the AISI model works because it has the technical staff, the lab relationships, and the empirical database to evaluate frontier AI before it ships. The counter-argument, laid out most directly by the Ada Lovelace Institute, is that the model works only insofar as the evaluations are valid, the versions tested are the versions deployed, and the labs are willing to participate. All three conditions are violated regularly.

The global export of the AISI framework is not a solution to the AI risk problem. It is, at best, a serious attempt at solving a problem that may not be solvable through pre-release evaluation alone. The difference matters enormously to anyone making policy decisions based on what the world's governments are calling a success.