Do the protections hold when the pressure is to grow, compete and deploy?
A lab can follow the rules while defeating the protection those rules were meant to provide. We assess twelve AI developers for that institutional exposure: whether control follows capability, responsibility remains enforceable, and oversight can act independently.
| EXPOSURE RANK | LAB | BYPASS | DIFFUSION | CAPTURE | GOV GAP | OVERALL / 10 | GOVERNANCE RISK | KEY FINDING |
|---|
These are editorial assessments of institutional exposure, not model safety rankings, legal verdicts or probabilities of harm. The overall averages four equally weighted dimensions; a severe component remains severe even when the average is lower. Ranges show where the evidence does not justify a single number. Overlapping ranges share possible positions. Small differences between editorial scores do not establish that one lab is safer.
Does a system defeat the protection a rule or control was meant to provide? Formal compliance can coexist with failure. A legal violation can establish a failed safeguard, but does not by itself establish every other dimension.
Does responsibility and effective control follow capability across actors, copies and deployments? An identifiable operator can still lack the power to contain a system or ensure that corrections reach its independent copies.
Can protective decisions withstand conflicting commercial or political interests? Dependence on a developer for oversight and binding state direction are different mechanisms. Both require evidence of the institutional relationship, not a judgment based on nationality or reputation.
Can institutions prevent, constrain or remedy the behavior in practice? Duties can miss a handoff, remedies can arrive after the protection is lost, and legal authority can stop at a jurisdictional boundary. The existence of a law does not answer that question.
For each component, we identify the protection, the mechanism that can defeat it, and the constraints that remain. The score reflects the strongest supported material mechanism within the stated scope, not a tally of incidents. Products and jurisdictions can differ between components; the mean summarizes this declared exposure profile, not every product a lab makes. One event can inform two dimensions only when it establishes a distinct mechanism in each.
Independent model copies can outlive the originating safeguards without becoming legally immune. That structural separation matters. Open inspection and local control also have benefits; this is an assessment of continuing accountability, not a presumption that closed models are safer. Evidence ceilings limit a score but never justify choosing the ceiling.
Zero requires affirmative evidence that the relevant protections work; missing evidence is not zero. A bounded range describes an assessed relationship, not an assurance about the whole company. Its overall is the mean of the lower and upper bounds, never an invented midpoint. These are judgment ranges, not statistical confidence intervals. Confidence and coverage remain separate from severity. An unfinished assessment would still be marked Pending, with no overall.
The important question is whether a protection survives the pressure to grow, compete and deploy. A promise matters. Evidence that it held matters more.
The scorecard does not rely on lab self-assessment. It compares public claims with court records, regulatory findings, official investigations, publicly documented technical architecture, and attributed reporting.
The record is cumulative. A resignation, court ruling, regulatory finding, lobbying disclosure, or independently verifiable remedy is appended to the chronology. New evidence can move a score; it does not erase the historical record.
The Synthetic Outlaw Index examines AI deployment across sectors. This scorecard focuses on the institutions building the systems. Neither an impressive benchmark nor a serious incident answers all four governance questions.
SCOPE
Twelve AI developers and the named products in each entry. Evidence and scoring reviewed 3 October 2026 under protocol 1.25. Each component names its product and jurisdictional scope. Every scored component concerns the lab's models or model services; platform conduct of a parent company is recorded and not scored. Obligations on a hosted service do not automatically apply to every foreign deployment of its downloadable weights.
INCLUDED
Dated public claims, court and regulatory records, publicly documented technical architecture, and attributed reporting. Each item is weighted under the protocol above.
FURTHER READING
The legal theory and proposed institutional remedies are developed in The Synthetic Outlaw.
Each lab is scored 0–10 across four dimensions drawn from J. Gropper, The Synthetic Outlaw. Provisional order follows the editorial mean; equal means share a position. Missing components are never treated as zero. Scores reflect the cited evidence through the stated review date. This scorecard measures institutional conduct: governance architecture, deployment decisions, and the gap between public safety claims and documented behaviour. Raw capability and market share do not earn adverse points. Evaluations can support a score when they demonstrate a specific governance-control failure; test conditions and limitations remain part of that evidence. Every score is traceable to the source cited beneath it.