External review for AI developers and operators
Do the controls around your AI systems do what the policy says they do? We examine the access rules, the monitoring and the detection, then report what failed, what's missing and what to do next, to technical leadership and to the board.
For frontier developers, the review can support the external assessment commitment in the voluntary White House Accord on Super Intelligence. Enterprise teams can commission the same control review without being signatories.
Scope an independent reviewThe Accord and your review
The September 29, 2026 accord describes four layers of controls and review for companies training and deploying frontier models. It is a voluntary commitment. The published text does not establish an auditor accreditation, certification, audit schedule or pass/fail standard. Read the original accord.
Accord layer 01
Monitor model capabilities and alignment, address serious risk domains, and prevent unintended access to technical systems.
How the review supports it
Check access rules, monitoring and escalation against their intended behavior. Identify areas that need a specialist assessment.
Accord layer 02
Give an internal team responsibility for checking controls, monitoring, detection and remediation.
How the review supports it
Check ownership, internal review records, exception handling and whether reported problems reach someone with authority to act.
Accord layer 03
Engage an independent external auditor or evaluator to assess whether those mechanisms operate as intended.
How the review supports it
Inspect configurations, operating records and test results. Report which controls worked in the checks performed, which failed and which could not be assessed.
Accord layer 04
An independent board committee oversees and receives reports from control teams and internal and external reviewers, and ensures identified issues are remediated.
How the review supports it
Deliver the findings and remediation register to the agreed committee or sponsor. The company establishes the committee and remains responsible for action.
This service supports the external assessment and reporting work. A scoped report does not establish compliance with the entire accord, certify a model as safe, or replace the company's internal team and board responsibilities. TKOResearch is not a White House approved or accredited auditor.
We start with named controls and the behavior they are supposed to enforce: access boundaries, tool permissions, approval requirements, monitoring coverage, alert handling, escalation and remediation. The scope identifies the systems, model and configuration versions, review period and reporting recipients.
We inspect configurations and representative operating records, speak with the people responsible, and observe agreed checks in an authorized environment. A policy document or a vendor statement alone cannot establish that a control works.
The accord also addresses model capabilities and alignment, biosecurity and chemical threats. This service focuses on security controls and their oversight. Specialized capability, biological or chemical evaluations require separately agreed work and named, qualified specialists. A cybersecurity review cannot stand in for those assessments.
If operating access or records are unavailable, we can scope a readiness review. Its report identifies preparation gaps; it does not conclude that the controls operate effectively.
For each control: expected behavior, records examined, tests performed and findings. The report includes versions, dates, sampling limits and unavailable access.
The important gaps, their consequences and the decisions needed from leadership. References to the technical assessment let reviewers check how a conclusion was reached.
Findings with owners, priorities, target dates and closure criteria. Follow-up testing records what changed and whether the fix met those criteria.
Findings distinguish observed behavior, client-supplied records and untested claims. Follow-up reviews are agreed around material changes, unresolved findings and the client's reporting needs; the accord does not prescribe a recurring audit interval.
Before accepting a review, we disclose relevant financial, product and prior advisory relationships. We do not provide an independent conclusion on controls we have designed, implemented or operated. Fees do not depend on a favorable result.
Kevin O'Connor leads the technical scoping. The proposal names the reviewers, their responsibilities and any specialist work required. Read Kevin's background.
The Seoul Frontier AI Safety Commitments also address mitigation effectiveness, external evaluations, governance and transparency. Where relevant, a scope can identify the specific commitments and the client's published safety framework being assessed.
If the review also needs to address a law, customer contract or internal standard, identify it during scoping. Its criteria and required coverage must be assessed separately from these voluntary commitments.
Start with a short description of the system, the commitment or decision involved, the reporting audience and the deadline. We agree on scope and secure handling before receiving confidential materials. Keep credentials and sensitive records out of the initial contact form.
The commitment mapping uses the original accord text published by the President on September 29 and the American Presidency Project transcript. The separately issued executive order on Super Intelligence concerns federal terminology; it does not establish an auditor certification. The review methods and deliverables are TKOResearch’s service terms.
