GenAI provider risks and the AI Safety implications

Not all AI systems are created equal when it comes to safety. As businesses rush to integrate generative AI tools like ChatGPT, Claude, and Gemini into their operations, significant differences in safety standards between providers are becoming apparent. These variations go beyond technical details, they directly impact business risk, regulatory compliance, and operational reliability.

The Future of Life Institute's 2025 AI Safety Index provides an independent and rigorous evaluation of seven leading AI companies that offer generative AI services. The findings revealed significant gaps in current approaches. Anthropic achieved the highest grade with a C+, while OpenAI got a C and Google DeepMind received a C- rating. The evaluation found that all flagship AI models remained vulnerable to attacks that bypass their safety measures, demonstrating the disparity between advancing capabilities and safety governance.

Understanding these safety differences matters because the provider you choose affects your exposure to everything from security vulnerabilities to regulatory penalties. This analysis examines what sets safer AI providers apart and what these differences mean for business decision-makers.

Why AI Safety is a business imperative

For business leaders, the current issues around AI safety represent both an immediate risk and a strategic opportunity. Organisations that develop robust AI safety capabilities now will gain competitive advantage as regulations tighten and stakeholder expectations evolve. Those that do not may face costly failures, regulatory penalties, and erosion of customer trust.

Within this context, AI safety refers to the measures that ensure AI systems are secure, reliable, and aligned with intended outcomes. It focuses on preventing failures, mitigating cybersecurity threats, and ensuring compliance with regulations. For businesses, AI safety means reducing operational risks, avoiding costly errors, and maintaining trust with customers and stakeholders.

With regards to AI risk recent safety evaluations highlight four risk areas that businesses must address when deploying AI systems. Please note, while most of these incidents occur within larger companies, this is likely to change as AI proliferates.

1. Model reliability and security gaps

All evaluated models remain vulnerable to "jailbreak" attacks that bypass safety measures. The report found that even leading providers struggle with adversarial testing, DeepSeek showed particularly high failure rates when subjected to security challenges. For businesses, this means AI systems may behave unpredictably when faced with unusual inputs or malicious prompts.

Most concerning for enterprise deployment: companies like Meta, Zhipu AI, and DeepSeek release full model weights without tamper resistant safeguards, enabling bad actors to remove safety protections entirely. This creates supply chain risks for businesses using open source AI components, as modified versions could be redistributed with hidden vulnerabilities.

The report also highlighted gaps in watermarking systems across most providers. Only Google DeepMind's SynthID showed advanced implementation, leaving businesses using other providers exposed to misinformation risks from AI-generated content.

2. Transparency and accountability deficits

The index revealed alarming gaps in corporate transparency that directly affect business procurement decisions. Only OpenAI has published its whistleblowing policy, which is a basic expectation in industries that prioritise safety. Most companies keep their system prompts secret, making it difficult for businesses to understand how AI systems will behave in specific contexts.

For procurement decisions, this opacity creates significant due diligence challenges. Legal and compliance teams cannot adequately assess risks when providers refuse to disclose fundamental aspects of their systems' operation. When companies do publish system prompts, businesses gain clearer insight into model behaviour and potential limitations.

3. Governance weaknesses that affect service quality

The report highlighted concerning patterns in corporate governance that may affect service reliability. Several companies lobbied against key AI safety regulations, including the EU AI Act and California's SB 1047, suggesting potential conflicts between safety commitments and commercial pressures.

OpenAI's proposed restructuring away from its nonprofit origins raised questions about long term mission alignment, though this was later abandoned following external pressure. Companies with stronger governance structures, such as Anthropic's Public Benefit Corporation status, may provide a more stable, safety focused services over time.

4. Risk assessment gaps

Only three companies (Anthropic, OpenAI, and Google DeepMind) conduct substantial testing for dangerous capabilities. The report criticised even these leaders for methodological shortcomings, noting that the reasoning linking evaluations to specific risks is often absent.

For businesses, this suggests current AI providers may not fully understand their own systems' capabilities and limitations, creating deployment risks that traditional vendor assessments might miss. The remaining four companies showed minimal evidence of systematic risk assessment.

AI safety as a competitive advantage

Rather than viewing AI safety as a compliance burden, forward thinking organisations recognise it as a strategic differentiator. The FLI index provides a framework for evaluating AI providers based on actual safety practices rather than marketing claims.

Companies investing in responsible AI practices build trust with customers and partners through transparency, achieve regulatory readiness by adopting compliance frameworks early, and gain market advantage by demonstrating safe, ethical AI leadership. The emergence of AI assurance services signals a maturing market where safety practices become differentiating factors.

Future-proofing your business

Based on the index findings, businesses should adopt these practical measures:

• Evaluate providers systematically: Use frameworks like the FLI index to assess AI vendors on safety practices, not just capabilities. Consider governance structures, transparency commitments, and regulatory positioning as indicators of long-term service reliability
• Ask targeted questions about system behaviour: Rather than demanding full system prompts, require providers to explain how their systems handle scenarios relevant to your business (e.g., how they respond to requests for confidential information, biased prompts, or edge cases in your sector)
• Implement internal governance oversight: Establish AI safety committees and incident reporting procedures within your organisation. Don't rely solely on vendor assurances - build your own monitoring capabilities
• Plan for regulatory compliance: Structure vendor relationships to accommodate evolving requirements. Choose providers that demonstrate regulatory engagement rather than resistance
• Check evidence-based safety claims: Use third-party evaluations to evaluate vendor safety claims, or benchmarking data rather than accepting marketing statements
• Develop incident response procedures: Establish clear protocols for what happens if your AI systems behave unexpectedly, including escalation paths and fallback procedures that don't depend on vendor support

The choice facing business leaders is straightforward: develop systematic approaches to AI safety evaluation now, or risk deploying systems from providers whose safety practices may not withstand regulatory scrutiny or operational stress as the technology matures.