5 Ways to Govern Frontier AI: CSET Compared

Only indirectly. SB-1047 was vetoed in September 2024, though its themes carried into SB 53, the narrower California transparency law that did pass in 2025. The federal framework was later turned into the Preserving American Dominance in AI Act, which has not passed. OpenAI's proposal, the Zero Trust AI Governance framework, and the academic preprint were never legislative vehicles — they're a company policy, a civil-society position paper, and a research preprint, respectively.

Different format and different objects entirely. CASRAI's Frontier AI Law: 10 Jurisdictions Compared page lines up ten enacted or proposed statutes on the same three legal axes (binding vs. voluntary, centralized vs. sector-led regulator, tiered vs. uniform obligations). This page instead follows CSET's method: five stakeholder proposals — not all of them law, or even meant to become law — tested against three structural questions about risk, delegation, and mechanism effectiveness.

That disclosures from AI companies about their own development are useful for governing AI — the only assumption in CSET's “which information or actions are useful” table held by all five, including OpenAI's proposal via its system-card commitment. Two other assumptions are shared by all five in a different table: that safety and risk-management frameworks or standards are necessary, and that information sharing between developers, users, and government actors is necessary.

No, and this page doesn't claim one exists. Every NIKOLAI crosswalk row is a shadow mapping — CASRAI's own reading of how a lab's or regulator's own published framework lines up against a NIKOLAI element — and those only exist where an actual framework exists to map against (a Preparedness Framework, a Responsible Scaling Policy, statutory text like SB-1047 or SB 53). CSET is not that kind of source: it's a research organization's analytical framework for comparing other stakeholders' proposals, and it doesn't publish its own risk taxonomy or scope test as a framework a lab or regulator could adopt. There's nothing for a NIKOLAI crosswalk row to map against, so none exists.

NIKOLAI's own Risk domain element, in its N1 track (Actors, models and scope). It's CASRAI's independent, unendorsed reference dictionary asking a version of the same question natively: the element defines “the top-level category of catastrophic harm under which threat models, thresholds, and evaluations are grouped,” with CBRN, cyber offense, loss of control, and harmful manipulation as its controlled values — the same move as CSET's proposals committing (or not) to a bounded harm-category list rather than an undefined “catastrophic risk.” CASRAI's Who Counts as 'Frontier AI'? Eleven Scope Tests Compared guide is the closest parallel to the second half of that question — who has oversight, and under what if-then test does a framework apply at all.

Yes — it's the technical literature behind one of CSET's shared “which techniques are effective” assumptions. RAND's Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models (Nevo, Lahav, Karpur, Bar-On, Bradley, and Alstott; May 30, 2024) catalogs 38 attack vectors against model weights and defines the five security levels that CASRAI's own NIKOLAI Security Level guide uses as its anchor. Note for anyone re-checking this citation: rand.org returns HTTP 403 to a default, non-browser fetch — that's a server-side block on the request type, not evidence the report doesn't exist. Fetched with a standard browser user-agent, the page resolves normally and confirms the title, all six authors, and the publication date exactly as cited here.