Examples
Examples from published documents
- Google DeepMind defines Internal Deployments as model releases "restricted to Google employees for internal use" (Google DeepMind Frontier Safety Framework v3.1, glossary, p.19)
- Meta defines open release as "releasing weights externally for open research and/or development as pre-trained and/or fine-tuned versions" (Meta Advanced AI Scaling Framework v2, Appendix I)
- "Open-weight model releases are irreversible. Once released, model weights cannot be recalled." (International AI Safety Report 2026, open-weight models discussion)
Counter-examples
Not to be confused with
- A deployment surface, such as an enterprise API or a consumer app, is the channel a model reaches users through; two surfaces can share one deployment type.
- Giving an outside evaluator access for testing is not a deployment under California SB 53, which excludes access for the primary purpose of developing or evaluating the model.
Related terms
Related AI safety terms
Terms defined under this element that are not NIKOLAI elements themselves, each as the cited document uses it. Every term is also listed in the AI safety glossary.
- Internal deployment
- Internal deployment is making a model available only inside the developer's own organisation. Google DeepMind defines internal deployments as model releases restricted to Google employees for internal use.
- Source: Google DeepMind Frontier Safety Framework v3.1
- External deployment
- External deployment is releasing a model to people or organisations outside the developer, from small private releases to trusted testers up to general releases to the public, as Google DeepMind's framework defines it.
- Source: Google DeepMind Frontier Safety Framework v3.1
- Open-weight model
- An open-weight model is a model whose trained weights are publicly available to download. The International AI Safety Report notes such releases cannot be recalled and that their safeguards are more easily removed.
- Source: International AI Safety Report 2026
- Unreleased model
- An unreleased model is one its developer has not made available outside the organisation. California SB 53 and the Seoul commitments both call for security practices to protect unreleased model weights from theft or tampering.
- Source: California SB 53
- Closed release
- Closed release, in Meta's framework, describes models released widely in Meta products without the weights being made directly available to external partners, in contrast to an open release of the weights.
- Source: Meta Advanced AI Scaling Framework v2
Source of record
Where this definition comes from
Google DeepMind Frontier Safety Framework v3.1, Glossary, p.19
“External Deployments "represent model releases to entities outside of Google. They can include both low-risk external deployments as well as general purpose releases to the broader public." Low-Risk External Deployments "represent small scale and private releases restricted to particular external groups or organizations." Internal Deployments "represent model releases restricted to Google employees for internal use."”
https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdfMeta Advanced AI Scaling Framework v2, Appendix I
“Internal deployment: "models that are exclusively available to Meta personnel." Limited deployment: "releasing a final version externally to a limited set of vetted and trustworthy external parties." Closed release: "models that are released widely in Meta products, but are not directly available to external partners with open weights." Open release: "releasing weights externally for open research and/or development as pre-trained and/or fine-tuned versions."”
https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2
Crosswalk
How named organisations use this concept
| Organisation | Their term, as published | Match & verification | Source |
|---|---|---|---|
| Google DeepMindShadow mapping Frontier Safety Framework v3.1 | “"External Deployments", "Low-Risk External Deployments", "Internal Deployments" and "High-Risk Internal Deployments" (glossary, p.19).” | exactEQ confidence: high | Google DeepMind Frontier Safety Framework v3.1 |
| MetaShadow mapping Advanced AI Scaling Framework v2 | “"Internal deployment", "Limited deployment", "Controlled deployment", "Closed release", "Open release" (Appendix I).” | exactEQ confidence: high | Meta Advanced AI Scaling Framework v2 |
| AnthropicShadow mapping Responsible Scaling Policy v3.4 | “A Risk Report covers "all publicly deployed models as of the coverage date, as well as any internally deployed models as of the coverage date" that meet an escalation test (§3.1, p.11).” A two-way public/internal split used for scope, not a full ladder of release types. | closeCL confidence: high | Anthropic Responsible Scaling Policy v3.4, effective 8 Jul 2026 |
| OpenAIShadow mapping Frontier Governance Framework | “The framework's processes "apply to covered models that OpenAI has deployed externally, and in some cases internally with respect to risks resulting from circumventing oversight mechanisms" (§1, p.02).” | closeCL confidence: high | OpenAI Frontier Governance Framework |
| California SB 53Shadow mapping SB 53 statute text | “"Deploy": "to make a frontier model available to a third party for use, modification, copying, or combination with other software"; it "does not include making a frontier model available to a third party for the primary purpose of developing or evaluating the frontier model" (22757.11(e)). Internal use is handled separately (22757.12(a)(10), (d)).” | closeCL confidence: high | California SB 53 |
| EUShadow mapping AI Act Article 3 | “Article 3(9): "'placing on the market' means the first making available of an AI system or a general-purpose AI model on the Union market".” The EU trigger is market placement; the Act does not grade release types the way lab frameworks do. | broadBR confidence: medium | EU AI Act Article 3 (Definitions) |
| International AI Safety Report 2026 (Chair: Yoshua Bengio)Shadow mapping International AI Safety Report 2026 | “"'AI system deployment' refers to making a model available for real-world use with integrated tools and interfaces, while 'model release' involves making the base model accessible to others – either as open-weight (downloadable parameters) or closed-weight (API access only)."” Verified against the report's official publication page (fetched 2026-11-13). | closeCL confidence: high | International AI Safety Report 2026 |
What do these codes mean?
- exact
- The source term is equivalent to this element
- close
- The source term is close but not equivalent to this element
- broad
- The source term is broader than this element
- narrow
- The source term is narrower than this element
- none
- No mapping claim — used for false-friend and declared-but-undefined rows
- EQ
- Equivalent
- CL
- Close
- BR
- Source is broader than the element
- NR
- Source is narrower than the element
- FF
- False friend — same or similar label, different meaning
- DU
- Declared but undefined by the source
- UV
- Unverified
Related, not mapped
Pointers that are not crosswalk claims
These sources mention this concept but do not define or map it clearly enough to count as a crosswalk row — noted here so the research is visible without overstating it as a mapping.
- Anthropic
Separate N6 element internal-deployment-risk records the assessment of risks from a developer's internal use; this element only records the release category.
Anthropic Risk Report, August 2026
Divergence
Where sources materially disagree
Sources disagree on where external deployment begins. Google DeepMind counts small private releases to trusted testers as low-risk external deployments, while California SB 53's "deploy" excludes making a model available to a third party for the primary purpose of developing or evaluating it. Meta and the International AI Safety Report separate open-weight release from closed release, a distinction Google DeepMind's four deployment types do not draw.
Gap
No two sources use the same ladder of values, and the anchor points differ (personnel, trusted testers, third parties, the market). A report should state which source's categories it uses.
