Frontier AI and the Question of AI Governance After Approval

Frontier AI and the question of AI governance are usually debated by labs and lawmakers. Meanwhile, your company is probably already using frontier AI, the most powerful type of AI available today, through tools someone approved months ago.

Here’s how it usually goes. Your team approves an AI assistant in March. By September, it runs on a newer model and can send emails on its own. Nobody filed a change request. The tool name stayed the same, so the spreadsheet never noticed. Spreadsheets rarely do.

The question most IT teams miss is smaller and closer to home. What has changed since we approved this tool, and what else breaks if its model goes down?

What Frontier AI Means and Why the Line Keeps Moving

Frontier AI refers to the most advanced general-purpose AI models available at a given time. These models can handle complex tasks, such as solving multi-step problems, writing code, understanding text, images, and audio, and using tools to complete tasks.

The term “frontier” doesn't refer to a specific AI model or product. Instead, it describes the leading edge of AI capabilities, which continues to advance as new models are developed.

That edge moves fast. GPT-4 was a frontier model in 2023. Newer models have since left it far behind.

Governments draw the line in two ways. The UK government’s frontier AI discussion paper looks at ability. It covers general-purpose models that match or beat today’s most advanced models. The EU AI Act looks at computing power. If a model was trained with more than 10^25 FLOPs (a huge amount of computing power), the EU assumes it carries systemic risk.

For IT teams, one fact matters more than the definition. The model you approved is rarely the model you’ll use next quarter.

Frontier AI vs. the AI You Already Run

Most companies already run several kinds of AI. Here’s how frontier models compare with what’s likely in your stack.

Type of AI	Typical example	Who builds it	How often it changes
Narrow machine learning	Spam filter, fraud check	Software vendors or in-house teams	Rarely
Generative AI apps	Writing assistant, meeting notes tool	SaaS vendors, often on top of a frontier model	Whenever the vendor switches models
Small language models	Local coding helper	AI labs and open-source communities	When IT installs a new version
Frontier models	Latest versions of ChatGPT, Claude, Gemini	A handful of large AI labs	Several big releases a year

Keep an eye on the second row. Many AI apps are really frontier AI with a different name on the box. The vendor picks the model and can change it without asking you.

Proprietary vs. Open-Weight Frontier Models

Proprietary models are the ones you use through an app or an API. The provider runs the model, updates it, and handles safety, but you can’t see much of what changes.

Open-weight models can be downloaded and run in your own cloud. You decide when to update, but monitoring, patching, and safety testing become your job. Put simply, with proprietary models, change happens to you. With open-weight models, change happens when you say so.

3 Reasons Frontier Models Are Hard to Approve Just Once

Most software approval assumes a tool stays the same until renewal. Frontier AI breaks that in three ways.

1. The model changes, but the product name doesn’t. Vendors swap the model behind the same login screen, so no change ticket ever gets created. The release notes say “performance improvements.” They always say that.
2. New abilities show up overnight. A chat assistant that only answered questions in spring might, after one update, browse the web, read shared drives, and take actions in other apps. Once AI can take actions, it’s a user with permissions. These jumps can be big. In UK AI Security Institute tests, Claude Mythos Preview became the first model to finish a 32-step simulated corporate network attack from start to end, in 3 of 10 tries.
3. A few labs sit behind many tools. Building a frontier model costs a fortune, so only a handful of companies do it. Dozens of SaaS products rent their AI from those same labs.

The first two problems lead to approval drift. The third leads to concentration risk.

Frontier AI and the Question of AI Governance: Who Sets the Rules?

The real question is no longer whether frontier AI should be governed, but who governs it and who gets the final say. Two groups lead today. Neither one fully covers companies that only use these models, and that’s where your own frontier AI governance comes in.

Labs Governing Themselves

The big labs publish their own safety rules, called frontier safety frameworks. Examples include Anthropic’s Responsible Scaling Policy, OpenAI’s Preparedness Framework, and Google DeepMind’s Frontier Safety Framework. Each one explains which dangerous abilities the lab tests for and what safeguards it adds.

These frameworks move fast, but each lab is grading its own homework, and the rules change often. Anthropic’s policy went from version 3.0 to 3.4 between February and July 2026.

Governments Writing Binding Rules

The EU AI Act goes furthest. Since August 2, 2026, the EU can fully enforce its rules for general-purpose AI providers. Models above the systemic risk line must be tested against attacks, report serious incidents, and stay secure.

In the US, California’s SB 53, New York’s RAISE Act, and Illinois’s SB 315 set state rules for frontier developers. A June 2026 White House executive order invites labs to share their most cyber-capable models with the government before release. The UK relies mostly on its AI Security Institute for testing.

Almost all of these rules target the companies that build models, not the ones that buy AI tools.

When Government Action Reaches Your Tools

On June 12, 2026, three days after launch, the US Department of Commerce placed export controls on Claude Fable 5 and Claude Mythos 5. The order covered foreign nationals, and Anthropic had no reliable way to check nationality in real time, so it paused both models for all users worldwide. The controls were lifted on June 30. Fable 5 began returning on July 1, and AWS, Google Cloud, and Microsoft Foundry followed on their own schedule.

We’re not taking a side on the policy here. The lesson is that one government decision can switch off every tool built on a model within hours. That’s concentration risk, and we’ll get to it below.

Approval Drift: When an Approved AI Tool Changes Under Your Feet

First, you need to know which AI tools you have. Our AI asset inventory guide covers that. Approval drift starts after a tool already has a nice green approved label.

What Can Change Without a New Purchase

Here’s a common case. In March, your team approves a meeting notes tool that can only read calendars, and Security, Legal, and Privacy all sign off. In August, the vendor quietly switches to a model from a different AI lab. In September, it adds a feature that sends follow-up emails, and an employee clicks “Allow” on a familiar Microsoft pop-up, because nobody has ever read one of those.

Your inventory still shows one approved tool with the same name and owner. But your data now goes to a new AI provider, and the tool sends mail for your staff. Nobody reviewed it again, because no process said to.

This differs from embedded AI risk, where a non-AI app suddenly adds AI. Here, the AI was already approved. What changed was the model, its abilities, and the rules behind it.

4 Changes That Mean Your AI Tool Needs a New Review

Checking AI tools once a year isn’t enough. Some triggers apply to any software, like a tool asking for more access. Frontier AI tools add four more. If you see one, review the tool again.

1. The vendor switches AI models. Your data now goes to a different company with different rules, so Security and Privacy should check it again.
2. The tool starts taking actions. After an update, the AI can send emails, edit files, or work inside other apps on its own. A tool that acts needs a new check from Security and IT.
3. The AI lab changes its safety policy or terms. A safeguard you counted on at approval may now be weaker or gone. Security and Legal should compare the old and new versions.
4. A government decision affects the model. The June 2026 export controls showed that access can disappear overnight. Legal should know before users notice.

You don’t need a big process. Ask vendors to warn you before they change models, check monthly which AI apps can access company accounts, and give every AI tool a named owner.

Concentration Risk: When One Model Sits Behind Many Tools

Approval drift is one tool changing. Concentration risk is many tools breaking at once because they depend on the same frontier model or lab.

Most teams list AI tools in their IT inventory by product name, which hides what’s underneath. This simple map shows what the product name hides.

In this example, three out of four tools stop working if Lab A has an outage, a policy change, or an export control. The middle column is the hard part. Vendors put the model name everywhere except the invoice, usually in a subprocessor list three clicks deep. The map also shows waste. If three tools pay for the same model to do similar jobs, one is probably a renewal you can skip.

Once the map is filled in, five questions tell you how exposed you really are.

1. Which model and AI lab does each tool depend on today?
2. Does the vendor have a backup model if its main provider goes down?
3. Does the contract say the vendor must warn us before changing models?
4. If we had to switch providers, how long would it take?
5. Do we use the model directly, through a SaaS vendor, or through a cloud marketplace, and how fast does each one recover?

Depending on one strong lab isn’t automatically bad. Just know your weak spots before an outage shows you.

How AssetLoom Supports Frontier AI Oversight

We built AssetLoom because IT teams kept losing track of laptops and licenses. AI subscriptions deserve the same IT asset management (ITAM) treatment, so every tool gets a real home and a clear owner instead of a spreadsheet row. Here’s how that works in practice.

• Track each AI tool as a license. Record its purchase cost and seats, then check it out to the people who use it.
• Build your concentration map with custom fields. Add a Single Select field for the AI lab and a Short Text field for the model behind it, so each license shows exactly what sits underneath.
• Spot stale approvals. A Date field for the last review shows which tools haven’t been checked in a while.
• Keep the paper trail in one place. Store the contract and any model-change notice in the license’s File tab, and use the History tab to see what changed on the record and when.
• Recheck at renewal. License expiration alerts remind you up to three times before renewal, which is a natural moment to ask the vendor what changed since you approved it.
• Start from what you have. CSV import brings your existing AI tool spreadsheet in, so you’re not rebuilding from scratch.

AssetLoom tracks who owns what. It doesn’t test AI models, monitor prompts, or detect model changes on its own.

Frontier AI Moves, So Your Approvals Should Too

You can’t control what AI labs release or what regulators decide. You can control how your team reacts. Review tools when something changes, ask vendors which model sits behind each tool, and map where your tools share a provider.

If your AI approval ends at the purchase order, that isn’t governance. It’s a receipt.

Want to see which AI apps are already connected to your company accounts? Run the free SaaS Scanner, then track what you find on AssetLoom’s free plan for teams with under 250 assets. Approvals that keep up are your team’s practical answer to frontier AI and the question of AI governance.

FAQs

1. What is frontier AI governance?

Frontier AI governance is the set of rules, reviews, and controls that decide how the most advanced AI models are built and used. Labs and governments govern how models are built and released. Companies that buy AI tools govern how those tools are approved, reviewed, and tracked after they change.

2. Is ChatGPT, Claude or Gemini considered frontier AI?

Their newest versions usually are. Older or smaller versions may not be, because “frontier” means the leading models right now, not a brand name.

3. What is the difference between frontier AI and AGI?

Frontier AI is the most advanced AI today. AGI (artificial general intelligence) is a possible future system that could match humans at almost any task.

4. Does the EU AI Act apply to companies that only use frontier AI?

The strictest frontier rules apply to model providers. Companies that use AI still have duties. You must take steps to support your staff’s AI literacy, and stricter rules for high-risk uses like hiring now start on December 2, 2027, after the EU’s 2026 AI Omnibus pushed the date back.

5. What is a frontier safety framework?

It’s a public document from an AI lab that explains which dangerous abilities it tests for and what safeguards it adds as models get stronger. It covers how the lab releases models, not how your vendors handle your data.