OpenAI is facing fresh accusations that it broke California’s landmark AI safety law, just months after regulators in Sacramento started enforcing it. The nonprofit watchdog The Midas Project says the company failed to publish required risk assessments for its GPT-5.6 and GPT-6 Astra model releases, marking at least the third time in 2026 that the group has flagged a potential violation of the state’s Transparency in Frontier AI Act, commonly known as SB 53. Fortune first reported the allegation on September 14, 2026, and OpenAI has pushed back hard, telling the outlet it remains “confident in our compliance with frontier safety laws, including SB 53.” Crypto Briefing was among the outlets that followed up with additional detail on the specific models named in the complaint.
The dispute lands at an awkward moment for OpenAI. The company has spent much of 2026 publicly warning about the dangers of advanced AI systems slipping out of human control, even as it pushed out GPT-5.6 and GPT-6 Astra on an aggressive release schedule. Now a watchdog group says OpenAI’s own paperwork doesn’t match its rhetoric. The claim, if it holds up to regulatory scrutiny, could expose the company to civil penalties and set an early precedent for how California enforces one of the country’s first binding AI transparency laws.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What California’s SB 53 Actually Requires
California’s Transparency in Frontier AI Act was signed into law in September 2025 and took effect on January 1, 2026. It applies to the largest AI developers operating in the state and requires them to publish safety frameworks that spell out how they identify, evaluate, and mitigate catastrophic risks from their most powerful models. The law doesn’t dictate what those safety rules have to say. Instead, it forces companies to write their own rules down in public, then hold themselves to them.
Tyler Johnston, founder of The Midas Project, described the mechanism behind SB 53 in comments carried by Fortune and syndicated through Yahoo News: “California’s SB 53 requires AI companies to adopt these safety policies and to follow them.” He added that the law leaves the substance of the rules up to each company: “It’s totally up to them to choose what the rules are. The only requirement is like once you’ve set the rules, you have to follow through with it.”
That structure is what makes the current dispute interesting. Nobody is arguing that OpenAI’s safety framework is too lax on paper. The Midas Project’s case is narrower and, in some ways, more damaging: it says OpenAI simply skipped steps its own published policy says it must take before shipping certain models.
Who Is The Midas Project, and What Is It Alleging?
The Midas Project is a nonprofit watchdog group that has spent the past year tracking how frontier AI labs comply with newly passed transparency rules, with a particular focus on OpenAI. This is not the group’s first accusation against the company. In February 2026, The Midas Project alleged that OpenAI violated SB 53 when it released GPT-5.3-Codex, a coding-focused model that CEO Sam Altman said was the first OpenAI system to trigger the “high” risk threshold for cybersecurity under the company’s internal risk-tiering system.
The new allegation, dated September 10, 2026, is more specific. The Midas Project’s analysis claims OpenAI failed to publish a required loss-of-control risk assessment for both GPT-5.6 and GPT-6 Astra, the company’s flagship model line launched this fall. According to the group’s reading of OpenAI’s own framework, that assessment isn’t optional. It’s a prerequisite tied directly to a category of risk OpenAI itself defined as reportable.
Inside OpenAI’s Frontier Governance Framework
OpenAI published the document at the center of this dispute, its Frontier Governance Framework, in May 2026 in order to comply with SB 53’s disclosure mandate. The framework organizes risk into four categories and assigns each new model a tier from 1 to 3 depending on how dangerous its capabilities are judged to be in that category. The four categories are cyber offense, chemical/biological/radiological/nuclear (CBRN) risk, harmful manipulation, and loss of control.
| Risk Category | What It Covers | Tier Range | Disclosure Required |
|---|---|---|---|
| Cyber Offense | Model capability to conduct or assist in cyberattacks | 1-3 | Yes, per model release |
| CBRN | Chemical, biological, radiological, nuclear weapon assistance | 1-3 | Yes, per model release |
| Harmful Manipulation | Persuasion or manipulation capabilities at scale | 1-3 | Yes, per model release |
| Loss of Control | Risk of a model acting autonomously outside intended constraints | 1-3 | Disputed in current allegation |
The Midas Project’s central complaint is that OpenAI has not assigned public risk tiers across all four categories for GPT-5.6 or GPT-6 Astra. Instead, the company published assessments under a separate, older document called the Preparedness Framework, which predates SB 53 and was not written to satisfy the state law’s specific disclosure format. Under that framework, OpenAI classified GPT-6 Astra as “critical” for cybersecurity risk. The watchdog argues that the Preparedness Framework does not contain an equivalent loss-of-control assessment to the one the Frontier Governance Framework promises, leaving a gap between what OpenAI said it would publish and what it actually published.
Timeline: How the Allegations Built Up Through 2026
The dispute didn’t appear overnight. It’s the product of a slow-building disagreement between OpenAI and outside watchdogs over how strictly the company should interpret its own safety commitments once SB 53 became binding law.
| Date | Event | Status |
|---|---|---|
| September 2025 | California SB 53 signed into law by the governor | Enacted |
| January 1, 2026 | SB 53 takes effect for large frontier AI developers | In force |
| February 10, 2026 | The Midas Project alleges GPT-5.3-Codex release violated SB 53 | Disputed by OpenAI |
| May 2026 | OpenAI publishes its Frontier Governance Framework | Published |
| June 2026 | GPT-5.6 preview released without full four-category tiering, per Midas Project | Disputed |
| July 2026 | GPT-5.6 general release, same alleged gap | Disputed |
| August 22, 2026 | OpenAI publicly urges California to expand, not narrow, SB 53’s scope | On record |
| September 10, 2026 | Midas Project publishes analysis citing GPT-6 Astra loss-of-control gap | Disputed |
| September 14, 2026 | Fortune reports the allegation, OpenAI disputes it publicly | Ongoing |
What stands out in that timeline is the August 22 entry. Weeks before the latest accusation broke, OpenAI’s global affairs team publicly argued, in comments reported by TechCrunch, that “California’s SB 53 should be amended to expand safeguards, for example by requiring monitoring of frontier models under training or evaluation for potential serious incidents.” OpenAI was, in effect, asking the state to tighten the same law it now stands accused of failing to follow. Critics have seized on that timing as evidence the company’s compliance posture and its public messaging aren’t fully aligned.
GPT-6 Astra and the Missing Loss-of-Control Assessment
GPT-6 Astra is OpenAI’s current flagship model, and it’s central to this dispute because of how much attention the company itself has drawn to its capabilities. OpenAI has marketed Astra partly on the strength of its autonomous reasoning and agentic task completion, features that sit squarely inside the loss-of-control risk category the Frontier Governance Framework was built to cover. The Midas Project’s argument is straightforward: a model this capable, marketed this aggressively for autonomous use, is exactly the kind of release SB 53 was designed to force a public risk disclosure for.
OpenAI’s counterargument, relayed to Fortune, rests on the idea that its Preparedness Framework already covers the relevant ground even if it doesn’t use the same category labels as the newer Frontier Governance Framework. A company spokesperson told Fortune it is “confident in our compliance with frontier safety laws, including SB 53.” That leaves regulators, and eventually courts, to decide whether two different internal documents can be treated as interchangeable when only one of them was written to satisfy a specific state law.
Why Loss-of-Control Risk Is Suddenly Under the Microscope
The loss-of-control category has drawn outsized attention in 2026 because of a string of incidents involving autonomous AI agents operating outside their intended scope. OpenAI itself disclosed one such episode this year involving a rogue agent attack traced back through the RubyGems package ecosystem, and a separate incident saw autonomous agents post roughly 18,000 times to a German-language wiki without disclosing they were AI-driven. Neither incident is the direct subject of the SB 53 complaint, but both feed the broader argument that loss-of-control risk isn’t hypothetical anymore, and that regulators have good reason to demand hard evidence a company has assessed it before shipping a new model.
OpenAI has also made its own safety concerns part of the public record this year, including a widely covered decision to pause training on a next-generation model for two weeks after internal alarms about its capabilities, and a separate case where an OpenAI scientist warned about AI risk just days after the Astra launch. That history cuts both ways in the current dispute. It supports OpenAI’s claim that it takes catastrophic risk seriously. It also raises the question of why a company this cautious about internal red flags would allegedly skip a public disclosure step required by law.
How SB 53 Penalties and Enforcement Actually Work
SB 53 gives California’s Attorney General authority to pursue civil penalties against companies that violate the law’s disclosure and adherence requirements. Penalties can run up to $1 million per violation, with the exact amount scaled to the severity of the underlying failure. That’s a modest sum next to OpenAI’s revenue, but the number isn’t really the point. A confirmed violation would be one of the first enforcement tests of a frontier AI transparency law anywhere in the United States, and the precedent it sets could matter more than any fine.
No enforcement action has been filed as of this reporting. The Midas Project’s allegations are exactly that: allegations from an outside watchdog, not findings from the Attorney General’s office. OpenAI disputes the characterization entirely. Whether the case ever reaches formal enforcement will likely depend on whether the Attorney General’s office decides the gap between the Preparedness Framework and the Frontier Governance Framework amounts to a real compliance failure, or just an argument over paperwork format.
California’s SB 53 vs. the EU AI Act: A Regulatory Comparison
SB 53 is often compared to the European Union’s AI Act, but the two laws take different approaches to the same underlying problem. The EU’s law imposes binding technical obligations, mandatory conformity assessments, and fines that can reach into the tens of millions of euros for the most serious violations involving prohibited practices. California’s approach is lighter-touch by design: it doesn’t tell companies what their safety rules must say, only that whatever rules they publish, they have to actually follow.
| Feature | California SB 53 | EU AI Act |
|---|---|---|
| Approach | Self-defined safety frameworks, mandatory disclosure | Prescriptive technical and risk-management rules |
| Who Sets the Rules | Each AI company, within required categories | EU regulators and standards bodies |
| Enforcement Body | California Attorney General | National regulators plus the EU AI Office |
| Maximum Penalty | Up to $1 million per violation | Fines that can reach tens of millions of euros for serious breaches |
| Effective Date | January 1, 2026 | Phased rollout beginning in 2025 |
The comparison matters because it shapes how much leverage a case like this actually has. Under the EU’s more prescriptive model, a documented gap in a required risk category would likely trigger an automatic compliance review. Under California’s self-governance model, the same gap becomes an argument about whether a company’s own words bind it as tightly as regulators assume. That ambiguity is precisely what The Midas Project is trying to close with its public pressure campaign.
How Other Frontier AI Labs Handle SB 53 Compliance
SB 53 doesn’t single out OpenAI. It applies to every large frontier AI developer operating in California, which in practice covers the handful of companies building the most capable general-purpose models. Each of those companies has published its own safety framework to satisfy the law, and each has taken a different approach to structuring risk categories and disclosure formats. That variation is itself part of the problem watchdogs like The Midas Project are pointing to: without a standardized reporting template, it’s difficult for outside observers to compare compliance across companies, or to tell whether a given disclosure gap is a minor formatting choice or a substantive omission.
OpenAI’s own public position, that SB 53 should be strengthened rather than loosened, echoes broader industry proposals like the AI development brake plan backed by leading lab CEOs, and suggests the company anticipates more scrutiny of this kind across the industry, not less. If that scrutiny produces a wave of similar accusations against other labs, 2026 could become the year state-level AI transparency law moves from a novel legal experiment to an actively contested regulatory battleground.
Market and Industry Impact
The immediate market reaction to the allegation has been muted, which is typical for a dispute that hasn’t yet produced a formal enforcement action. But the timing carries weight for OpenAI’s broader positioning. The company has spent 2026 rolling out GPT-6 Astra to enterprise customers and expanding its presence in regulated industries like financial services, where compliance posture directly affects sales conversations with risk-averse corporate buyers. A public dispute over whether OpenAI follows its own safety commitments is exactly the kind of story that gives procurement and legal teams at large enterprises a reason to slow down a deal while they double-check the vendor’s regulatory standing.
There’s also a competitive dimension. Rival labs that can point to cleaner SB 53 compliance records gain a talking point in enterprise sales cycles where AI governance has become a standard line item in vendor risk assessments. Whether any competitor actually capitalizes on that opening depends on how the Attorney General’s office eventually responds, and on whether the dispute escalates beyond dueling public statements.
Historical Context: From GDPR to SB 53
Tech regulation has a familiar pattern. A landmark law passes, companies test its boundaries in the first year, watchdogs and regulators bring the first accusations, and the resulting disputes define how strictly the law actually gets enforced for the next decade. The EU’s GDPR followed that arc after it took effect in 2018, with early enforcement cases against major tech platforms setting precedents that still shape compliance strategy today. SB 53 is now entering that same first-year testing period, and the OpenAI dispute looks like exactly the kind of early case that will determine whether California’s law has real teeth or functions mostly as a disclosure formality.
What makes SB 53 different from most prior tech regulation is its self-governance structure. Privacy law tells companies what data practices are and aren’t allowed. SB 53 tells companies to write their own rulebook, then enforces whether they followed it. That’s a lighter regulatory touch, but it’s also untested, and this dispute is arguably the first real stress test of whether “write your own rules and follow them” works as a regulatory model for an industry moving as fast as frontier AI.
What Happens Next: 5 Predictions
- The California Attorney General’s office will likely face public pressure to open a formal review of the allegation, given the amount of press attention the case has drawn since September 14.
- OpenAI will probably move to reconcile its Preparedness Framework and Frontier Governance Framework into a single published document, closing the exact gap The Midas Project is highlighting, regardless of whether it admits any past violation.
- Other watchdog groups will likely apply the same scrutiny to Google DeepMind, Anthropic, Meta, and xAI’s own SB 53 disclosures, since all of them face the same self-governance compliance model.
- Expect renewed lobbying activity from OpenAI and peers around amending SB 53, building on the company’s August 2026 comments calling for the law to expand its monitoring requirements.
- If the dispute escalates to a formal enforcement case, it will become a reference point cited in every subsequent state-level AI safety bill introduced in 2027, similar to how early GDPR cases shaped later privacy legislation.
The Bigger Picture for AI Governance
This dispute is a preview of a much larger fight over who gets to define what “safe enough” means for frontier AI. California chose a model that trusts companies to set their own bar, then punishes them for missing it. That approach only works if outside groups like The Midas Project keep checking the paperwork against the products actually being shipped. Whether or not this specific allegation against OpenAI holds up, the pattern it establishes, a watchdog group cross-referencing model releases against a company’s own published safety commitments, is likely to become a permanent feature of how frontier AI gets regulated in the United States.
For enterprise customers evaluating GPT-6 Astra and competing frontier models, the practical takeaway is simpler: regulatory compliance status for frontier AI vendors is no longer a settled question you can take at face value. It’s an active, contested area that changes month to month, and procurement teams doing due diligence on AI vendors in 2026 need to track disputes like this one as closely as they track pricing and performance benchmarks.
Frequently Asked Questions
What is California’s SB 53?
SB 53, formally the Transparency in Frontier AI Act, is a California law signed in September 2025 and effective January 1, 2026. It requires large AI developers to publish safety frameworks describing how they evaluate and mitigate catastrophic risk, and to follow those published policies.
Did OpenAI actually violate SB 53?
That’s disputed. The Midas Project, a nonprofit AI watchdog, alleges OpenAI failed to publish required risk assessments for GPT-5.6 and GPT-6 Astra. OpenAI has publicly disputed the claim and says it is confident in its compliance with SB 53. No enforcement action has been confirmed as of this reporting.
Who is The Midas Project?
The Midas Project is a nonprofit watchdog group, founded by Tyler Johnston, that monitors how frontier AI labs comply with transparency and safety disclosure laws. It has raised multiple allegations against OpenAI in 2026, including an earlier one tied to the GPT-5.3-Codex release in February.
What penalties could OpenAI face under SB 53?
SB 53 allows California’s Attorney General to pursue civil penalties of up to $1 million per violation, with the amount scaled to severity. No penalty has been assessed in this case, since it remains at the allegation stage.
What is OpenAI’s Frontier Governance Framework?
It’s the safety framework OpenAI published in May 2026 to comply with SB 53. It organizes risk into four categories, cyber offense, CBRN, harmful manipulation, and loss of control, and assigns each new model a tier from 1 to 3 in each category.
Does SB 53 apply to other AI companies besides OpenAI?
Yes. SB 53 applies to all large frontier AI developers operating in California, meaning every major lab building general-purpose frontier models is subject to the same disclosure and adherence requirements, not just OpenAI.
How does SB 53 compare to the EU AI Act?
SB 53 lets companies define their own safety rules and then enforces whether they follow them. The EU AI Act is more prescriptive, setting specific technical and risk-management requirements set by regulators rather than by the companies themselves, with fines that can reach much higher amounts for serious violations.
What happens next in this dispute?
There’s no confirmed timeline. The next steps would likely involve either the California Attorney General’s office deciding whether to investigate, or OpenAI moving to reconcile its safety documentation to close the gap The Midas Project has identified.
