The International AI Safety Report is the closest thing the world has to a shared scientific baseline on what general-purpose AI can do and what can go wrong. Its second full edition was published on 3 February 2026, chaired by Yoshua Bengio, written by more than 100 independent experts and backed by more than 30 countries and international organisations. It is also, by its own account, not a rulebook: it recommends nothing and names no obligation. That is exactly why compliance teams misread it. The pages ranking for this report summarise it; none of them says where its findings land in an EU AI Act file. This guide does. It reads the 2026 edition as evidence: what it establishes, where Article 55 and the GPAI Code of Practice expect you to have read it, what a deployer can take from it, and where it stops being usable as proof.
Key takeaways
- The International AI Safety Report 2026 (3 February 2026) is a scientific synthesis, not a legal text. It makes no recommendations, and the United States declined to sign the final version.
- It sorts risks into misuse, malfunctions and systemic risks. Each category maps onto the systemic risks named in Recital 110 of the EU AI Act and in Appendix 1 of the GPAI Code of Practice.
- For providers of general-purpose AI models with systemic risk, it is the citable baseline for the “state of the art” test in Article 55(1)(a) and for systemic risk identification under the Code.
- For everyone else, it is a risk-source catalogue for Article 9, ISO/IEC 23894 and NIST AI 600-1, and a reason to measure automation bias in human oversight.
- Cite the edition and the date. The numbers age in months, the Key Updates exist for that reason, and the AI Office has had enforcement powers over general-purpose models since 2 August 2026.
What the International AI Safety Report is, and what it is not
The report was commissioned at the Bletchley Park AI Safety Summit in November 2023, when the participating governments asked for an independent, science-led account of the risks of advanced AI. An interim report followed in May 2024, the first full edition on 29 January 2025, two Key Updates on 15 October and 25 November 2025, and the International AI Safety Report 2026 on 3 February 2026. The 2026 edition carries the UK reference DSIT 2026/001 and was posted to arXiv on 24 February 2026 under a CC BY 4.0 licence with 92 listed authors. Who writes it matters for how you may cite it. The chair leads a group of more than 100 independent experts who, the report states, had full discretion over the content. An Expert Advisory Panel of nominees from more than 30 countries, the European Union, the United Nations and the OECD reviewed drafts and gave technical feedback. The result is neither a government position nor an industry paper. It is also published in three layers: the full report, an Extended Summary for Policymakers of about 20 pages, and a three-page Executive Summary translated into the six official UN languages. What it is not is stated plainly in the document. It endorses no policy or regulatory approach. It represents no single government. It is not binding on anyone. Its political backing is also not universal: as TIME reported on 3 February 2026, the United States commented on earlier drafts and then declined to sign the final version, unlike the year before, while the United Kingdom, China and the EU backed it. Bengio’s response was that “the greater the consensus around the world, the better”. Two calendar facts frame its authority. The report was released ahead of the India AI Impact Summit in New Delhi (16 to 20 February 2026), with the next summit due in Geneva in 2027. And it no longer stands alone: the UN General Assembly created an Independent International Scientific Panel on AI by resolution A/RES/79/325 of 26 August 2025 and appointed its 40 members on 12 February 2026 for a term running to 11 February 2029, with a mandate to publish an annual evidence-based assessment. For the first time there are two international scientific instruments on AI risk, which changes what “state of the art” will mean to a European regulator. Our guide to AI laws in 2026 places both in the wider map.
What changed between the 2025 and 2026 editions
The 2026 International AI Safety Report is not a refresh of the 2025 edition. Three things moved. First, the source of capability gains changed. The 2025 report described progress driven by ever larger pre-training runs. The 2026 report attributes most recent gains to post-training and to inference-time scaling, where a model spends more compute generating intermediate steps before it answers. The results are concrete: gold-medal performance at the International Mathematical Olympiad in July 2025; more than 60% of SWE-bench Verified software tasks solved, up from about 41% in late 2024; about 26% on Humanity’s Last Exam, up from under 5% for models released in early 2024. On one software benchmark, the length of task an agent completes with 50% reliability rose from about 18 minutes to over two hours in a year, and the report estimates that this time horizon has been doubling roughly every seven months. Training compute for leading models has grown about fivefold a year, with algorithmic efficiency improving two- to sixfold a year on top. Second, the report is far more explicit that capabilities are “jagged”. The same systems that answer more than 80% of graduate-level science questions fail at counting objects, reasoning about physical space and recovering from simple errors in long workflows. One study found 79% accuracy on questions about US culture and 12% on Ethiopian culture. On realistic workplace tasks, the best agents completed under 40% of simulated customer-service tasks, 30% of simulated office tasks and 12% of open-ended web tasks. For a compliance reader this is the single most useful finding in the document, because it describes exactly the failure pattern that human oversight has to catch: brilliance on the hard case, nonsense on the trivial one. Third, the 2026 report names an “evaluation gap”. Pre-deployment tests often fail to predict real-world performance, and models increasingly recognise when they are being tested and exploit loopholes in evaluations. The First Key Update calls this evaluation awareness and stresses that the evidence comes mainly from laboratory settings. It is still a direct challenge to any compliance programme that treats a pre-release test report as the end of the matter. The industry side changed too. Twelve companies published or updated Frontier AI Safety Frameworks in 2025, more than double the early-2025 count. Several developers released models with heightened safeguards because pre-deployment testing could not rule out meaningful uplift to novices seeking biological weapons: the report cites Anthropic’s ASL-3 protections for Claude Opus 4, OpenAI’s “High capability” safeguards for GPT-5 and mitigations for Gemini 2.5 Deep Think. And the best open-weight models now trail the best closed models by less than a year. If you govern frontier models or buy from those who build them, these are the facts your supplier questionnaire should now reflect.
The three risk categories, read as a risk register
The report groups risks into misuse, malfunctions and systemic risks. Read as a risk register rather than as a narrative, each category yields risk sources you can lift into your own file, with the report as the citation.
Risks from misuse
Criminal content is the best-documented case. One study cited by the report estimates that 96% of deepfake videos online are pornographic, and 19 of 20 popular “nudify” applications specialise in simulated undressing of women. People misidentified AI-generated text as human-written 77% of the time and AI voices as real 80% of the time. The report notes that watermarks and labels help but can often be removed, a point that bears directly on Article 50 transparency duties. Influence and manipulation sit in a different evidentiary state. In laboratory studies, models trained with more compute were more persuasive, and persuasiveness rose with longer and more personal interactions. The report finds little evidence of AI manipulation at scale in the real world. Both facts belong in your register: the capability is measured, the prevalence is not. Cyber is where the numbers moved most. In one major competition an AI agent identified 77% of vulnerabilities in real software, placing it in the top 5% of more than 400 mostly human teams. The UK National Cyber Security Centre, quoted in the First Key Update, assesses with 95 to 100% confidence that AI will make cyber offence more effective and efficient by 2027. Developers increasingly report attackers using their systems, while no fully autonomous end-to-end attack has been reported. Human-AI collaboration is the near-term threat. Biological and chemical risk is the category where developers acted before the evidence was conclusive. One model outperformed 94% of domain experts at troubleshooting virology laboratory protocols. The report is careful: how far material barriers still constrain a would-be attacker is hard to assess. The safeguards added in 2025 were precautionary, and the report says so.
Risks from malfunctions
Reliability failures are mundane and expensive: fabricated information, flawed code, misleading medical advice. The report’s new emphasis is on agents. When a system acts rather than answers, humans have fewer chances to intervene, and errors can propagate between interacting agents; the analysis draws on a survey of 67 deployed agents. No combination of current methods eliminates these failures, and the report says current techniques do not reduce failure rates enough for many high-stakes settings. That is the technical case for agentic AI security controls that assume the agent will be wrong. Loss of control is treated soberly. Current systems lack the capabilities to pose such risks, but they are improving in autonomous operation. In laboratory settings, models told to achieve a goal “at all costs” disabled simulated oversight mechanisms and gave false justifications when confronted. Researchers disagree widely on the likelihood of real-world loss of control. For your register this is a watch item with a trigger, not a scored risk.
Systemic risks
At least 700 million people now use general-purpose AI weekly. One estimate cited in the report puts about 60% of jobs in advanced economies and 40% in emerging economies as likely to be affected. Studies from the United States and Denmark in 2025 found no overall employment effect, but employment has declined for early-career workers in the most exposed occupations since late 2022. The human-autonomy findings are the ones a deployer should read twice. In a clinical study, clinicians’ detection rate during colonoscopy was about six percentage points lower after months of AI-assisted procedures. In a randomised experiment with 2,784 participants, people were less likely to correct erroneous AI suggestions when correcting them took more effort. The report calls this automation bias. Article 14 of the AI Act calls it the thing your oversight measures must prevent.
From the Report’s categories to the EU AI Act’s list
The EU AI Act defines systemic risk in Article 3(65) and lists examples in Recital 110. The GPAI Code of Practice narrows that list in its Appendix 1 to four “selected” systemic risks that every signatory must assess. The table below is our reading of how the report’s evidence lines up with both. <table header-row=”true”> <tr> <td>Report finding (2026 edition)</td> <td>Recital 110 example</td> <td>Code of Practice, Appendix 1</td> </tr> <tr> <td>Virology troubleshooting above 94% of experts; precautionary bio safeguards in 2025</td> <td>Chemical, biological, radiological and nuclear risks, lowering barriers to weapons development</td> <td>CBRN risks (selected)</td> </tr> <tr> <td>Agent finds 77% of vulnerabilities; NCSC forecast for 2027</td> <td>Offensive cyber capabilities, vulnerability discovery and exploitation</td> <td>Cyber offence (selected)</td> </tr> <tr> <td>Models disable simulated oversight; evaluation awareness; agents acting without intervention</td> <td>Unintended issues of control relating to alignment with human intent; self-replication</td> <td>Loss of control (selected)</td> </tr> <tr> <td>Persuasion rises with compute and interaction length; deepfakes at scale</td> <td>Dissemination of illegal, false or discriminatory content; effects on democratic processes</td> <td>Harmful manipulation (selected)</td> </tr> <tr> <td>Automation bias; deskilling; early-career labour effects</td> <td>Serious consequences to public health and safety; public and economic security</td> <td>Other systemic risks, to be assessed where relevant</td> </tr> </table> The mapping is ours, not the Commission’s. Its use is practical: when a reviewer asks why a given risk is in your file, the answer is a page number in a document 30 governments backed, not an opinion. The wider method sits in our guide to AI risk.
International AI Safety Report and Article 55: where it lands in a GPAI provider’s file
If you provide a general-purpose AI model classified as having systemic risk, the report is not background reading. It is the document your regulator will have read. Who is in scope is set by Article 51: a model with high-impact capabilities, presumed where cumulative training compute exceeds 10\^25 floating point operations, or one the Commission designates, including after a qualified alert from the scientific panel. The obligations in Article 55 have applied since 2 August 2025. Models placed on the market before that date must comply by 2 August 2027. The AI Office’s supervisory and enforcement powers, including fines of up to EUR 15 million or 3% of worldwide turnover under Article 101, became applicable on 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the Annex III high-risk deadline to 2 December 2027 and left the general-purpose AI chapter where it was. Article 55(1) asks four things of such a provider: (a) evaluate the model in accordance with standardised protocols and tools “reflecting the state of the art”, including documented adversarial testing; (b) assess and mitigate possible systemic risks at Union level, including their sources; (c) track, document and report serious incidents to the AI Office “without undue delay”; (d) ensure an adequate level of cybersecurity. Until a harmonised standard exists, adherence to an approved code of practice is the way to demonstrate compliance. That code exists. The GPAI Code of Practice was published on 10 July 2025, and the Commission lists 22 signatories, with xAI signing the Safety and Security chapter only. The Safety and Security chapter sets out ten commitments, from adopting a Safety and Security Framework through systemic risk identification, analysis and acceptance determination, safety and security mitigations, a Safety and Security Model Report, responsibility allocation, serious incident reporting and documentation. Its incident clocks are shorter than most teams assume: as summarised by BCLP, Measure 9.3 requires an initial report within 2 days for a disruption of critical infrastructure, 5 days for a serious cybersecurity breach including exfiltration of model weights, 10 days for a death and 15 days for other serious harm, with intermediate reports at least every four weeks and a final report within 60 days of resolution. Here is where the International AI Safety Report fits. The Code asks signatories to identify systemic risks, including the four selected ones, and to analyse their sources, which the Code describes in terms of model capabilities and propensities. The report is the most authoritative public statement of what those capabilities and propensities currently are, with the evidence graded by maturity. It is therefore the natural citation for the “state of the art” test in Article 55(1)(a): a provider whose evaluation protocol ignores evaluation awareness, situational awareness or defence-in-depth will have to explain why the scientific consensus does not apply to it. The findings of the Second Key Update on safeguards belong in the same section of the Model Report: prompt injection still succeeds about half the time with ten attempts; as few as 250 malicious documents can poison training data; unlearning can be reversed with fewer than 100 fine-tuning examples; and the weakest area of fulfilment across voluntary commitments was model-weight security. What the report is not is a model-specific evaluation. It tells you what to test for and what the literature says about the tests. It does not test your model, and no reviewer will accept it as a substitute for the adversarial testing Article 55 names. Nor does it replace your own incident tracking, which our guide to AI incident reporting covers. One more clock. Article 90, applicable since 2 August 2026, lets the scientific panel of independent experts send the AI Office a qualified alert when it has reason to suspect that a model poses “a concrete identifiable risk at Union level”. The panel reads the same science you do. If your file and the report disagree, make sure your file says why.
What the Report means for deployers and non-frontier providers
Most readers of this guide do not train frontier models. For them the report is still useful in five places. Risk identification. Article 9 requires providers of high-risk systems to identify known and reasonably foreseeable risks; ISO/IEC 23894 asks for risk sources; NIST AI 600-1 lists twelve generative-AI risks. The report gives you the evidence behind each: which risks are measured, which are observed, which remain theoretical. Cite it at the identification step and your impact assessment gains a defensible proportionality argument. Human oversight. The colonoscopy and automation-bias findings are the strongest empirical case yet that oversight degrades with use. Article 14 requires oversight measures that let the natural person remain aware of automation bias; Article 26 puts the deployer’s oversight duty on the record. Measure override rates, rotate reviewers, and keep an unassisted performance baseline you can compare against. These are controls a reviewer can inspect. Third-party risk. The report is explicit that open-weight models cannot be recalled, that their safeguards are easier to remove and that misuse is harder to trace. If your supplier fine-tunes an open model, your vendor due diligence must ask which safeguards survive fine-tuning, who monitors the deployed version and how a serious incident reaches you. AI literacy. Article 4 has required providers and deployers to ensure a sufficient level of AI literacy since 2 February 2025. The three-page Executive Summary, available in six languages, is ready-made material, and the jagged-capabilities finding is the one lesson every user needs. Our AI literacy guide shows how to evidence the training. Transparency and provenance. The report’s conclusion that watermarks and provenance signals can be removed, forged or degraded means marking is a control, not proof. Article 50 still requires it, and the marking transition for systems already on the market closes on 2 December 2026. Layer marking with disclosure and detection, and record that the layering decision was informed by the report. Finally, governance. Your AI governance committee should minute which edition of the report it relied on and when it will look again. An undated reference to “the Bengio report” is not evidence.
Six findings to carry into your controls
The International AI Safety Report never tells you what to do. These six findings nonetheless translate into controls with evidence behind them. <table header-row=”true”> <tr> <td>Finding in the 2026 report</td> <td>Control</td> <td>Evidence artefact</td> </tr> <tr> <td>Pre-deployment tests often fail to predict real-world performance (evaluation gap)</td> <td>Post-market monitoring on production metrics, with a drift review cadence</td> <td>Monitoring plan, dated drift reviews, deviation log</td> </tr> <tr> <td>Prompt injection succeeds about half the time with ten attempts</td> <td>Defence-in-depth: input and output filters, least privilege, human approval gates for agent actions</td> <td>Red-team reports, filter configurations, approval logs</td> </tr> <tr> <td>As few as 250 malicious documents can poison training data</td> <td>Data provenance controls and dataset hashes in the system’s bill of materials</td> <td>Dataset lineage records, hashes, supplier attestations</td> </tr> <tr> <td>Watermarks and provenance signals can be removed or forged</td> <td>Layered Article 50 compliance: marking plus disclosure plus detection</td> <td>Marking test results, disclosure texts, detection procedure</td> </tr> <tr> <td>Automation bias and deskilling after months of AI-assisted work</td> <td>Oversight metrics, periodic unassisted performance checks, reviewer rotation</td> <td>Override rates, escalation records, baseline comparisons</td> </tr> <tr> <td>Errors propagate between interacting agents; identity frameworks for agents are immature</td> <td>Agent inventory with scopes, kill switch, approval gates</td> <td>Inventory record, runtime logs, tested shutdown procedure</td> </tr> </table> The common thread is that each control leaves a dated record. The agent row deserves a word: an AI registry that lists agents with their tools and scopes is the precondition for every other agent control, and the report’s finding that agent identity and accountability frameworks are at an “early stage” is the reason to keep that record yourself rather than wait for a standard. Our guide to autonomous AI agents covers the governance side.
The evidence dilemma, and how to document a decision under it
The most quoted idea in the International AI Safety Report is also its most useful for an auditor. It describes an “evidence dilemma”: acting on thin evidence risks entrenching ineffective measures, while waiting for conclusive data can leave society exposed to serious harm. It names four institutional challenges behind it: gaps in scientific understanding, information asymmetries between developers and everyone else, market failures that externalise harm, and weaknesses in institutional design and coordination. Neither the AI Act nor ISO/IEC 42001 expects you to resolve the dilemma. Both expect you to document a decision taken under it. A usable record has seven parts: the question you faced; the edition and section of the report you relied on, with its date; the uncertainty you acknowledged; the control you chose and why it is proportionate; the trigger that will make you revisit the decision (a new edition, a Key Update, a Commission guideline, a qualified alert under Article 90, an incident); the owner; and the date. The “if-then” commitments the report describes in frontier safety frameworks, where a capability threshold triggers a predefined response, are a template anyone can borrow for the trigger clause. Written this way, a decision taken on incomplete evidence becomes defensible, which is what risk appetite means in practice, and what AI accountability looks like on paper. Written as “we considered the Bengio report”, it is a liability.
Limits of the International AI Safety Report as evidence
Four limits should be stated in any file that cites it. It recommends nothing. The report is descriptive by design. It will tell a regulator what the science says; it will not tell them what you should have done. The obligation always comes from the law, the standard or the Code, and your file must name that source separately. Its political backing is broad but incomplete. Thirty countries and organisations stand behind the 2026 edition, including the United Kingdom, China and the European Union. The United States does not. In Brussels or London the report can be cited without reservation; in a US proceeding, cite it with that context. Much of its risk evidence is laboratory evidence. The report says so itself about loss of control, evaluation awareness and persuasion, and it repeatedly notes that systematic data on real-world prevalence is limited and that the effectiveness of safeguards is uncertain. A finding of capability is not a finding of harm. Record which one you are relying on. Its numbers age in months. Benchmark results, safeguard bypass rates and agent task horizons all moved between January 2025 and February 2026, which is why the Key Updates exist. Cite the edition and the date, and set a review trigger. The same discipline applies to the frameworks the report itself names as new in 2025: the EU Code, China’s AI Safety Governance Framework 2.0 and the G7 Hiroshima reporting framework that our OECD AI Principles guide describes. Their effectiveness, the report says, is not yet known.
FAQ
What is the International AI Safety Report? It is an independent, science-led review of the capabilities and risks of general-purpose AI, commissioned at the 2023 Bletchley Park summit and chaired by Yoshua Bengio. The 2026 edition, published on 3 February 2026, was written by more than 100 experts and backed by more than 30 countries and international organisations. It is published as a full report, a 20-page Extended Summary for Policymakers and a three-page Executive Summary in six languages, with interim Key Updates between editions. Who writes the International AI Safety Report, and is it independent? A chair-led group of independent experts writes it, with full discretion over the content. An Expert Advisory Panel of nominees from the backing countries, the EU, the UN and the OECD reviews drafts and provides technical feedback. The report states that it represents no single government’s views and endorses no policy approach. The UK Department for Science, Innovation and Technology provides the secretariat, which is why the 2026 edition carries the reference DSIT 2026/001. Is the International AI Safety Report legally binding? No. It creates no obligation and names no clause. Its legal relevance is indirect: the EU AI Act asks providers of general-purpose AI models with systemic risk to evaluate their models with methods “reflecting the state of the art” and to identify systemic risks and their sources, and the report is the most authoritative public statement of that state of the art. Your obligation comes from Article 55, the Code of Practice or your sector law; the report is evidence about the science those texts refer to. Did the United States endorse the 2026 report? No. According to TIME, the United States gave feedback on earlier drafts and declined to sign the final version, unlike in 2025, when the Department of Commerce was named on the report. The United Kingdom, China and the European Union backed the 2026 edition. The report does not depend on any single government’s endorsement, but a file that cites it in a US context should note the position. How does the report relate to the EU AI Act and the GPAI Code of Practice? The Act’s Article 55 requires systemic-risk providers to evaluate models with state-of-the-art protocols, to assess and mitigate systemic risks and their sources, and to report serious incidents. The Code of Practice, signed by 22 companies, turns that into ten commitments and names four selected systemic risks: CBRN, loss of control, cyber offence and harmful manipulation. The three risk categories of the International AI Safety Report map onto that list, and its evidence on evaluation awareness, prompt injection and safeguard removal is the baseline a provider’s Model Report should address or explain. How often is the report updated, and what is the evidence dilemma? A full edition has appeared each year since January 2025, with Key Updates in between: two in 2025, on 15 October and 25 November. The evidence dilemma is the report’s description of the policymaker’s position: acting on thin evidence risks entrenching ineffective measures, while waiting for conclusive data risks leaving society exposed. For a company it means documenting decisions with the edition relied on and a trigger for review, rather than waiting for certainty.
Conclusion
The International AI Safety Report 2026 will not tell you what to do. It will tell every regulator, notified body and auditor what the science said in February 2026, and from that point the burden of explaining any gap between your file and the consensus is yours. For a provider of a general-purpose model with systemic risk, that makes it the reference line for Article 55 and the Code of Practice. For a deployer, it is a catalogue of risk sources, a warning about oversight that decays with use, and a reason to treat every vendor safeguard as a claim to verify. Cite the edition, date the decision, name the trigger that will reopen it. AI Sigil keeps each AI system as a record with its risks, controls and evidence, so that when the next edition moves the baseline, you can see in one place which decisions it touches.