AI Security & Safety Institutes Need A Comparative Advantage

• AI Safety and Security Institutes (AISIs) outside America and Britain are going to face a similar set of problems: their size and resourcing will potentially limit their ability to attract top talent, and they may find themselves having access to frontier AI models withdrawn for geopolitical reasons. Even Britain’s AISI - with the best funding and technical talent - cannot and does not assume that it will continue to get pre-release models from frontier AI companies. For other smaller AISIs, attempting to reproduce the same analysis but with less expertise and leverage leaves them in an even more precarious position than their British counterparts.
• To counter this, AISIs should devote 20% of their time and resources in areas in which their countries already possess expertise, infrastructure or institutional capacity. Executed correctly, this could help create comparative advantage, novel datasets, and leverage in negotiations with Washington and US frontier companies, when placed into wider statecraft. Britain’s AISI should not do this - it should continue to work specifically on what it does with the resources it already has.
• Alongside this, AISIs should internalise that their work is going to be under increasing political and media scrutiny, and invest in ways of communicating their efforts within their countries. Specialisation is one such approach.

There are now a dozen or so institutes and related bodies working on AI safety and security. Their structures, resources and mandates vary, but their purpose is broadly threefold: first, test models produced by frontier AI companies such as OpenAI, Anthropic and their Chinese counterparts. Second, research the problems these models create, including alignment, cyber security, and chemical and biological risks. Third, brief that information back into government, and disseminate some of it publicly or among their international counterparts.

As nations procure the services of frontier AI companies, embedding their technologies into their economies and societies, it is strategically important for them to understand what is taking place at the frontier of these technologies. The strongest AISIs combine technical talent, access to the companies’ models, and substantial state funding. These are scarce resources for most nations, and currently Britain’s AISI leads the way by some distance. The funding granted to Britain’s AISI (UKAISI) allows it to hire excellent technical talent, keep them on the books, and procure third parties to help design and test critical parts of its brief. For example, UKAISI spent more on procuring outside contractors than the entire budget of its Korean counterpart in 2025.¹

Resources are not the only necessity for an impactful AISI: there is the need to secure models to test from the frontier AI companies. But as it stands, a worrying trend has emerged in the last few months of American frontier firms withholding models from UKAISI.²

So how can AISIs look to build something that offers substance to both its own government and society, whilst also creating potential sources of strategic leverage in Washington? Specialisation seems a coherent approach.

Britain: A Case Study In Entering The Spotlight

Britain’s experience over the summer provides an indication of what increased political and media scrutiny of an AISI can look like. On early August, UKAISI disclosed that agents in a cyber evaluation had taken unsanctioned actions against real people and organisations.³ Internet access had been deliberately permitted and the developers’ cyber safety filters disabled to test the models’ capabilities; the failure concerned the scope and oversight of the agents’ actions. UKAISI said its investigation had found no evidence of resulting real world harm but the behaviour had exceeded what it anticipated and threw the institute into the political and public spotlight.

Media and Parliamentary attention subsequently widened, both in Britain and internationally. The attention also took more demanding forms with Select Committees getting involved. In early September, influential Labour MP and chair of the Business and Trade Committee Liam Byrne asked whether UKAISI had sufficient mechanisms, relationships and leverage to secure access to frontier models, just one voice among others raising concerns.⁴,⁵,⁶ Media attention also increased, with various journalists chiming in to offer views on the issue for the first time.

Focus on the UKAISI continued beyond this incident, because the media next revealed that American frontier companies had stopped sharing some models pre-release at the request of the US Administration. In its 15 September response, UKAISI acknowledged that Anthropic had made Mythos 5.1 unavailable to organisations outside the US, while noting that it had tested OpenAI’s GPT-6 Astra before release. While at the time of the letter it looked like access could vary between developers and between releases from the same developer, it has since been reported that the White House’s Office of the National Cyber Director leaned on the American companies not to share pre-release models with UKAISI.⁷

Bluntly: even an institute with Britain’s resources and relationships could not assume that past cooperation would continue on the same terms, which in turn caused frothing media and political questions as to what risks this may throw up going forward. It has reportedly taken direct Ministerial lobbying from a very charismatic British politician to regain British access - not something replicable elsewhere necessarily, nor a fallback a country wants to rely on.⁸

What’s an AISI to do?

Even if they cannot guarantee the same funding as UKAISI or access to pre-release American models, countries should still develop the expertise to understand frontier AI. For as long as governments attract, procure and integrate these technologies, they will need people who can explain the risks and benefits to ministers and provide analysis independent of the companies selling them or other third party groups. The question then becomes: how can an institute make the best use of its resources while strengthening its position at home and abroad?

AI will become more politically consequential as its effects begin to spread through industry, society, and general consciousness. With the exception of Singapore, every single democratic country with an AISI has an election due before 2030, and that will bring arguments over who benefits, who pays, and who is responsible when something goes wrong. Already, government leaders and ministers cite the existence of their respective AISI as proof that they are ‘doing something active’ about this technology: but AISIs have yet to be really tested by a crisis, and those officials may not fully understand what the AISI’s actual roles and responsibilities are.

In the coming months and years, AISIs will increasingly be asked to explain their findings, defend their procedures and demonstrate that they can fulfil their remit. The age of existing on the peripheries of politics is over - not inherently a bad thing at all, given they are Government bodies. But politicians, commentators and activists may also press them to become regulators - especially if AI-related incidents occur. In doing so, they will run head first into geopolitics: America’s AISI - CAISSI - is mandated to “represent U.S. interests internationally to guard against burdensome and unnecessary regulation of American technologies by foreign governments," and may prove a painful impediment to those plans.⁹

Specialisation can help an institute build support beyond the minister responsible for AI and the frontier research community and deeper across the host government, economy and society. If done well, it could also offer technical expertise and data sets useful for negotiating with Washington and San Francisco. An AISI that has won the acclaim of those working in disease preparedness agencies, manufacturers or financial supervisors has several institutions with a reason to defend its continued existence beyond its core current supporters.

Crucially, it can also broaden the expertise brought into AI safety and security. There are pools of expert technical talent working in biosecurity, engineering and other state organs that have yet to work with frontier technologies and methods. Their insights working with an AISI may allow new datasets to be developed, or new bottlenecks to be understood better. What could this look like in practice? Australia offers one potential example. As an island with significant native flora and fauna and a huge agricultural sector, Canberra has an advanced and sophisticated biosecurity layout. This includes CSIRO, Australian Centre for Disease Preparedness, which has expertise in emerging diseases. On the international level, the country also chairs the Australia Group, an international collection of nations that coordinates chemical and biological export controls. The foundations on which an AI biosecurity programme could be built as part of the Australian AISI’s specific remit already exist.

Japan offers a different potential example: embodied-AI safety, or the safety of models that perceive and act through physical machines - robots to you and I. Some of this differentiation is already underway. Japan’s AISI published robotics safety evaluation guidance in July 2026, using café transport and delivery robots as examples.¹⁰ Its advanced robotics industry could collaborate more coherently with its AISI, producing novel datasets or insights around the potential for tacit knowledge erosion.

For less developed countries, Kenya provides an interesting case. Nairobi is currently developing its AISI - the first on the African continent. It could explore safe AI deployment through mobile financial services, building on an ecosystem in which mobile money is a major driver of financial inclusion, or African language application of the technology.

Importantly, UKAISI should continue to create high quality technical research and best practise, building on the high quality talent and significant resources it has available compared to its peers.

Getting Into The Mechanics

Building these specialisms would require sustained interaction between AISIs and existing parts of government, business and the research community. Around a fifth of an institute’s resources would be a starting proposal, with the allocation reviewed against results. The institute would contribute knowledge of frontier models and ideally, it would share a physical space with other non-AISI but technically sound and security cleared staff, going some way to help tackle monoculture of thought and allow the permeation of new ideas and views into the system.¹¹

While avoiding politicising AISIs, it will likely be helpful for governments going forward to be able to evidence to their voters that AI and its potential risks and opportunities are being taken seriously. In this sense, specialisation also provides a tangible example of what is taking place on this front, rather than the also important but incredibly abstract art of alignment testing or sandboxing. If a Prime Minister or President can talk of their AISI’s work on testing robotics safety for the elderly, or cracking down on AI-enabled fraud in mobile payments, that provides further institutional relevance. Geopolitically, an institute that can provide difficult-to-recreate testing environments, specialist expertise or valuable datasets gives international partners a reason to involve it. For a frontier company, this could help identify risks that its own evaluators would miss, and for the US government, it could add capacity to a problem that no single country can fully assess - to this degree, it is worth exploring how smaller security partners in the Nordics offer value to the US. But the leverage needs to be practical and strategically considered. A continuing partnership, in which new models can be assessed using a valuable specialist capability, creates a stronger incentive to maintain access - especially if considered thought has been given on ways to avoid instant saturation of the evaluation set. In return, the AISIs’ governments could seek reciprocal evaluation arrangements as part of those partnerships, potentially providing a small amount of leverage to help avoid the Permanent Periphery.¹² This would strengthen their position in negotiations, although it would not override American restrictions or guarantee a private developer’s cooperation.

Mission Creep, or Refocusing?

There are some valid criticisms of the specialisation approach, which is not without risk. Mission creep is the most obvious: an institute could gradually become an AI adoption consultancy, choosing projects for their visibility or popularity, and the dilution may drive away the exact type of person who is willing to not work at a frontier company and instead focus on existential risk within an AISI. On this point, it should be clear that only 20% of resources should be expended on the specialisation: the bulk of any AISI’s work will remain focused on the usual remit. As noted prior, to make this work, each specialism therefore needs to build on pre-existing expertise in-country, a connection to the institute’s remit and a useful research contribution beyond its home country. Another criticism is that this 20% is, in fact, too little capacity or resourcing. This may well be true, so after a two year effort, size and resources can be reassessed.

The already existing AISI network should be streamlined to share new findings, and a secondary channel of informal conversations between researchers and other related characters developed. Each should retain the core ability to understand the frontier, and the diplomatic and security know-how to access and analyse the results coming from their international partners.

Passivity Is Not A Strategy

Even if Beijing and Washington look to cut out others from the perceived AI race, they will not solve every AI-related problem on their own. Their AI companies still need to expand into foreign markets, make deals with foreign governments, and - crucially - be viewed as trustworthy products by current and future users.¹³ While this serves as a useful starting point for governments today to consider, it is too passive to rely on as its own strategy. Instead, countries around the world should remember that they have expertise worth bringing to the task - or the ability to rapidly grow it - and their AISIs should make deliberate use of it. The jagged frontier of AI capabilities and the need to consume vast new data sets presents dexterous governments an opportunity to embed their AISIs into the supply chain of these companies, and in turn, build leverage in Washington.

Domestically, it is going to continue to be important for a state to prove to its population that it is taking the risks of this technology seriously - not just the opportunities to entice business or investment. Politicians often talk of AI’s widespread potential to touch all parts of life and society - so why not broaden the work their respective AISIs are doing to rise to the claim?