Anthropic's METR arrangement: six staff, no veto, and a redaction clause rewritten 27 hours after publication

Six staff, no veto, and a redaction paragraph rewritten 27 hours after publication

Anthropic's post "An update on independent evaluators" was published at 17:20 UTC on 15 October 2026, according to its own page data. The same data gives a last-modified time of 20:30 UTC on 16 October, which is 27.2 hours later (derived). The post's second footnote says it was "Updated on October 16 to clarify METR's current project terms with Anthropic." It does not say what changed. The Internet Archive holds seven captures of the page. Comparing the first with the sixth shows what changed. Between them, a sentence saying METR may say whether Anthropic's redactions were justified was removed, a sentence saying Anthropic decides what falls into the redaction categories was added, and the word "narrow" was dropped from the description of those categories. An earlier edit, 6.3 hours after publication (derived), removed a line placing SecureBio in the first access tier.

The post's own headline facts are these, all Anthropic's account of itself. Six METR employees have company hardware, office space and access "roughly on par" with Anthropic's own risk assessment teams. Anthropic "can't veto publication". And Anthropic "ultimately decides what information does and does not fall into these categories" of redactable information. Six is about 14 per cent of the 44 people METR's About page lists as staff (derived, counted on 17 October 2026, including one research contractor; advisors and collaborators excluded).

Three statements of what an evaluator may say about a redaction, in order. The first is from the chief executive's September essay, the second and third from Anthropic's 15 October post. Wording quoted from each page as read.

When	What the page said	Scope
12 September 2026 (earliest archive capture 12 September; the page gives the month only)	"The reviewers can say publicly if a redaction removed something important to their conclusions."	Embedded reviewers in general. A commitment, not a contract.
15 October 2026, 17:20 UTC (first version of the post)	METR "is free to characterize our redactions publicly, and say whether it believes the redactions were justified", without revealing what was redacted.	METR, in a sentence about its terms.
16 October 2026 (current version)	"Anthropic ultimately decides what information does and does not fall into these categories, although METR reserves the right to make certain statements about the level of access and information it received."	METR. Now about access, not about whether a redaction was justified.

That is a change of wording, and the record does not show why. Anthropic calls it a clarification of METR's "current project terms". Reuters reported on 13 October, two days before the post, that two people it did not name said Anthropic and OpenAI had sought significant control over what evaluators publish, and that one of them said Anthropic's talks with some evaluators appeared to have changed by 8 October (Reuters, read via a syndicating site). Read as a whole, the page is now ambiguous rather than clearly narrower. Tier 3 still gives METR publication rights "similar to" tier 2, and tier 2 evaluators "can publish their views on whether our redactions were justified". What the page no longer says in so many words is whether that includes METR. METR's own site shows nothing about the arrangement: its latest post, as re-read at 11:35 BST on 17 October, is dated 14 October, the day before. The one METR sentence found on it is quoted by Reuters, saying its report will describe the scope, access and limitations of its work.

The record does not establish what METR is paid for this, or by whom; whether any of the evaluators has a conflict; whether anything METR finds could stop a model release; what happens if METR disagrees with a redaction; whether any evaluator has found anything under these terms; how an Accord that the post cites can be enforced; or when the first METR publication will appear. The post gives no date. Each gap is set out below with the source that is silent on it.

Interest, in one sentence: Anthropic sells the Claude models these evaluators assess and chose the evaluators, METR is a nonprofit that says it has not accepted funding from AI companies though it uses their free model access, Accenture is a commercial partner that Anthropic says it will pay directly, and none of that is a finding about anyone's conduct. Everything was read between 11:07 and 11:36 BST on Saturday 17 October 2026: Anthropic's post in full, footnotes and partnerships section included, then METR's, SecureBio's and Accenture's own pages, the AI Evaluator Forum documents, the Accord and the UK pages. Reuters is cited as secondary. A page that was edited twice in its first 28 hours can change again, so every wording here is time-stamped.

What is new on 15 October, and what had already been said

Anthropic's post presents embedded evaluation as a start. Most of its parts have a dated earlier record, which the table sets out. The post says Anthropic has worked with METR on "several reviews of our Risk Reports"; METR's own list shows three reviews of Anthropic risk reports, dated 28 October 2025, 12 March 2026 and 8 May 2026 (derived count). One of them, the 8 May review, says METR does "not think the report adequately supports its conclusion". That is the record of an outside party disagreeing in public, under an earlier and different arrangement.

Dated items before the 15 October post, each read at the page named in the article text. Day counts to the post are derived.

Date (2026 unless stated)	What the record shows	New on 15 October?
28 Oct 2025, 12 Mar, 8 May	METR reviews of Anthropic's pilot sabotage report, the Opus 4.6 sabotage report and the research-automation section of the February Risk Report.	No
26 Mar, 19 May	METR red-teams Anthropic's internal agent monitoring for three weeks, then publishes a pilot Frontier Risk Report with an AEF-1 checklist that says METR's conflict policy was not in place at the start.	No
July	SecureBio publishes its pilot review of the February Risk Report's chemical and biological sections. [SecureBio says](https://securebio.org/resources/anthropic_feb_2026_risk_review.pdf) Anthropic "had the right to veto and/or redact" and "exercised neither right", and that it received no funding from Anthropic for the work.	No. And a veto right existed in a pilot
9 Sep (36 days before)	Anthropic's alignment-assessment post says it signed an agreement for METR to investigate four cyber-evaluation incidents. The initial term is eight weeks (56 days, derived). The start date is not stated.	No
12 Sep (33 days before)	The chief executive's essay commits Anthropic to embedded evaluators and says it is "unilaterally committing to this step now".	No. The promise
18 Sep (27 days before)	Anthropic names Accenture's Faculty unit as its first embedded evaluator and says it "will fund Accenture's work directly". Both companies expect to invest at least $1 billion over five years.	No
22 Sep (23 days before)	METR's Claude Opus 5.5 summary says the work was under "an unpaid agreement" and that Anthropic could review and edit the text, which METR then signed off.	No
29 Sep (16 days before)	The White House Accord on Super Intelligence is signed. Its third commitment is an independent external auditor or evaluator.	No
15 Oct	Six METR employees onboarded; stated no-veto terms for them; three access tiers; SecureBio placed in tier 1 (first version only); early talks with Hugging Face.	Yes

So the new things are narrow: a named team of six, the stated no-veto term for that team, and a three-tier design. The reviews, the pilots, the funding arrangement with Accenture and the promise itself were already on the record. The 22 September METR page matters here because it shows a second regime with the same two parties: there, Anthropic reviewed and edited the text before METR signed off. It also says a separate METR team "with elevated access" shared conclusions with the pre-deployment team without its evidence, and that METR expected further public output from that separate work "in the coming weeks". As of 17 October that is 25 days (derived), and no such output was found on METR's site.

The 15 October post, line by line: stated and not stated

The table reads the post as it stands on 17 October. The middle column is Anthropic's wording or a close paraphrase of it. The right column is what a reader would need and the post, or the sources linked from it, do not give.

Stated and not stated in Anthropic's "An update on independent evaluators", current text as read on 17 October 2026. The right column is this briefing's reading of the gaps.

Topic	Stated by Anthropic	Not stated
People	Six METR employees, a "small team operating under enforceable agreements", siloed from other METR staff, including researchers on other Anthropic projects.	Roles, seniority, start date, length of stay. How the other METR work with Anthropic is kept apart in practice.
Access	Company hardware, office space and tools and systems "roughly on par" with Anthropic's own risk assessment teams. Employees are "encouraged" to share.	Which tools. Whether "on par" includes the alignment, training or security teams. The size of Anthropic's risk teams, so the six cannot be set against it.
Exclusions	"A small number of clearly defined categories", with three examples: customer data, attorney-client privileged information, model architecture.	The full list, who defined it, whether METR has seen it, and a log of refused requests.
Architecture	Highly relevant architecture information: "we will generally seek to share it", with "explicit internal approvals".	Who decides relevance. What happens if approval is refused.
Publication	METR "will publish its analysis of our risk levels, incidents, or practices."	The first publication date. How often. A time limit on Anthropic's review.
Veto	Anthropic "can't veto publication."	Whether drafts are shared first, and whether any other approval (legal, security) can hold a report.
Redaction	Anthropic can require redaction of "predefined categories" and "ultimately decides" what falls inside them.	The categories in full. A route to challenge a decision. A redaction log.
Disagreement	METR "reserves the right to make certain statements about the level of access and information it received."	Whether METR may say a redaction was unjustified. What happens if the two sides do not agree.
Independence	Evaluators should hold no equity and not be "financially or operationally dependent".	Who checks. What METR is paid, if anything, for this engagement. Which conflict policy applies: METR's version 1.1 covers projects beginning on or after 9 October, and the start date is not stated.
Other evaluators	SecureBio reviewing a chapter of the August Risk Report; Accenture and Faculty in an "ambitious partnership"; "early discussions" with Hugging Face and others.	Tier for each (SecureBio's was removed). Accenture's fee. Hugging Face's role. The names of the others.
Findings	Nothing.	Any finding by the embedded team, any incident it has reported, or any item it has asked for and been refused.
Authority	Nothing on stopping, delaying or reporting to anyone.	Any power to delay a release or to reach a board or a government body.
Enforcement	The METR team's agreements are "enforceable". The post says it embeds evaluators "voluntarily".	Who can enforce the publication terms, with what remedy, under which law.

How "independent" is defined, and who tests it

Anthropic's post names four requirements of an evaluator: expertise, independence, enough access, and freedom to publish. Independence is three tests: evaluators "shouldn't hold equity in the company they're evaluating, or be financially or operationally dependent on it." The post does not say who applies the tests, when, or on what evidence. Anthropic's own June 2026 policy framework, which the post links, was stricter in two ways. It proposed that evaluators certify their independence, including funding and equity disclosures. And it warned of "evaluator shopping": companies seeking "whichever evaluator(s) will ask the least of them and be most generous in their assessments", which it suggested government agencies could counter by rating evaluators and randomly assigning highly rated ones in high-stakes cases. The 15 October post describes none of those safeguards. It describes a company choosing its own evaluators, the setting in which the June framework says shopping can occur. That is a comparison of two Anthropic documents, not a finding about any evaluator.

Five written tests of independence, each read at its own source. Who wrote each is in the first column.

Source	What it requires	What it leaves open
Anthropic, 15 October post	No equity; not financially or operationally dependent.	Who checks; payments; other business.
Anthropic, June framework	No financial interest in the developer; no major conflicts; certification and disclosure; random assignment for high stakes.	Written as a proposal for government, not a practice.
[AI Evaluator Forum letter](https://aievaluatorforum.org/initiatives/embedded-evaluation-letter), 18 September, signed by 200 or more people (its count)	Not owned or governed by the company; "should not have other significant commercial business with them"; no payment contingent on findings; full editorial control.	A letter, not a standard. Its signatories include METR and SecureBio staff.
[AEF-1](https://aievaluatorforum.org/initiatives/minimum-operating-conditions), version 1 of December 2025	Five principles. Conflicts: no contingent pay, no organisational or financial control, a published conflict policy that was applied, disclosure of payments and equity. Redaction: the provider "did not have authority to redact results to conceal concerning findings".	Voluntary. Written by evaluators, among them METR and SecureBio.
[METR conflict policy](https://metr.org/coi-policy.pdf), version 1.1	Three tiers of staff conflict; the top tier requires recusal. Effective for projects beginning on or after 9 October 2026.	Covers staff conflicts. Funding sits in METR's separate independence principles.

The Forum's authors and signatories include the evaluators themselves, so its standard is the evaluator side's account of what it needs. METR says as much about its own work. In its 14 October post, the day before Anthropic's, METR says its published principles cover two of the Forum's five embedding conditions (independence and transparency), do not cover two others (multiple evaluators, and protection from retaliation), and only partly cover the fifth, access. METR adds that because "access requests are approved or denied at the company's discretion", its embedded assessors "will not have the same degree of access as a company's senior safety staff". Anthropic's phrase is "employee-like access", and its figure for comparison is its own risk assessment teams, not its senior safety staff.

Money and ties, as each party states them in its own words. "Stated" is attributed to the party that said it. Nothing here is a finding of conflict.

Evaluator	What the primaries state	Not stated
METR	METR "has not accepted funding from AI companies, though we make use of significant free tokens" ([About page](https://metr.org/about)). It lists donors and foundations, the UK AI Security Institute, and a small technical-assistance contract with the European AI Office. It said on 14 August it had raised around $71 million of commitments in six months ([funding update](https://metr.org/blog/2026-08-14-funding-update/)). In its May report METR disclosed that its use of non-public models and free tokens "incentivize a cordial relationship with AI companies" and that at least six people involved had close personal ties to AI-company staff. Anthropic said on 18 September it was in dialogue with METR to pilot embedded evaluation "using their own funding".	Whether the six staff are METR-funded for this work. Whether free tokens extend to them. Which conflict policy applies, since the start date is not stated.
Accenture and Faculty	Anthropic: it "will fund Accenture's work directly"; each company expects to invest at least $1 billion over five years, about $200 million a year each on average (derived), an investment expectation and not a fee. Accenture and Anthropic formed the Accenture Anthropic Business Group on 9 December 2025, with about 30,000 Accenture staff to be trained on Claude. Anthropic's 15 October post says its partnership with Accenture and Faculty includes "building capabilities across our organizations".	The fee, the term, the tier, the publication rights. Whether this business counts as "financially dependent" under Anthropic's own test.
SecureBio	[SecureBio says](https://securebio.org/blog/review-of-anthropics-unredacted-chemical/) it "did not receive funding from Anthropic" for its pilot review. Its [principles page](https://securebio.org/ai/principles/) says that for some for-profit engagements it requests funding, and for others it does not.	Funding for the review now under way. Which AI companies provide the "small portion" of its funding that its pilot report mentions. Its tier.
Hugging Face	Anthropic: "early discussions". No Hugging Face statement was found.	Scope, funding, timing.

This site's earlier briefing on Anthropic's midterms post met the same label on three other groups. "Independent" there meant only that the groups were not part of Anthropic, and the post did not say who funded them, set the scope, saw drafts or could stop publication. The word carries the same weight here, with one difference worth keeping: for METR the primaries do say a lot about funding. For Accenture they say that Anthropic pays.

Who can see what, and who decides what is redactable

Anthropic describes three access tiers. In the first, it decides what access an evaluator gets and the evaluator "can publish their findings with our approval". In the second, evaluators publish without approval and see more, but Anthropic can still require removal of specific categories. The third is METR's, with "employee-like access" and publication rights "similar to those of the second tier". The figure sets the four levers against the three tiers. Reading each cell for who holds the lever gives 5 cells for Anthropic, 3 for the evaluator, 1 partly and 3 not stated (derived). For METR, Anthropic holds two of the four: what falls outside access, and what counts as redactable. The post names four organisations as evaluators or prospective ones: METR, SecureBio, Accenture (with its unit Faculty) and Hugging Face, which is in "early discussions". Of the three at work, the current text places one in a tier (derived).

The categories are the crux, and the record gives three different lists, none of which is the "predefined" one. A count shows how loose the term is.

Three published lists of what a developer may withhold, each from its own date. Counts are derived from the text.

Source and date	What may be withheld	Count
Chief executive's essay, 12 September	Security-sensitive, legally privileged, commercially sensitive, or third-party confidential information. "We can't redact findings just because they are unfavorable."	4 named
Anthropic post, 15 October	"E.g.": data about customers, attorney-client privileged information, information about model architectures.	3 examples; total not stated
[August 2026 Risk Report](https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026%20.pdf), public version	Footnote notices of the form "redacted here for" give intellectual property, public safety, commercial sensitivity and security as reasons; two appendices are marked "[Appendix redacted]".	16 notices (at least) and 4 reasons, by text search

"Commercially sensitive" appears in the essay and the Risk Report and not in the 15 October examples. "Model architecture" appears only in the October examples. The essay promised that Anthropic could not redact findings merely because they were unfavourable. The 15 October post, in its current form, does not repeat that promise and says Anthropic decides what the categories cover. The AEF-1 standard draws the line in a different place: authority to redact is for privacy, ethical restrictions, trade secrets or information hazards, and "must not be used" to conceal poor performance. Reuters' 13 October report adds that what labs treat as crucial intellectual property can overlap with what is relevant to a model's risk, which "can lead to arguments and redactions", and that Anthropic told it that for new evaluators it reserved a right to comment on and approve reports.

Nine friendly names, and what each does the work of

Labels in Anthropic's post, the Accord and the surrounding coverage, with what each stands in for and what the record shows.

Label	Does the work of	What the record shows
"Independent"	A test of trust, passed.	Three limbs, applied by no one the post names. Anthropic chooses the evaluators. Its June framework calls that choice a risk.
"Employee-like access"	The same view as a staff member.	"Roughly on par" with risk teams, minus withheld categories. METR itself says embedded assessors will not match senior safety staff.
"Third-party assessment"	An audit.	METR's [14 October proposal](https://metr.org/blog/2026-10-14-better-informing-the-public-about-loss-of-control-risks/) says these exercises are "not themselves audits, compliance assessments, or formal oversight arrangements" and that its work cannot give the assurance audits and regulation give in finance.
"Evaluator"	A neutral reviewer.	A nonprofit that lists its funders, a commercial partner that Anthropic says it will pay, a nonprofit that takes some funding from AI companies for its services, and a company in early talks.
"Publish"	Findings reach the public.	"Will publish", with no date, after Anthropic's redactions. Earlier reports were reviewed by Anthropic first; in METR's Opus 5.5 summary Anthropic could edit the text.
"Veto"	Control of the outcome.	No veto, but a right to require redaction by categories that Anthropic decides apply. A reader meets the redaction, not the veto.
"Redact"	Trimming what is sensitive.	A power over content. METR says a company can use it, and the right to withhold access, "to exert control" over what the public receives.
"Accord"	A binding agreement.	A voluntary joint commitment of 317 words with no date, penalty or publication duty (derived from its text).
"Enforceable agreements"	Terms that bind both ways.	The post uses the phrase for the limits on METR's small team. It does not say who can enforce the publication terms.

METR says one more thing that bears on "publish". Because companies "can stop their engagement with an external assessor" at any time, it says, voluntary exercises create "soft pressures" for assessors not to upset the companies they work with. Whether the Anthropic agreement has a notice period, or any protection for an evaluator that publishes something unwelcome, is not stated. METR's October post adds that there is currently no way to be fully protected from retaliation for adverse findings.

The bank-supervision analogy, mapped onto UK law

Anthropic writes: "Although the analogy isn't exact, bank supervision operates on similar logic." It adds that regulators "assign resident examiners" to the largest banks. The post does not name a country. UK readers can test the analogy against the Financial Services and Markets Act 2000, as printed on legislation.gov.uk and stated there to be up to date to 17 October 2026. Section 165 lets either regulator require an authorised person to provide specified information or documents by written notice. Section 166 lets a regulator require a firm to provide a report from a skilled person, or appoint one itself. A person the firm appoints "must be a person nominated or approved by the regulator".

How the analogy maps. The left column is the UK statute as printed; the right is Anthropic's 15 October post and METR's 14 October post. "Pays" is shown because the statute lets a firm be made to pay.

Question	UK bank supervision (FSMA 2000)	Anthropic and METR, as stated
Who chooses the examiner?	The regulator appoints, or nominates or approves (s.166(3), (6)).	Anthropic. Reuters reports experts saying the labs choose who reviews them.
Who gets the report?	The regulator (s.166(3)).	Not stated for Anthropic. METR publishes, after redactions.
Can information be compelled?	Yes, by written notice (s.165(1)).	No statute. Access is by agreement; METR says requests "are approved or denied at the company's discretion".
What if the firm does not help?	Duty to give all assistance reasonably required, enforceable by injunction (s.166(7), (8)).	Not stated. METR says a company can stop its engagement at any time.
Who pays?	The firm can be made to pay the expenses of a regulator-appointed person (s.166(9)).	Anthropic says it will pay Accenture and that METR pilots use METR's own funding. METR says it has not accepted AI-company funding. The statute shows payment alone is not the test: who chooses and who receives the report are.
Can it stop something?	Not in these sections; they gather information.	Not stated by Anthropic. METR says its proposed assessments "would not involve METR making go / no go decisions".

The analogy therefore holds for access and breaks on selection, compulsion and enforcement. It is a voluntary version of resident examination chosen and bounded by the examined company. That is a description of the design, not a criticism of the people in it. METR says so itself: "We remain dependent on the companies we work with to voluntarily engage, provide access, and permit us to publish."

What the White House Accord requires, and by when

The post says Anthropic signed the "White House Accord on Super Intelligence", in which companies "pledged to partner with independent external auditors or evaluators". The Accord's text, as reproduced by the American Presidency Project under 29 September 2026, is 317 words (derived). No White House page carrying the Accord itself was found; the White House's fact sheet and Executive Order 14434 of the same date concern renaming AI as "Super Intelligence" in the executive branch and do not contain it. It is signed by the President and six companies: Google, Anthropic, Meta, OpenAI, xAI and Nvidia.

It has four numbered layers of control. The third is the one the post cites: "Partner with an independent external auditor or evaluator to carry out independent assessments of whether the controls, monitoring, and detection are operating as intended." The introduction says each company "should" implement the four layers, and the close says it "may make sense to codify these steps into laws or regulations". Counted in the text (derived): no date or deadline, no penalty or enforcement mechanism, no duty to publish, no definition of independence and no named auditor. The participating companies "will meet regularly to establish standards". Reuters calls it a one-page document that "did not say how those reviews should be conducted" and notes the President's description of it as morally binding.

So the answer to "by when" is: no date. Anthropic's post came 16 days after the Accord (derived) and 33 days after the chief executive's essay. An evaluator relationship that exists is evidence that Anthropic has acted. It is not evidence that the Accord's third layer has been met in any measurable sense, because the Accord names no measure.

Has any evaluator found anything?

Under the earlier regimes, yes. METR's May review did not accept that one section of Anthropic's Risk Report supported its conclusion. METR's 14 October post summarises its Frontier Risk Report as finding that Anthropic's monitoring systems at the time "could be circumvented in a variety of ways". SecureBio's pilot agreed with Anthropic's chemical and biological risk conclusions with minor areas of disagreement. Under the 15 October terms, nothing is on the record. METR's embedded team has published nothing, the post gives no date, and no Accenture, Faculty or Hugging Face evaluation of Anthropic was found. METR's 14 October post says it plans to share more soon about which assessments companies are undertaking with it. The post of 14 October also refers to an "in-depth alignment assessment with Anthropic" that METR says it recently announced in a post on X. That post could not be read, and whether it is the same work as the 9 September incident investigation or the embedded team is not stated.

The UK: what applies, what a buyer can ask, and where the rules stop

The UK pages read here describe voluntary or sector-specific arrangements. The AI Security Institute describes itself on its about page as a research organisation within the Department for Science, Innovation and Technology, with "pre-deployment access to leading AI models and close collaborations with AI companies". The page does not describe a statutory power to compel access or to stop a release. It is also connected to this story twice. METR lists the AI Security Institute among its funders and as a partner, and the Institute's 4 August incident report says it intends to work with METR on an independent third-party review of its own cyber-testing incident.

UK instruments read for this briefing, what each says, and where it stops. Each was read at its own page.

Instrument	What it says	Where it stops
[Code of Practice for the Cyber Security of AI](https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai), DSIT, 31 January 2025	Principle 9: developers "shall" ensure released models are tested in a security assessment (9.1); operators and developers "should use independent security testers" (9.2.1); developers "should" share findings with operators (9.3).	Voluntary, in the page's own word. "Should" for independence. It is about security testing, not publication of risk findings or company-level assessment.
[ETSI EN 304 223](https://www.etsi.org/newsroom/press-releases/2627-etsi-releases-world-leading-standard-for-securing-ai), 14 January 2026	The global standard the Code was meant to help create, in the Code's own words: 13 principles across five lifecycle phases.	A baseline standard. It does not set evaluator publication rights.
AI Security Institute	Tests leading systems before release and collaborates with companies.	The page states no power to compel access or to block a release.
FSMA 2000, [s.165](https://www.legislation.gov.uk/ukpga/2000/8/section/165) and [s.166](https://www.legislation.gov.uk/ukpga/2000/8/section/166)	Compulsion and skilled-person reports for regulated financial firms.	Does not reach AI developers.
Cyber Security and Resilience Bill ([this site](https://www.pk-sharma.com/briefing/uk-cyber-bill-ai-appears-0-times-in-text-0-of-47-report-amendments-on-13-october-list-are-governments))	The Lords text says AI zero times.	This site's briefing found nothing on AI evaluators or publication in it.

What a UK buyer can ask is therefore a matter of contract and procurement, not statute. The Code gives the strongest hook: a system operator that deploys Claude is a "system operator" in the Code's terms, and the Code says developers should share testing findings with it (9.3) and that testing should use independent testers (9.2.1). A buyer can ask for those findings, ask which testers, and ask under what publication terms. It can ask for the evaluator's AEF-1 checklist and conflict policy, for the access tier and its definition with an edit history, and for notice when any of it changes. None of the UK pages read places a duty on a frontier developer to engage an outside evaluator, to publish an evaluator's findings, or to let a regulator pick the evaluator. That is where the rules stop, and it is why the contract has to say it.

What to do, in the order worth doing

What could not be verified

• Why the post changed. Anthropic says it clarified METR's current terms. The reason, the terms themselves and METR's view of them are not stated anywhere found.
• The terms of the agreement. Neither Anthropic nor METR has published the contract. Payment, start date, duration, categories, review time limit and dispute route are unknown.
• Who edited and when. The three modified times come from the page's own data and the Internet Archive's seven captures. The exact time of each edit is bounded by the capture times, not known.
• The 12 September date. The essay gives the month only. The earliest archive capture is 12 September, and the 33-day figure assumes that day.
• METR's statements on X. METR's 14 October post links an announcement on X about an alignment assessment with Anthropic. It could not be read. No other METR statement on the arrangement was found on metr.org.
• The Accord at a White House address. Its text was read as reproduced by the American Presidency Project. The Reuters description of the President calling it morally binding was not checked at the source.
• Reuters. Read through syndicating sites, not on Reuters' own pages. Its anonymous sources cannot be checked.
• SecureBio and Accenture on the 15 October post. No statement from either about the new arrangement was found. Faculty's role was read in Anthropic's and Accenture's September releases.
• The EU AI Office. The Forum says the Office endorsed key AEF-1 provisions. That was not checked and is not relied on here.
• Time-stamped. Sources were read between 11:07 and 11:36 BST on 17 October 2026. A page's wording, a METR post or a named evaluator could change within hours.

The question that exposes the gap

If an evaluator inside a vendor found a problem that the vendor says falls into a redactable category, who decides, who is told that it did, and where is that written down in a document you can read?

Key facts