Maloney asks companies who owns the fix after an incident

The testimony helps highlight that there's more work to be done to classify what's incidents in the future and create an industry standard for what would require disclosure and what would require action.

The second part of the question was to walk through what happens after an incident occurs, who owns the fix, and who decides whether or not the model or the product keeps running in the meantime.

Thank you.

Yeah, so OpenAI has instituted monitoring during testing and evaluation.

That monitoring creates automated alerts to our research and security engineering teams to let them know of potential incidents.

And then we have recently clarified our escalation processes as well as responsibilities across teams

and made it clear the process for pausing activity and when it is safe to restart.

Council member, in relation to your second question, we have an extensive team, actually extensive teams of people who, as part of their day-to-day, every day, day in and day out,

are leading and responsible for the development, deployment and use of our AI systems.

I'll just say, ma'am, I was attempting to answer that question when I referred to the process internally with our trust and safety teams.

But if you'd like some more detail, I'm happy to follow up after the hearing.

Yeah, likewise, the process involves multiple different teams depending on the nature of the incident.

If it's at the core of security and our own security, we require a security team to work on this.

If it's about the model behavior and misalignment, it might be a research or training or safety consideration.

If it's about incidents of misuse on the platform, we have the safeguards team.

I think you're pointing at this is becoming more complex over time.

And I think this is one reason, as my colleagues mentioned here, this is a frontier of defining both what is an incident and how or what would a good process look like for dealing with them.