Comment by Joe Kwon

Regulations could establish assessment triggers tied to capability indicators, use cases, or incident patterns rather than just fixed periodic reviews. [...] Triggers might include demonstrated capabilities based on evaluations (e.g., sophisticated deception, autonomous operation beyond specified bounds, advanced capabilities in biological or chemical domains), usage for pre-specified types of tasks, integration into new high-stakes applications, or patterns of concerning behaviors reported through incident systems. [...] Internal deployment of comparable systems should trigger the same security and safety requirements that developers already implement for external offerings.