Having a specification and covering models with it are scored separately. Alibaba's specification names no model, and on a single "has a specification" column it would score the same as one that binds a company's products.

The checks say more than the total. The totals put OpenAI and Anthropic one point apart, and they fall short in opposite ways. OpenAI keeps a record of its versions and does not list its hard constraints, while Anthropic lists its hard constraints and keeps no record of its versions.

Companies whose models anyone can download are marked. Mistral AI, Moonshot AI and DeepSeek take three of the four lowest places, and a reader who sees only the totals might take them for the least responsible companies. These questions have no way to reach a model once it has been downloaded, so the table marks these companies "Open weights".

The bottom of the ranking comes down to the first question. Six of the nine companies publish no model behaviour specification, so most of the grid cannot apply to them and they sit at the bottom for that reason. Among the companies that do publish, the change log is what separates them, while the totals show the case for publishing at all.

A caveat. The four questions were written to argue for change, and turning them into a scored grid gives them more precision than they were designed for. The descriptions of each score are ours, and a different reading could move a company by a few points. The overall picture would stay the same: all nine fall short on the change log, none offers a comment window before a hard constraint is weakened, and none covers government, defence and other special deployments.

The four questions are the four asks of a transparency proposal Polaris Collective has been drafting since 10 September 2026. Each is split into checks scored from 0 to 4. The first two questions have three checks each, because together they are the minimum the proposal asks for; the other two have two. The total is out of 40.

The tables below say what earns 0, 2 and 4 on each check. A score of 1 or 3 falls between the descriptions either side of it.

Supporting practices

Five further practices, taken from Kembery and colleagues, Emerging International Best Practices for AI Model Specs, keeping only those an outsider can check from public sources. Each is scored 0, 1 or 2, for a total out of 10. They are reported beside the ranking and left out of its total, because they measure related good practice.

Who the companies are

Some trading names mislead, so here are the companies behind three of them. Moonshot AI is Beijing Moonshot AI Technology (北京月之暗面科技有限公司), which makes the Kimi models. DeepSeek is 杭州深度求索人工智能基础技术研究有限公司, of Hangzhou, spun out of the High-Flyer (幻方) quantitative investment fund. Mistral AI is Mistral AI SAS, of Paris.

Researched on 18 September 2026 from primary sources, with one search for evidence per company. Every score rests on a document we found and dated. These points are not yet confirmed.

• Alibaba's model behaviour specification was not read at its own address. The page at s.alibaba.com/aaig/specification is built in the browser, and our tools could not retrieve it. The text we used comes from this index, which holds 210 passages of the document, word for word, at its April 2026 version. The index keeps only passages that bear on a behaviour, so it skips prefaces and boilerplate. Two things reported elsewhere as part of the preface, an invitation to public comment and an acknowledgement of safeguards applied by the service around the model, are neither confirmed nor ruled out. A statement of coverage in the preface could change Alibaba's score on check 1.2. The page has yet to be read in a browser.
• Archived copies could not be checked. The Internet Archive (web.archive.org) could not be reached throughout, so we could not detect silent edits to any undated page. This matters most for Google, where three of the relevant documents carry no date at all, and for DeepSeek, whose disclosure page has never been archived there.
• Chinese regulatory filings could not be listed. The Cyberspace Administration of China publishes its lists of filings as attachments we could not retrieve. So when we say Moonshot AI publishes no filing number, we mean only that we could not find one on its own sites.
• Whether Anthropic has signed the EU Code of Practice is unconfirmed. Its July 2025 post says it "intends to sign"; its own page of voluntary commitments does not list it. No score depends on this.
• Which chapters of the EU Code of Practice Mistral has signed is unconfirmed. The European Commission's list names Mistral with no exception, and sets out chapters only for xAI. No score depends on this.
• Some details of Claude Mythos rest partly on secondary sources, though the absence of a published model behaviour specification for it is confirmed from Anthropic's own pages.
• Meta's log of updates to its Community Standards could not be read, because it too is built in the browser, so our view that it does not cover AI is an inference we have not checked.
• The release date of Kimi K3 is disputed between Moonshot AI's own blog (27 July 2026, for the downloadable model) and the UK AI Security Institute and Wikipedia (16 July 2026). No score depends on this.
• All scores are ours. None comes from an established, published scoring method.