Third-party risk assessment — axes of variation
Taxonomy of who audits AI developers, for whom, and what gets disclosed. Cotra and Christiano–inspired framework.
• Developers vs. stakeholders (governments, public, board, employees)
• Role of confidentiality: auditor as intermediary filtering sensitive data
• Trade-off between disclosure and commercial protection