gov, which solved an almost identical problem for pharmaceutical trial reporting).

The package is not the training data or model weights; it is the minimum needed for a qualified third party to assess whether the claim is verifiable: the exact evaluation protocol run (ideally as an Inspect-compatible spec, since that tooling already exists and is free), red-team composition and instructions given, number of attack rounds and tool access granted during testing, train-test overlap disclosure for any benchmark cited, and raw pass/fail results including failures that were mitigated post-hoc.

This does not require every detail to be public immediately. , UK AISI, US CAISI) covers anything the company argues is a genuine security risk to disclose more broadly, such as specific jailbreak strings that shouldn't be published verbatim.

A company that skips registration simply forfeits the right to make the public safety claim at all -- app stores, cloud marketplaces, and government procurement portals would be asked to treat an unregistered safety claim as equivalent to an unsubstantiated health claim on a supplement label, which is to say, not usable in marketing or compliance documentation.

Enforcement leverage comes from procurement and insurance, not new criminal statute, which is why this is achievable faster than comprehensive AI legislation: government agencies and large enterprise buyers already increasingly require vendor safety documentation, and AI liability insurers already need underwriting signal.

Both can simply require registry-verified claims as a condition of contract or coverage, creating market pressure without waiting for a legislature. The registrar function could plausibly be run by an existing body (NIST, an expanded CAISI/AISI joint secretariat, or a nonprofit modeled on the Center for AI Standards and Innovation) rather than a new agency.