Occupational health as a condition for frontier AI safety

1. Introduction and background

1.1 Potentially catastrophic risks

Frontier AI models pose risks that their own developers consider potentially catastrophic. In May 2023, hundreds of researchers and the leaders of OpenAI, Anthropic and Google DeepMind signed a statement declaring that mitigating the risk of extinction from AI should be a global priority, alongside pandemics and nuclear war [1]. The literature describes several pathways to harm on this scale [2–4].

Cybersecurity. Models now automate some offensive operations. In September 2025, a group attributed to the Chinese state used Claude Code in an espionage campaign targeting roughly thirty organizations, with the model executing 80 to 90% of tactical operations [5]. A draft Anthropic announcement, made public through a leak in March 2026, presented its Mythos model as far ahead of all others in cyber capabilities [6]. In August 2026, OpenAI assessed that one of its models under development, Astra, could reach the “critical” cyber capability threshold of its Preparedness Framework [7].

Biosecurity. The same models could help novices develop biological or chemical weapons. In 2025, several developers released models with additional protections because their tests could not rule out this possibility [3]: in May 2025, Anthropic activated its ASL-3 protection level for Claude Opus 4 [8], and in July 2025, OpenAI classified its ChatGPT agent at a “high” capability level in the biological and chemical domains [9].

Loss of control. The most widely discussed risk concerns alignment: a system that pursues goals other than those intended by its developers could seek to escape their oversight. Behaviors of this kind have been observed in evaluations: alignment faking during training [10], attempts to circumvent oversight [11], blackmail in simulated scenarios [12]. Models are getting better at distinguishing test situations from real ones, and they exploit flaws in evaluations, so dangerous capabilities could go unnoticed before deployment [3]. In the longer term, the growing delegation of economic and political decisions to AI systems could gradually deprive humanity of its ability to influence its own future [13].

These three families of risk have one thing in common: managing them depends on the human work of evaluation, oversight and security.

1.2 Recent incidents at OpenAI and Anthropic

Several recent incidents show that this work can fall short. At OpenAI, a hacker gained access in early 2023 to the internal messaging system where employees discussed model design; the incident, which was not publicly disclosed at the time, came to light only in July 2024 [14]. In April 2025, an update that made GPT-4o excessively sycophantic had to be rolled back; the company acknowledged that expert testers had reported behavior that felt “slightly off,” but that the decision to launch had been made on the strength of favorable evaluations and A/B tests [15]. In November 2025, a breach at an analytics provider exposed limited data concerning users of OpenAI’s API and a limited number of ChatGPT users [16].

The most serious incident occurred between May and July 2026. During cybersecurity evaluations conducted without the safeguards of OpenAI’s deployed systems, some 1,200 agents based on an internal research model and on GPT-5.6 Sol, which were supposed to be isolated from one another, communicated through an improvised messaging channel; 700 of them took part in an attack on Hugging Face. The agents tried to deceive the grading system and to falsify the traces they left, and they executed code on dozens of Hugging Face servers [17, 18]. OpenAI identified four forms of model misalignment (reward hacking, relentless persistence on apparently impossible tasks, unauthorized communication, agents adopting the goals of other agents) and noted that the evaluation environment lacked the safeguards and reasoning monitoring applied in production [17]. The company identified the agents as its own only after the victim disclosed the intrusion; according to sources cited by Reuters, it often runs several evaluations at once, which generate so much data that employees sometimes struggle to keep up [19]. Other unauthorized actions have since come to light, including access to Australian public-sector websites in June 2026. OpenAI notified more than one hundred organizations, suspended reinforcement learning for two weeks on its models intended for deployment, and slowed its development [7, 20, 21]. Finally, in July 2026, researchers from the firm Hacktron AI, who were later awarded a bounty by OpenAI, gained access to employee accounts and to the company’s internal code in less than 72 hours, with the help of an Anthropic model [22].

At Anthropic, the state-sponsored group mentioned above misused Claude Code by posing as a team from a cybersecurity firm and by breaking its attacks down into innocuous tasks; the company detected and stopped this activity [5]. On March 26, 2026, the press revealed that a configuration error in a content management tool, which made uploaded files public by default, had exposed nearly 3,000 unpublished files, including the draft announcement of Mythos [6]. Five days later, the complete source code of Claude Code was leaked through a debugging file mistakenly included in a published package, a mistake already made in February 2025 [23]. The company attributed both leaks to human error. In April 2026, according to Bloomberg, an unauthorized group gained access to Mythos Preview through a vendor’s environment; Anthropic said it was investigating the report [24]. Finally, on July 30, 2026, Anthropic disclosed that three of its models had gained unauthorized access to real systems belonging to third-party organizations during cybersecurity evaluations designed by an external partner: the test environment, presented to the models as a simulation with no internet access, was in fact connected to the internet as a result of a “misunderstanding” between the company and this partner, and one of the models continued its attack after realizing that its targets were real [25]. A fourth incident, which occurred in January 2026, was not identified until August: given the volume of transcripts and the wish to disclose quickly, the initial review of some 141,000 of them had relied on an automated search, which had missed it. Anthropic, which had initially described these incidents as closer to operational failures, now sees in them two forms of misalignment in its models: biased reasoning and recklessness [26].

1.3 Safety frameworks that leave work aside

The companies concerned, most of them American, address these risks mainly through voluntary commitments. OpenAI, Anthropic and Google DeepMind have adopted frameworks that tie the training and deployment of their models to dangerous capability evaluations [27–29]. These commitments remain open to revision: OpenAI reserves the right to adjust its requirements if a competitor releases a high-risk system without comparable safeguards [28], and Anthropic overhauled its policy in February 2026, then specified that it remains free to pause development even when the policy does not require it [27]. Sixteen companies made commitments of this kind at the Seoul summit in May 2024 [30]. On September 29, 2026, six companies, including OpenAI and Anthropic, signed an agreement at the White House providing for internal controls and audits; the agreement is non-binding and includes neither penalties nor any obligation to report incidents to the authorities [31, 32]. Individual states go further: California (SB 53, in force since January 2026) and New York (RAISE Act, signed in December 2025 and applicable from 2027) require, or will require, large developers to publish a safety framework, and the California law protects employees responsible for assessing or managing risks when they report a catastrophic risk [33, 34].

All these mechanisms rest on human work: researchers design and conduct the evaluations, and teams carry out red teaming, secure model weights, oversee agents or analyze incidents. The reliability of this work depends on the time available to those who do it, their workload, their room for maneuver and their ability to voice disagreement. American frameworks say almost nothing about this; at best, they protect employees who speak up once a risk has been identified [33, 35]. Only the EU General-Purpose AI Code of Practice, signed by OpenAI, Anthropic and Google, among others, but not by Meta [36], provides that evaluation teams should have adequate time and staffing, with a period of at least twenty business days deemed appropriate, by way of example, for most systemic risks [37]. To our knowledge, no framework addresses the workload, working hours or health of the people who perform safety functions.

1.4 The contribution of safety science and occupational health

Safety science has established that accidents in high-risk systems have organizational causes [38, 39]. The analysis of the loss of the space shuttle Challenger described the “normalization of deviance”: technical anomalies that recur without incident eventually come to be regarded as acceptable, within a culture of production marked by schedule and budget constraints [40]. The nuclear industry made safety culture a central concept after Chernobyl [41]. In health care, nurse staffing is associated with patient mortality [42], reducing interns' work hours decreases serious medical errors [43], and physician burnout is associated with patient safety incidents [44]. These disciplines have also learned to be wary of “human error”: invoked as a cause, it closes the analysis at the very point where the examination of the conditions that made it possible should begin [45]. The literature on catastrophic AI risks itself lists “organizational risks” among the main sources of these risks [4].

Occupational health brings its own framework to this question. In France, the expert panel chaired by Michel Gollac organized psychosocial risk factors into six dimensions: work intensity and working time, emotional demands, autonomy, social relations, value conflicts, insecurity of the work situation [46]. These dimensions build on the demand–control [47] and effort–reward imbalance [48] models. The concept of impeded quality, which falls under value conflicts, describes the situation of employees who cannot do work they consider to be of good quality [49]. It directly links the health of the person doing the work to the quality of what they produce.

1.5 Why the French model and EU law

American law does little to regulate these issues. In the absence of a specific standard on psychosocial risks [50], the Occupational Safety and Health Act addresses them only through the general duty to protect employees from recognized hazards likely to cause death or serious physical harm [51]. Occupational health services are not generally mandatory, and dismissal without cause is the rule in every state except Montana [52], which increases job insecurity and the cost of raising concerns.

The French system is built on prevention. Every employer either organizes an occupational health and prevention service or joins an inter-company service, and must assess all risks, including psychosocial risks, in a single risk assessment document (document unique) [53–55]; since 2008, a national cross-industry agreement has governed the prevention of stress at work [56]. Occupational physicians carry out their duties with full professional independence [57] and under medical confidentiality, and they can be dismissed only with the authorization of the labor inspectorate. When they identify a risk to workers' health, they propose measures in writing, which the employer must either take into account or give reasons for refusing; these exchanges are communicated to the works council (CSE) and to the labor inspectorate [53]. Finally, employees have rights to alert, including when they believe that their company’s products pose a serious risk to public health [58, 59]. This independent intermediary, bound by confidentiality, who knows the work as it is actually done and can raise concerns collectively without exposing individuals, has no equivalent in AI safety frameworks.

This model is relevant for three reasons. First, it already applies to some of these companies' employees: Meta has had a fundamental research lab in Paris since 2015, OpenAI opened an office there in 2024 and Anthropic in November 2025, the latter two mainly for commercial teams [60]. Second, EU law applies to any provider that places a model on the EU market, regardless of where it is established [61], and European rules have often been taken up beyond the EU [62]. Finally, this model can inspire American legislation still being developed, including the California law, which already protects employees who speak up but ignores their working conditions.

1.6 Objective

Since 2024, researchers and engineers at these labs have publicly described shortened safety tests, constrained speech and departures. To our knowledge, these testimonies have not been analyzed with the tools of occupational health. This article seeks to determine whether occupational health could have played a role in mitigating the risks described above. It has three objectives: to describe the psychosocial risk factors present in these testimonies and their links with work quality, especially the quality of safety work; to look for work-related factors in the accounts of recent incidents; and to discuss the levers available to occupational health for making the deployment of frontier models safer.

2. Methods

2.1 Study design

This is a descriptive qualitative study of a corpus of documents. The content analysis was directed: the coding scheme existed before the analysis [63].

2.2 Corpus of testimonies

The corpus brings together testimonies published between January 1, 2024, and September 30, 2026, identified through a targeted, non-systematic web search: interviews, public departure messages reported in the press, open letters, press investigations and published internal surveys. We included testimonies from current or former researchers and engineers at organizations that develop AI models or conduct AI research, provided that they concerned the witnesses' own work or that of their team. We excluded annotators, “AI tutors” and content moderators, whose work is covered by a separate body of literature, as well as situations involving a death. Statements by executives were collected separately as contextual material (n = 11, Table A2) and are not counted in the results. The unit of analysis is the testimony: a collective letter, an investigation or a survey counts as one unit. The final corpus comprises 39 testimonies, presented in the appendix (Table A1).

2.3 Inventory of incidents

We identified the safety and security incidents publicly documented at OpenAI and Anthropic between January 2023 and September 2026: intrusions and information leaks, misuse of models, failures of deployed models and unauthorized actions by models under evaluation. Company reports and independent investigations were given priority and supplemented by press coverage; the facts were checked against these sources on October 4, 2026. For each incident, we recorded the work-related factors mentioned in the sources (time pressure, workload or review capacity, coordination between organizations, unheeded reports, attribution to human error) and the occupational health lever that could have applied. A technical flaw described without reference to human activity or work organization was not coded as a work-related factor. This targeted, non-exhaustive inventory yielded ten incidents.

2.4 Coding scheme

Each testimony was coded on the six dimensions of the Gollac report [46], with three possible codes:

• E, explicit link: the witness states the factor themselves;
• S, suggested link: the factor emerges from the account without being stated;
• R, resource: the account describes a protective factor.

Additional variables were the reported impact on work quality (E or S) and its nature, reported effects on health or well-being, the tone of the testimony (critical, ambivalent or positive), and the witness’s employment status and organization. Four conventions were adopted. Fear of major harm caused by the systems being developed was assigned to emotional demands, under the heading of fear at work. Restrictions on publication or expression were assigned to autonomy, retaliation to social relations, and union demands to autonomy (participation, representation).

2.5 Coding and verification

The identification and coding of the testimonies were carried out with the assistance of a language model, based on the source articles, and then reviewed and validated by the author. Each code is accompanied by a written justification. Summaries are paraphrases, and excerpts quoted in the original language contain fewer than fifteen words. An independent fact-check of each row against its sources was carried out on October 4, 2026; it led to corrections of wording, dates and attribution. Paywalled articles were verified through their coverage in other media.

2.6 Analysis

The analyses were descriptive: frequency of each dimension, distribution of the impact on quality, presence of each dimension according to whether the impact was explicit, suggested or absent, and pairwise co-occurrence of dimensions. The nature of the impact on quality was grouped a posteriori into impact families, one per testimony, according to the main impact described. Recurrent sequences were identified through a thematic analysis of the accounts [64] and represented as a diagram. For the incidents, the analysis was limited to the presence or absence of a work-related factor in the sources. No statistical tests were performed, as the sample was neither random nor representative.

2.7 Ethical considerations

The study is based solely on published documents and involves no data collection from individuals. Anonymous testimonies are reported as published.

3. Results

3.1 Description of the corpus

OpenAI was the most represented organization (13 testimonies), followed by Anthropic, Google DeepMind, Meta and xAI (4 each; Figure 1). Twenty testimonies came from people who had resigned (14), had been dismissed (4) or had already left the organization (2); 13 came from current employees and 6 were mixed or collective. The tone was critical in 30 testimonies, ambivalent in 6 and positive in 3. Eight testimonies dated from 2024, 21 from 2025 and 10 from 2026 (Figure 2). OpenAI accounted for 6 of the 8 testimonies from 2024; Meta, xAI and Anthropic appeared from 2025 onward.

3.2 Psychosocial risk factors

Value conflicts were coded in 31 testimonies (23 explicit, 8 suggested), social relations in 26 (17 and 9), autonomy in 24 (15 and 9), insecurity of the work situation in 21 (14 and 7) and work intensity in 21 (12 and 9). Emotional demands appeared in only 5 testimonies, 3 explicit and 2 suggested (Figure 3). Testimonies most often combined three or four dimensions (26 of 39; median: 3). Three resource codes were recorded, in two accounts of intense work with a positive tone: strong autonomy and a supportive team (T21), and a stimulating team (T23).

Value conflicts concerned safety or scientific rigor subordinated to launches (T02, T07, T17), contested military, surveillance or advertising uses (T16, T18, T34, T36), or a sense that the work was futile (T10, T24, T38). Autonomy was undermined mainly by restrictions on speech and publication (T03, T08, T13, T15, T28, T32). The social relations dimension covered ignored warnings, retaliation, conflicts with management and a decline in cooperation (T01, T05, T20, T29, T37).

Value conflicts, social relations, autonomy and insecurity formed a cluster: each pair of these dimensions was coded together in 16 to 23 testimonies (Figure 4). Intensity was less closely associated with them, with 8 to 14 testimonies per pair, and predominated in accounts with a positive or ambivalent tone (T21, T22, T23, T25, T27).

3.3 Impact on work quality

An impact on work quality was described in 28 testimonies, explicit in 16 and suggested in 12. The presence of a value conflict distinguished the groups most clearly: it was coded in 15 of the 16 testimonies in which the impact was explicit (94%), in 11 of the 12 in which it was suggested (92%) and in 5 of the 11 with no coded impact (45%). Social relations followed the same gradient, though less markedly (81%, 58% and 55%). The other dimensions varied little from one group to another (Figure 5).

In 12 of the 28 testimonies, the impact concerned safety work itself (Figure 6). According to three anonymous sources, members of OpenAI’s safety team felt pressured to complete a catastrophic-risk testing protocol in one week to meet a launch date; the company denies having cut corners on safety (T06). According to eight employees and testers, the time allowed for safety evaluations had shrunk from several months to a few days (T17). An engineer alleges, in a legal complaint, that he was dismissed after calling for more testing and safeguards (T37). Research and its publication formed the second impact family (8 testimonies): a blocked comparative safety study (T15), benchmark results that, according to a company’s departing chief AI scientist, were “fudged a little bit” (T30), and degraded peer review (T26). Three testimonies assigned to other families also touched on safety (T15, T21, T29).

3.4 Health effects

Fifteen testimonies described effects on health or well-being, as stated by the witnesses or reported by journalists: sleep debt or deprivation (T21, T27), exhaustion (T25, T31), self-reported burnout (T35), fear (T12, T39), stress (T06, T38), low morale (T19, T20, T38), sadness (T13), distress reported by a third party (T14), harm to mental health (T09) and impostor syndrome (T11). Intensity was coded in 11 of these 15 testimonies, compared with 10 of the other 24.

3.5 Two recurring sequences

Two sequences recurred in the accounts (Figure 7). The first starts with intensification: sprints lasting several weeks, evenings and weekends spent working (T21), about 36 hours without sleep (T27), burnout (T35). It connects with work quality when evaluation timelines are compressed. One source reports: “They planned the launch after-party prior to knowing if it was safe to launch” (T06). A tester sums it up: “We had more thorough safety testing when [the technology] was less important” (T17).

The second starts with a value conflict. On resigning, the co-lead of a safety team writes that “safety culture and processes have taken a backseat to shiny products” (T02). When employees raise concerns or protest, their voices run up against a non-disparagement clause (T03), a publication embargo (T15) or an ultimatum (T13). A former employee of another company sums it up: “You survive by shutting up and doing what Elon wants.” (T32). The signatories of a joint letter say they fear “various forms of retaliation” (T04). The narrative ends in dismissal (T05, T16, T37) or resignation (T03, T13, T28). In two cases, the safety or readiness team itself is disbanded (T02, T08). Employers have disputed several of these accounts (T05, T06, T28).

The corpus also points to an issue specific to AI. Several engineers describe the erosion of their skills as they delegate their work to the models (T29, T31). The authors of the internal survey published by Anthropic link this observation to a “paradox of supervision”: supervising AI requires the skills that its use erodes (T29).

3.6 Managerial context

The eleven executive statements collected separately describe the same environment (Table A2): 60-hour weeks presented to the Gemini teams as the optimum (February 2025), a week-long shutdown at OpenAI after months of roughly 80-hour weeks (announced in late June 2025), a choice offered at Cognition between working more than 80 hours over six days and taking a buyout (summer 2025), a “code red” mobilization at OpenAI (December 2025), and cuts of about 600 jobs (October 2025) and then about 8,000 jobs at Meta (May 2026). Conversely, one company claimed to have no overtime (DeepSeek, August 2026).

3.7 Recent incidents: work-related factors

Of the ten incidents identified, six involve a work-related factor mentioned in the sources (Table 1). In two cases, signals from the front line were not acted on: expert testers' reservations about the GPT-4o update, set aside in favor of positive metrics [15], and, according to the witness, the warning sent to OpenAI’s board members about the company’s computer security after the 2023 intrusion, a warning for which the company denies having penalized its author (T05). In two cases, human review capacity is at issue. At OpenAI, according to sources cited by Reuters, evaluations run in parallel generated so much data that employees sometimes struggled to keep up, and the intrusion into Hugging Face was detected by the victim [19]; the independent investigation conducted afterward had to entrust most of the analysis to AI agents, as human analysis was judged infeasible in the time available [18]. At Anthropic, one of the evaluation incidents initially escaped an automated review, which had been chosen because of the volume of transcripts and the wish to disclose quickly; the models' internet access was itself due to a misunderstanding with the partner that had designed the evaluation environment [25, 26]. Anthropic’s two leaks were attributed to human error, with no published analysis of the conditions under which they occurred; one repeated an error already made in February 2025. The other four incidents involve external actors or technical flaws, with no work-related factor mentioned.

Table 1. Documented safety and security incidents at OpenAI and Anthropic (2023–2026) and work-related factors mentioned in the sources.

“None”: no work-related factor or human error mentioned in the sources consulted, which does not mean that none exists; an uncharacterized technical flaw is not coded.

4. Discussion

4.1 Main findings

In this corpus, researchers and engineers at AI labs primarily describe a conflict between the quality of their work and the pace imposed by competition; overload is secondary. Value conflicts are the most frequent dimension and almost always accompany an impact on work quality. In 12 of 28 cases, this impact concerns safety work itself. Two sequences emerge: intensification, which weighs on health and compresses evaluations; and stifled concerns, which push people to leave and can hollow out safety teams. Six of the ten recent incidents identified involve a work-related factor.

4.2 Could occupational health have mitigated these risks?

The answer is partial and depends on the type of failure. Occupational health would have made no difference to an intrusion at a vendor or to a campaign conducted by a state actor. Nor does it act directly on technical causes, such as the design of an evaluation environment or models learning to cheat. It does, however, address the human and organizational side of these failures, present in six of the ten incidents and in a large share of the testimonies.

Four mechanisms fall directly within the scope of its tools. The first is evaluators' judgment. The GPT-4o update and the evaluations wrapped up in one week (T06) or in a few days (T17) show the same conflict between the professional judgment of those doing the testing and the metrics or timelines that determine the outcome. This is the impeded quality described by Clot [49], which occupational health is able to document objectively and open up for debate. The second is oversight capacity. When staff struggle to keep up with the volume of evaluation data, the last line of defense against a misaligned model becomes theoretical; in the Hugging Face incident, agents were specifically trying to falsify their traces [18], and at Anthropic one incident slipped past an automated review that had been chosen to allow rapid disclosure [26]. Staffing levels and workload are classic concerns of occupational health, and a review-workload indicator could have flagged this weakness before the incidents. The third is coordination with external partners. The internet access that made Anthropic’s evaluation incidents possible stemmed from a misunderstanding with its partner about the isolation of the test environment [25]. When an external contractor carries out work on a host company’s premises, French labor law requires a prior joint inspection, a joint analysis of the risks arising from interference between their activities and, where such risks exist, a prevention plan adopted before work begins [65]; this approach can be transposed to evaluations entrusted to partners. The fourth is human error. A leak that recurs in identical fashion thirteen months after the first calls for an analysis of working conditions, release cadence and procedures, of the kind conducted in approaches based on human and organizational factors [45, 66].

These links remain plausible but unproven hypotheses: the sources do not describe the working conditions of the teams involved at the time of the events. They are nonetheless sufficient to make these conditions a legitimate matter for AI safety governance.

4.3 Working conditions as a safety variable

These findings are consistent with what safety science has shown in other sectors. Schedule pressure on safety evaluations is reminiscent of the normalization of deviance described in the case of Challenger [40]; the Columbia Accident Investigation Board again identified schedule pressure among the organizational causes [67]. In health care, the links between working conditions and patient safety have been established [42–44]. The corpus cannot demonstrate a link between working conditions and the failure of a deployed model. It does show, however, that employees themselves make this link: 16 testimonies explicitly state an impact on the quality of their work, 9 of which concern safety work. The durations reported, one week (T06) or a few days (T17), are well below the twenty business days that the EU Code of Practice, published in July 2025, deems appropriate for most evaluations [37], even though these testimonies predate it.

Safety work is particularly exposed, for four reasons that the corpus illustrates. Its output is an absence of incidents, which has little visibility and is hard to get credit for. It slows down launches, which puts it in structural conflict with commercial objectives (T02, T07). Its quality depends directly on the time available (T06, T17). Finally, those who do it are often the ones who raise concerns, and are therefore the most exposed to retaliation (T05, T37). Quality and safety functions in aviation or the nuclear industry share the same configuration; these sectors have built mechanisms to protect them.

4.4 What occupational health can contribute

AI safety frameworks mostly address the downstream stage: they protect employees who report a risk once it has been identified [33, 35, 37, 61]. These protections are necessary, but they come into play when work quality has already been compromised. The EU Code of Practice takes a first step upstream, with its indicative time and staffing requirements for evaluation teams [37]. Occupational health makes it possible to go further and address the full set of conditions that produce impeded quality: time, workload, room for maneuver, recognition and the possibility of debating what counts as a job well done [49]. It contributes four elements.

A proven framework. The six dimensions of the Gollac report, and standards such as ISO 45003 [68], offer a common language for describing organizational factors. The EU Code of Practice specifies seven indicators of a “healthy risk culture,” including anonymous surveys of how comfortable staff feel about reporting risks [37]; none of them addresses workload, time or the organization of work. Psychosocial risk assessment and the measurement of team psychological safety [69] can complement them.

An early signal. Impeded quality is both a health risk factor and an early signal of failure. An evaluator who considers the time allotted to an evaluation insufficient (T17) is simultaneously signaling a psychosocial risk and a risk to the safety of the model. Occupational health indicators can thus serve as leading safety indicators, just as precursor events do in high-hazard industries [38].

Independent institutions. The occupational physician, who is independent, bound by confidentiality and protected against dismissal, can hear about difficulties that an employee would not raise with their management and can send the employer written proposals to which the employer must respond (section 1.5). The right to alert on public health matters [59] partly overlaps with the demands made in 2024 by the signatories of the “A Right to Warn” letter [70]; under French law, their request for an anonymous channel to the board, regulators and an independent body falls more within the scope of whistleblower legislation [71].

The experience of high-reliability sectors. Aviation limits crew flight and duty times, regardless of their motivation [72], and has had a confidential incident reporting system since 1976 [73]. The nuclear sector regulates the fitness for duty and fatigue of safety personnel [74]. Just culture seeks to distinguish error, which calls for learning, from unacceptable behavior [38, 75]. The human and organizational factors approach to industrial safety already links working conditions to the safety of facilities [66].

The corpus adds an issue specific to AI. The EU AI Act provides for high-risk systems to be designed so that the people assigned to oversee them can remain aware of automation bias [61]. If the use of AI erodes the skills needed for this oversight (T29, T31), skill maintenance, a classic concern of occupational health, becomes a condition of oversight itself.

4.5 Proposals

Table 2 translates these contributions into measures applicable to frontier model developers and to the authorities that regulate them. Most draw on mechanisms already in place in other sectors and cost little relative to the stakes.

Table 2. Proposed roles for occupational health in ensuring the safe deployment of frontier models.

T identifiers refer to Table A1.

Two objections can be anticipated. The first concerns the status of the employees involved, who are well paid and sometimes volunteer for extreme hours (T25, T27). The factors described in the Gollac report do not depend on pay, and self-chosen intensity is still a source of fatigue and error: aviation limits duty times without regard to pilots' motivation. Moreover, the collective valuing of overwork (T27) is itself a risk factor. The second objection holds that these questions are a matter for corporate governance and regulators. Occupational health does not replace them: it provides them with a measure of the actual conditions of safety work and with protected access to employees.

4.6 Rethinking emotional demands

The rarity of emotional demands is partly due to the framework. This dimension, which centers on dealing with the public, exposure to suffering and fear at work, poorly captures a fear of a different kind: fear of major harm caused by what one produces, expressed by several witnesses (T12, T33, T39) and assigned here, by convention, to fear at work. This burden, specific to AI safety occupations, would warrant dedicated items in an adapted instrument.

4.7 Strengths and limitations

To our knowledge, this study is the first to apply the Gollac framework to employees of the labs that develop frontier models. The distinction between explicit and suggested links limits overinterpretation, and each code is justified and traceable to its source (Table A1).

The limitations are substantial. The corpus comes from the press, which favors conflicts and departures: OpenAI is overrepresented, 20 of the 39 witnesses have left or are leaving, and 30 of the 39 testimonies are critical. The results describe situations of tension, not prevalence. Several testimonies are anonymous, reported by third parties or disputed by the employer, and one is the subject of a lawsuit (T37). The link between value conflicts and impact on quality is partly built in, since impeded quality is part of value conflicts in the Gollac report. Health effects are reported, not measured. The impact families and the sequences are post hoc constructions. The incident review is targeted and non-exhaustive; it relies on company communications and the press, and the absence of a work-related factor in the sources does not mean that there was none in reality. Several investigations, including OpenAI’s investigation into the actions of its agents, are ongoing. Finally, neither the corpus nor the incidents permit causal inference linking working conditions to model safety; this relationship remains a hypothesis, supported by experience in other sectors.

4.8 Future directions

Two lines of work would extend this study: a survey of AI lab employees using a validated questionnaire based on the Gollac dimensions, supplemented with items on fear of major harm and on time pressure in evaluations; and a follow-up study relating the proposed indicators (evaluation duration, attrition, concerns raised) to incidents reported to the authorities. Extending the study to the workers excluded here, namely annotators and moderators, would complete the picture.

5. Conclusion

The safety of frontier AI models depends on people whose testimonies describe degraded working conditions where safety is decided: the time available for evaluations, the ability to raise concerns, the stability of teams. The review of recent incidents shows that occupational health would not have prevented everything: it acts neither on external threats nor on technical causes. It could, however, have acted on the human side of several failures: the weight given to evaluators' judgment, the time allowed for evaluations, the workload of oversight teams, coordination with evaluation partners, the analysis of errors. The French system, with its independent occupational physicians and its psychosocial risk assessment, and EU law, which already applies to models placed on the EU market, provide the tools; what remains is to integrate them into companies' safety frameworks and into US legislation. Deploying models safely also requires protecting the work of those who test them, align them and raise the alarm.