Appendices

Appendices

The six appendices below form part of the manuscript. The downloads page lists the DOI-backed companion files preserved alongside the paper.

Search and Screening

Version: 2.0
Search cutoff / incident corpus freeze / policy corpus freeze: 2026-03-04
Release audit date: 2026-03-25
Public release date: 2026-03-25

Purpose

This supplement makes the registry build auditable at the screened-record level and documents the strongest search-history reconstruction still supportable from the archived materials. It records the source families searched, representative search strings, screening and deduplication rules, the retained screened ledger, the retained-corpus maintenance note required to reconcile the preserved 34-row screening ledger with the 32-row public registry corpus, the archive-reconstructed execution log in search_execution_log.csv, and the row-level screening_ledger.csv export.

The registry is reproducible from the screened-record layer forward. It does not preserve every preliminary search-engine impression, syndicated duplicate, or transient web result returned before incident-level screening. The new execution log is therefore an archive reconstruction of the search workflow, not a recovered raw-identification export from the original build materials.

Date Semantics

• search cutoff: March 4, 2026. No incident or policy document first identified after this date enters the retained incident corpus or retained policy corpus.

• incident corpus freeze: March 4, 2026. Counts in the manuscript and incident_registry_coded.csv are keyed to this boundary.

• policy corpus freeze: March 4, 2026. Counts in the manuscript and policy_registry_coded.csv are keyed to this boundary.

• release audit date: March 25, 2026. Integrity-review date for the posted study materials.

• public release date: March 25, 2026. Publication date for the manuscript and standalone supplement files.

Search-Execution Log Status

search_execution_log.csv records one row per archive-reconstructed database or document-source workflow. The file includes:

• source_family

• platform_or_database

• run_date

• search_string

• filters

• sort_order

• results_returned_n

• advanced_to_screening_n

• notes

  results_returned_n = not_preserved indicates that the raw hit count was not archived in the original build materials and should not be reverse-engineered after the fact.

Screening Ledger and Source-Capture Files

Two additional CSV files now expose the screened layer more directly:

• screening_ledger.csv — one row per candidate advanced to screening, with dedupe_cluster_id, final_disposition, exclusion_reason, source_capture_date, archive_reference, and local_snapshot_sha256 where a local source copy exists.

• policy_source_index.csv — one row per retained policy document with document_genre, source_capture_date, and the public archive reference used in this release.

  source_capture_date in these files records the capture or verification date represented by the current public materials. It should not be back-interpreted as the original historical search date unless the file explicitly says so.

Source Families and Representative Searches

Screening Workflow

Reviewer roles

• Search, screening, and deduplication were performed by the author as a single-reviewer pass.

• The public materials do not support a duplicated historical screen because no archived second screener log is available.

• The preserved materials are sufficient to audit decisions from the screened-ledger layer forward.

Incident inclusion rule

Advance a candidate to the codable ledger only when all three conditions hold:

1. The record documents a specific AI-self-harm intersection rather than general commentary.

2. The record is attributable to a named platform, system, or evaluation object.

3. The public evidence is sufficient to code outcome and evidence fields under the registry rubric.

Exclusion rule

Exclude records that are:

• unverifiable social-media claims or screenshots without attributable provenance;

• duplicates or syndicated copies without new codable evidence;

• general commentary or policy discussion without a specific incident or evaluation anchor;

• too thin to support even Grade C coding.

Deduplication rule

Deduplicate first at the report level, then at the incident level. Preserve distinct platform or pathway exposures when the same harmed person encountered multiple systems in separately codable ways. This is why the Molly Russell inquest yields both 2017-IG-01 and 2017-PIN-01.

Registry Assembly Flow

Preserved Screened Ledger

The table below preserves the screened ledger that underlies the retained-corpus maintenance note above. It contains the 34 records advanced to incident-level screening in the preserved ledger state. The machine-readable screening_ledger.csv carries the release-stage dispositions: 31 retained_in_registry_corpus rows, 1 retained_as_contextual_only row, and 2 excluded_at_screening Grade D rows.

Retained-Corpus Maintenance Update

The preserved screened ledger above is not itself the final public retained corpus. One older included contextual benchmark row was removed from the codable incident corpus, and one new A2 complaint row was added before the March 4, 2026 freeze.

Policy-Corpus Assembly Rule

The parallel policy corpus was assembled separately from the incident ledger. A document entered the policy corpus only if it met all of the following conditions:

1. It was issued publicly by one of the five provider groups in the crosswalk.

2. It belonged to a codable governance genre: preparedness framework, responsible-scaling policy, system card, model card, model spec, usage policy, or comparable official safety/governance post.

3. It was current through the March 4, 2026 cutoff.

4. It was codable under policy_registry_schema.csv and not merely a superseded draft or non-governance marketing page.

5. The provider either appeared in the incident corpus or functioned as a major frontier-model governance comparator with a comparable public document set.

   Companion-app vendors without a comparable public governance-document set by the freeze date remain out of scope for this crosswalk even when they appear in the incident registry.

Definitions and Coding Boundaries

Version: 2.0
Search cutoff / incident corpus freeze / policy corpus freeze: 2026-03-04
Public release date: 2026-03-25

Core Objects

Outcome Labels

Use the canonical incident labels:

Reliability Grades and Evidentiary Levels

Reliability grades describe the traceability of the incident’s public evidence anchor, not adjudicated merit.

Explicit B/C Boundary

• B requires inspectable evidentiary detail beyond bare assertion, such as reproduced excerpts, screenshots, or attributable first-person / investigative sourcing that allows a reviewer to trace why the row is codable.

• C is used when the public record still supports row-level coding, but the available material is materially thinner: party statements, summary reporting, or limited excerpts without enough independent inspection to justify B.

Taxonomy Key

The registry uses a six-category, 13-subcode, non-mutually-exclusive taxonomy. These codes identify loci of evaluative intervention rather than mutually exclusive harm types.

Boundary Rules

RTI-CO Versus LONG-DEL

• Code RTI-CO when the record documents a discrete fixed-belief non-amplification failure in one focal exchange.

• Code LONG-DEL when the record documents repeated or temporally extended reinforcement of that frame across turns or sessions.

• Code both when the public record shows a focal affirming exchange embedded in a longer reinforcement trajectory.

LONG-DEP Versus High Engagement

Do not code LONG-DEP for mere frequency of use. The record should show dependency, emotional exclusivity, erosion of offline supports, or a closely related attachment pattern.

DET-FN

DET-FN is not a general criticism of safety quality. It is reserved for cases where the system detects or is presented with acute risk cues but does not meaningfully interrupt, route, or escalate.

Derived Analysis View

incident_registry_analysis_view.csv is an analysis-only companion keyed by incident_record_id. It does not alter the canonical 20-field incident schema.

Legacy identifier note

• incident_record_id is the row-level identifier used for the analysis companion.

• incident_id is retained in the same file as a backward-compatible legacy record identifier because downstream study materials already use that label.

• In the current public release, incident_record_id and incident_id are identical string values.

record_type

• human_harm_incident for person-level death, injury, or harm-exposure rows.

• evaluation_or_demonstration for rows where user_type = test.

evaluation_subtype

Use the following mapping for the six evaluation/demonstration rows:

trajectory_structured_strict

• yes when one or more adjudicated LONG-* subcodes are present.

• no otherwise.

  This field is fully mechanical: it is derived from the canonical taxonomy coding only, and it is the manuscript’s primary trajectory indicator.

trajectory_basis_strict

• Use semicolon-separated LONG-* subcodes when trajectory_structured_strict = yes.

• Use none when trajectory_structured_strict = no.

trajectory_structured_broad

• yes when the record satisfies the strict rule or the public record otherwise documents a cross-turn or cross-session pathway strongly enough to satisfy the prespecified appendix rule.

• no when only event-level evidence is supported.

• indeterminate when the public materials describe an extended pathway but remain too thin for a conservative broad-route yes.

  This field is retained as a descriptive sensitivity check rather than the headline prevalence measure.

trajectory_basis_broad

• Use semicolon-separated LONG-* subcodes when trajectory_structured_broad = yes because of adjudicated longitudinal codes.

• Use documented_multi_turn_pathway_insufficient_for_subcode when trajectory_structured_broad = indeterminate.

• Use none when trajectory_structured_broad = no.

Legacy trajectory alias

• trajectory_structured_flag is retained as a backward-compatible alias of trajectory_structured_broad.

• trajectory_basis is retained as a backward-compatible alias of trajectory_basis_broad.

One-page decision tree

1. Does the adjudicated registry row contain one or more LONG-* subcodes? If yes, set trajectory_structured_strict = yes, trajectory_structured_broad = yes, and carry the LONG-* codes into both basis fields.

2. If no LONG-* code is present, does the public record still document repeated turns, repeated sessions, retained memory, or another clearly cumulative interaction pathway? If no, set trajectory_structured_strict = no and trajectory_structured_broad = no.

3. If the public record does document a repeated or cumulative pathway without adjudicated LONG-* support, ask whether the evidence is specific enough to support a conservative broad-route longitudinal designation. If yes, set trajectory_structured_broad = yes. If no, set trajectory_structured_broad = indeterminate.

Worked examples

Cluster Fields

• person_cluster_id groups explicit pathway duplicates or clearly identical harmed-person rows for analytic deduplication.

• provider_cluster_id groups rows by provider or platform family.

• case_cluster_id groups rows by the same case family, inquest, hearing package, or benchmark study.

• pathway_duplicate_group_id groups rows that document the same underlying harmed-person pathway but are intentionally retained as separate platform/pathway records.

Study Architecture

Policy Crosswalk Glossary

One-Page Glossary for Frequent Shorthand

Reliability Appendix

Version: 2.0
Search cutoff / incident corpus freeze / policy corpus freeze: 2026-03-04
Public release date: 2026-03-25

Source Basis

This appendix now distinguishes between two reliability components:

1. the retained 8-incident independent-rater summary audit already archived in earlier study materials; and

2. the new full-corpus audit scaffold archived in incident_taxonomy_rater_matrix.csv and incident_taxonomy_adjudication_log.csv.

   Historical raw second-rater exports for the retained 8-incident audit are still not publicly available. The new full-corpus files therefore expose the primary-coder side of the audit matrix and the forward adjudication surface, but they should not be described as a completed independent second-rater re-audit.

Retained 8-Incident Audit Summary

Recoverable audited incident set

The retained audit summary covers the following incident records:

• 2017-IG-01

• 2023-CAI-01

• 2024-CAI-02

• 2025-GEM-01

• 2025-GPT-01

• 2025-MAI-01

• 2025-MLP-01

• 2025-REP-01

Coverage note

• The recoverable audited set covers deaths, harm exposures, and unsafe-output rows.

• The recoverable audited set does not include an injury row.

• The recoverable audited set is concentrated in A1 and A2 materials; it does not provide a raw archived audit surface for the most interpretation-sensitive B and C rows.

  The retained 8-incident table is an archived historical agreement summary preserved from an earlier coding state. It should not be read as a row-level parity check or independent validation of the current 2.0 released taxonomy assignments, which have since been updated. Accordingly, the pooled and per-subcode agreement statistics below are historical audit artifacts, not current-release subcode validation metrics.

Retained pooled agreement summary

The confidence interval is the asymptotic interval implied by the retained pooled 2 x 2 decision table (23 / 0 / 8 / 73), not a bootstrap interval from raw coder-level exports.

Retained per-subcode summary

For sparse subcodes, the agreement counts and positive agreement are more informative than kappa alone.

Full-Corpus Audit Scaffold

Two new files now define the forward reliability surface:

• downloads/incidents/incident_taxonomy_rater_matrix.csv

• downloads/incidents/incident_taxonomy_adjudication_log.csv

What the scaffold contains

• One row per incident_record_id x review_item combination across the full 32-record retained registry corpus.

• review_family = taxonomy_subcode for the 13 multi-label taxonomy decisions.

• Additional review rows for outcome_category, reliability_grade, eligibility_retention_status, and trajectory_structured_broad.

• evidence_stratum populated as A1, A2, B, or C for planned stratified reporting.

• blinding_requirement = blind_to_rater_1_and_expected_outcomes for every row.

• rater_1 populated from the current released coding.

• Blank rater_2 and adjudicated_value columns reserved for a future independent second-rater completion pass.

• A status column marking every row as awaiting_independent_second_rater.

What the scaffold does not contain

• It does not reconstruct historical second-rater decisions that were not archived.

• It does not justify stronger claims than the retained 8-incident summary audit supports.

• It does not convert the current release into a completed full-corpus independent-rater package.

Intended reporting strata for a completed pass

If a true second-rater pass is later completed, report agreement separately for:

• A1/A2

• B

• C

  Do not collapse B and C into a single interpretive-risk stratum.

Planned review-surface rules

• outcome_category and reliability_grade should be coded independently from the released CSV.

• eligibility_retention_status should distinguish retained_in_registry_corpus from any future contextual-only or excluded rows if the corpus changes.

• trajectory_structured_broad requires independent review because it is not purely mechanical.

• trajectory_structured_strict does not require a second coder because it is mechanically derivable from adjudicated LONG-* values.

Interpretation-Seams Still Worth Monitoring

The retained audit materials and the current codebook continue to identify three seams that deserve attention in any future completed re-audit:

1. GEN-E versus no code when a response is ambiguous between encouragement and neutral acknowledgment.

2. LONG-DEL versus RTI-CO, where the practical distinction is temporal: focal exchange versus repeated reinforcement trajectory.

3. LONG-DEP versus high engagement without a documented dependency or exclusivity signal.

What This Appendix Supports

This appendix supports a narrower claim than the earlier wording: the current taxonomy is operationalized and partially reliability-tested, but the public materials do not yet contain a completed full-corpus independent second-rater archive. The retained 8-incident summary audit remains informative; the new scaffold makes the next audit pass forward-completable and file-level auditable.

Policy Reliability Appendix

Version: 2.0
Search cutoff / incident corpus freeze / policy corpus freeze: 2026-03-04
Public release date: 2026-03-25

Purpose

This appendix defines the auditable reliability surface for the 16-document policy crosswalk and records what is and is not yet archived in the public release.

Archived Files

• downloads/policy/policy_registry_second_rater.csv

• downloads/policy/policy_registry_adjudication_log.csv

• downloads/policy/policy_registry_coded.csv

• downloads/policy/policy_registry_schema.csv

• downloads/policy/policy_registry_coding_manual.md

Current Status

The policy crosswalk remains a single-coder descriptive pass in this release. The new files add the row-level second-rater scaffold and adjudication surface, but they do not contain completed independent second-rater decisions.

Independent-Review Surface

The intended non-derived analytic review surface is:

• document_genre

• self_harm_named

• self_harm_domain_form

• risk_domain_status

• first_class_equivalence

• named_frontier_risk_domains

• self_harm_comparability_note

• threshold_mechanism

• deployment_consequence

• external_review_requirement

• specialized_red_teaming

• monitoring_obligation

• incident_response_layer

• all_self_harm_layers_present

• governance_fragmentation

• temporal_model

• multi_turn_evaluation

• memory_personalization_attention

• dependency_attention

• cross_session_accumulation

• mechanism_coverage

• evaluative_object_status

• epistemic_risk_attention

• architecture_level_attention

• detection_to_action_coupling

  Derived gap fields should be regenerated only after those base fields are independently reviewed and adjudicated.

Scaffold Design

policy_registry_second_rater.csv

• One row per policy document.

• record_id populated for all 16 documents.

• document_genre and all analytic coding fields left blank pending an actual independent second-rater pass.

• audit_status = awaiting_independent_second_rater for every row.

policy_registry_adjudication_log.csv

• Reserved for field-level disagreements.

• Should be populated only after a completed second-rater pass exists.

Recommended Completion Rule

When a true second-rater pass is available:

1. Complete policy_registry_second_rater.csv independently from the canonical coded CSV.

2. Compare coder 1 versus coder 2 on the non-derived analytic fields only.

3. Log every disagreement in policy_registry_adjudication_log.csv.

4. Recompute derived gap fields from the adjudicated base fields.

5. Report exact agreement and Cohen’s kappa for single-choice nominal fields.

6. Report exact-set agreement and label-level positive agreement for mechanism_coverage.

7. Report results within document_genre before any provider-level rollup.

What This Appendix Supports

This appendix supports two bounded claims:

• the public materials now provide a file-level, forward-completable reliability surface for the policy crosswalk; and

• the policy crosswalk should still be described as a single-coder descriptive audit until the scaffold is actually completed by an independent second rater.

Policy Crosswalk Appendix

Version: 2.0
Search cutoff / incident corpus freeze / policy corpus freeze: 2026-03-04
Public release date: 2026-03-25

Purpose

This appendix makes the 16-document policy crosswalk directly auditable from the public study materials. It states the corpus-selection rule, summarizes the public-document field distributions, lists the fixed fields intended for independent review, and exposes the row-level coding ledger derived from policy_registry_coded.csv. It should be read together with policy_registry_second_rater.csv, which provides the forward second-rater scaffold, and policy_source_index.csv, which records public source-capture metadata for the retained policy corpus.

Corpus Selection Rule

A document enters the public policy corpus only if it satisfies all of the following conditions:

1. It is publicly issued by one of the five selected provider groups represented in the crosswalk.

2. It belongs to a codable governance genre: preparedness framework, responsible-scaling policy, system card, model card, model spec, usage policy, or comparable official safety/governance post.

3. It is current through the March 4, 2026 search cutoff and policy corpus freeze.

4. It is codable under policy_registry_schema.csv using the highest-evidenced-tier rule.

5. It is not a superseded draft, marketing page, or non-codable announcement.

6. The provider either appears in the incident registry or functions as a major frontier-model governance comparator with a comparable public-document set by the freeze date.

   The resulting corpus contains 16 documents across Anthropic, Google / Google DeepMind, Meta, OpenAI, and xAI. Companion-app vendors without a comparable public governance-document set by the freeze date remain out of scope even when they appear in the incident registry.

Provider-Group Freeze

Google and Google DeepMind are treated as one provider group for corpus selection and provider-level rollups, while their public documents retain separate issuing-organization labels at the row level.

Corpus Composition

By organization

By document genre

By genre group

High-level field summary

Fixed Fields for Independent Review

The manuscript discusses the following fields as the minimum independent-review surface for the policy crosswalk:

• document_genre

• self_harm_named

• self_harm_domain_form

• risk_domain_status

• evaluative_object_status

• first_class_equivalence

• threshold_mechanism

• deployment_consequence

• multi_turn_evaluation

Public-archive status of independent review

The policy crosswalk remains a single-coder descriptive pass. The public materials include policy_registry_second_rater.csv and policy_registry_adjudication_log.csv as forward-completable audit files, but they do not yet include a completed independent second-rater review for all 16 documents. This appendix therefore exposes the row-level evidence, excerpts, and field values needed for such a review, but it should not be described as a completed independent adjudication table.

Row-Level Public-Document Ledger

The table below is generated from the current coded CSV and is the authoritative row-level audit surface for the manuscript. Two retained Meta canonical URLs on ai.meta.com required login during the March 25, 2026 release audit; the study materials preserve their canonical URLs together with source-capture metadata and archived excerpt provenance.

Reading the Table

• tier is the coded risk_domain_status.

• genre is the coded document_genre, used for within-genre comparison before provider-level rollups.

• layers is the coded all_self_harm_layers_present.

• object is the coded evaluative_object_status.

• first_class indicates whether self-harm is treated on frontier-comparable terms.

• threshold and deploy report whether self-harm findings trigger thresholded review or deployment consequences in the public document itself.

• multi_turn reports whether the document contains explicit, partial, or absent longitudinal evaluation procedures.

What This Appendix Supports

This appendix supports cautious claims about what the public documents themselves operationalize. It does not support claims about undisclosed internal practice, unpublished red-team protocols, or organization-wide governance measures not evidenced in the document row being coded.

Reference and Source Index

Version: 2.0
Search cutoff / incident corpus freeze / policy corpus freeze: 2026-03-04
Public release date: 2026-03-25

This appendix indexes the public evidence routes used in the registry and the public policy documents included in the crosswalk. The DOI-backed release files listed on the downloads page include the datasets, coding manuals, citation metadata, and audit-surface files preserved for public release.

Incident Citation and Evidence-Route Index

Archive status = present means a local evidence file is bundled in the release. Archive status = external_only means the public route is an external primary source and no local mirror is bundled.

Policy Document Source Index

The 16 policy rows are directly indexed below. For quick lookup, the public-document identifiers are:

Two Meta canonical URLs are retained even though ai.meta.com required login during the March 25, 2026 release audit; corresponding source-capture metadata are preserved in policy_source_index.csv.

Data Availability and Declarations

Data Availability

Version 2.0 study materials are available at https://selfharm.ai/downloads/ and are keyed to the DOI deposit at https://doi.org/10.17605/OSF.IO/49AGJ. The public release includes the coded incident registry, the analysis companion, the coded policy registry, schemas, coding manuals, search-execution log, screening and source-capture ledgers, incident and policy audit scaffolds, the manuscript PDF, and citation metadata.

Some records are intentionally routed to external primary sources rather than archived locally, and some legal materials remain paywalled or externally hosted. No private platform logs or non-public human-subject materials are included.

Ethics Review

This study used only publicly available records, court filings, hearing materials, public journalism, benchmark reports, and provider-issued governance documents. No direct participant recruitment, private records, or non-public human-subject data were used. On that basis, the work did not require IRB or human-subjects review under the applicable public-records standard.

Funding

This work received no external funding.

Competing Interests

The author declares no competing interests.

Sensitive-Material Handling

This article discusses suicide and self-harm but does not reproduce operational instructions. Means-specific details are redacted or omitted, quotations are minimized, and the focus remains on system behavior, evidentiary discipline, and prevention-oriented evaluation design. Because the corpus includes minors and deaths, the article relies only on already public materials and does not introduce new identifying detail beyond what is already part of the source record.

AI-Use Statement

Where generative AI assistance was used, it was not used to identify incidents, select sources, assign incident taxonomy codes, determine reliability grades, extract evidentiary claims, or resolve interpretive disputes. No AI-generated text was treated as evidence. AI assistance was used only for drafting, rephrasing, table formatting, and revision support, with all retained text checked against the cited source material and coded materials.

References

Artificial Intelligence Incident Database. (n.d.-a). CSETv1 charts. Retrieved March 2026, from https://incidentdatabase.ai/taxonomies/csetv1/

Artificial Intelligence Incident Database. (n.d.-b). Editor’s guide. Retrieved March 2026, from https://incidentdatabase.ai/editors-guide/

Artificial Intelligence Incident Database. (n.d.-c). GMF charts. Retrieved March 2026, from https://incidentdatabase.ai/taxonomies/gmf/

Anthropic. (2025, June 27). How people use Claude for support, advice, and companionship. https://www.anthropic.com/news/how-people-use-claude-for-support-advice-and-companionship

Anthropic. (2025, August 12). Building safeguards for Claude. https://www.anthropic.com/news/building-safeguards-for-claude

Anthropic. (2025, December 18). Protecting the well-being of our users. https://www.anthropic.com/news/protecting-well-being-of-users

Anthropic. (2025, December 19). Sharing our compliance framework for California’s Transparency in Frontier AI Act. https://www.anthropic.com/news/compliance-framework-SB53

Anthropic. (2026, February 24). Anthropic’s Responsible Scaling Policy: Version 3.0. https://www.anthropic.com/news/responsible-scaling-policy-v3

Centers for Disease Control and Prevention. (2024, November 29). Youth mental health: The numbers. https://www.cdc.gov/healthy-youth/mental-health/mental-health-numbers.html

Chatterji, A., Cunningham, T., Deming, D. J., Hitzig, Z., Ong, C. W., Shan, C. Y., & Wadman, K. (2025). How people use ChatGPT (Working Paper No. 34255). National Bureau of Economic Research. https://www.nber.org/papers/w34255

Faverio, M., & Sidoti, O. (2025, December 9). Teens, social media and AI chatbots 2025. Pew Research Center. https://www.pewresearch.org/internet/2025/12/09/teens-social-media-and-ai-chatbots-2025/

Garcia v. Character Technologies, Inc., No. 6:24-cv-01903 (M.D. Fla. May 21, 2025) (order on motions to dismiss).

Gavalas v. Google LLC and Alphabet Inc., No. 5:26-cv-01849 (N.D. Cal. filed March 4, 2026).

Google. (2024, December 17). Generative AI Prohibited Use Policy. https://policies.google.com/terms/generative-ai/use-policy

Google DeepMind. (2025, November). Frontier Safety Framework Report - Gemini 3 Pro (November, 2025) v2. https://deepmind.google/models/fsf-reports/gemini-3-pro/

Google DeepMind. (2025, December). Gemini 3 Pro - Model Card. https://deepmind.google/models/model-cards/gemini-3-pro

Meta. (2023, July 18). Llama 2 Acceptable Use Policy. https://ai.meta.com/llama/use-policy/

Meta. (2025, September 24). Code World Model Preparedness Report. https://ai.meta.com/research/publications/code-world-model-preparedness-report/

Moore, J., Grabb, D., Agnew, W., Klyman, K., Chancellor, S., Ong, D. C., & Haber, N. (2025). Expressing stigma and inappropriate responses prevents LLMs from safely replacing mental health providers. In Proceedings of the 2025 ACM Conference on Fairness, Accountability, and Transparency (pp. 599–627). https://doi.org/10.1145/3715275.3732039

OECD. (2025). Towards a common reporting framework for AI incidents (OECD Artificial Intelligence Papers No. 34). OECD Publishing. https://doi.org/10.1787/f326d4ac-en

OECD.AI. (n.d.-a). Overview and methodology of the AI Incidents and Hazards Monitor. Retrieved March 2026, from https://oecd.ai/en/incidents-methodology

OECD.AI. (n.d.-b). Name it to tame it: Defining AI incidents and hazards. Retrieved March 2026, from https://oecd.ai/en/wonk/defining-ai-incidents-and-hazards

Ofcom. (2025, August 22). Protecting people from online suicide and self-harm material. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/protecting-people-from-online-suicide-and-self-harm-material

OpenAI. (2025, April 15). Preparedness Framework (Version 2). https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf

OpenAI. (2025, October 27). Addendum to GPT-5 System Card: Sensitive Conversations. https://cdn.openai.com/pdf/3da476af-b937-47fb-9931-88a851620101/addendum-to-gpt-5-system-card-sensitive-conversations.pdf

OpenAI. (2025, December 18). Model Spec (2025/12/18). https://model-spec.openai.com/2025-12-18.html

OpenAI. (2026, March 3). GPT-5.3 Instant System Card. https://deploymentsafety.openai.com/gpt-5-3-instant/gpt-5-3-instant.pdf

Pichowicz, W., Kotas, M., & Piotrowski, P. (2025). Performance of mental health chatbot agents in detecting and managing suicidal ideation. Scientific Reports, 15, 31652. https://doi.org/10.1038/s41598-025-17242-4

Robb, M. B., & Mann, S. (2025). Talk, trust, and trade-offs: How and why teens use AI companions. Common Sense Media. https://www.commonsensemedia.org/sites/default/files/research/report/talk-trust-and-trade-offs_2025_web.pdf

Spittal, M. J., et al. (2025). Can suicide and self-harm in children and adolescents be predicted by mental health and social care contact? A systematic review and meta-analysis. PLOS Medicine, 22(8), e1004581. https://doi.org/10.1371/journal.pmed.1004581

Tricco, A. C., Lillie, E., Zarin, W., et al. (2018). PRISMA extension for scoping reviews (PRISMA-ScR): Checklist and explanation. Annals of Internal Medicine, 169(7), 467-473. https://doi.org/10.7326/M18-0850

U.S. Senate Judiciary Committee, Subcommittee on Crime and Counterterrorism. (2025, September 16). Examining the harm of AI chatbots. https://www.judiciary.senate.gov/committee-activity/hearings/examining-the-harm-of-ai-chatbots

World Health Organization. (2019, June 24). Preventing suicide: A resource series. https://www.who.int/publications/i/item/preventing-suicide-a-resource-series

xAI. (2025, November 17). Grok 4.1 Model Card. https://data.x.ai/2025-11-17-grok-4-1-model-card.pdf

xAI. (2025, December 30). xAI Frontier Artificial Intelligence Framework. https://data.x.ai/2025-12-31-xai-frontier-artificial-intelligence-framework.pdf