Providers of general-purpose AI models with systemic risk must document adversarial testing and any involvement of independent external evaluators under Article 55 of the AI Act. Population-scale synthetic-persona simulation infrastructure is a plausible candidate for that role — external to the model provider, but not independent of itself when its own population and validation figures are self-reported. No such case has been identified; this article examines the structural gap that would arise if one did.

OpenAI's Astra disclosure raises a Critical-level cybersecurity flag on the basis of an evaluation record only OpenAI has seen. This article examines what would, and would not, make that determination independently verifiable.