Four-category framework for disclosing internal AI deployments

Referee: Risk-mitigation analysis per category: whether the paper provides concrete mechanisms, examples, or evidence for mitigating disclosure-related risks, or merely asserts manageability. Special concern about the 'capabilities' category where disclosure vs. competitive/misuse tension is sharpest.

Authors: This is the most important concern and we agree it is load-bearing. The full manuscript does not merely list risks and assert they are manageable. For each of the four categories, we identify specific disclosure-related risks and then discuss concrete mitigation strategies. For the capabilities category specifically—which the referee correctly identifies as the sharpest tension—we address the competitive and misuse risks by distinguishing between information appropriate for private regulatory reporting (where confidentiality protections exist) and public disclosure (where they do not), and by proposing specific scoping mechanisms such as describing capability evaluation methodologies and results at a level of granularity sufficient for oversight without revealing reproducible details. We also discuss differential disclosure thresholds depending on the capability level. That said, we accept the referee's implicit challenge: if any reviewer finds the mitigation analysis for a given category insufficiently concrete after reading the full text, we will strengthen it. We commit to revisiting the capabilities section to ensure the mitigation mechanisms are as specific as possible, with worked examples where feasible. revision: partial

Referee: Dual-use claim: whether the paper provides concrete mapping from each category to public vs. private disclosure contexts, addressing different risk tolerances and audiences.

Authors: The referee is right that a framework which does not distinguish public from private disclosure contexts would be substantially weaker. The full manuscript does provide this mapping. For each category, we discuss what information is appropriate for public transparency documents (e.g., system cards) versus private regulatory reports, and we explicitly address how the different risk tolerances and audiences of these two contexts affect disclosure recommendations. The distinction is woven throughout the per-category analysis rather than confined to a single section, because the appropriate disclosure level depends on the interaction between the category of information and the reporting context. We will ensure this mapping is as explicit as possible—potentially adding a summary table cross-referencing categories against disclosure contexts—to make the dual-use claim easier to verify. revision: partial

Referee: Justification for the four-category taxonomy: whether the categories are grounded in prior literature, empirical examples, or stakeholder analysis, or merely asserted.

Authors: We agree that a taxonomy presented without justification would weaken the paper's contribution. The four categories are not asserted arbitrarily. The full manuscript grounds them in a review of existing transparency frameworks and disclosure practices (including system cards, frontier model regulations, and voluntary commitments), identifying what these frameworks already cover and where gaps exist specifically for internal deployments. The categories emerged from analyzing what information stakeholders—regulators, researchers, civil society—would need to assess the safety of internal deployments, combined with examination of what developers have historically disclosed (or failed to disclose) in analogous contexts. We do not claim the taxonomy is formally complete or exhaustive; we position it as a practically motivated organizing structure. If the referee, upon reading the full text, finds the justification insufficient, we will strengthen the literature grounding and add explicit discussion of alternative category structures we considered and rejected. revision: partial