Three profiles
Developer profile
Applied to companies that build, train, and distribute AI models. Heavier weight on: AI Safety and Robustness (D2), Data Ethics and Privacy (D4), Cybersecurity and AI Resilience (D9). Rationale: Model developers bear primary responsibility for safety properties, training data governance, and model security. Their governance failures propagate downstream to every deployer. Examples: Foundation model labs, AI infrastructure providers, companies that train and distribute proprietary models.Deployer profile
Applied to companies that integrate, deploy, and operate AI systems built by others. Heavier weight on: Governance Infrastructure (D5), Fairness and Bias Mitigation (D6), Societal/Workforce Impact (D7), Third-Party and Supply Chain Governance (D10). Rationale: Deployers are accountable for how AI is used in their context. Their governance challenges center on vendor selection, integration testing, bias in applied settings, and workforce impact. Examples: Financial institutions using AI for lending, healthcare organizations deploying clinical AI, retailers using AI for pricing and recommendations.Hybrid profile
Applied to companies that both build and deploy AI systems. Blended weights that reflect dual responsibility across the full value chain. Examples: Large technology companies that develop proprietary AI and deploy it in consumer and enterprise products.Profile assignment
The rating report always discloses which profile was applied and why. Profile assignment considers:- Revenue mix (model licensing vs. AI-powered services)
- Whether the company trains foundation models
- Degree of downstream deployment
- Self-classification in public disclosures
Profile assignment is determined in Phase 1 (Alpha Materiality Profile) and disclosed in every rating report. Companies can request a profile review if their business model changes materially.