Governing Frontier AI: Organizational Boundaries and the Providers of AI Governance

Who performs the work of frontier-AI governance, and what role do commercial specialists play in it? We combine first-party disclosures from 12 developers with at least one publicly announced model whose training compute is estimated to be above 1025 FLOPs with a frozen Crunchbase-derived classifier of commercial AI-governance providers. A systematic verification pass yields 238 realized model- or system-specific governance-provision instances across 10 developers. Collapsing repeated model-level observations produces 99 unique developer–provider/process–function relationships, of which 58 cross an organizational boundary. Evaluation is the most frequently documented function, accounting for 53 of 99 relationships and spanning internal, for-profit/certification, public, nonprofit/research, and unnamed external modes. External evidence remains highly concentrated: OpenAI and Anthropic account for 50 of 58 external relationships. Because the evidence is disclosure-dependent and based primarily on English-language public sources, this concentration should not be read as a population measure of outsourcing. On the commercial side, the frozen classifier identifies 51 canonical specialist firms, 25 of which have positive disclosed funding amounts. These firms have approximately $428.5 million in disclosed historical funding, with 85.3% concentrated in the ten largest. The developer-centered evidence nevertheless contains a broader institutional set of specialist firms, diversified service providers, public institutes, nonprofits, and certification bodies. The results show why venture-oriented provider data and developer disclosures capture different layers of frontier-AI governance and why organizational externality should not be equated with substantive independence or adequate governance capacity.