The Dual-Use Dilemma: What Frontier Biology Models Mean for Enterprise Biosecurity and AI Procurement

The arrival of restricted-access frontier models rated at high biological capability levels introduces a procurement category that most enterprise AI teams have no framework for evaluating. These are not general-purpose assistants with a biology plugin. They are purpose-built reasoning systems trained on dense scientific literature, capable of generating synthesis pathways, protein interaction analyses, and experimental design guidance at a level of specificity that sits uncomfortably close to dual-use territory. For CTOs and compliance leaders in pharma and biotech, the question is not whether to engage with this class of model, but whether your current governance infrastructure is anywhere near adequate to do so responsibly.

What "High Biological Capability" Actually Means in Practice

Frontier model developers now publish capability classifications as part of their responsible scaling frameworks. A model rated at the highest tier of biological capability has demonstrated, under evaluation, that it can provide meaningful uplift to someone attempting to work with dangerous pathogens or controlled biological agents. That is not a hypothetical risk category invented by regulators. It reflects empirical red-team findings.

The practical implication for enterprise buyers is that acquiring access to one of these systems is not analogous to subscribing to a scientific literature database. It is closer to deploying a piece of dual-use laboratory equipment that happens to live in software. The vendor's safety rating is a signal about what the model can do, not just a marketing classification.

What makes this more complicated is that several vendors in this space are explicitly reducing refusal rates on sensitive biology queries for credentialed research users. The logic is defensible: a virologist working on pandemic preparedness should not have to fight through safety guardrails to do legitimate science. The risk is that the credentialing mechanism becomes the entire security perimeter, and that perimeter is only as strong as the vetting process behind it.

The Gap Between Standard SaaS Procurement and Dual-Use AI

Standard enterprise software procurement checklists were not designed for this. They ask about SOC 2 compliance, data residency, uptime SLAs, and contractual liability caps. None of those questions address what happens when a credentialed researcher at your institution uses a high-capability biology model in a way that generates export-controlled outputs, or when a query log becomes discoverable in litigation.

The gap is structural. Most procurement frameworks treat AI models as tools that process data, not as systems that generate novel technical knowledge. A model that can reason through gain-of-function experimental design is generating knowledge, not retrieving it. That distinction has regulatory consequences under export control regimes like EAR and ITAR, where the transmission of certain technical information is controlled regardless of whether it originates from a human expert or a software system.

Compliance officers who have not yet mapped their AI procurement decisions onto export control obligations are operating with a blind spot. The fact that a vendor holds a SOC 2 Type II certificate tells you nothing about whether their model's outputs are subject to export licensing requirements when used by your researchers.

Tiered Access Governance: What a Credible Vendor Framework Looks Like

Vendors offering high-capability biology models should be operating tiered access systems with meaningful differentiation between tiers. A credible framework distinguishes between institutional verification, individual researcher credentialing, use-case scoping, and audit logging at the query level. Each of those layers addresses a different failure mode.

Institutional Verification

Institutional verification establishes that the purchasing organisation is a legitimate research entity operating under appropriate oversight. This typically involves review of institutional biosafety committee structures, existing regulatory relationships, and the nature of the research programme. It is a necessary condition, but not a sufficient one.

Individual Credentialing and Use-Case Scoping

Individual credentialing matters because institutional affiliation does not constrain individual behaviour. A researcher with a legitimate institutional home can still make queries that fall outside the scope of approved research. Use-case scoping, where access is granted for defined research domains rather than general biology reasoning, is the mechanism that limits this exposure.

Query-level audit logging is the enforcement layer. Without it, neither the vendor nor the institution can reconstruct what was asked, what was returned, and whether that output should have been generated at all.

The Vendor Accountability Questions Procurement Teams Are Not Asking

Most procurement conversations with frontier AI vendors in this space focus on capability and price. The accountability questions are harder and less frequently asked.

Who conducts the biological capability evaluations, and are those evaluators independent of the product team? What is the vendor's process for reclassifying a model's capability tier if post-deployment red-teaming reveals new risks? What notification obligations exist if the vendor discovers that a customer's usage patterns suggest misuse? These are not hypothetical edge cases. They are the questions that determine whether a vendor's safety framework is substantive or cosmetic.

Equally important is the question of contractual liability allocation. Standard AI vendor terms of service typically disclaim liability for outputs. In a context where a model's output could constitute a controlled technical export or contribute to a biosecurity incident, that disclaimer does not hold up to scrutiny as an adequate risk allocation mechanism. Legal teams reviewing these contracts need to be asking whether the vendor's indemnification scope has been updated to reflect the actual risk profile of high-capability biology models.

Building an Internal Governance Layer That Matches the Risk

Vendor governance frameworks are a necessary condition for responsible deployment, but they are not sufficient on their own. Institutions deploying high-capability biology models need internal governance structures that treat these systems as a distinct category from general-purpose AI.

That means designated oversight at the institutional level, typically through an AI governance committee with representation from biosafety, legal, and research leadership. It means written policies that define which research use cases are in scope, which require additional review, and which are out of scope regardless of vendor capability. And it means a documented incident response process for the scenario where a query or output is flagged as potentially problematic.

The institutions that will manage this category of risk most effectively are those that treat the governance design as a parallel workstream to the technical evaluation, not as a compliance checkbox to be completed after the contract is signed. The regulatory environment around dual-use AI in biology is still forming, but the direction of travel is clear. Institutions that have built internal governance structures now will be in a materially stronger position when formal requirements arrive.