OpenAI said on Friday, 23 October 2026, that it has signed an agreement with Poland's NASK National Research Institute to explore joint work on AI safety and security. The OpenAI NASK partnership makes Poland the third country whose national AI safety body OpenAI has named as a formal research partner, after the United States and the United Kingdom.
The deal itself is light on detail. No budget, timeline or list of deliverables has been published. What gives it weight is a pilot that ran this summer, in which Poland's national cyber team used an OpenAI model to find real flaws in widely used network equipment.
What the OpenAI NASK partnership covers
NASK is a state-owned research institute based in Warsaw. It houses two bodies that matter here: its AI Safety Research Center, which acts as Poland's AI safety institute, and CERT Polska, the national team that responds to cyberattacks on Polish networks.
According to OpenAI's announcement, as summarised by Techi, the two sides will work on three things:
- Evaluating increasingly capable AI systems.
- Identifying vulnerabilities in those systems.
- Strengthening safeguards before and after deployment.
Techi described the agreement as "a framework, not a program." Model-access terms and duration were not disclosed.
NASK director Radosław Nielek said the aim was to combine "our research expertise with OpenAI's technical capabilities" to anticipate risks and build public trust. Tom Duff Gordon, OpenAI's head of EMEA policy, said "Poland is home to exceptional scientists and technical talent," noting that many Polish researchers have helped lead OpenAI's own work.
The July pilot that came first
The partnership follows an earlier, narrower arrangement. On 2 July, NASK announced that it had received access to GPT-5.5 Cyber, a specialised OpenAI model for detecting and analysing cyber threats. Access came through OpenAI's Government Trusted Access for Cyber programme, which the company calls Daybreak. NASK said Poland was the third European country, and one of only a few worldwide, to receive it.
CERT Polska used the model for malware analysis, digital forensics and vulnerability discovery. The clearest result came from work on MikroTik RouterOS, the operating system that runs on routers used by many internet providers and businesses:
- The team found six vulnerabilities.
- Some could be chained together to take over affected devices without logging in.
- MikroTik released fixes, and CERT Polska said the patches blocked attacks it had already seen in the wild.
That is the only verifiable output of the relationship so far. It is also the kind of result governments say they want from frontier labs: AI used under supervision to find and close holes before attackers do.
Why national safety institutes matter to the labs
OpenAI's other named institute partners are the US Center for Advancing Standards and Innovation for Super Intelligence (CAISSI) and the UK AI Security Institute. The UK institute has been the most visible of the group. It recently worked with Anthropic on an alignment assessment, which we covered in our report on the Claude Mythos 5 incident.
For the labs, these partnerships do several jobs at once. They give outside testers early access, which supports the companies' claims that their models are checked before release. They also build relationships with governments that are writing the rules those models must follow.
For a country like Poland, the benefit is practical. CERT Polska defends networks that face regular attacks, and access to a specialised cyber model has already produced patched equipment. A formal research agreement could extend that from defensive security work into evaluating the models themselves.
The open questions
Several things are not yet clear from the published material.
Access and independence
Evaluations are only as useful as the access behind them. It is not known whether NASK will test models before release, what versions it will see, or whether it can publish its findings without OpenAI's approval.
How it fits EU rules
Poland is an EU member, and general-purpose AI providers now face obligations under the EU AI Act, enforced from Brussels by the AI Office. The announcement does not say how NASK's work with OpenAI relates to that system. A national institute testing a model is not the same as the EU regulator assessing compliance.
Measurable results
Techi noted that no verifiable deliverables have been named for OpenAI's US or UK partnerships either. Until the parties publish evaluation reports or vulnerability disclosures, the router flaws from July remain the main evidence of what the arrangement produces.
What to watch next
- Any joint evaluation report from NASK's AI Safety Research Center.
- Further vulnerability disclosures from CERT Polska credited to AI-assisted research.
- Whether other EU states sign similar agreements, and how the AI Office responds.
