Compare frameworks

Stated

• Paraphrase: The “Non-novel chemical/biological weapons production” row of the threshold table concerns AI systems able to give significant help to people with a basic technical background in making or obtaining and deploying chemical or biological weapons with serious catastrophic potential.

  PDF p. 6, §1 Our Recommendations for Industry-Wide Safety, threshold table, row 'Non-novel chemical/biological weapons production', left column ('Capability or usage threshold')

Note: Chemical and biological weapons are named in two threshold rows (“Non-novel” and “Novel chemical/biological weapons production”); v3.3 redefined the novel row as AI systems that can stand in functionally for the scarce specialist expertise that is the main barrier to developing novel weapons (see “Stated changes from the previous edition”). Radiological and nuclear weapons are not named as thresholds; “CBRN” appears only in changelog entries about earlier versions.

Stated

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and in “machine learning R&D and misalignment”.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

Note: One CCL (CBRN uplift level 1) and one TCL (CBRN uplift TCL), PDF p. 11.

Stated

• Paraphrase: The edition says the Framework currently concentrates on catastrophic risk in three areas: chemical and biological, cybersecurity, and “Loss of Control”.

  PDF p. 1 (unnumbered opening page), second paragraph, second sentence

• Paraphrase: The edition says radiological and nuclear risks are further possible sources of risk from Frontier AI that have been identified.

  PDF p. 36 (printed p. 36), §4.2.4 Emerging Evaluations and Outcomes, 'Radiological and nuclear', first sentence

Note: Chemical and biological risks are tracked with outcomes CB 1–CB 3 (§3.4.2). Radiological and nuclear risks are placed under 'Emerging Evaluations and Outcomes': outcomes that the edition says cannot yet be incorporated because ways of evaluating them are still nascent. No threshold is set for them.

Stated

• Paraphrase: The edition lists chemical, biological, radiological and nuclear (“CBRN”) weapons as a tracked high-risk capability: a model's ability to give an actor significant uplift in developing and deploying such a weapon.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', first bullet

Note: Capability thresholds for low, medium, high and critical are set in Appendix I (PDF p. 12).

Stated

• Paraphrase: The edition says its processes for assessing and mitigating systemic risk span key risk categories, among them “cybersecurity”, “CBRN” (chemical, biological, radiological and nuclear), “harmful manipulation” and “loss of control risks”.

  PDF p. 3 (printed p. 01), §1 Introduction, second paragraph, second sentence

• Paraphrase: The edition says OpenAI builds its safeguards principally against biological and chemical threats.

  PDF p. 10 (printed p. 08), §2.4 Risk tiers › 'CBRN', first paragraph, second sentence

Note: CBRN has a three-tier table (PDF pp. 10–11). For nuclear and radiological threats the edition states continued research and development of threat models rather than tiers specific to them.

Stated

• Paraphrase: The edition lists Biological and Chemical capabilities as a Tracked Category, describing them as capabilities that can also make it easier to create and use biological or chemical weapons.

  PDF p. 2 (printed p. 1), opening page, first bullet of the Tracked Categories list

• Paraphrase: The edition states that Nuclear and Radiological capabilities have become a Research Category.

  PDF p. 9 (printed p. 8), §2.3 Research Categories, box 'Changes to Tracked Categories in version 2', second paragraph

Note: Biological and chemical capability is a Tracked Category with High and Critical thresholds; nuclear and radiological capability is a Research Category without thresholds (Table 2 lists a potential response).

Stated

• Paraphrase: The edition names four primary risk domains, those it considers most likely to lead to significant or severe outcomes in present and future systems: “CBRN Risks”, “Offensive Cybersecurity Risks”, “Loss of Control Risks” and “Harmful Manipulation Risks”.

  PDF p. 2, §2.1 Risk Identification, third paragraph, first sentence

Note: Detailed in §2.1(a) 'Addressing CBRN Risks' (PDF pp. 3–4); no numeric threshold is stated.

Stated

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and in “machine learning R&D and misalignment”.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

Note: One CCL: Cyber uplift level 1 (Table 2.2.2.a, PDF p. 12).

Stated

• Paraphrase: The edition says the Framework currently concentrates on catastrophic risk in three areas: chemical and biological, cybersecurity, and “Loss of Control”.

  PDF p. 1 (unnumbered opening page), second paragraph, second sentence

Note: Outcomes Cyber 1–3 (§3.4.1, PDF pp. 18–20) include large-scale compromise, discovery and exploitation of zero-day vulnerabilities, and scaled fraud, extortion and scams; operational thresholds are in §4.2.1.

Stated

• Paraphrase: The edition lists “Offensive cyberoperations” as a tracked high-risk capability: a model's ability to give an actor significant uplift in carrying out cyberattacks that are highly disruptive or destructive, critical infrastructure included.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', second bullet

Note: Capability thresholds in Appendix I (PDF p. 13).

Stated

• Paraphrase: The edition says its processes for assessing and mitigating systemic risk span key risk categories, among them “cybersecurity”, “CBRN” (chemical, biological, radiological and nuclear), “harmful manipulation” and “loss of control risks”.

  PDF p. 3 (printed p. 01), §1 Introduction, second paragraph, second sentence

Note: Listed as 'Cyber offense' among the systemic risk categories (PDF p. 6), with a three-tier table (PDF p. 9).

Stated

• Paraphrase: The edition lists Cybersecurity capabilities as a Tracked Category, describing them as capabilities that can also bring new risks of cyberattacks at scale and of exploiting vulnerabilities.

  PDF p. 2 (printed p. 1), opening page, second bullet of the Tracked Categories list

Stated

• Paraphrase: The edition names four primary risk domains, those it considers most likely to lead to significant or severe outcomes in present and future systems: “CBRN Risks”, “Offensive Cybersecurity Risks”, “Loss of Control Risks” and “Harmful Manipulation Risks”.

  PDF p. 2, §2.1 Risk Identification, third paragraph, first sentence

• Paraphrase: The edition says xAI treats malicious cyber offence accelerated by AI as a core risk domain.

  PDF p. 4, §2.1(c) 'Addressing Risks of Malicious Offensive Cybersecurity Usage', second paragraph, first sentence

Stated

• Paraphrase: The “Automated R&D in key domains” row of the threshold table concerns AI systems capable of fully automating, or dramatically speeding up, the work of large teams of leading human researchers in domains where rapid progress could threaten international security or quickly disrupt the global balance of power.

  PDF p. 8, §1, threshold table, row 'Automated R&D in key domains', left column, first sentence

Note: Named as a threshold row on automated R&D in key domains; the edition says its evaluations will for now focus on AI R&D. Autonomous, goal-directed operation appears as part of the “Misaligned AI systems in high-stakes settings” row (see “Other named domains”). No separate threshold for autonomous replication is set.

Stated

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and in “machine learning R&D and misalignment”.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

Note: Machine learning R&D is tracked in a combined “ML R&D and Misalignment” domain with ML R&D acceleration level 1 and ML R&D automation level 1 (Table 3.2.2.a, PDF p. 15) and the “Stealth and Situational Awareness TCL” (PDF p. 14).

Stated

• Paraphrase: The edition says the Framework currently concentrates on catastrophic risk in three areas: chemical and biological, cybersecurity, and “Loss of Control”.

  PDF p. 1 (unnumbered opening page), second paragraph, second sentence

• Paraphrase: For the outcome “Loss of Control 1”, the edition gives as a threat scenario that AI development speeds up so that new capabilities and behaviours appear faster than the organisation's evaluation processes.

  PDF pp. 22–23, §3.4.3 Loss of Control, table row 'Loss of Control 1', Potential Threat Scenario column

• Paraphrase: In the same row, the edition lists “Autonomous AI R&D” as an example enabling capability: the ability to complete, autonomously and consistently, tasks representative of a researcher's work to advance AI development.

  PDF pp. 22–23, §3.4.3 Loss of Control, table row 'Loss of Control 1', Example Enabling Capabilities column

Note: Meta names one domain, Loss of Control, which the edition frames as failures of critical control mechanisms (PDF p. 22). Its outcome Loss of Control 1 rests on autonomous AI research and development and evaluation awareness, which the edition lists as example enabling capabilities of a control failure rather than as domains of their own (PDF pp. 22–23), with capability checkpoints in §4.2.3; it is recorded here. Its outcome Loss of Control 2, AI undermining monitoring, is recorded under “Other named domains” under the “Risk domains covered” overlap rule. Self-exfiltration and autonomous replication appear only as illustrative emerging threat scenarios (PDF p. 38).

Stated

• Paraphrase: The edition lists “Advanced autonomy” as a tracked high-risk capability: a model's ability to carry out expert-level tasks on its own, AI research and development among them.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', third bullet

Note: Advanced autonomy has capability thresholds in Appendix I (PDF p. 14). Loss of control, a separately named tracked capability that the edition defines through deceptive and other mechanisms that undermine human control (PDF p. 4), is recorded under “Other named domains” under the “Risk domains covered” overlap rule.

Stated

• Paraphrase: The edition says its processes for assessing and mitigating systemic risk span key risk categories, among them “cybersecurity”, “CBRN” (chemical, biological, radiological and nuclear), “harmful manipulation” and “loss of control risks”.

  PDF p. 3 (printed p. 01), §1 Introduction, second paragraph, second sentence

• Paraphrase: The edition says that its loss-of-control risk tiers, apart from those for risks related to AI self-improvement, are still exploratory and may change substantially.

  PDF p. 12 (printed p. 10), §2.4 Risk tiers › 'Loss of control', first paragraph, final sentence

Note: The domain is framed as loss of control, with a three-tier table; self-improvement is named within it rather than as its own category.

Stated

• Paraphrase: The edition lists AI Self-improvement capabilities as a Tracked Category, describing them as capabilities that could also pose new challenges to humans controlling AI systems.

  PDF p. 2 (printed p. 1), opening page, third bullet of the Tracked Categories list

Note: AI Self-improvement is a Tracked Category. “Long-range Autonomy” and “Autonomous Replication and Adaptation” are named as Research Categories without thresholds (Table 2, PDF p. 8).

Stated

• Paraphrase: The edition names four primary risk domains, those it considers most likely to lead to significant or severe outcomes in present and future systems: “CBRN Risks”, “Offensive Cybersecurity Risks”, “Loss of Control Risks” and “Harmful Manipulation Risks”.

  PDF p. 2, §2.1 Risk Identification, third paragraph, first sentence

• Paraphrase: The edition describes loss-of-control risks as those arising when humans can no longer reliably direct, modify or switch off a model.

  PDF p. 1, §1 Introduction, third paragraph, third sentence

Note: The domain is framed as loss of control (described in the passage paraphrased here); autonomy, replication or automation of AI research and development are not named as separate tracked capabilities. §2.1(b) (PDF p. 4) describes oversight, training against deception and sycophancy, and sandboxed evaluation of agents.

Stated

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and machine learning R&D and misalignment.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

• Paraphrase: A note on harmful manipulation says both the CCL and the assessment of risk in this domain are exploratory and open to further research.

  PDF p. 12 (printed p. 12), §2.2.3 Harmful Manipulation, Note, second sentence

Note: One CCL marked exploratory: Harmful manipulation level 1 (Table 2.2.3.a, PDF p. 12).

Stated

• Paraphrase: The edition lists “Harmful manipulation” as a tracked high-risk capability: a model's ability to distort human behaviour or beliefs strategically and at scale.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', fifth bullet

Note: Named as a tracked high-risk capability. No thresholds are set: Appendix I says Microsoft is researching evaluation approaches and risk acceptance criteria for manipulation risk (PDF p. 15). Appendix I also says Microsoft prohibits use of its generative AI services in ways that include intentionally manipulating users' behaviour (PDF p. 15).

Stated

• Paraphrase: The edition says its processes for assessing and mitigating systemic risk span key risk categories, among them “cybersecurity”, “CBRN” (chemical, biological, radiological and nuclear), “harmful manipulation” and “loss of control risks”.

  PDF p. 3 (printed p. 01), §1 Introduction, second paragraph, second sentence

• Paraphrase: The edition says OpenAI's approach to harmful manipulation is still exploratory.

  PDF p. 11 (printed p. 09), §2.4 Risk tiers › 'Harmful manipulation', first sentence

Note: Named as one of the key risk categories and given its own section under §2.4 Risk tiers, without a tier table; the section calls the approach exploratory and says the tier needs more research and may change (PDF p. 11). §2.2 says risks are currently estimated for three categories (CBRN, cyber offense, loss of control), and that an approach for assessing harmful manipulation is at an early stage (PDF p. 7).

Stated

• Paraphrase: The edition names four primary risk domains, those it considers most likely to lead to significant or severe outcomes in present and future systems: “CBRN Risks”, “Offensive Cybersecurity Risks”, “Loss of Control Risks” and “Harmful Manipulation Risks”.

  PDF p. 2, §2.1 Risk Identification, third paragraph, first sentence

• Paraphrase: The edition refers to risks that models with high manipulative capabilities could be misused in a way that could reasonably cause large-scale harm.

  PDF p. 1, §1 Introduction, third paragraph, fourth sentence

Note: Named as “Harmful Manipulation Risks” (footnote 1 attributes the term to the EU General-Purpose AI Code of Practice); unlike the other three domains it has no dedicated subsection in §2.1.

Stated

• Paraphrase: The edition’s threshold table has a row titled “Misaligned AI systems in high-stakes settings”.

  PDF p. 7, §1, threshold table, row title, left column (“Capability or usage threshold”)

Note: A threshold row on sabotage by AI systems. Its industry-wide column calls for compartmentalization, monitoring, capability assessments and evidence on whether models tend to deceive, manipulate or sabotage their users.

Stated

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and in “machine learning R&D and misalignment”.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

Note: Misalignment is no longer a separate exploratory section; it is part of the combined “ML R&D and Misalignment” domain, tracked through the “Stealth and Situational Awareness TCL”, which the edition describes (PDF p. 14) as a baseline capability level above which misalignment risks may start to arise.

Stated

• Paraphrase: The edition names the outcome “Loss of Control 2” as losing the ability to monitor how AI behaves in operation, with the threat scenario that AI disables or corrupts monitors so as to reduce oversight and achieve its objectives.

  PDF p. 23, §3.4.3 Loss of Control, table row 'Loss of Control 2', Outcome and Potential Threat Scenario columns

• Paraphrase: The edition says physical autonomy is now a further, nascent outcome of Frontier AI.

  PDF p. 36 (printed p. 36), §4.2.4 Emerging Evaluations and Outcomes, 'Physical autonomy', first sentence

Note: Meta names one domain, Loss of Control, one of the three areas the edition says the Framework currently focuses on (PDF p. 1). Under the “Risk domains covered” overlap rule its outcome Loss of Control 2, defined through AI undermining monitoring, is recorded here; Loss of Control 1 (autonomous AI research and development) is recorded under “Autonomy, self-improvement or AI research and development”. Physical autonomy (second passage) is listed under 'Emerging Evaluations and Outcomes' with a sample outcome and threat scenario, not incorporated into the thresholds.

Stated

• Paraphrase: The edition lists “Loss of control” as a tracked high-risk capability: the ability of a model to undermine effective control by humans through adaptive, deceptive or self-reinforcing means, so that once deployed it can no longer reliably be directed, modified or shut down.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', fourth bullet

Note: A separately named tracked capability, recorded here under the “Risk domains covered” overlap rule because the edition defines it through deceptive mechanisms that undermine human control. No thresholds are set: Appendix I says Microsoft is researching evaluation approaches and risk acceptance criteria for loss of control risk (PDF p. 15).

Stated

• Paraphrase: The edition lists Undermining Safeguards as a Research Category: a model's ability and propensity to act so as to undermine the safeguards placed on it.

  PDF p. 8 (printed p. 7), Table 2 'Research Categories', fourth row

Note: Named as a Research Category, not a Tracked Category: the edition sets no thresholds for it. Table 2 also names Sandbagging as a Research Category; deception appears as an example within Undermining Safeguards.

Stated

• Paraphrase: The edition says the left column of its three-column table sets out the capability thresholds at which heightened mitigations would be needed.

  PDF p. 4, §1 Our Recommendations for Industry-Wide Safety, first paragraph

Note: The left column is headed “Capability or usage threshold” and has four rows with no ranking: non-novel chemical/biological weapons production; novel chemical/biological weapons production; “Misaligned AI systems in high-stakes settings”; automated R&D in key domains. Appendix B keeps “AI Safety Levels” (ASLs) only to refer to current levels of mitigation, not as a ladder of future capability levels.

Stated

• Paraphrase: The edition names two kinds of capability level: “Tracked Capability Levels (TCLs)”, at which models may pose significant risks, and “Critical Capability Levels (CCLs)”, at which they may pose severe risks.

  PDF p. 2 (printed p. 2), Overview, third paragraph, first sentence

• Paraphrase: The edition says it sets TCLs for CBRN risk and for ML R&D and misalignment risks.

  PDF p. 4 (printed p. 4), §1.2, last paragraph, third sentence

Note: Two tiers. CCLs: CBRN uplift level 1, Cyber uplift level 1, Harmful manipulation level 1 (exploratory), ML R&D acceleration level 1, ML R&D automation level 1. TCLs: CBRN uplift TCL, Stealth and Situational Awareness TCL. Alert thresholds are defined for CCLs (PDF p. 5); the text uses “T/CCL” for both tiers.

Stated

• Paraphrase: The edition says Meta reports its risk assessment of the model, for plausible contexts of deployment, at one of three levels: “critical”, “high”, or “moderate or lower”.

  PDF p. 8 (printed p. 8), §2.2.1 Preparedness Reports, fourth paragraph, second sentence (opening)

Note: Table 1 (PDF p. 15) has three rows (Critical, High, Moderate or lower) with the measures 'Develop with Mitigations', 'Deploy with mitigations' and 'Deploy'. The High row describes deployment that could make a substantial contribution to a threat scenario linked to a catastrophic outcome.

Stated

• Paraphrase: The edition says the framework assesses whether a tracked capability presents a risk to public safety or national security that is low, medium, high or critical.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, paragraph after the tracked-capabilities list, first sentence

Note: Low, medium, high and critical levels are defined in Appendix I for three of the five tracked capabilities: CBRN weapons, offensive cyberoperations and advanced autonomy (PDF pp. 12–14). For the other two (loss of control, harmful manipulation), Appendix I says evaluation approaches and risk acceptance criteria are being researched (PDF p. 15). For low and medium levels the deployment requirement allows deployment under the Responsible AI Program's requirements; for high and critical, further review and mitigations are required.

Stated

• Paraphrase: The edition says OpenAI has set up a system of tiers for cyber offense systemic risks, and introduces the table of those tiers.

  PDF p. 9 (printed p. 07), §2.4 Risk tiers › 'Cyber offense', introductory paragraph

Note: Tiers 1–3 are tabulated for cyber offense, CBRN and loss of control (PDF pp. 9–12); harmful manipulation has no tier table.

Stated

• Paraphrase: The edition defines High capability thresholds as capabilities that markedly raise existing vectors of risk for severe harm, and Critical capability thresholds as capabilities carrying a meaningful risk of a threat vector for severe harm that is qualitatively new and without ready precedent.

  PDF p. 5 (printed p. 4), §2.2 Tracked Categories, first paragraph

Note: Two levels, High and Critical, are defined for each Tracked Category in Table 1 (PDF pp. 6–7).

Stated

• Paraphrase: The edition defines CCLs as levels of capability at which frontier AI models or systems, absent mitigations, may present a heightened risk of severe harm.

  PDF p. 4 (printed p. 4), §1.2, first paragraph, second sentence

• Paraphrase: The glossary defines TCLs as levels of capability at which, without mitigations, such models or systems may present a heightened risk of harm that is significant but not severe.

  PDF p. 18, glossary, entry for Tracked Capability Levels

Note: Footnote 8 (PDF p. 11) says that in misuse T/CCLs “additional” harm is intended to mean harm beyond a baseline in which generative AI is absent.

Stated

• Paraphrase: The edition says Meta defines its thresholds by how far Frontier AI would make a substantial contribution to carrying out any identified threat scenario that could on its own lead to a catastrophic outcome.

  PDF p. 3 (printed p. 3), §1.1 Scope, third paragraph, first sentence (opening)

Note: Appendix I defines 'substantially contribute' as the model being a material factor in an outcome (PDF p. 42). The critical threshold also covers a model that could be the unique enabler of a threat scenario whose risk cannot be mitigated (PDF p. 26); 'uniquely enabling' is defined as the model being an essential controlling factor (PDF p. 42).

Stated

• Paraphrase: The edition says systemic risks are estimated, where appropriate and practicable, with risk tiers that describe in concrete terms what an AI system might help someone do, or might do itself, that could meaningfully increase the risk of severe harm.

  PDF p. 7 (printed p. 05), §2.2 Systemic risk analysis

Note: Tiers are defined per risk category in §2.4 (PDF pp. 9–12). Separately, §2.1 defines systemic risk by severity, including a model materially contributing to over 50 fatalities or $1 billion in property damage or losses from a single incident (PDF p. 5).

Stated

• Paraphrase: The edition says capability thresholds describe in concrete terms what an AI system might help someone do, or might do itself, that could meaningfully increase the risk of severe harm.

  PDF p. 5 (printed p. 4), §2.2 Tracked Categories, first paragraph, third sentence

Stated

• “We will maintain or improve on our ASL-3 protections, which include classifier guards at least as robust as our initial Constitutional Classifiers”

  PDF p. 6, §1, threshold table, row 'Non-novel chemical/biological weapons production', middle column ('Mitigations—our plan as a company')

Note: Company plans (middle column) are separated from industry-wide recommendations (right column), which the edition says it cannot unilaterally and unconditionally commit to. For the novel chemical/biological row the company column extends protections at least as strong as ASL-3 to more use cases; for the misaligned AI systems in high-stakes settings and Automated R&D rows it lists Risk Report disclosure, security and alignment projects rather than a named standard.

Stated

• “The following mitigation process for external deployments will be applied to models reaching a misuse T/CCL”

  PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, first sentence

• “We recommend a security level for each CCL”

  PDF p. 11 (printed p. 11), §2.2 Misuse Capability Levels, first paragraph, third sentence

Note: Recommended security levels: 'Security level 2+' (defined on PDF p. 9 as RAND SL2 plus insider-threat and non-state-actor measures) for CBRN, cyber and harmful manipulation CCLs; 3 and 4 for ML R&D CCLs. A parallel deployment process applies to ML R&D and Misalignment T/CCLs (§3.1.2). For the Stealth and Situational Awareness TCL, safeguards such as chain-of-thought monitoring are applied if residual risk from internal deployment is deemed unacceptable (PDF p. 14).

Stated

• “Proceed with deployment of the Frontier AI only if sufficient mitigations are defined, implemented and validated to reduce risk to that of a moderate or lower model.”

  PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1, High row, Measures column, under the label 'Deploy with mitigations'

Note: Table 1 also assigns security measures: heightened access controls to model weights for High and Critical (for Critical 'as overseen by the Chief AI Officer and/or Director of Alignment and Risk … insofar as is technically feasible and commercially practicable').

Stated

• “Models posing high-risk on one or more tracked high-risk capability will be subject to security measures protective against most cybercrime groups and insider threats.”

  PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph, first sentence

Note: Safety mitigations are applied 'so that the model’s risk level remains at low or medium once mitigations have been applied' (PDF p. 8); critical-risk models are subject to 'the highest level of security safeguards' (PDF p. 8).

Stated

• “OpenAI tailors these measures to the capability of a model and its deployment, as appropriate, to mitigate systemic risks to acceptable levels.”

  PDF p. 13 (printed p. 11), §2.5 Safety mitigations, first paragraph, second sentence

Note: No tier-by-tier safeguard requirements are stated; safeguards are tied to residual risk being within acceptable levels. Security mitigations are listed in §3 (PDF pp. 16–17).

Stated

• “Covered systems that cross this capability threshold are required to have robust and effective safeguards … before they are deployed and appropriate security controls as they are developed.”

  PDF p. 5 (printed p. 4), §2.2 Tracked Categories, first paragraph, sentence following the definition of High capability thresholds

Note: Refers to High thresholds. Table 1 lists risk-specific safeguard guidelines, and Appendix C gives illustrative safeguards and the security practices required for High capability models (PDF pp. 17–22).

Stated

• “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”

  PDF p. 17 (printed p. 17), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column

• “the commitments below do not preclude us from taking cautionary action, such as refraining from training or deploying models, in other circumstances.”

  PDF p. 17 (printed p. 17), Appendix A: Commitments Related to Competitors, introductory paragraph, second-to-last sentence

Note: Delay commitments are tied to Appendix A competitor scenarios (see “Provisions conditioned on other developers”); outside them the edition says it would 'strongly consider' pausing (conditional wording, added in v3.1). No passage commits to not training or deploying a model without adequate safeguards (the dataset records that provision as not found in this edition).

Stated

• “Pre-deployment review of residual risk assessment: external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).”

  PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, numbered step 2, first sentence

Note: A deployment gate: external deployment (and, under §3.1.2, high-risk internal deployment) takes place only after a governance determination that residual risk is acceptable. The misuse deployment-mitigation acceptance criterion is 'required only for external deployment, not internal deployment or further development' (PDF p. 7). No passage states that development will be put on hold.

Stated

• “Should either scenario arise, we will only continue development of the Frontier AI if our risk assessments are complete and safeguards are defined, implemented and validated to reduce risk to the moderate or lower risk threshold.”

  PDF p. 17 (printed p. 17), §3.3 Risk Thresholds, final sentence of the paragraph beginning on PDF p. 16 ('First, a Frontier AI meets the critical risk threshold…')

Note: Applies to either critical-threshold scenario. Development and deployment are conditioned on validated mitigations rather than stopped; for cyber, a model meeting the simple-suite threshold is provisionally rated high and 'such deployment will not be implemented' until complex evaluation is complete (PDF p. 29); the change log records the critical measure changing from 'Stop' to 'Develop with Mitigations' (see “Stated changes from the previous edition”).

Stated

• “If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.”

  PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentence

Note: The pause is tied to unmitigable risk rather than to reaching a level; high or critical models are 'subject to further review and safety and security mitigations prior to deployment' (PDF p. 7).

Stated

• “If residual risks associated with the model exceed acceptable risk levels, the model is not deployed unless additional mitigation measures are implemented that sufficiently minimize risk.”

  PDF p. 13 (printed p. 11), §2.5 Safety mitigations, first paragraph, third sentence

Note: The condition is residual risk relative to acceptable levels, not a named tier; the statement concerns deployment, not training.

Stated

• “We do not deploy models that reach a High capability threshold until the associated risks that they pose are sufficiently minimized.”

  PDF p. 4 (printed p. 3), §1 Introduction, third bullet ('Safeguard against severe harms'), second sentence

• “If a model under development reaches a Critical capability threshold, we also require safeguards to sufficiently minimize the associated risks during development, irrespective of deployment plans.”

  PDF p. 4 (printed p. 3), §1 Introduction, third bullet

Note: The deployment statement is conditioned on risks being 'sufficiently minimized'. §4.3 allows adjustment of required safeguards under stated conditions (see the competitor facet).

Stated

• “xAI will only proceed with the development, the making available on the market, and/or the use of the model, if the systemic risks stemming from the model are determined to be acceptable.”

  PDF p. 6, first §2.3 'Systemic risk acceptance determination', fourth paragraph, first sentence

Stated

• “CEO and RSO will make the ultimate determination regarding the adequacy of the risk assessment and any downstream deployment or development plans.”

  PDF p. 13, §3.4 Procedures, item 3 ('Executive approval'), second sentence

Note: The determination is tied to approval of a Risk Report rather than to a per-threshold capability or safeguards determination. The RSO's duties also include approving relevant model development or deployment decisions (§4, item 1).

Stated

• “Pre-deployment review of residual risk assessment: external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).”

  PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, numbered step 2, first sentence

Note: The 'appropriate governance function' is not named. The same function may also exempt low-risk external deployments from a critical capability assessment (see “Other exceptions or discretion”).

Stated

• “Based on this pre-mitigation risk assessment, the Chief AI Officer and Director of Alignment and Risk2 will assign a risk threshold.”

  PDF p. 6 (printed p. 6), §2.1.2 Evaluate and Mitigate, 'Evaluate for performance and safety', paragraph beginning 'These assessments typically use a version of the Frontier AI', second sentence

• “Informed by this analysis, the Chief AI Officer or the Director of Alignment and Risk will determine whether to request further testing or information, require additional mitigations or improvements, or approve the model for deployment.”

  PDF p. 7 (printed p. 7), §2.1.3 Decide, 'Make a decision on deployment', second sentence

Note: Threshold assignment names both officers ('and'); the deployment decision names either ('or'). §2.3 adds that deployment follows 'with the approval of the Chief AI Officer' (PDF p. 10).

Stated

• “The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.”

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentence

Note: No named role assigns the pre-mitigation score; the Executive Officers are those 'responsible for Microsoft’s AI governance program'.

Stated

• “OpenAI Leadership can approve or reject these recommendations, and our Board’s Safety and Security Committee provides oversight of these decisions.”

  PDF p. 4 (printed p. 3), §1 Introduction, final paragraph, second sentence

Note: The SAG reviews the Capabilities Report and decides on next steps (§3.3, PDF p. 10) and assesses whether safeguards sufficiently minimize risk (§4.2, PDF p. 11); Appendix B gives OpenAI Leadership (the CEO or a designee) all final decisions, including deployment go/no-go (PDF p. 16).

Stated

• “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”

  PDF p. 14 (printed p. 14), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')

• “In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.”

  PDF p. 14 (printed p. 14), §3.6 External Review, final paragraph before §3.6.1

Note: Otherwise the CEO and RSO share their decision(s), the Risk Report and internal feedback with the Board and LTBT after approval (§3.4 item 4). External reviewers of Risk Reports are selected with the Board consulted and LTBT approval required (from v3.2) and asked to publish commentary (§3.6); an approximately annual third-party review of procedural compliance is commissioned (§4).

Stated

• “The board of directors of OpenAI Ireland Limited exercise systemic risk oversight under this Framework for EU purposes.”

  PDF p. 20 (printed p. 18), §6 Allocation of responsibility for risk management, final paragraph

Note: Material updates to the Framework go to the OpenAI Foundation board's Safety and Security Committee and the OpenAI Ireland Limited board for oversight (§7.1, PDF p. 21).

Stated

• “OpenAI Leadership can approve or reject these recommendations, and our Board’s Safety and Security Committee provides oversight of these decisions.”

  PDF p. 4 (printed p. 3), §1 Introduction, final paragraph, second sentence

• “Where necessary, the Board may reverse a decision and/or mandate a revised course of action.”

  PDF p. 16 (printed p. 15), Appendix B 'Decision-making practices', paragraph on the Safety and Security Committee, final sentence

Stated

• Paraphrase: Google DeepMind conducts a critical capability assessment before a new frontier AI model’s first external deployment; under footnote 4, one may be skipped for a low-risk external deployment if the appropriate governance function finds its residual risk acceptable, even at a reached T/CCL (with a safety case at a CCL).

  PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, first paragraph, second sentence, and footnote 4

Note: Material capability change assessments are run on various checkpoints once a post-training run is completed (PDF p. 5). For later versions deployed externally, Google DeepMind decides if another critical capability assessment is needed where a model shows meaningful new capabilities or a material increase in performance and it believes these could materially undercut its justification for accepting the risks. No compute or calendar interval is stated. Footnote 4 (PDF p. 5) says the assessment may be skipped for low-risk external deployments, such as to a few trusted testers, if the governance function finds the residual risk acceptable, even where a T/CCL has been reached.

Stated

• Paraphrase: The edition says Meta typically repeats evaluations when a Frontier AI model is close to finishing, or has finished, training.

  PDF p. 26 (printed p. 26), §4.2 Evaluation and mitigation, sixth paragraph, first sentence

Note: The edition also says monitored indicators during development trigger further evaluations (PDF p. 5), preliminary assessments precede controlled deployments (PDF p. 8), and residual risk is assessed before deployment (PDF p. 6).

Stated

• Paraphrase: The edition says the leading indicator assessment runs at four points: during pre-training, once pre-training has finished, after post-training, and before deployment.

  PDF p. 6 (printed p. 5), §3 Evaluation and assessment, second paragraph, first sentence

• Paraphrase: The edition says that, once a first deeper capability assessment has been done, Microsoft will repeat such assessments if the risk profile of the deployed model changes materially, giving fine-tuning as an example.

  PDF p. 7 (printed p. 6), §3, Deeper capability assessment, 'Timing of deeper capability assessment'

Note: Leading indicator assessment applies to models in scope of frontier-model laws (EU AI Act, TFAIA, RAISE Act) and to substantial fine-tuning, and the edition says models in scope undergo it at least every six months (PDF p. 6).

Stated

• Paraphrase: The edition states that models within the Framework's scope go through a suite of scalable evaluations before deployment.

  PDF p. 8 (printed p. 06), §2.3 Systemic risk acceptance determination, second paragraph, first sentence

Note: §2.2 states that risk assessment may happen at any stage of a model's lifecycle (PDF p. 7); §4 describes lighter-touch evaluations at trigger points and a decision every six months on whether the Model Report needs updating (PDF p. 18).

Stated

• Paraphrase: The edition states that every covered model goes through the suite of Scalable Evaluations before deployment.

  PDF p. 10 (printed p. 9), §3.3 Capability threshold determinations, first sentence

Note: Coverage is triggered by deployments (§3.2 lists covered deployments); a checkpoint during development is covered when forecasts and threat models justify it (PDF p. 10). No compute-interval trigger is stated.

Stated

• Paraphrase: The edition says xAI will carry out, at least once a year, a full process of systemic risk assessment and mitigation for its frontier models.

  PDF p. 2, §2 Risk Management Framework, second paragraph, first sentence

• Paraphrase: The edition says these evaluations are performed before wider deployment of xAI's models.

  PDF p. 6, first §2.3 'Systemic risk acceptance determination', first paragraph (continued from PDF p. 5), second sentence

Note: The edition says smaller-scale evaluations may also be run at listed trigger points: an updated model release, a serious incident, materially increased risk from use or integration, or a material change in the basis for acceptability (PDF p. 2).

Stated

• “we will meet or exceed the overall risk reduction posture of these competitors”

  PDF p. 17, Appendix A, table row 'Competitors have strong safety measures', Commitment column, first sentence

• “We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.”

  PDF p. 17, Appendix A, table row 'General upleveling', Commitment column, second sentence

Note: Appendix A ('Commitments Related to Competitors') has three scenarios; the 'Anthropic in the lead' delay is recorded under “Pause, non-deployment or non-training”. §1 says Anthropic cannot unilaterally and unconditionally commit to the industry-wide recommendations, framing the change as a collective action problem. Where a decision relies on marginal risk analysis, Risk Reports add a competitive landscape analysis (§3.3) and need Board and LTBT approval (§3.4).

Stated

• “if other models are similarly capable and have few mitigations, then the marginal risk added by our external deployment is likely low”

  PDF p. 7 (printed p. 7), §1.3.5 Risk Acceptance Determination, misuse T/CCL bullet, first sub-bullet, parenthetical example

• “a model does not possess capabilities meaningfully different from other publicly available models that have weaker security applied”

  PDF p. 11 (printed p. 11), §2.2 Misuse Capability Levels, second paragraph, second sentence

Stated

• “another frontier AI model developer might develop or release a system with High or Critical capability … without instituting comparable safeguards”

  PDF p. 13 (printed p. 12), §4.3 Marginal risk, first paragraph, first sentence

• “If we are able to rigorously confirm that such a scenario has occurred, then we could adjust accordingly the level of safeguards that we require in that capability area, but only if:”

  PDF p. 13 (printed p. 12), §4.3 Marginal risk, first paragraph

Stated

• “not hard commitments but rather public goals”

  PDF p. 3, Introduction, paragraph on Frontier Safety Roadmaps, final sentence

• “making judgment calls on policy interpretation and application”

  PDF p. 16, §4 Governance, item 1 ('Responsible Scaling Officer'), duty (6)

Note: Further room for judgement: Appendix A says Anthropic will often have to use its best judgment on whether a competitor scenario applies; Risk Reports may record deviations from described mitigations (§3.2); redactions may be made for listed reasons 'not limited to' those (§3.5); a report is 'significantly redacted' in the judgment of the RSO, CEO, Board or LTBT (§3.6).

Stated

• “A critical capability assessment may not be conducted for low-risk external deployments (e.g. to a small number of trusted testers)”

  PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, footnote 4

Note: §1.3.3 (PDF p. 6) says the specific mitigations implemented 'may be determined when a T/CCL is reached'. Security adequacy may also be assessed on other grounds than the recommended level (§1.3.5), and the closing Note says assessments 'will often involve some level of subjective analysis' (PDF p. 8).

Stated

• “Final deployment decisions may also consider additional factors beyond those covered in this Framework.”

  PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1, note below the Measures column, second sentence

Note: Other stated room for judgement: cyber capabilities may be made available 'to qualified and trusted customers where appropriate' (PDF p. 30); chemical and biological capabilities may be offered to trusted researchers 'with reduced mitigations via structured access controls' (PDF p. 33, research area), and non-material modifications are presumed to inherit the underlying model's threshold (PDF p. 17).

Stated

• “the marginal benefits of a model outweigh any residual risk”

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, first paragraph, numbered point 2)

Note: Point 2 is one element of the recommendation submitted for the deployment decision.

Stated

• “also reflects a holistic judgment based on the totality of available evidence”

  PDF p. 8 (printed p. 06), §2.3 Systemic risk acceptance determination, final paragraph, final sentence

• “We will not consider an update necessary if (1) the model’s capabilities have not materially changed since the last update”

  PDF p. 18 (printed p. 16), §4 Model reporting › 'Model report updates', final sentence

Stated

• “OpenAI Leadership can also make decisions without the SAG’s participation”

  PDF p. 16 (printed p. 15), Appendix B, SAG responsibilities, fifth bullet

Note: Other stated room for judgement: threshold determinations reflect 'holistic judgment' (PDF p. 10); footnote 6 states that distilled, fine-tuned or quantized models from a model below High will ordinarily not require additional safety measures (PDF p. 10); disclosures may be redacted or summarized (PDF p. 14).

Stated

• “The final decision also reflects an overall judgment based on all the available evidence”

  PDF p. 6, first §2.3 'Systemic risk acceptance determination', third paragraph, third sentence

• “xAI may change its approach from that listed above in order to make additional improvements.”

  PDF p. 7, second §2.3 'Safety mitigations', paragraph following the safeguards list, second sentence

Note: The December 2025 trusted-user and benefits-outweigh-benchmark clauses do not appear in this edition.

Stated

• Paraphrase: The edition says final Risk Reports without redactions will be shared with many Anthropic employees (at least 200).

  PDF p. 16, §4 Governance, item 3 ('Internal transparency')

• Paraphrase: The edition says Anthropic will brief the LTBT regularly on plans and developments relating to its Risk Reports, including model training.

  PDF p. 16, §4 Governance, item 2 ('Long Term Benefit Trust')

Note: Also: the Board receives quarterly updates on noncompliance reports (§4); the Frontier Safety Roadmap is shared with every full-time employee, the Board and the LTBT (§2); the CEO and RSO, once they have approved a Risk Report, share their decisions, the report and the internal feedback with the Board and the LTBT (§3.4).

Stated

• Paraphrase: The edition says that, under the reporting protocol, every report will in the end be submitted to three recipients: Meta's internal governance function, its “Chief AI Officer”, and its “Director of Alignment and Risk”.

  PDF p. 10 (printed p. 10), §2.3.1 Reporting, second sentence

Note: Refers to employee reports of non-compliance under a protocol that the edition says Meta is developing.

Stated

• Paraphrase: The edition says documentation of the capability assessments before and after mitigation will go to the “Executive Officers” responsible for Microsoft's AI governance programme, or their delegates.

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, first paragraph

Note: The edition also says all employees are encouraged to raise concerns through internal channels, anonymously if they choose, and are protected from retaliation (PDF p. 10).

Stated

• Paraphrase: The edition says OpenAI will keep a record of relevant reports to the SAG and of the SAG's decisions and reasoning.

  PDF p. 13 (printed p. 12), §5.1 Internal governance, 'Internal Transparency', first sentence

Note: The same item says employees may ask for, and receive, a summary of testing results and of the SAG recommendation, subject to limits for highly sensitive information (PDF p. 13).

Stated

• Paraphrase: The edition says the results of xAI’s processes and measures for assessing and mitigating systemic risk will be documented.

  PDF p. 2, §2 Risk Management Framework, third paragraph

Note: No internal recipient is named. Employee escalation is listed as a channel for identifying incidents (PDF p. 8).

Stated

• Paraphrase: The edition says a public version of each Risk Report will be published.

  PDF p. 14, §3.5 Publication and Redactions, first sentence

• Paraphrase: The edition says the existence of every redaction in the public version will be disclosed.

  PDF p. 14, §3.5 Publication and Redactions, paragraph after the list of redaction reasons

Note: Also: the Frontier Safety Roadmap is published in redacted form (§2); external reviewers are asked to publish commentary within 30 days (§3.6.2); in the novel chemical/biological weapons row (PDF p. 7), the company column says threat-pathway content and policy recommendations will be shared with policymakers; where a noncompliance report is substantiated and involves a material safety risk, Anthropic “may” give public notice (§4).

Stated

• Paraphrase: The edition says that if Google DeepMind assesses a model as having reached a CCL presenting a material, unmitigated risk to public safety overall, it aims to give relevant information to appropriate government authorities where this will help frontier AI safety.

  PDF p. 17 (printed p. 17), §5.2 Disclosures, first sentence

Note: Conditional wording (“aim to”). The trigger refers to CCLs only, not TCLs.

Stated

• Paraphrase: The edition says Meta will publish, in a timely manner and in connection with deployment, a preparedness report for every closed or open release of Frontier AI.

  PDF p. 7 (printed p. 7), §2.2.1 Preparedness Reports, first sentence

Note: The edition also says Meta will, as appropriate, give relevant authorities a summary of its assessments of risk from internal use in an internal-use risk report (PDF p. 9), and will publish a model spec and the results of evaluations of adherence to it (§2.2.3, PDF p. 9).

Stated

• Paraphrase: The edition says Microsoft will share publicly information on the model’s capabilities and limitations, on relevant evaluations and on its risk classification, while taking care to protect commercially sensitive information and to minimise information hazards capable of creating safety and security risks.

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, third paragraph, first sentence

• Paraphrase: The edition says Microsoft will report information on tracked high-risk capabilities where regulation requires it and as appropriate for managing frontier risks effectively.

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, third paragraph, second sentence

Note: Public sharing is qualified in the same sentence: care is to be taken to minimise information hazards and to protect information that is commercially sensitive. The edition also says reports on serious or critical incidents go to regulatory authorities and affected customers as appropriate (PDF p. 9).

Stated

• Paraphrase: The edition says that, for models within the Framework’s scope, OpenAI also publishes details of the assessments in system cards or other reports when a model launches.

  PDF p. 18 (printed p. 16), §4 Model reporting, first paragraph, first and second sentences

• Paraphrase: The edition says that for an incident found to be reportable, OpenAI will collect information from its investigation and remediation to report to the appropriate authorities by the required deadlines.

  PDF p. 15 (printed p. 13), §2.6 › 'External reporting', second sentence

Note: The first paragraph of §4 says results are recorded in a “Safety and Security Model Report”, which is called 'Transparency Reports' under the TFAIA. §7.1 states that changelogs for material updates are published within 30 days (PDF p. 21); as publication of the framework itself, that is recorded under “Revision”, not here.

Stated

• Paraphrase: The edition says OpenAI will release information about its Preparedness Framework results for major deployments.

  PDF p. 13 (printed p. 12), §5.2 Transparency and external participation, 'Public disclosures', first sentence

Note: §4.3 lists public acknowledgement as one of the conditions for adjusting safeguards on marginal-risk grounds (PDF p. 13).

Stated

• Paraphrase: The edition says that, where applicable laws and regulations make an incident reportable, xAI will send the relevant authorities a copy of its incident report within the deadlines that apply.

  PDF p. 9, §3 Incident reporting, numbered item 4 (continued from PDF p. 8)

Note: External reporting is stated only for legally reportable incidents; the list of information that the December 2025 edition said xAI may publish does not appear.

Stated

• Paraphrase: The edition says the CEO and RSO will propose any change to the RSP, and the Board will approve it in consultation with the LTBT.

  PDF p. 16, §4 Governance, item 8 ('Policy changes'), first sentence

Note: The same item says updated versions will be published on or before their effective date, with the differences recorded in the Change Log. The Introduction describes the RSP as a living document to be updated continually, and §2 says Roadmap goals may change.

Stated

• Paraphrase: The edition says the Framework will be reviewed no less than once a year.

  PDF p. 17 (printed p. 17), §5.1 Updates, first sentence

• Paraphrase: The edition says the appropriate corporate governance bodies will review the updated version and the framework assessment.

  PDF p. 17 (printed p. 17), §5.1 Updates, last sentence

Stated

• Paraphrase: The edition says Meta will update the Framework at least every twelve months, or sooner on the stated trigger; the “Director of Alignment and Risk” and the “Chief AI Officer” are to confirm the update, which Meta will then publish.

  PDF p. 40 (printed p. 40), §5.1 Updates to our Framework, first paragraph, fourth to sixth sentences

Note: The same sentence names a further trigger: reasonable grounds to believe that the Framework's adequacy, or Meta's adherence to it, has been undermined in a material way. The edition says published updates will include a justification recorded in the change log.

Stated

• Paraphrase: The edition says Microsoft will discuss explicitly, at least every twelve months, how the framework may need improving.

  PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', second sentence

• Paraphrase: The edition says Microsoft's Chief Responsible AI Officer will review any updates to its practices before they are adopted.

  PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentence

• Paraphrase: The edition says every material revision will be published within 30 days of its adoption.

  PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fifth sentence

Note: The edition adds that material revisions may, where appropriate, be published at the time of adoption.

Stated

• Paraphrase: The edition says material updates will be presented for oversight to the OpenAI Foundation board's Safety and Security Committee and to OpenAI Ireland Limited's board of directors.

  PDF p. 21 (printed p. 19), §7.1 Update and approval process, fourth (final) sentence, up to 'for oversight'

• Paraphrase: The edition says a Framework Assessment will be completed by OpenAI at least every 12 months, counted from when the EU Code of Practice and the TFAIA took effect.

  PDF p. 22 (printed p. 20), §7.2 Framework assessment, first sentence

Note: Being presented for oversight is not stated as approval: the edition names no approver. §7.1 states that updates may be proposed by named officers and bodies, that the Legal function oversees the update process, and that changelogs for material updates are published within 30 days (PDF p. 21). The edition describes itself as overlapping with the Preparedness Framework, which OpenAI says it will keep using and developing (PDF p. 4).

Stated

• Paraphrase: The edition says OpenAI will review the Framework for continued sufficiency, and may update it, at least once a year.

  PDF p. 16 (printed p. 15), Appendix B, 'Updates to the Preparedness Framework', third sentence

Note: Appendix B (PDF p. 16): proposed changes to the Framework are reviewed by the SAG, whose recommendation is handled by the standard decision-making process, in which OpenAI Leadership makes final decisions.

Stated

• Paraphrase: The edition says xAI will review the framework periodically and expects significant changes as its models' capabilities expand.

  PDF p. 2, §1 Introduction, final paragraph, final sentence

Note: No review interval or approval body for revisions of the framework is stated; the edition says the Security Goal is to be reviewed at least every year (PDF p. 7).

Stated

• Paraphrase: The v3.4 changelog entry says the update makes five changes, the first being a revision of the Automated R&D capability threshold.

  PDF p. 20, Changelog, entry 'July 8, 2026 (RSP v3.4)', lead-in and item 1

• Paraphrase: Item 2 says fully unredacted Risk Reports must now go to at least 200 Anthropic employees, not to all staff with regular clearance.

  PDF p. 21, Changelog, entry 'July 8, 2026 (RSP v3.4)', item 2, first sentence

Note: Items 3–5 set a Risk Report coverage date that may be as much as 30 days before publication, require Anthropic to disclose publicly, in general terms, when it makes redactions in a published Risk Report, and allow external review to be split among reviewers provided every unredacted part is reviewed by at least one reviewer.

Stated

• Paraphrase: The Version 3.1 changelog entry says the edition introduced CBRN TCLs and outlined a process for mitigation and risk acceptance.

  PDF p. 17 (printed p. 17), §5.3 Past Updates and Changes, Version 3.1 (April 17, 2026), first bullet

• Paraphrase: The Version 3.1 changelog entry says the earlier exploratory Misalignment risk domain was folded into one domain, “ML R&D and Misalignment”.

  PDF p. 17 (printed p. 17), §5.3, Version 3.1, second bullet

Note: The changelog's remaining Version 3.1 entries: Security Level 2+ for the CCLs in the CBRN, Cyber and Harmful Manipulation domains, to protect against insider threats and actors other than states; more detail on the risk management process; a description of the internal governance structure; and a glossary.

Stated

• Paraphrase: The change log for version 2.0 says the primary standard for the high and critical thresholds changed from “uniquely enable” to “substantially contribute to”.

  PDF p. 44 (printed p. 44), Appendix II – Change log, entry 'April 7, 2026 (Advanced AI Scaling Framework v2.0)', sub-bullet 'Updated risk threshold language'

• Paraphrase: The same entry says the critical threshold's measure changed from “Stop” to “Develop with Mitigations” and the high threshold's measure from “Do not release” to “Deploy with mitigations”.

  PDF p. 44, same entry, sub-bullet 'Revised thresholds', first and second sentences

Note: The same change-log entry also records the rename from 'Frontier AI Framework', the addition of Loss of Control as a domain and of emerging areas (nuclear and radiological, physical autonomy), named decision-makers and incident response, transparency requirements, and a revised definition of Frontier AI.

Stated

• Paraphrase: The change log for February 2026 lists the addition of two tracked high-risk capabilities: harmful manipulation, and the loss of control.

  PDF p. 16 (printed p. 15), Appendix II – Change log, 'February 2026' row, first bullet

Note: The row describes a one-year update following the EU Code of Practice, the New York RAISE Act and California's TFAIA, and also lists adjusting the update cadence to regulatory obligations, aligning the framework's scope with regulations, adjusting the cadence of deeper capability assessment, defining substantially fine-tuned models, and other edits for clarity and transparency.

Stated

• Paraphrase: The change log states that the terms 'low' and 'medium' are dropped, because those two levels played no operational part in its Preparedness work.

  PDF p. 15 (printed p. 14), Appendix A 'Change log', item 2, final sentence

Note: The change log has 12 items (PDF pp. 15–16); others include introducing Research Categories (item 5), handling persuasion outside the Framework, moving Nuclear and Radiological to Research Categories, Capabilities and Safeguards Reports, deprioritising safety drills, the marginal-risk approach and the governance process.