Versions Google DeepMind · Frontier Safety Framework: 4 recorded versions, oldest first, published by Google DeepMind. A version is shown as replacing another only where a record says so. Date order alone never implies it.
2024-05-17 · published v1.0 2025-02-04 · published v2.0 (this version) 2025-09-22 · published v3.0 2026-04-17 · published v3.1 Read the full document history of these frameworks → This version Replaces Frontier Safety Framework v2.0 replaces v1.0 in the publisher’s documented framework version sequence. 2025-02-04 · publication · Stated in source · Supported Inspect claim & evidence ↗ FSF · 2024: document page → Replaced by Frontier Safety Framework v3.0 replaces v2.0 in the publisher’s documented framework version sequence. 2025-09-22 · publication · Stated in source · Supported Inspect claim & evidence ↗ FSF · v3.0: document page → Publisher statement Recorded change from the previous version FSF v2.0 introduces recommended security levels for Critical Capability Levels. 2025-02-04 · publication · Stated in source · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Response plan may put deployment or development on hold v2.0 states that where a model flagged by an alert threshold is assessed to pose risks for which readily available mitigations may not be sufficient, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied; v1.0 stated that if a model reached evaluation thresholds before mitigations at appropriate levels were ready, Google DeepMind would put further deployment or development on hold or implement additional protocols. 2025-02-04 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Proximity and risk assessment informing a response plan v2.0 states that on reaching an alert threshold for a CCL the model's proximity to the CCL is assessed and the risk analysed, involving internal and external experts as needed, to inform the formulation and application of a response plan; v1.0 stated that on reaching evaluation thresholds a response plan would be formulated based on the analysis of the CCL and evaluation results. 2025-02-04 · publication · Inferred · Supported Inspect claim & evidence ↗ Publisher statement Change recorded in v3.0 FSF v3.0 introduces a Critical Capability Level for harmful manipulation. 2025-09-22 · publication · Stated in source · Supported Inspect claim & evidence ↗ FSF · v3.0: document page → Inferred document comparison Change recorded in v3.0 v3.0’s alert thresholds for its early warning evaluations are designed to flag when a CCL may be reached before a risk assessment is conducted again, and its Note on Machine Learning R&D CCLs adds that the alert threshold may be defined based on sources of information about Google DeepMind’s own progress at accelerating ML R&D, rather than on evaluation scores; v2.0’s alert threshold flagged when a CCL may be reached before the evaluations are run again, and v2.0 contains no such note. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.0: document page → Inferred document comparison Change recorded in v3.0 v3.0 aims to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI; v2.0 aimed to share information with them where it will facilitate the development of safe AI. The triggering assessment (a CCL posing an unmitigated and material risk to overall public safety) is worded the same. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.0: document page → Inferred document comparison Change recorded in v3.0 v3.0 makes external deployments of a model conditional on the appropriate governance function determining the safety case for each CCL reached to be adequate; v2.0 made general availability deployment conditional on the appropriate corporate governance body making that determination. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.0: document page → Inferred document comparison Change recorded in v3.0 v3.0's example for adjusting recommended security levels refers to models with capabilities not meaningfully different from other publicly available models that have weaker security applied, adding that the marginal benefit of higher security is then limited; v2.0's example referred to other widely available models that have not demonstrably caused or contributed to severe risks. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.0: document page → Provisions in this version · 8 quoted · 2 not found A limited selection of quoted provisions: what this edition says about thresholds, required actions, who decides and exceptions. It is not a full summary and says nothing about implementation. A “not found” record states which part of the edition was inspected. It is not a claim that the text was deleted.
Threshold or trigger Early warning evaluations with an alert threshold “we will define a set of evaluations called “early warning evaluations,” with a specific “alert threshold” that flags when a CCL may be reached before the evaluations are run again.” PDF p. 3 (printed p. 3), Framework, component “2 - Assessing the Capabilities of Frontier Models”, second paragraph, first sentence Inspect claim & evidence ↗ Required action Response plan may put deployment or development on hold “If this happens, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied.” PDF p. 3 (printed p. 3), Framework, component “3 - Applying Mitigations”, third paragraph, second sentence Inspect claim & evidence ↗ Required action Proximity and risk assessment informing a response plan “When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.” PDF p. 3 (printed p. 3), component “3 - Applying Mitigations”, first paragraph, first two sentences Inspect claim & evidence ↗ Who decides Disclosure to government authorities “If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share information with appropriate government authorities where it will facilitate the development of safe AI.” Decides: Google DeepMind · Informed: Appropriate government authorities Governance and Accountability, “Disclosure”, first sentence: PDF p. 8 in the Internet Archive capture of 2025-02-05; PDF pp. 7–8 in the served file, where a page break and footnote 14 interrupt the sentence after “facilitate the” Inspect claim & evidence ↗ Who decides Pre-deployment safety case review by corporate governance body “Pre-deployment review of safety case: general availability deployment8 of a model takes place only after the appropriate corporate governance body determines the safety case regarding each CCL the model has reached to be adequate.” Decides: Appropriate corporate governance body PDF p. 4 (printed p. 4), Misuse, Mitigation Approach, “Deployment Mitigations”, numbered step 2 Inspect claim & evidence ↗ Who decides Corporate governance bodies approve response plans “For Google models, when alert thresholds are reached, the response plan will be reviewed and approved by appropriate corporate governance bodies such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council.” Decides: Appropriate corporate governance bodies, such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council PDF p. 7 (printed p. 7), Governance and Accountability, “Governance” paragraph, first sentence Inspect claim & evidence ↗ Exception Adoption of protocols may depend on industry-wide adoption “our adoption of the protocols described in this Framework may depend on whether such organizations across the field adopt similar protocols.” PDF p. 1 (unnumbered), opening section, paragraph beginning “The safety of frontier AI systems is a global public good”, last sentence, final clause Inspect claim & evidence ↗ Exception Recommended security levels may be adjusted “This may occur if, for example, a model does not possess capabilities meaningfully different from other widely available models that have not demonstrably caused or contributed to severe risks,” PDF p. 5 (printed p. 5), Misuse, Misuse Critical Capability Levels, paragraph beginning “These recommended security levels”, second sentence Inspect claim & evidence ↗ Not found in the inspected text Autonomy level 1 CCL Inspected: Whole document in both copies (2025-02-05 capture PDF pp. 1–8; served copy PDF pp. 1–9), including Table 1 (Misuse CCLs, PDF pp. 5–6), Table 2 (Deceptive Alignment CCLs, PDF p. 7) and all footnotes Inspect claim & evidence ↗ Not found in the inspected text Evaluation every 6x effective compute and 3 months’ fine-tuning Inspected: Whole document in both copies (2025-02-05 capture PDF pp. 1–8; served copy PDF pp. 1–9): all sections, Tables 1–2, footnotes and the served copy’s Updates and changes page Inspect claim & evidence ↗ Issue and authorship records Issued by: Google DeepMind Google DeepMind published Frontier Safety Framework v2.0, identified by its publication date of 2025-02-04. 2025-02-04 · publication · Stated in source · Supported Inspect claim & evidence ↗ Google DeepMind: institution → Documentary relations Each relation is listed separately. Citing, crediting and reporting the use of a method are different acts, and none of them shows agreement or influence by itself.
Not recorded for this document: cites · cited by · explicitly credits · reports using a method from · method reported as used by · applies parts of · parts applied by · discusses · reports evaluation of. A missing record does not show that the relation does not exist.