Versions Google DeepMind · Frontier Safety Framework: 4 recorded versions, oldest first, published by Google DeepMind. A version is shown as replacing another only where a record says so. Date order alone never implies it.
2024-05-17 · published v1.0 2025-02-04 · published v2.0 2025-09-22 · published v3.0 (this version) 2026-04-17 · published v3.1 Read the full document history of these frameworks → This version Replaces Frontier Safety Framework v3.0 replaces v2.0 in the publisher’s documented framework version sequence. 2025-09-22 · publication · Stated in source · Supported Inspect claim & evidence ↗ FSF · v2.0: document page → Replaced by Frontier Safety Framework v3.1 replaces v3.0 in the publisher’s documented framework version sequence. 2026-04-17 · publication · Stated in source · Supported Inspect claim & evidence ↗ FSF · v3.1: document page → Publisher statement Recorded change from the previous version FSF v3.0 introduces a Critical Capability Level for harmful manipulation. 2025-09-22 · publication · Stated in source · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Threshold or trigger: Alert thresholds for early warning evaluations v3.0’s alert thresholds for its early warning evaluations are designed to flag when a CCL may be reached before a risk assessment is conducted again, and its Note on Machine Learning R&D CCLs adds that the alert threshold may be defined based on sources of information about Google DeepMind’s own progress at accelerating ML R&D, rather than on evaluation scores; v2.0’s alert threshold flagged when a CCL may be reached before the evaluations are run again, and v2.0 contains no such note. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Who decides: Information sharing with government authorities v3.0 aims to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI; v2.0 aimed to share information with them where it will facilitate the development of safe AI. The triggering assessment (a CCL posing an unmitigated and material risk to overall public safety) is worded the same. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Who decides: Pre-deployment safety case review by governance function v3.0 makes external deployments of a model conditional on the appropriate governance function determining the safety case for each CCL reached to be adequate; v2.0 made general availability deployment conditional on the appropriate corporate governance body making that determination. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Exception: Recommended security levels may be adjusted v3.0's example for adjusting recommended security levels refers to models with capabilities not meaningfully different from other publicly available models that have weaker security applied, adding that the marginal benefit of higher security is then limited; v2.0's example referred to other widely available models that have not demonstrably caused or contributed to severe risks. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ Official changelog Change recorded in v3.1 FSF v3.1 introduces CBRN Tracked Capability Levels. 2026-04-17 · publication · Stated in source · Supported Inspect claim & evidence ↗ FSF · v3.1: document page → Inferred document comparison Change recorded in v3.1 v3.1 defines alert thresholds for CCLs that may draw on evaluation results, expert assessments and other sources of information and flag when a CCL may be reached before a critical capability assessment is conducted again; v3.0 defined alert thresholds for its early warning evaluations that flag when a CCL may be reached before a risk assessment is conducted again, with a separate note allowing the ML R&D alert threshold to be defined from information on Google DeepMind’s own ML R&D progress rather than evaluation scores. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.1: document page → Inferred document comparison Change recorded in v3.1 v3.1's misuse deployment-mitigation criterion is stated to be required only for external deployment, not internal deployment or further development, and its ML R&D criterion for external and high-risk internal deployment; v3.0's misuse criterion was stated to be required only for external deployment, not further development, and its ML R&D criterion for external and large scale internal deployment. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.1: document page → Inferred document comparison Change recorded in v3.1 v3.1 states that the Framework will be reviewed at least once a year; v3.0 stated that it will be updated at least once a year. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.1: document page → Inferred document comparison Change recorded in v3.1 v3.1 makes external deployments conditional on the appropriate governance function determining the residual risk to be acceptable, including a safety case where a CCL has been reached; v3.0 made them conditional on that function determining the safety case regarding each CCL the model has reached to be adequate. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.1: document page → Inferred document comparison Change recorded in v3.1 v3.1 states that if risks remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate; v3.0 stated that where capabilities remain quite distant from a CCL, a response plan may involve adopting additional capability assessment processes to flag when heightened mitigations are required. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ FSF · v3.1: document page → Provisions in this version · 9 quoted · 3 not found A limited selection of quoted provisions: what this edition says about thresholds, required actions, who decides and exceptions. It is not a full summary and says nothing about implementation. A “not found” record states which part of the edition was inspected. It is not a claim that the text was deleted.
Threshold or trigger Alert thresholds for early warning evaluations “Central to our model evaluations are “early warning evaluations,” to assess the proximity of the model to a CCL. We define “alert thresholds” for these evaluations that are designed to flag when a CCL may be reached before a risk assessment is conducted again.” PDF p. 5 (printed p. 5), §1.3 Outline of Our Risk Assessment Process, “Analysis” bullet, first and second sentences Inspect claim & evidence ↗ Required action Framework updated at least once a year “The Frontier Safety Framework will be updated at least once a year” PDF p. 16 (printed p. 16), §5.1 Updates, first sentence Inspect claim & evidence ↗ Required action Proximity and risk assessment informing a response plan “When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.” PDF p. 6 (printed p. 6), §1.4 Response Plans and Mitigations, second paragraph, first two sentences Inspect claim & evidence ↗ Required action Response plan where capabilities remain distant from a CCL “Where model capabilities remain quite distant from a CCL, a response plan may involve the adoption of additional capability assessment processes to flag when heightened mitigations are required.” PDF p. 6 (printed p. 6), §1.4 Response Plans and Mitigations, second paragraph, third sentence Inspect claim & evidence ↗ Who decides Information sharing with government authorities “If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.” Decides: Google DeepMind · Informed: Appropriate government authorities PDF p. 16 (printed p. 16), §5.2 Disclosures, first paragraph, first sentence Inspect claim & evidence ↗ Who decides Pre-deployment safety case review by governance function “Pre-deployment review of safety case: external deployments of a model take place only after the appropriate governance function determines the safety case regarding each CCL the model has reached to be adequate.” Decides: Appropriate governance function PDF p. 9 (printed p. 9), §2.1.2 Deployment Mitigations, numbered step 2, first sentence Inspect claim & evidence ↗ Exception Alternative security adequacy assessment for risk acceptance “or we otherwise assess that the level of security applied is adequate, e.g. if they match or exceed the level of security applied to other models with similar capabilities or risk profiles, or we assess that the benefits of the open release of model weights outweigh the risks.” PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse-CCL bullet (begins PDF p. 6), second sub-bullet, from “or we otherwise assess” Inspect claim & evidence ↗ Exception Misuse deployment-mitigation criterion limited to external deployment “This is required only for external deployment, not further development.” PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse CCL bullet, first sub-bullet, final sentence Inspect claim & evidence ↗ Exception Recommended security levels may be adjusted “This may occur if, for example, a model does not possess capabilities meaningfully different from other publicly available models that have weaker security applied (in which case the marginal benefit of higher security is limited),” PDF p. 9 (printed p. 9), §2.2 Misuse Critical Capability Levels, second paragraph, second sentence Inspect claim & evidence ↗ Not found in the inspected text Putting deployment or development on hold pending mitigations Inspected: PDF pp. 1–16, all sections, tables and footnotes Inspect claim & evidence ↗ Not found in the inspected text Response plans approved by named corporate governance bodies Inspected: PDF pp. 1–16, all sections, tables and footnotes Inspect claim & evidence ↗ Not found in the inspected text Adoption of protocols dependent on industry-wide adoption Inspected: PDF pp. 1–16, all sections, tables and footnotes Inspect claim & evidence ↗ Issue and authorship records Issued by: Google DeepMind Google DeepMind published Frontier Safety Framework v3.0, identified by its publication date of 2025-09-22. 2025-09-22 · publication · Stated in source · Supported Inspect claim & evidence ↗ Google DeepMind: institution → Documentary relations Each relation is listed separately. Citing, crediting and reporting the use of a method are different acts, and none of them shows agreement or influence by itself.
Not recorded for this document: cites · cited by · explicitly credits · reports using a method from · method reported as used by · applies parts of · parts applied by · discusses · reports evaluation of. A missing record does not show that the relation does not exist.