Versions Google DeepMind · Frontier Safety Framework: 4 recorded versions, oldest first, published by Google DeepMind. A version is shown as replacing another only where a record says so. Date order alone never implies it.
2024-05-17 · published v1.0 2025-02-04 · published v2.0 2025-09-22 · published v3.0 2026-04-17 · published v3.1 (this version) Read the full document history of these frameworks → This version Replaces Frontier Safety Framework v3.1 replaces v3.0 in the publisher’s documented framework version sequence. 2026-04-17 · publication · Stated in source · Supported Inspect claim & evidence ↗ FSF · v3.0: document page → Official changelog Recorded change from the previous version FSF v3.1 introduces CBRN Tracked Capability Levels. 2026-04-17 · publication · Stated in source · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Threshold or trigger: Alert thresholds drawing on evaluations and other information v3.1 defines alert thresholds for CCLs that may draw on evaluation results, expert assessments and other sources of information and flag when a CCL may be reached before a critical capability assessment is conducted again; v3.0 defined alert thresholds for its early warning evaluations that flag when a CCL may be reached before a risk assessment is conducted again, with a separate note allowing the ML R&D alert threshold to be defined from information on Google DeepMind’s own ML R&D progress rather than evaluation scores. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Exception: Misuse deployment-mitigation criterion limited to external deployment v3.1's misuse deployment-mitigation criterion is stated to be required only for external deployment, not internal deployment or further development, and its ML R&D criterion for external and high-risk internal deployment; v3.0's misuse criterion was stated to be required only for external deployment, not further development, and its ML R&D criterion for external and large scale internal deployment. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Framework reviewed at least once a year v3.1 states that the Framework will be reviewed at least once a year; v3.0 stated that it will be updated at least once a year. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Who decides: Pre-deployment residual risk review by governance function v3.1 makes external deployments conditional on the appropriate governance function determining the residual risk to be acceptable, including a safety case where a CCL has been reached; v3.0 made them conditional on that function determining the safety case regarding each CCL the model has reached to be adequate. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Response plan may update the alert threshold v3.1 states that if risks remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate; v3.0 stated that where capabilities remain quite distant from a CCL, a response plan may involve adopting additional capability assessment processes to flag when heightened mitigations are required. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Provisions in this version · 8 quoted A limited selection of quoted provisions: what this edition says about thresholds, required actions, who decides and exceptions. It is not a full summary and says nothing about implementation. A “not found” record states which part of the edition was inspected. It is not a claim that the text was deleted.
Threshold or trigger Alert thresholds drawing on evaluations and other information “For CCLs, we define “alert thresholds,” which may draw on evaluation results, expert assessments, and other sources of information; that are designed to flag when a CCL may be reached before a critical capability assessment is conducted again.” PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, third paragraph, second sentence Inspect claim & evidence ↗ Required action Framework reviewed at least once a year “The Frontier Safety Framework will be reviewed at least once a year” PDF p. 17 (printed p. 17), §5.1 Updates, first sentence Inspect claim & evidence ↗ Required action Proximity and risk assessment informing a response plan “When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.” PDF p. 6 (printed p. 6), §1.3.3 Risk Mitigation, second paragraph, first two sentences Inspect claim & evidence ↗ Required action Response plan may update the alert threshold “However, if we assess that risks stemming from the model remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate.” PDF p. 6 (printed p. 6), §1.3.3 Risk Mitigation, second paragraph, fourth sentence Inspect claim & evidence ↗ Who decides Information sharing with government authorities “If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.” Decides: Google DeepMind · Informed: Appropriate government authorities PDF p. 17 (printed p. 17), §5.2 Disclosures, first sentence Inspect claim & evidence ↗ Who decides Pre-deployment residual risk review by governance function “Pre-deployment review of residual risk assessment: external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).” Decides: Appropriate governance function PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, numbered step 2, first sentence Inspect claim & evidence ↗ Exception Misuse deployment-mitigation criterion limited to external deployment “This is required only for external deployment, not internal deployment or further development.” PDF p. 7 (printed p. 7), §1.3.5 Risk Acceptance Determination, misuse T/CCL bullet, first sub-bullet, final sentence Inspect claim & evidence ↗ Exception Low-risk external deployments may skip critical capability assessment “may not be conducted for low-risk external deployments (e.g. to a small number of trusted testers) if the appropriate governance function determines the residual risk of such deployments to be acceptable even if the model has reached a T/CCL (including with a safety case where a CCL has been reached).” PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, footnote 4 Inspect claim & evidence ↗ Issue and authorship records Issued by: Google DeepMind Google DeepMind published Frontier Safety Framework v3.1, identified by its publication date of 2026-04-17. 2026-04-17 · publication · Stated in source · Supported Inspect claim & evidence ↗ Google DeepMind: institution → Documentary relations Each relation is listed separately. Citing, crediting and reporting the use of a method are different acts, and none of them shows agreement or influence by itself.
Not recorded for this document: cites · cited by · explicitly credits · reports using a method from · method reported as used by · applies parts of · parts applied by · discusses · reports evaluation of. A missing record does not show that the relation does not exist.