Document history · 22 editions · 7 frameworks · Anthropic, Google DeepMind, OpenAI, xAI, Meta, Microsoft Frontier safety frameworks What did each developer’s published safety framework say, when, what replaced it, and what changed between editions?
Each framework below lists the editions recorded here, oldest first, with the date each edition is identified by. An edition is shown as replacing another only where a record documents it from the publisher’s own version sequence. Date order alone never implies replacement. Recorded changes are selected, sourced differences between two editions. They describe what the documents say. They do not show whether any requirement was implemented, followed or effective. Each edition also lists a limited set of quoted provisions: thresholds, required actions, who decides and stated exceptions. Where competent sources disagree about what a provision or change means, the disagreement is kept as a separate assessment record, marked contested or unresolved.
A machine selected and arranged these records. No human review of the selection or framing is recorded.
Download research starter Every edition, claim, qualification, coverage gap, open question and source reference on this page, with the location of each piece of evidence, stored paraphrases and permitted short quotes. The machine selection and each record’s review status are kept separate. Original documents are not included.
Download Markdown Download JSON
Original sources for a reference manager. Every source this export cites, for Zotero, EndNote and similar tools. Cite the original documents, not Selekoa, and check each entry against them.
Download BibTeX Download RIS Download CSL-JSON
Copy link to this history
Editions, 2023–2026 Each mark is one edition, placed at its effective date, or at its revision or publication date where no effective date is known. Select a framework or an edition to read it.
Anthropic · Responsible Scaling Policy v1.0 v2.0 v2.1 v2.2 v3.0 v3.1 v3.2 v3.3 v3.4 Google DeepMind · Frontier Safety Framework OpenAI · Preparedness Framework OpenAI · Frontier Governance Framework xAI · Frontier AI Framework Meta · Frontier AI / Advanced AI Scaling Framework Microsoft · Frontier Governance Framework Feb 2025 (Version 1) Feb 2026 Limits of this history A published framework shows what its publisher stated. It does not show implementation, compliance, effectiveness or relative safety. This page does not compare or rank developers. Recorded changes are a selection of documented differences. They are not a full list of amendments, and an edition with no recorded change has not been shown to be unchanged. Effective, publication and revision dates are kept apart. Each edition shows only the dates that have been established. A missing date is unknown. Editions are grouped by publisher and framework name for navigation. A different framework from the same publisher counts as a successor only where a record says so. Provisions are a limited, quoted selection for each edition, within the quotation policy’s limit for each document. They are not a full summary. An edition without a recorded provision has not been shown to lack it. A “not found” record states exactly which text was inspected and never claims that a provision was deleted. Contested records show competing assessments side by side. Secondary commentary is admitted only as evidence of the disagreement, and the page does not decide between the sides. Archived copies are the existing Internet Archive captures nearest each edition’s date. A capture shows only what the archive retrieved that day. It does not prove what the document said earlier, and it can differ from the copy checked for the evidence. Anthropic · Responsible Scaling Policy Published by Anthropic. 9 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 22 tracked provisions “Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
v1.0 Responsible Scaling Policy (2023) Effective 2023-09-19 · Published 2023-09-19 ↗ Exact edition text: Responsible Scaling Policy — v1.0 ↗ Archived copy, captured 2023-09-19: Responsible Scaling Policy — v1.0 ↗
Earliest edition of this framework recorded here.
Provisions · 8 quoted Threshold or trigger ASL-3 misuse capability: substantially increased catastrophic misuse risk “Access to the model would substantially increase the risk of deliberately-caused catastrophic harm, either by proliferating capabilities, lowering costs, or enabling new methods of attack. This increase in risk is measured relative to today’s baseline level of risk that comes from e.g. access to search engines and textbooks.” PDF p. 6 (printed p. 6), section 'ASL-3 Commitments', subsection 'ASL-3 Capabilities and Threat Models', numbered item 1 ('Capabilities that significantly increase risk of misuse catastrophe'), first and second sentences Inspect claim & evidence ↗ Required action Pause scaling or delay deployment when safety procedures lag “Anthropic’s commitment to follow the ASL scheme thus implies that we commit to pause the scaling2 and/or delay the deployment of new models whenever our scaling ability outstrips our ability to comply with the safety procedures for the corresponding ASL.” PDF p. 2 (printed p. 2), section 'Framework', paragraph beginning 'Complying with higher ASLs', second sentence Inspect claim & evidence ↗ Required action Pause training before capability outstrips Containment Measures “We commit to pause training before a model's capability level outstrips the Containment Measures we have implemented.” PDF p. 4 (printed p. 4), section 'Initial Commitments', numbered item 4 ('Evaluation protocol'), second sentence Inspect claim & evidence ↗ Who decides ASL evaluation results shared with board and LTBT “Share results of ASL evaluations promptly with Anthropic's governing bodies, including the board of directors and LTBT, in order to sufficiently inform them of changes to our risk profile.” Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 10 (printed p. 10), section 'Procedural Commitments', numbered item 6 Inspect claim & evidence ↗ Who decides Policy updates approved by board after LTBT consultation “Follow an "Update Process" for this document, including approval by the board of directors, following consultation with the Long-Term Benefit Trust (LTBT).” Decides: Board of Directors · Consulted: Long-Term Benefit Trust PDF p. 10 (printed p. 10), section 'Procedural Commitments', numbered item 1, first sentence Inspect claim & evidence ↗ Who decides CISO and CEO convened to decide on weight deletion “If the model has already surpassed the next ASL during training, immediately lock down access to the weights. Stakeholders including the CISO and CEO should be immediately convened to determine whether the level of danger merits deletion of the weights.” Decides: CISO (among convened stakeholders) · Decides: CEO (among convened stakeholders) PDF p. 13 (printed p. 13), section 'Evaluation Protocol', bullet 'Response policy', step (2c), first and second sentences Inspect claim & evidence ↗ Exception Emergency loosening of restrictions “we could envisage a substantial loosening of these restrictions as an emergency response. Such action would only be taken in consultation with governmental authorities, and the compelling case for it would be presented publicly to the extent possible.” PDF p. 10, Procedural Commitments, item 1 (“Update Process”), second sub-bullet, from the second half of the first sentence Inspect claim & evidence ↗ Exception Tiered access for vetted users “In limited cases, models with capabilities relevant to catastrophic harm may be made available to a select group of vetted users with a legitimate and beneficial use-case that cannot be separated from dangerous capabilities, and only if such access can be granted safely and with sufficient oversight.” PDF p. 9 (printed p. 9), section 'ASL-3 Commitments', subsection 'ASL-3 Deployment Measures', bullet 'Tiered access', first sentence Inspect claim & evidence ↗ Links itself to external commitments or laws Anthropic’s Responsible Scaling Policy v1.0 states that its ASL-2 deployment measures overlap substantially with the White House voluntary commitments that Anthropic and other companies made in July, which it says it continues to maintain. 2023-09-19 · effective · Stated in source · Supported Inspect claim & evidence ↗ Date basis and other records Placed on the timeline by its effective date. Initial public policy dated September 19, 2023; original entity and publication claim retained.
Anthropic RSP v1.0 says its commitments are designed in the spirit of the Responsible Scaling Policy framework being developed by Paul Christiano and ARC Evals. 2023-09-19 · publication · Stated in source · Supported Inspect claim & evidence ↗ The RSP announcement explicitly credited ARC Evals’ framework as inspiring Anthropic’s approach. 2023-09-19 · event · Stated in source · Supported Inspect claim & evidence ↗ v2.0 Anthropic Responsible Scaling Policy — v2.0 Effective 2024-10-15 ↗ publication day not established Exact edition text: Responsible Scaling Policy — v2.0 ↗ Archived copy, captured 2024-10-22: Responsible Scaling Policy — v2.0 ↗ Replaces v1.0 ↗
Recorded changes from v1.0 Inferred document comparison Provision · Threshold or trigger: CBRN weapons Capability Threshold v2.0's threshold concerns CBRN weapons specifically, defined as significant help to individuals or groups with basic technical backgrounds in creating/obtaining and deploying them; v1.0's ASL-3 misuse capability was defined as model access substantially increasing the risk of deliberately-caused catastrophic harm generally, measured against a search-engine and textbook baseline. 2024-10-15 · effective · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Pause training until ASL-3 Security Standard implemented v2.0 makes the training pause conditional on a model in pretraining reaching capabilities comparable to or greater than a model that requires the ASL-3 Security Standard and continues it until that standard is implemented and established as sufficient for the model, within §6.2, which applies where a model requires the ASL-3 Required Safeguards but Anthropic is unable to implement them immediately; v1.0 committed to pause training before a model’s capability level outstrips the Containment Measures Anthropic has implemented. 2024-10-15 · effective · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Who decides: Policy changes proposed by CEO and RSO, approved by Board v2.0 states that policy changes are proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors in consultation with the LTBT; v1.0's Update Process named approval by the board of directors following consultation with the LTBT and named no proposer. 2024-10-15 · effective · Inferred · Supported Inspect claim & evidence ↗ Assessed effect Unresolved Did RSP v2.0’s changes to threshold and mitigation specification reduce the verifiability of Anthropic’s safety commitments relative to v1.0? 2024-10-15 · effective · Question posed by Selekoa · Unresolved Inspect claim & evidence ↗ Official changelog RSP v2.0 changes “ASL” to refer to groups of safeguards, rather than also referring to models. 2024-10-15 · effective · Stated in source · Supported Inspect claim & evidence ↗ Provisions · 9 quoted · 1 not found Threshold or trigger CBRN weapons Capability Threshold “The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.” PDF p. 7 (printed p. 3), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', Capability Thresholds column Inspect claim & evidence ↗ Required action Commitment not to train or deploy without adequate safeguards “In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.” PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentence Inspect claim & evidence ↗ Required action Pause training until ASL-3 Security Standard implemented “If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.” PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence Inspect claim & evidence ↗ Required action Restrict deployment and scaling if safeguards showing fails “If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.” PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the bulleted process) Inspect claim & evidence ↗ Who decides CEO and RSO deployment decision shared with Board and LTBT “If the CEO and RSO decide to proceed with deployment and training, they will share their decision–as well as the underlying Capability Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.” Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 13 (printed p. 9), §4.3 Safeguards Decision, fourth bullet Inspect claim & evidence ↗ Who decides Policy changes proposed by CEO and RSO, approved by Board “Changes to this policy will be proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors, in consultation with the Long-Term Benefit Trust.” Recommends: CEO · Recommends: Responsible Scaling Officer · Decides: Board of Directors · Consulted: Long-Term Benefit Trust PDF p. 16 (printed p. 12), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentence Inspect claim & evidence ↗ Exception Required Safeguards may be lowered if another actor passes a threshold “In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.” PDF p. 16, footnote 18, second sentence Inspect claim & evidence ↗ Exception May deploy and train above threshold once ASL-3 Required Safeguards met “If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.” PDF p. 13 (printed p. 9), §4.3 Safeguards Decision, first paragraph, first sentence Inspect claim & evidence ↗ Exception ASL-3 Security Standard alone suffices to continue training “We consider implementation of the ASL-3 Security Standard alone sufficient to continue training, regardless of whether the ASL-3 Deployment Standard is satisfied.” PDF p. 15 (printed p. 11), footnote 14 (attached to the §6.2 'Monitoring pretraining' bullet), first sentence Inspect claim & evidence ↗ Not found in the inspected text CISO and CEO convened to decide on weight deletion Inspected: RSP v2.0 (effective October 15, 2024), whole text layer, PDF pp. 1–22: cover, summary and contents (pp. 1–4); Introduction and §§1–7 (pp. 5–17); Appendices A–C (pp. 18–20); Changelog (pp. 21–22). Inspect claim & evidence ↗ Links itself to external commitments or laws Anthropic’s Responsible Scaling Policy v2.0 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024). 2024-10-15 · effective · Stated in source · Supported Inspect claim & evidence ↗ Anthropic’s Responsible Scaling Policy v2.0 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023). 2024-10-15 · effective · Stated in source · Supported Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v2.1 Anthropic Responsible Scaling Policy — v2.1 Effective 2025-03-31 ↗ publication day not established Exact edition text: Responsible Scaling Policy — v2.1 ↗ Archived copy, captured 2025-04-02: Responsible Scaling Policy — v2.1 ↗ Replaces v2.0 ↗
Recorded changes from v2.0 Inferred document comparison Provision · Who decides: CEO and RSO deployment decision shared with Board and LTBT In the safeguards decision, v2.1 has the CEO and RSO share the underlying Safeguards Report with the Board and LTBT; v2.0's sentence named the underlying Capability Report. 2025-03-31 · effective · Inferred · Supported Inspect claim & evidence ↗ Official changelog RSP v2.1 separates AI R&D thresholds for automating entry-level research and dramatically accelerating effective scaling. 2025-03-31 · effective · Stated in source · Supported Inspect claim & evidence ↗ Provisions · 8 quoted Threshold or trigger CBRN-3 Capability Threshold “The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.” PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds column Inspect claim & evidence ↗ Required action Commitment not to train or deploy without adequate safeguards “In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.” PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentence Inspect claim & evidence ↗ Required action Pause training until ASL-3 Security Standard implemented “If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.” PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence Inspect claim & evidence ↗ Required action Restrict deployment and scaling if safeguards showing fails “If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.” PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the numbered process) Inspect claim & evidence ↗ Who decides CEO and RSO deployment decision shared with Board and LTBT “If the CEO and RSO decide to proceed with deployment and training, they will share their decision–as well as the underlying Safeguards Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.” Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, item 4 Inspect claim & evidence ↗ Who decides Policy changes proposed by CEO and RSO, approved by Board “Changes to this policy will be proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors, in consultation with the Long-Term Benefit Trust.” Recommends: CEO · Recommends: Responsible Scaling Officer · Decides: Board of Directors · Consulted: Long-Term Benefit Trust PDF p. 17 (printed p. 13), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentence Inspect claim & evidence ↗ Exception Required Safeguards may be lowered if another actor passes a threshold “In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.” PDF p. 17, footnote 17, second sentence Inspect claim & evidence ↗ Exception May deploy and train above threshold once ASL-3 Required Safeguards met “If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.” PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, first paragraph, first sentence Inspect claim & evidence ↗ Links itself to external commitments or laws Anthropic’s Responsible Scaling Policy v2.1 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024). 2025-03-31 · effective · Stated in source · Supported Inspect claim & evidence ↗ Anthropic’s Responsible Scaling Policy v2.1 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023). 2025-03-31 · effective · Stated in source · Supported Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v2.2 Anthropic Responsible Scaling Policy — v2.2 Effective 2025-05-14 ↗ publication day not established Exact edition text: Responsible Scaling Policy — v2.2 ↗ Archived copy, captured 2025-05-14: Responsible Scaling Policy — v2.2 ↗ Replaces v2.1 ↗
Recorded changes from v2.1 Official changelog RSP v2.2 excludes sophisticated insiders and state-compromised insiders from the ASL-3 Security Standard. 2025-05-14 · effective · Stated in source · Supported Inspect claim & evidence ↗ Provisions · 7 quoted Threshold or trigger CBRN-3 Capability Threshold “The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.” PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds column Inspect claim & evidence ↗ Required action Commitment not to train or deploy without adequate safeguards “In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.” PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentence Inspect claim & evidence ↗ Required action Pause training until ASL-3 Security Standard implemented “If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.” PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence Inspect claim & evidence ↗ Required action Restrict deployment and scaling if safeguards showing fails “If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.” PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the numbered process) Inspect claim & evidence ↗ Who decides CEO and RSO deployment decision shared with Board and LTBT “If the CEO and RSO decide to proceed with deployment and training, they will share their decision– as well as the underlying Safeguards Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.” Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, item 4 Inspect claim & evidence ↗ Exception Required Safeguards may be lowered if another actor passes a threshold “In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.” PDF p. 17, footnote 17, second sentence Inspect claim & evidence ↗ Exception May deploy and train above threshold once ASL-3 Required Safeguards met “If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.” PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, first paragraph, first sentence Inspect claim & evidence ↗ Links itself to external commitments or laws Anthropic’s Responsible Scaling Policy v2.2 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024). 2025-05-14 · effective · Stated in source · Supported Inspect claim & evidence ↗ Anthropic’s Responsible Scaling Policy v2.2 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023). 2025-05-14 · effective · Stated in source · Supported Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v3.0 Anthropic Responsible Scaling Policy — v3.0 Effective 2026-02-24 · Published 2026-02-24 ↗ Exact edition text: Responsible Scaling Policy — v3.0 ↗ Archived copy, captured 2026-02-24: Responsible Scaling Policy — v3.0 ↗ Replaces v2.2 ↗
Recorded changes from v2.2 Inferred document comparison Provision · Who decides: CEO and RSO Risk Report decisions shared with Board, LTBT v3.0 has the CEO and RSO, following approval of a Risk Report, promptly share their decision(s), the Risk Report and internal feedback with the Board and LTBT; v2.2 had them, on deciding to proceed with deployment and training, share that decision with the Safeguards Report and internal and any external feedback with the Board and LTBT before moving forward. 2026-02-24 · effective · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Threshold or trigger: Non-novel chemical/biological weapons production threshold v3.0's threshold covers significant help to individuals or groups with basic technical backgrounds in creating/obtaining and deploying chemical and/or biological weapons with serious potential for catastrophic damages; v2.2's CBRN-3 threshold covered the same help for CBRN weapons without that qualifier. 2026-02-24 · effective · Inferred · Supported Inspect claim & evidence ↗ Assessed effect Unresolved Whether RSP v3.0’s new roadmap and transparency mechanisms compensate for its reduced unilateral commitments, in the policy’s overall capacity to secure risk mitigation, remains unsettled. 2026-02-24 · effective · Question posed by Selekoa · Unresolved Inspect claim & evidence ↗ Publisher statement RSP v3.0 separates Anthropic’s own mitigation plans from its recommendations for industry-wide mitigation. 2026-02-24 · effective · Stated in source · Supported Inspect claim & evidence ↗ Publisher statement RSP v3.0 introduces Risk Reports discussing model risks and development or deployment determinations. 2026-02-24 · effective · Stated in source · Supported Inspect claim & evidence ↗ Publisher statement RSP v3.0 introduces Frontier Safety Roadmaps. 2026-02-24 · effective · Stated in source · Supported Inspect claim & evidence ↗ Provisions · 8 quoted · 4 not found Threshold or trigger Automated R&D threshold: two years' progress in one year “Our working operationalization is to trigger this risk threshold at the point where we determine that a model could compress two years of 2018 – 2024 AI progress into a single year.” PDF p. 8 (printed p. 8), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column, third paragraph, first sentence Inspect claim & evidence ↗ Threshold or trigger Non-novel chemical/biological weapons production threshold “AI systems with the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy chemical and/or biological weapons with serious potential for catastrophic damages.” PDF p. 6 (printed p. 6), §1 Our Recommendations for Industry-Wide Safety, table row 'Non-novel chemical/biological weapons production', left column ('Capability or usage threshold') Inspect claim & evidence ↗ Required action Delay development and deployment when Anthropic is in the lead “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.” PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column Inspect claim & evidence ↗ Required action Meet or exceed competitors' risk reduction posture “For our highly capable frontier models, we will meet or exceed the overall risk reduction posture of these competitors, as far as we can tell based on our best efforts to assess that posture.” PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Competitors have strong safety measures', Commitment column, first sentence Inspect claim & evidence ↗ Required action General upleveling: effort to match competitor mitigation, no necessary delay “We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.” PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'General upleveling', Commitment column Inspect claim & evidence ↗ Who decides CEO and RSO Risk Report decisions shared with Board, LTBT “Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.” Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 12 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification') Inspect claim & evidence ↗ Who decides Board and LTBT approval when marginal risk analysis is central “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.” Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling Officer PDF p. 12 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case') Inspect claim & evidence ↗ Exception No unilateral, unconditional commitment to industry-wide recommendations “In particular, we cannot unilaterally and unconditionally commit to staying in line with the industry-wide recommendations in the right column.” PDF p. 4 (printed p. 4), §1 Our Recommendations for Industry-Wide Safety, second paragraph, second sentence Inspect claim & evidence ↗ Not found in the inspected text Commitment not to train or deploy without adequate safeguards Inspected: RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports, 3.1–3.6.3 (pp. 10–15); §4 Governance (p. 15); Appendix A: Commitments Related to Competitors and Appendix B: Notes on ASLs (p. 16); Changelog (pp. 17–19). Inspect claim & evidence ↗ Not found in the inspected text Pause training until ASL-3 Security Standard implemented Inspected: RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19). Inspect claim & evidence ↗ Not found in the inspected text Restrict deployment and scaling if safeguards showing fails Inspected: RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19). Inspect claim & evidence ↗ Not found in the inspected text May deploy and train above threshold once ASL-3 Required Safeguards met Inspected: RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19). Inspect claim & evidence ↗ Links itself to external commitments or laws Anthropic's Responsible Scaling Policy v3.0 says it uses 'catastrophic risk' in its plain meaning rather than adopting any specific statutory definition. It adds that where laws such as California SB 53 define this or similar terms with specific thresholds, Anthropic addresses those requirements in separate compliance frameworks. 2026-02-24 · effective · Stated in source · Supported Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The cover effective date and release announcement publication date both identify February 24, 2026.
v3.1 Anthropic Responsible Scaling Policy — v3.1 Effective 2026-04-02 ↗ publication day not established Exact edition text: Responsible Scaling Policy — v3.1 ↗ Archived copy, captured 2026-04-07: Responsible Scaling Policy — v3.1 ↗ Replaces v3.0 ↗
Recorded changes from v3.0 Official changelog Provision · Threshold or trigger: Automated R&D threshold: researcher substitution or dramatic acceleration v3.1 treats the Automated R&D threshold as met if Anthropic determines either that its models could fully substitute for its entire set of Research Scientists and Research Engineers at competitive costs (within a factor of 5) or that AI progress is dramatically accelerating for reasons likely related to automation of AI R&D (an observed or expected doubling of the rate of progress plausibly attributable to that automation); v3.0's working operationalization triggered it where a model could compress two years of 2018–2024 AI progress into one year. 2026-04-02 · effective · Stated in source · Supported Inspect claim & evidence ↗ Provisions · 4 quoted · 1 not found Threshold or trigger Automated R&D threshold: researcher substitution or dramatic acceleration “We will consider this threshold to be met if we determine that either (1) our models would be able to fully substitute for our entire set of Research Scientists and Research Engineers, at competitive costs” PDF p. 8 (printed p. 8), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column, third paragraph (sentence continues on PDF p. 9) Inspect claim & evidence ↗ Required action Delay development and deployment when Anthropic is in the lead “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.” PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column Inspect claim & evidence ↗ Who decides CEO and RSO Risk Report decisions shared with Board, LTBT “Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.” Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification') Inspect claim & evidence ↗ Who decides Board and LTBT approval when marginal risk analysis is central “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.” Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling Officer PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case') Inspect claim & evidence ↗ Not found in the inspected text Commitment not to train or deploy without adequate safeguards Inspected: RSP v3.1 (effective April 2, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10); §2–§3 Risk Reports (pp. 11–15); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 17–20). Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v3.2 Anthropic Responsible Scaling Policy — v3.2 Effective 2026-04-29 ↗ publication day not established Exact edition text: Responsible Scaling Policy — v3.2 ↗ Archived copy, captured 2026-05-05: Responsible Scaling Policy — v3.2 ↗ Replaces v3.1 ↗
Recorded changes from v3.1 Official changelog RSP v3.2 gives the Long-Term Benefit Trust authority to approve the selection of external Risk Report reviewers. 2026-04-29 · effective · Stated in source · Supported Inspect claim & evidence ↗ Provisions · 6 quoted · 1 not found Threshold or trigger Novel chemical/biological weapons production threshold “AI systems with the ability to significantly help threat actors (for example, moderately resourced expert-backed teams) create/obtain and deploy chemical and/or biological weapons with potential for catastrophic damages far beyond those of past catastrophes such as COVID-19.” PDF p. 7 (printed p. 7), §1 Our Recommendations for Industry-Wide Safety, table row 'Novel chemical/biological weapons production', left column ('Capability or usage threshold') Inspect claim & evidence ↗ Required action Delay development and deployment when Anthropic is in the lead “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.” PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column Inspect claim & evidence ↗ Who decides CEO and RSO Risk Report decisions shared with Board, LTBT “Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.” Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification') Inspect claim & evidence ↗ Who decides Regular LTBT briefings on Risk Report plans and developments “We will regularly brief the LTBT on plans and developments related to our Risk Reports, including model training, capability evals, mitigations, and risk analyses.” Informed: Long-Term Benefit Trust PDF p. 16 (printed p. 15), §4 Governance, numbered item 2 ('Long Term Benefit Trust') Inspect claim & evidence ↗ Who decides External review of a Risk Report on LTBT request “In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.” Decides: Long-Term Benefit Trust PDF p. 14 (printed p. 13), §3.6 External Review, final paragraph before §3.6.1 Inspect claim & evidence ↗ Who decides Board and LTBT approval when marginal risk analysis is central “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.” Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling Officer PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case') Inspect claim & evidence ↗ Not found in the inspected text Commitment not to train or deploy without adequate safeguards Inspected: RSP v3.2 (effective April 29, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 18–20). Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v3.3 Anthropic Responsible Scaling Policy — v3.3 Effective 2026-05-26 ↗ publication day not established Exact edition text: Responsible Scaling Policy — v3.3 ↗ Archived copy, captured 2026-05-28: Responsible Scaling Policy — v3.3 ↗ Replaces v3.2 ↗
Recorded changes from v3.2 Official changelog Provision · Threshold or trigger: Novel chemical/biological weapons production threshold v3.3’s threshold covers AI systems that can functionally substitute for the scarce human expertise that is currently the primary barrier to novel development of chemical and biological weapons with potential for catastrophic harm (footnoted as consequences comparable to or worse than COVID-19); that is, a well-resourced team could use the model for the end-to-end agent design and deployment, including formulation and dissemination, that would otherwise require recruiting one of a small number of world-leading specialists. v3.2’s threshold covered AI systems able to significantly help threat actors, such as moderately resourced expert-backed teams, create or obtain and deploy such weapons with potential for catastrophic damages far beyond past catastrophes such as COVID-19. 2026-05-26 · effective · Stated in source · Supported Inspect claim & evidence ↗ Provisions · 6 quoted · 1 not found Threshold or trigger Automated R&D threshold: when dramatic acceleration counts as occurring “We would consider scenario (2) to have occurred where (a) we observe or expect double the rate of progress8 in AI aggregate capabilities compared to the rate we’d expect in the absence of significant AI contributions to AI R&D” PDF p. 9 (printed p. 9), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column ('Capability or usage threshold'), paragraph beginning 'We would consider scenario (2)', to the end of condition (a) Inspect claim & evidence ↗ Threshold or trigger Novel chemical/biological weapons production threshold “AI systems that can functionally substitute for the scarce human expertise that is currently the primary barrier to novel development of chemical and biological weapons with potential for catastrophic harm.” PDF p. 7 (printed p. 7), §1 Our Recommendations for Industry-Wide Safety, table row 'Novel chemical/biological weapons production', left column, first sentence Inspect claim & evidence ↗ Required action Delay development and deployment when Anthropic is in the lead “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.” PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column Inspect claim & evidence ↗ Who decides CEO and RSO Risk Report decisions shared with Board, LTBT “Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.” Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification') Inspect claim & evidence ↗ Who decides External review of a Risk Report on LTBT request “In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.” Decides: Long-Term Benefit Trust PDF p. 14 (printed p. 13), §3.6 External Review, final paragraph before §3.6.1 Inspect claim & evidence ↗ Who decides Board and LTBT approval when marginal risk analysis is central “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.” Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling Officer PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case') Inspect claim & evidence ↗ Not found in the inspected text Commitment not to train or deploy without adequate safeguards Inspected: RSP v3.3 (effective May 26, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10, columns on p. 9 read individually because the text layer interleaves them); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 18–20). Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v3.4 Anthropic Responsible Scaling Policy — v3.4 Effective 2026-07-08 ↗ publication day not established Exact edition text: Responsible Scaling Policy — v3.4 ↗ Archived copy, captured 2026-07-10: Responsible Scaling Policy — v3.4 ↗ Replaces v3.3 ↗
Recorded changes from v3.3 Official changelog Provision · Threshold or trigger: Automated R&D threshold: when dramatic acceleration counts as occurring v3.4 counts the dramatic-acceleration scenario of the Automated R&D threshold as having occurred where the observed or expected doubling of AI progress is measured against both the rate Anthropic would expect and the fastest rate of extended progress it has observed (over at least three model generations) without significant AI contributions to AI R&D, and where continuing the trend “seems likely to lead to” even greater acceleration; v3.3 measured the doubling against the expected rate alone, and continuing the trend “could lead to” even greater acceleration. 2026-07-08 · effective · Stated in source · Supported Inspect claim & evidence ↗ Official changelog RSP v3.4 allows a Risk Report coverage date up to 30 days before publication. 2026-07-08 · effective · Stated in source · Supported Inspect claim & evidence ↗ Official changelog RSP v3.4 changes fully unredacted Risk Report sharing to at least 200 employees, instead of all regular-clearance staff. 2026-07-08 · effective · Stated in source · Supported Inspect claim & evidence ↗ Provisions · 5 quoted · 1 not found Threshold or trigger Automated R&D threshold: when dramatic acceleration counts as occurring “We would consider scenario (2) to have occurred where (a) we observe or expect double the rate of progress8 in AI aggregate capabilities compared to both the rate we’d expect and the fastest rate of extended progress9 we’ve observed in the absence of significant AI contributions to AI R&D” PDF p. 9 (printed p. 9), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column ('Capability or usage threshold'), paragraph beginning 'We would consider scenario (2)', to the end of condition (a); footnote 9 Inspect claim & evidence ↗ Required action Delay development and deployment when Anthropic is in the lead “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.” PDF p. 17 (printed p. 17), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column Inspect claim & evidence ↗ Who decides CEO and RSO Risk Report decisions shared with Board, LTBT “Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.” Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit Trust PDF p. 13 (printed p. 13), §3.4 Procedures, item 4 ('Governance notification') Inspect claim & evidence ↗ Who decides External review of a Risk Report on LTBT request “In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.” Decides: Long-Term Benefit Trust PDF p. 14 (printed p. 14), §3.6 External Review, final paragraph before §3.6.1 Inspect claim & evidence ↗ Who decides Board and LTBT approval when marginal risk analysis is central “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.” Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling Officer PDF p. 14 (printed p. 14), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case') Inspect claim & evidence ↗ Not found in the inspected text Commitment not to train or deploy without adequate safeguards Inspected: RSP v3.4 (effective July 8, 2026), whole text layer, PDF pp. 1–21: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10, columns on p. 9 read individually because the text layer interleaves them); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A and Appendix B (p. 17); Changelog (pp. 18–21). Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
Open questions and source limits Two questions remain open. Did the v2.0 revision make Anthropic’s commitments less verifiable? Do v3.0’s roadmap and transparency mechanisms compensate for its reduced unilateral commitments? Each record keeps the published assessments as context, because none directly opposes another on the same question. The changes to the text are recorded separately.
Records: RSP · v2.0 → changes from → RSP · 2023 · RSP · v3.0 → changes from → RSP · v2.2
Most Responsible Scaling Policy revisions are identified by their effective dates. Where no publication day was established, none is inferred.
Records: Anthropic → published → RSP · v2.0 · Anthropic → published → RSP · v2.1 · Anthropic → published → RSP · v2.2 · Anthropic → published → RSP · v3.1 · Anthropic → published → RSP · v3.2 · Anthropic → published → RSP · v3.3 · Anthropic → published → RSP · v3.4
Google DeepMind · Frontier Safety Framework Published by Google DeepMind. 4 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 15 tracked provisions “Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
v1.0 Frontier Safety Framework (2024) Published 2024-05-17 ↗ Exact edition text: Frontier Safety Framework — v1.0 ↗ Archived copy, captured 2024-05-17: Frontier Safety Framework — v1.0 ↗
Earliest edition of this framework recorded here.
Provisions · 5 quoted Threshold or trigger Early warning evaluations with a pass condition “we will define a set of evaluations called “early warning evaluations,” with a specific “pass” condition that flags when a CCL may be reached before the evaluations are run again.” PDF p. 2 (printed p. 2), Framework, component “2 - Evaluating frontier models”, first paragraph, second sentence Inspect claim & evidence ↗ Threshold or trigger Autonomy level 1 CCL “Autonomy level 1: Capable of expanding its effective capacity in the world by autonomously acquiring resources and using them to run and sustain additional copies of itself on hardware it rents.” PDF p. 5 (printed p. 5), Critical Capability Levels table, Autonomy row, “Critical capability level” column Inspect claim & evidence ↗ Threshold or trigger Evaluation every 6x effective compute and 3 months’ fine-tuning “We are aiming to evaluate our models every 6x in effective compute3 and for every 3 months of fine-tuning progress.” PDF p. 2 (printed p. 2), Framework, component “2 - Evaluating frontier models”, second paragraph, first sentence Inspect claim & evidence ↗ Required action Hold on deployment or development if mitigations not ready “A model may reach evaluation thresholds before mitigations at appropriate levels are ready. If this happens, we would put on hold further deployment or development, or implement additional protocols” PDF p. 2 (printed p. 2), Framework, component “3 - Applying mitigations”, third paragraph, first sentence and opening of second sentence Inspect claim & evidence ↗ Required action Response plan when evaluation thresholds are reached “When a model reaches evaluation thresholds (i.e. passes a set of early warning evaluations), we will formulate a response plan based on the analysis of the CCL and evaluation results.” PDF p. 2 (printed p. 2), Framework, component “3 - Applying mitigations”, first paragraph, first sentence Inspect claim & evidence ↗ Date basis Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
v2.0 Google DeepMind Frontier Safety Framework — v2.0 Published 2025-02-04 ↗ Exact edition text: Frontier Safety Framework — v2.0 ↗ Archived copy, captured 2025-02-05: Frontier Safety Framework — v2.0 ↗ Replaces v1.0 ↗
Recorded changes from v1.0 Publisher statement FSF v2.0 introduces recommended security levels for Critical Capability Levels. 2025-02-04 · publication · Stated in source · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Response plan may put deployment or development on hold v2.0 states that where a model flagged by an alert threshold is assessed to pose risks for which readily available mitigations may not be sufficient, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied; v1.0 stated that if a model reached evaluation thresholds before mitigations at appropriate levels were ready, Google DeepMind would put further deployment or development on hold or implement additional protocols. 2025-02-04 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Proximity and risk assessment informing a response plan v2.0 states that on reaching an alert threshold for a CCL the model's proximity to the CCL is assessed and the risk analysed, involving internal and external experts as needed, to inform the formulation and application of a response plan; v1.0 stated that on reaching evaluation thresholds a response plan would be formulated based on the analysis of the CCL and evaluation results. 2025-02-04 · publication · Inferred · Supported Inspect claim & evidence ↗ Provisions · 8 quoted · 2 not found Threshold or trigger Early warning evaluations with an alert threshold “we will define a set of evaluations called “early warning evaluations,” with a specific “alert threshold” that flags when a CCL may be reached before the evaluations are run again.” PDF p. 3 (printed p. 3), Framework, component “2 - Assessing the Capabilities of Frontier Models”, second paragraph, first sentence Inspect claim & evidence ↗ Required action Response plan may put deployment or development on hold “If this happens, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied.” PDF p. 3 (printed p. 3), Framework, component “3 - Applying Mitigations”, third paragraph, second sentence Inspect claim & evidence ↗ Required action Proximity and risk assessment informing a response plan “When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.” PDF p. 3 (printed p. 3), component “3 - Applying Mitigations”, first paragraph, first two sentences Inspect claim & evidence ↗ Who decides Disclosure to government authorities “If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share information with appropriate government authorities where it will facilitate the development of safe AI.” Decides: Google DeepMind · Informed: Appropriate government authorities Governance and Accountability, “Disclosure”, first sentence: PDF p. 8 in the Internet Archive capture of 2025-02-05; PDF pp. 7–8 in the served file, where a page break and footnote 14 interrupt the sentence after “facilitate the” Inspect claim & evidence ↗ Who decides Pre-deployment safety case review by corporate governance body “Pre-deployment review of safety case: general availability deployment8 of a model takes place only after the appropriate corporate governance body determines the safety case regarding each CCL the model has reached to be adequate.” Decides: Appropriate corporate governance body PDF p. 4 (printed p. 4), Misuse, Mitigation Approach, “Deployment Mitigations”, numbered step 2 Inspect claim & evidence ↗ Who decides Corporate governance bodies approve response plans “For Google models, when alert thresholds are reached, the response plan will be reviewed and approved by appropriate corporate governance bodies such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council.” Decides: Appropriate corporate governance bodies, such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council PDF p. 7 (printed p. 7), Governance and Accountability, “Governance” paragraph, first sentence Inspect claim & evidence ↗ Exception Adoption of protocols may depend on industry-wide adoption “our adoption of the protocols described in this Framework may depend on whether such organizations across the field adopt similar protocols.” PDF p. 1 (unnumbered), opening section, paragraph beginning “The safety of frontier AI systems is a global public good”, last sentence, final clause Inspect claim & evidence ↗ Exception Recommended security levels may be adjusted “This may occur if, for example, a model does not possess capabilities meaningfully different from other widely available models that have not demonstrably caused or contributed to severe risks,” PDF p. 5 (printed p. 5), Misuse, Misuse Critical Capability Levels, paragraph beginning “These recommended security levels”, second sentence Inspect claim & evidence ↗ Not found in the inspected text Autonomy level 1 CCL Inspected: Whole document in both copies (2025-02-05 capture PDF pp. 1–8; served copy PDF pp. 1–9), including Table 1 (Misuse CCLs, PDF pp. 5–6), Table 2 (Deceptive Alignment CCLs, PDF p. 7) and all footnotes Inspect claim & evidence ↗ Not found in the inspected text Evaluation every 6x effective compute and 3 months’ fine-tuning Inspected: Whole document in both copies (2025-02-05 capture PDF pp. 1–8; served copy PDF pp. 1–9): all sections, Tables 1–2, footnotes and the served copy’s Updates and changes page Inspect claim & evidence ↗ Date basis Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
v3.0 Google DeepMind Frontier Safety Framework — v3.0 Published 2025-09-22 ↗ Exact edition text: Frontier Safety Framework — v3.0 ↗ Archived copy, captured 2025-09-22: Frontier Safety Framework — v3.0 ↗ Replaces v2.0 ↗
Recorded changes from v2.0 Publisher statement FSF v3.0 introduces a Critical Capability Level for harmful manipulation. 2025-09-22 · publication · Stated in source · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Threshold or trigger: Alert thresholds for early warning evaluations v3.0’s alert thresholds for its early warning evaluations are designed to flag when a CCL may be reached before a risk assessment is conducted again, and its Note on Machine Learning R&D CCLs adds that the alert threshold may be defined based on sources of information about Google DeepMind’s own progress at accelerating ML R&D, rather than on evaluation scores; v2.0’s alert threshold flagged when a CCL may be reached before the evaluations are run again, and v2.0 contains no such note. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Who decides: Information sharing with government authorities v3.0 aims to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI; v2.0 aimed to share information with them where it will facilitate the development of safe AI. The triggering assessment (a CCL posing an unmitigated and material risk to overall public safety) is worded the same. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Who decides: Pre-deployment safety case review by governance function v3.0 makes external deployments of a model conditional on the appropriate governance function determining the safety case for each CCL reached to be adequate; v2.0 made general availability deployment conditional on the appropriate corporate governance body making that determination. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Exception: Recommended security levels may be adjusted v3.0's example for adjusting recommended security levels refers to models with capabilities not meaningfully different from other publicly available models that have weaker security applied, adding that the marginal benefit of higher security is then limited; v2.0's example referred to other widely available models that have not demonstrably caused or contributed to severe risks. 2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗ Provisions · 9 quoted · 3 not found Threshold or trigger Alert thresholds for early warning evaluations “Central to our model evaluations are “early warning evaluations,” to assess the proximity of the model to a CCL. We define “alert thresholds” for these evaluations that are designed to flag when a CCL may be reached before a risk assessment is conducted again.” PDF p. 5 (printed p. 5), §1.3 Outline of Our Risk Assessment Process, “Analysis” bullet, first and second sentences Inspect claim & evidence ↗ Required action Framework updated at least once a year “The Frontier Safety Framework will be updated at least once a year” PDF p. 16 (printed p. 16), §5.1 Updates, first sentence Inspect claim & evidence ↗ Required action Proximity and risk assessment informing a response plan “When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.” PDF p. 6 (printed p. 6), §1.4 Response Plans and Mitigations, second paragraph, first two sentences Inspect claim & evidence ↗ Required action Response plan where capabilities remain distant from a CCL “Where model capabilities remain quite distant from a CCL, a response plan may involve the adoption of additional capability assessment processes to flag when heightened mitigations are required.” PDF p. 6 (printed p. 6), §1.4 Response Plans and Mitigations, second paragraph, third sentence Inspect claim & evidence ↗ Who decides Information sharing with government authorities “If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.” Decides: Google DeepMind · Informed: Appropriate government authorities PDF p. 16 (printed p. 16), §5.2 Disclosures, first paragraph, first sentence Inspect claim & evidence ↗ Who decides Pre-deployment safety case review by governance function “Pre-deployment review of safety case: external deployments of a model take place only after the appropriate governance function determines the safety case regarding each CCL the model has reached to be adequate.” Decides: Appropriate governance function PDF p. 9 (printed p. 9), §2.1.2 Deployment Mitigations, numbered step 2, first sentence Inspect claim & evidence ↗ Exception Alternative security adequacy assessment for risk acceptance “or we otherwise assess that the level of security applied is adequate, e.g. if they match or exceed the level of security applied to other models with similar capabilities or risk profiles, or we assess that the benefits of the open release of model weights outweigh the risks.” PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse-CCL bullet (begins PDF p. 6), second sub-bullet, from “or we otherwise assess” Inspect claim & evidence ↗ Exception Misuse deployment-mitigation criterion limited to external deployment “This is required only for external deployment, not further development.” PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse CCL bullet, first sub-bullet, final sentence Inspect claim & evidence ↗ Exception Recommended security levels may be adjusted “This may occur if, for example, a model does not possess capabilities meaningfully different from other publicly available models that have weaker security applied (in which case the marginal benefit of higher security is limited),” PDF p. 9 (printed p. 9), §2.2 Misuse Critical Capability Levels, second paragraph, second sentence Inspect claim & evidence ↗ Not found in the inspected text Putting deployment or development on hold pending mitigations Inspected: PDF pp. 1–16, all sections, tables and footnotes Inspect claim & evidence ↗ Not found in the inspected text Response plans approved by named corporate governance bodies Inspected: PDF pp. 1–16, all sections, tables and footnotes Inspect claim & evidence ↗ Not found in the inspected text Adoption of protocols dependent on industry-wide adoption Inspected: PDF pp. 1–16, all sections, tables and footnotes Inspect claim & evidence ↗ Date basis Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
v3.1 Google DeepMind Frontier Safety Framework — v3.1 Published 2026-04-17 ↗ Exact edition text: Frontier Safety Framework — v3.1 ↗ Archived copy, captured 2026-04-23: Frontier Safety Framework — v3.1 ↗ Replaces v3.0 ↗
Recorded changes from v3.0 Official changelog FSF v3.1 introduces CBRN Tracked Capability Levels. 2026-04-17 · publication · Stated in source · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Threshold or trigger: Alert thresholds drawing on evaluations and other information v3.1 defines alert thresholds for CCLs that may draw on evaluation results, expert assessments and other sources of information and flag when a CCL may be reached before a critical capability assessment is conducted again; v3.0 defined alert thresholds for its early warning evaluations that flag when a CCL may be reached before a risk assessment is conducted again, with a separate note allowing the ML R&D alert threshold to be defined from information on Google DeepMind’s own ML R&D progress rather than evaluation scores. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Exception: Misuse deployment-mitigation criterion limited to external deployment v3.1's misuse deployment-mitigation criterion is stated to be required only for external deployment, not internal deployment or further development, and its ML R&D criterion for external and high-risk internal deployment; v3.0's misuse criterion was stated to be required only for external deployment, not further development, and its ML R&D criterion for external and large scale internal deployment. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Framework reviewed at least once a year v3.1 states that the Framework will be reviewed at least once a year; v3.0 stated that it will be updated at least once a year. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Who decides: Pre-deployment residual risk review by governance function v3.1 makes external deployments conditional on the appropriate governance function determining the residual risk to be acceptable, including a safety case where a CCL has been reached; v3.0 made them conditional on that function determining the safety case regarding each CCL the model has reached to be adequate. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Response plan may update the alert threshold v3.1 states that if risks remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate; v3.0 stated that where capabilities remain quite distant from a CCL, a response plan may involve adopting additional capability assessment processes to flag when heightened mitigations are required. 2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗ Provisions · 8 quoted Threshold or trigger Alert thresholds drawing on evaluations and other information “For CCLs, we define “alert thresholds,” which may draw on evaluation results, expert assessments, and other sources of information; that are designed to flag when a CCL may be reached before a critical capability assessment is conducted again.” PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, third paragraph, second sentence Inspect claim & evidence ↗ Required action Framework reviewed at least once a year “The Frontier Safety Framework will be reviewed at least once a year” PDF p. 17 (printed p. 17), §5.1 Updates, first sentence Inspect claim & evidence ↗ Required action Proximity and risk assessment informing a response plan “When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.” PDF p. 6 (printed p. 6), §1.3.3 Risk Mitigation, second paragraph, first two sentences Inspect claim & evidence ↗ Required action Response plan may update the alert threshold “However, if we assess that risks stemming from the model remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate.” PDF p. 6 (printed p. 6), §1.3.3 Risk Mitigation, second paragraph, fourth sentence Inspect claim & evidence ↗ Who decides Information sharing with government authorities “If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.” Decides: Google DeepMind · Informed: Appropriate government authorities PDF p. 17 (printed p. 17), §5.2 Disclosures, first sentence Inspect claim & evidence ↗ Who decides Pre-deployment residual risk review by governance function “Pre-deployment review of residual risk assessment: external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).” Decides: Appropriate governance function PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, numbered step 2, first sentence Inspect claim & evidence ↗ Exception Misuse deployment-mitigation criterion limited to external deployment “This is required only for external deployment, not internal deployment or further development.” PDF p. 7 (printed p. 7), §1.3.5 Risk Acceptance Determination, misuse T/CCL bullet, first sub-bullet, final sentence Inspect claim & evidence ↗ Exception Low-risk external deployments may skip critical capability assessment “may not be conducted for low-risk external deployments (e.g. to a small number of trusted testers) if the appropriate governance function determines the residual risk of such deployments to be acceptable even if the model has reached a T/CCL (including with a safety case where a CCL has been reached).” PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, footnote 4 Inspect claim & evidence ↗ Date basis Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
OpenAI · Preparedness Framework Published by OpenAI. 2 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 9 tracked provisions “Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
Beta OpenAI Preparedness Framework — Beta Published 2023-12-18 ↗ Exact edition text: Preparedness Framework — Beta ↗ Archived copy, captured 2023-12-18: Preparedness Framework — Beta ↗
Earliest edition of this framework recorded here.
Provisions · 7 quoted Threshold or trigger Risk gradation scale from “low” to “critical” “In general, “low” on this gradation scale is meant to indicate that the corresponding category of risks is not yet a significant problem, while “critical” represents the maximal level of concern.” PDF p. 5 (printed p. 5), “Tracked Risk Categories”, second paragraph, third (final) sentence Inspect claim & evidence ↗ Required action Further development only at post-mitigation “high” or below “Only models with a post-mitigation score of "high" or below can be developed further.” PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, first sentence Inspect claim & evidence ↗ Required action Deployment only at post-mitigation “medium” or below “Only models with a post-mitigation score of "medium" or below can be deployed.” PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting deployment”, first sentence Inspect claim & evidence ↗ Who decides SAG recommends; Leadership decides; Board may overrule “(2) there is an advisory group (Safety Advisory Group) that has a sufficient diversity of perspectives and technical expertise to provide nuanced input and recommendations, and (3) there is a final decision-maker (OpenAI Leadership, with the option for the OpenAI Board of Directors to overrule).” Recommends: Safety Advisory Group (SAG) · Decides: OpenAI Leadership · Can overrule: OpenAI Board of Directors PDF p. 22 (printed p. 22), Governance › “Operations”, opening paragraph, second sentence, items (2) and (3) Inspect claim & evidence ↗ Who decides Leadership may decide without SAG participation “For the avoidance of doubt, Leadership can also make decisions without the SAG’s participation, i.e., the SAG does not have the ability to “filibuster” Decides: OpenAI Leadership PDF p. 24 (printed p. 24), Governance › Operations › “Decision process”, fourth item Inspect claim & evidence ↗ Exception Capabilities-enhancing development only if reasonably assured safe “We would also focus our efforts as a company towards solving these safety challenges and only continue with capabilities-enhancing development if we can reasonably assure ourselves (via the operationalization processes) that it is safe to do so.” PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, fourth sentence Inspect claim & evidence ↗ Exception Development restriction does not preclude safety-enhancing development “Note that this should not preclude safety-enhancing development.” PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, third sentence Inspect claim & evidence ↗ Date basis Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
Version 2 OpenAI Preparedness Framework — Version 2 Revised 2025-04-15 · Published 2025-04-15 ↗ Exact edition text: Preparedness Framework — Version 2 ↗ Archived copy, captured 2025-04-15: Preparedness Framework — Version 2 ↗ Replaces Beta (unresolved) ↗
Recorded changes from Beta Official changelog Preparedness Version 2 moves handling of persuasion risks outside the Preparedness Framework. 2025-04-15 · revision · Stated in source · Supported Inspect claim & evidence ↗ Official changelog Preparedness Version 2 introduces Research Categories for capabilities requiring further threat-model and measurement work. 2025-04-15 · revision · Stated in source · Supported Inspect claim & evidence ↗ Official changelog Preparedness Version 2 removes the terms “low” and “medium” while defining High and Critical capability thresholds. 2025-04-15 · revision · Stated in source · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: Critical capability requires safeguards during development Version 2 states that if a model under development reaches a Critical capability threshold, safeguards are also required to sufficiently minimize the associated risks during development, irrespective of deployment plans; the Beta states that only models with a post-mitigation score of “high” or below can be developed further. 2025-04-15 · revision · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Who decides: Leadership approves or rejects SAG recommendations; SSC oversight Version 2’s passage states that OpenAI Leadership can approve or reject the SAG’s recommendations and that the Board’s Safety and Security Committee provides oversight of these decisions; the Beta’s passage names OpenAI Leadership as final decision-maker with the option for the OpenAI Board of Directors to overrule. 2025-04-15 · revision · Inferred · Supported Inspect claim & evidence ↗ Inferred document comparison Provision · Required action: No deployment at High until risks sufficiently minimized Version 2 states that models reaching a High capability threshold are not deployed until the associated risks they pose are sufficiently minimized; the Beta states that only models with a post-mitigation score of “medium” or below can be deployed. 2025-04-15 · revision · Inferred · Supported Inspect claim & evidence ↗ Provisions · 5 quoted · 1 not found · 1 disputed assessment Required action Critical capability requires safeguards during development “If a model under development reaches a Critical capability threshold, we also require safeguards to sufficiently minimize the associated risks during development, irrespective of deployment plans.” PDF p. 4 (printed p. 3), §1 Introduction, third bullet (“Safeguard against severe harms”), third sentence Inspect claim & evidence ↗ Required action No deployment at High until risks sufficiently minimized “We do not deploy models that reach a High capability threshold until the associated risks that they pose are sufficiently minimized.” PDF p. 4 (printed p. 3), §1 Introduction, third bullet (“Safeguard against severe harms”), second sentence Inspect claim & evidence ↗ Who decides Leadership approves or rejects SAG recommendations; SSC oversight “OpenAI Leadership can approve or reject these recommendations, and our Board’s Safety and Security Committee provides oversight of these decisions.” Recommends: Safety Advisory Group (SAG) · Decides: OpenAI Leadership · Informed: Safety and Security Committee of the OpenAI Board of Directors PDF p. 4 (printed p. 3), §1 Introduction, final paragraph, second sentence Inspect claim & evidence ↗ Who decides SAG makes final determination on ambiguous coverage “In cases of ambiguity about whether a model is covered by the Preparedness Framework, the SAG is responsible for making the final determination.” Decides: Safety Advisory Group (SAG) PDF p. 10 (printed p. 9), §3.2 Testing scope, final paragraph Inspect claim & evidence ↗ Exception Safeguard adjustment if another developer lacks comparable safeguards “If we are able to rigorously confirm that such a scenario has occurred, then we could adjust accordingly the level of safeguards that we require in that capability area, but only if:” PDF p. 13 (printed p. 12), §4.3 Marginal risk, first paragraph, third sentence (up to the colon introducing three bullets) Inspect claim & evidence ↗ Assessment of this required action provision Contested Preparedness Framework v2’s governance arrangements permit OpenAI Leadership to deploy models with High capabilities without safeguards that sufficiently minimize their associated risks. Holds: Coggins et al. (arXiv) · Disputes: OpenAI Inspect claim & evidence ↗ Not found in the inspected text Development restriction does not preclude safety-enhancing development Inspected: Version 2, both copies (Internet Archive capture of 2025-04-15 and current file), PDF pp. 1–22: §§1–5, Tables 1–3 and Appendices A (Change log), B (Decision-making practices) and C Inspect claim & evidence ↗ Date basis Placed on the timeline by its revised date. Cover last-updated date and dated publication announcement both identify April 15, 2025; no distinct effective date is asserted.
Open questions and source limits No OpenAI text inspected so far names the December 2023 Beta as the edition that Version 2 replaces, so the replacement record is unresolved and carries context evidence only. A separate question is contested: whether Version 2’s governance arrangements let OpenAI Leadership deploy High-capability models without sufficient safeguards. The two sides are an academic analysis of leadership discretion and OpenAI’s stated predeployment requirement. The rule’s text itself is recorded as a supported provision.
Records: Preparedness · Version 2 → supersedes version → Preparedness · Beta · Preparedness · Version 2 → has a disputed assessment of its provision → Whether Version 2’s governance arrangements permit OpenAI Leadership to deploy High-capability models without sufficient safeguards
OpenAI · Frontier Governance Framework Published by OpenAI. 1 recorded edition, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 8 tracked provisions “Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
May 2026 edition OpenAI Frontier Governance Framework — May 2026 edition Published 2026-05-28 ↗ Exact edition text: Frontier Governance Framework — May 2026 edition ↗ Archived copy, captured 2026-05-29: Frontier Governance Framework — May 2026 edition ↗
Earliest edition of this framework recorded here.
Provisions · 8 quoted Threshold or trigger Models treated as crossing threshold when not ruled out “For example, out of an abundance of caution we have treated models as crossing a capability threshold in circumstances where we are unable to rule out that a new threshold had been reached, even in the absence of direct evidence that it has occurred.” PDF p. 8 (printed p. 06), §2.3 Systemic risk acceptance determination, first paragraph, final sentence Inspect claim & evidence ↗ Threshold or trigger Systemic risk: over 50 fatalities or $1 billion “including risks that a model will materially contribute to greater than 50 fatalities or $1 billion of property damages or losses arising from a single incident.” PDF p. 5 (printed p. 03), §2.1 Systemic risk identification, first paragraph, second sentence (from “including”) Inspect claim & evidence ↗ Required action No deployment above acceptable residual risk without mitigation “If residual risks associated with the model exceed acceptable risk levels, the model is not deployed unless additional mitigation measures are implemented that sufficiently minimize risk.” PDF p. 13 (printed p. 11), §2.5 Safety mitigations, first paragraph, third sentence Inspect claim & evidence ↗ Who decides Material FGF updates presented to two boards for oversight “Material updates will be presented to the Safety and Security Committee of the board of directors of the OpenAI Foundation and to the board of directors of OpenAI Ireland Limited for oversight” Informed: Safety and Security Committee of the OpenAI Foundation board of directors · Informed: Board of directors of OpenAI Ireland Limited PDF p. 21 (printed p. 19), §7.1 Update and approval process, fourth (final) sentence, up to “for oversight” Inspect claim & evidence ↗ Who decides Safety Advisory Group and external experts inform risk acceptance “We document a justification for why the systemic risks stemming from the model are acceptable, including reasonably foreseeable conditions under which the justification may no longer hold, as informed by recommendations from OpenAI’s Safety Advisory Group and external experts, as available and appropriate.” Recommends: OpenAI Safety Advisory Group · Recommends: External experts (as available and appropriate) PDF p. 13 (printed p. 11), §2.5 Safety mitigations, second paragraph, second sentence Inspect claim & evidence ↗ Who decides Legal function oversees FGF updates and determines required ones “OpenAI’s Legal function, in collaboration with relevant internal stakeholders, will oversee the process for FGF updates, including determining which updates are required” Decides: OpenAI Legal function (which updates are required) PDF p. 21 (printed p. 19), §7.1 Update and approval process, second sentence, up to “required” Inspect claim & evidence ↗ Who decides Who may propose updates to the FGF “Updates to this FGF may be proposed by Open AI’s Safety Advisory Group, Head of Safety Systems, Head of Preparedness, Chief Information Security Officer, Chief Compliance Officer, General Counsel, or executive leadership.” Recommends: OpenAI Safety Advisory Group · Recommends: Head of Safety Systems · Recommends: Head of Preparedness · Recommends: Chief Information Security Officer · Recommends: Chief Compliance Officer · Recommends: General Counsel · Recommends: Executive leadership PDF p. 21 (printed p. 19), §7.1 Update and approval process, first sentence Inspect claim & evidence ↗ Exception Acceptable residual risk permits development, internal use, deployment “Where the residual risk falls within acceptable levels, taking into account appropriate safety margins, the model may be approved for continued development and internal use (where applicable), and may be deployed under this Frontier Governance Framework.” PDF p. 13 (printed p. 11), §2.5 Safety mitigations, second paragraph, first sentence Inspect claim & evidence ↗ Links itself to external commitments or laws OpenAI’s Frontier Governance Framework (May 2026 edition) states that, under the EU General-Purpose AI Code of Practice, it serves as OpenAI’s publicly available summary of its Safety & Security Framework. 2026-05-28 · publication · Stated in source · Supported Inspect claim & evidence ↗ OpenAI's Frontier Governance Framework (May 2026 edition) states that, under California's TFAIA, it is OpenAI's Frontier AI Framework. 2026-05-28 · publication · Stated in source · Supported Inspect claim & evidence ↗ Date basis and other records Placed on the timeline by its published date. Publication date comes from the release announcement; the PDF cover has no separate version date.
OpenAI describes its Frontier Governance Framework as applying relevant parts of its continuing Preparedness approach to specific regulatory obligations. 2026-05-28 · publication · Stated in source · Supported Inspect claim & evidence ↗ Open questions and source limits The Frontier Governance Framework is recorded as applying relevant parts of the continuing Preparedness approach. Its announcement names no Preparedness version. The link therefore points to the Preparedness framework as a whole rather than to Version 2, and the new framework is not recorded as its successor.
Records: FGF · May 2026 edition → applies parts of → Preparedness family
xAI · Frontier AI Framework Published by xAI. 2 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 8 tracked provisions “Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
December 2025 edition xAI Frontier Artificial Intelligence Framework — December 2025 edition Revised 2025-12-30 ↗ publication day not established Exact edition text: Frontier Artificial Intelligence Framework — December 2025 edition ↗ Archived copy, captured 2026-01-02: Frontier Artificial Intelligence Framework — December 2025 edition ↗
Earliest edition of this framework recorded here.
Provisions · 4 quoted Threshold or trigger Bio/chem deployment criterion: answer rate below 1 in 20 “We developed an internal benchmark of benign and restricted biology and chemistry related queries in collaboration with SecureBio. Our risk acceptance criteria for system deployment is maintaining an answer rate of less than 1 out of 20 on restricted queries.” PDF p. 6 (no printed page numbers), “Addressing Risks of Malicious Use” › “2. Risk Assessment”, paragraph beginning “Thresholds:”, first and second sentences Inspect claim & evidence ↗ Threshold or trigger Deployment criterion: MASK dishonesty rate below 1 in 2 “Our risk acceptance criteria for system deployment is maintaining a dishonesty rate of less than 1 out of 2 on MASK.” PDF p. 7 (no printed page numbers), “Addressing Risks of Loss of Control” › “2. Risk Assessment”, paragraph beginning “Thresholds:”, first sentence Inspect claim & evidence ↗ Exception Deployment benefits may outweigh benchmark-identified risks “It is conceivable that for a particular modality and/or type of release, the expected benefits of model deployment may outweigh the risks identified by a particular benchmark.” PDF p. 10 (no printed page numbers), “Operational and Societal Risks” › “5. Deployment Decisions”, second paragraph, sixth sentence Inspect claim & evidence ↗ Exception Vetted, highly trusted users may receive responses “However, we may selectively allow xAI’s models to respond to such requests from some vetted, highly trusted users (such as trusted third-party safety auditors or large enterprise customers under contract) whom we know to be using those capabilities for benign or beneficial purposes” PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, third paragraph, single sentence, up to “purposes” Inspect claim & evidence ↗ Links itself to external commitments or laws xAI's Frontier Artificial Intelligence Framework (December 2025 edition) states that the FAIF complies with California's Transparency in Frontier Artificial Intelligence Act (Bus. & Prof. Code § 22757.10 et seq.). 2025-12-30 · revision · Stated in source · Supported Inspect claim & evidence ↗ Date basis Placed on the timeline by its revised date. The printed update date is retained; it is not silently treated as publication. The URL filename says December 31; the visible document says last updated December 30.
June 2026 edition xAI Frontier Artificial Intelligence Framework — June 2026 edition Effective 2026-06-30 ↗ publication day not established Exact edition text: Frontier Artificial Intelligence Framework — June 2026 edition ↗ Archived copy, captured 2026-07-16: Frontier Artificial Intelligence Framework — June 2026 edition ↗ replacement not recorded
Recorded changes Inferred document comparison The June 2026 FAIF does not contain the December 2025 edition’s sentence asserting compliance with California’s TFAIA. 2026-06-30 · effective · Inferred · Supported Inspect claim & evidence ↗ Coverage gap. No record yet says which earlier edition, if any, this edition replaced.
Provisions · 4 quoted · 3 not found Threshold or trigger Acceptance criteria with security margin for each risk “xAI applies a systemic risk acceptance criteria to each identified risk, incorporating a margin of security, to determine whether each identified systemic risk and the overall systemic risk are acceptable” PDF p. 5 (no printed page numbers), §2.3 Systemic risk acceptance determination (the first of two sections numbered 2.3), first sentence, up to “acceptable” Inspect claim & evidence ↗ Required action Heightened safeguards for prompts demonstrating WMD intent “Under this FAIF, xAI’s models apply heightened safeguards if they receive user prompts that demonstrate intent to engage in the development, use, , or proliferation of weapons of mass destruction, including CBRN agents.” PDF p. 3 (no printed page numbers), §2.1 Risk Identification › “(a) Addressing CBRN Risks”, second paragraph, first sentence Inspect claim & evidence ↗ Required action Proceed only if systemic risks are determined acceptable “xAI will only proceed with the development, the making available on the market, and/or the use of the model, if the systemic risks stemming from the model are determined to be acceptable.” PDF p. 6 (no printed page numbers), §2.3 Systemic risk acceptance determination (the first of two sections numbered 2.3), fourth paragraph, first sentence Inspect claim & evidence ↗ Required action Documented Security Goal naming targeted threat actors “xAI will maintain a documented Security Goal that identifies the threat actors against which mitigations are designed to protect against, including sophisticated non-state actors, insider threats, state-sponsored actors and other foreseeable actors.” PDF p. 7 (no printed page numbers), §2.4 Security mitigations, first paragraph, first sentence Inspect claim & evidence ↗ Not found in the inspected text Bio/chem deployment criterion: answer rate below 1 in 20 Inspected: June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 Governance Inspect claim & evidence ↗ Not found in the inspected text Deployment criterion: MASK dishonesty rate below 1 in 2 Inspected: June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 Governance Inspect claim & evidence ↗ Not found in the inspected text Deployment benefits may outweigh benchmark-identified risks Inspected: June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 Governance Inspect claim & evidence ↗ Links itself to external commitments or laws xAI’s Frontier Artificial Intelligence Framework (effective 30 June 2026) attaches a footnote to its statement of four primary risk domains saying that it follows the Safety and Security chapter of the General-Purpose AI Code of Practice developed under the EU AI Act. 2026-06-30 · effective · Stated in source · Supported Inspect claim & evidence ↗ Date basis Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
Open questions and source limits No record links the June 2026 edition to the December 2025 edition as its replacement, because no explicit statement that one supersedes the other was found. The one recorded difference was inferred by comparing the two documents. It is not based on a statement by xAI.
Records: FAIF · June 2026 edition → changes from → FAIF · December 2025 edition · xAI → published → FAIF · December 2025 edition · xAI → published → FAIF · June 2026 edition
The December 2025 edition is identified by its printed “last updated” date. The file name carries a different day, as the date note records. Neither edition has an established publication day of its own.
Records: xAI → published → FAIF · December 2025 edition · xAI → published → FAIF · June 2026 edition
Microsoft · Frontier Governance Framework Published by Microsoft. 2 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 9 tracked provisions “Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
Feb 2025 (Version 1) Microsoft Frontier Governance Framework — Version 1 (February 2025) Published 2025-02 ↗ Exact edition text: Frontier Governance Framework — Version 1 (February 2025) ↗ Archived copy, captured 2025-02-26: Frontier Governance Framework — Version 1 (February 2025) ↗
Earliest edition of this framework recorded here.
Provisions · 7 quoted Threshold or trigger CBRN weapons High risk-level capability thresholds “The model provides a meaningful uplift to an expert’s (PhD level education in related fields) ability to develop and deliver a novel CBRN threat. The model provides a meaningful uplift to a medium-skilled actor’s (e.g., STEM education) ability to develop and deliver a known CBRN threat.” PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, High row, Capability threshold column (both statements) Inspect claim & evidence ↗ Required action High or critical risk: review and mitigations before deployment “Models assessed as having a high or critical risk are subject to further review and safety and security mitigations prior to deployment.” PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', third sentence Inspect claim & evidence ↗ Required action High-risk models: security against cybercrime groups and insiders “Models posing high-risk on one or more tracked capability will be subject to security measures protective against most cybercrime groups and insider threats.” PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph (section begins on PDF p. 7), first sentence Inspect claim & evidence ↗ Required action Pause development and deployment if risk cannot be mitigated “If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.” PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentence Inspect claim & evidence ↗ Who decides Executive Officers make final deployment decision “The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.” Decides: Executive Officers responsible for Microsoft’s AI governance program (or their delegates) PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentence Inspect claim & evidence ↗ Who decides Chief Responsible AI Officer reviews updates before adoption “Any updates to our practices will be reviewed by Microsoft’s Chief Responsible AI Officer prior to their adoption.” Consulted: Chief Responsible AI Officer PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentence Inspect claim & evidence ↗ Exception Low or medium risk models may be deployed “Models assessed as posing low or medium risk may be deployed with appropriate safeguards as outlined below.” PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', second sentence Inspect claim & evidence ↗ Links itself to external commitments or laws Microsoft’s Frontier Governance Framework, Version 1 (February 2025), states that the framework has its genesis in the voluntary Frontier AI Safety Commitments that Microsoft and fifteen other AI labs made in May 2024. 2025-02 · publication · Stated in source · Supported Inspect claim & evidence ↗ Date basis Placed on the timeline by its published date. Page footers read “Version 1 (February 2025)” and the change log dates the first version 8 February 2025. No separate dated announcement was located; the earliest archive capture is 2025-02-26, so publication is dated only to the month.
Feb 2026 Microsoft Frontier Governance Framework — February 2026 Revised 2026-02 ↗ publication day not established Exact edition text: Frontier Governance Framework — February 2026 ↗ Archived copy, captured 2026-04-24: Frontier Governance Framework — February 2026 ↗ Replaces Feb 2025 (Version 1) ↗
Recorded changes from Feb 2025 (Version 1) Coverage gap. No change from the previous edition is recorded yet. That does not mean nothing changed.
Provisions · 9 quoted Threshold or trigger CBRN weapons High risk-level capability thresholds “The model provides a meaningful uplift to an expert’s (PhD level education in related fields) ability to develop and deliver a novel CBRN threat. The model provides a meaningful uplift to a medium-skilled actor’s (e.g., STEM education) ability to develop and deliver a known CBRN threat.” PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, High row, Capability threshold column (both statements) Inspect claim & evidence ↗ Required action High or critical risk: review and mitigations before deployment “Models assessed as having a high or critical risk are subject to further review and safety and security mitigations prior to deployment.” PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', third sentence Inspect claim & evidence ↗ Required action High-risk models: security against cybercrime groups and insiders “Models posing high-risk on one or more tracked high-risk capability will be subject to security measures protective against most cybercrime groups and insider threats.” PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph, first sentence Inspect claim & evidence ↗ Required action Incident response and reports for serious or critical incidents “Where we or others identify serious or critical incidents that may pose public safety or national security risks, we operationalize incident response policies and processes, conduct investigations, provide reports to regulatory authorities and impacted customers as appropriate” PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, 'Monitoring, response, and remediation' bullet, fourth sentence (first part) Inspect claim & evidence ↗ Required action Pause development and deployment if risk cannot be mitigated “If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.” PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentence Inspect claim & evidence ↗ Who decides Executive Officers make final deployment decision “The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.” Decides: Executive Officers responsible for Microsoft’s AI governance program (or their delegates) PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentence Inspect claim & evidence ↗ Who decides Independent internal experts decide on external evaluators “The decision to involve qualified and expert external actors that meet relevant security standards, including those with domain-specific expertise, is made by internal experts who are independent from the model development team.” Decides: Internal experts independent from the model development team PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, 'Capability evaluation' bullet, fifth sentence Inspect claim & evidence ↗ Who decides Chief Responsible AI Officer reviews updates before adoption “Any updates to our practices will be reviewed by Microsoft’s Chief Responsible AI Officer prior to their adoption.” Consulted: Chief Responsible AI Officer PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentence Inspect claim & evidence ↗ Exception Low or medium risk models may be deployed “Models assessed as posing low or medium risk may be deployed with appropriate safeguards as outlined below.” PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', second sentence Inspect claim & evidence ↗ Links itself to external commitments or laws Microsoft’s Frontier Governance Framework (February 2026) describes itself in its change log as a one-year update following finalisation of the EU Code of Practice for General Purpose AI, the New York RAISE Act and California’s Transparency in Frontier Artificial Intelligence Act. 2026-02 · revision · Stated in source · Supported Inspect claim & evidence ↗ Microsoft’s Frontier Governance Framework, February 2026 edition, states that the framework has its genesis in the voluntary Frontier AI Safety Commitments that Microsoft and fifteen other AI labs made in May 2024. 2026-02 · revision · Stated in source · Supported Inspect claim & evidence ↗ Microsoft's Frontier Governance Framework (February 2026) explicitly references California's TFAIA in two places. Its change log describes the edition as a one-year update following finalisation of the EU GPAI Code of Practice, New York's RAISE Act and TFAIA. Its leading-indicator assessment is run on any model in scope for frontier-model requirements under applicable laws, and it names TFAIA among those laws. 2026-02 · revision · Stated in source · Supported Inspect claim & evidence ↗ Date basis Placed on the timeline by its revised date. The edition’s footers and change log date it February 2026. A publication date is not established: the file was last modified 2026-03-24 and first captured 2026-04-24.
Open questions and source limits The February 2026 edition is identified by its version month. Its publication date is not established. The file was last modified on 2026-03-24 and first captured on 2026-04-24.
Records: Microsoft → published → Microsoft FGF · Feb 2026