Frontier safety frameworks
What did each developer’s published safety framework say, when, what replaced it, and what changed between editions?
Each framework below lists the editions recorded here, oldest first, with the date each edition is identified by. An edition is shown as replacing another only where a record documents it from the publisher’s own version sequence. Date order alone never implies replacement. Recorded changes are selected, sourced differences between two editions. They describe what the documents say. They do not show whether any requirement was implemented, followed or effective. Each edition also lists a limited set of quoted provisions: thresholds, required actions, who decides and stated exceptions. Where competent sources disagree about what a provision or change means, the disagreement is kept as a separate assessment record, marked contested or unresolved.
A machine selected and arranged these records. No human review of the selection or framing is recorded.
Download research starter
Every edition, claim, qualification, coverage gap, open question and source reference on this page, with the location of each piece of evidence, stored paraphrases and permitted short quotes. The machine selection and each record’s review status are kept separate. Original documents are not included.
Original sources for a reference manager. Every source this export cites, for Zotero, EndNote and similar tools. Cite the original documents, not Selekoa, and check each entry against them.
Editions, 2023–2026
Each mark is one edition, placed at its effective date, or at its revision or publication date where no effective date is known. Select a framework or an edition to read it.
Limits of this history
- A published framework shows what its publisher stated. It does not show implementation, compliance, effectiveness or relative safety. This page follows each framework on its own. The comparison page places what the frameworks say under shared questions; neither page ranks developers, and a shared question does not make two provisions equivalent.
- Recorded changes are a selection of documented differences. They are not a full list of amendments, and an edition with no recorded change has not been shown to be unchanged.
- Effective, publication and revision dates are kept apart. Each edition shows only the dates that have been established. A missing date is unknown.
- Editions are grouped by publisher and framework name for navigation. A different framework from the same publisher counts as a successor only where a record says so.
- Provisions are a limited, quoted selection for each edition, within the quotation policy’s limit for each document. They are not a full summary. An edition without a recorded provision has not been shown to lack it. A “not found” record states exactly which text was inspected and never claims that a provision was deleted.
- Contested records show competing assessments side by side. Secondary commentary is admitted only as evidence of the disagreement, and the page does not decide between the sides.
- Archived copies are the existing Internet Archive captures nearest each edition’s date. A capture shows only what the archive retrieved that day. It does not prove what the document said earlier, and it can differ from the copy checked for the evidence.
Anthropic · Responsible Scaling Policy
Published by Anthropic. 9 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 32 tracked provisions
“Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
| Provision | v1.0 | v2.0 | v2.1 | v2.2 | v3.0 | v3.1 | v3.2 | v3.3 | v3.4 |
|---|---|---|---|---|---|---|---|---|---|
| Threshold or trigger ASL-2 illustration: a system giving bioweapon-related information not findable via a search engine, but too unreliably to be useful | Stated | – | – | – | – | – | – | – | – |
| Threshold or trigger Early guess at ASL-4: AI models have become the primary source of national security risk in a major area, such as biological weapons | Stated | – | – | – | – | – | – | – | – |
| Threshold or trigger v3.0: Automated R&D threshold: two years' progress in one yearv3.1: Automated R&D threshold: researcher substitution or dramatic accelerationv3.3, v3.4: Automated R&D threshold: when dramatic acceleration counts as occurringv2.0 to v2.2 also have a capability threshold for “Autonomous AI Research and Development”, which this row does not yet track. See each edition’s document page. v2.0 → · v2.1 → · v2.2 → | – | – | – | – | Stated | Stated | – | Stated | Stated |
| Threshold or trigger CBRN-4: substantial uplift to the CBRN development capabilities of moderately resourced state programs | – | – | Stated | – | – | – | – | – | – |
| Threshold or trigger CBRN threshold assessed against 2023-level online resources, with funding and up to a year but no initial specialised expertise | – | Stated | – | – | – | – | – | – | – |
| Threshold or trigger v1.0: ASL-3 misuse capability: substantially increased catastrophic misuse riskv2.0: CBRN weapons Capability Thresholdv2.1, v2.2: CBRN-3 Capability Thresholdv3.0: Non-novel chemical/biological weapons production threshold | Stated | Stated | Stated | Stated | Stated | – | – | – | – |
| Threshold or trigger Novel chemical/biological weapons production threshold | – | – | – | – | – | – | Stated | Stated | – |
| Required action ASL-3 deployment red-teaming must cover at least extreme CBRN risks and cybersecurity | Stated | – | – | – | – | – | – | – | – |
| Required action CBRN-4 is expected to require the ASL-4 Deployment and Security Standards, not yet specified | – | – | Stated | – | – | – | – | – | – |
| Required action CBRN Capability Threshold requires the ASL-3 Deployment Standard and the ASL-3 Security Standard | – | Stated | – | – | – | – | – | – | – |
| Required action Delay development and deployment when Anthropic is in the lead | – | – | – | – | Stated | Stated | Stated | Stated | Stated |
| Required action Meet or exceed competitors' risk reduction posture | – | – | – | – | Stated | – | – | – | – |
| Required action General upleveling: effort to match competitor mitigation, no necessary delay | – | – | – | – | Stated | – | – | – | – |
| Required action v1.0: Pause scaling or delay deployment when safety procedures lagv2.0, v2.1, v2.2: Commitment not to train or deploy without adequate safeguards | Stated | Stated | Stated | Stated | Not found | Not found | Not found | Not found | Not found |
| Required action v1.0: Pause training before capability outstrips Containment Measuresv2.0, v2.1, v2.2: Pause training until ASL-3 Security Standard implemented | Stated | Stated | Stated | Stated | Not found | – | – | – | – |
| Required action Restrict deployment and scaling if safeguards showing fails | – | Stated | Stated | Stated | Not found | – | – | – | – |
| Who decides ASL evaluation results shared with board and LTBT | Stated | – | – | – | – | – | – | – | – |
| Who decides v2.0, v2.1, v2.2: CEO and RSO deployment decision shared with Board and LTBTv3.0, v3.1, v3.2, v3.3, v3.4: CEO and RSO Risk Report decisions shared with Board, LTBT | – | Stated | Stated | Stated | Stated | Stated | Stated | Stated | Stated |
| Who decides Regular LTBT briefings on Risk Report plans and developments | – | – | – | – | – | – | Stated | – | – |
| Who decides External review of a Risk Report on LTBT request | – | – | – | – | – | – | Stated | Stated | Stated |
| Who decides Board and LTBT approval when marginal risk analysis is central | – | – | – | – | Stated | Stated | Stated | Stated | Stated |
| Who decides v1.0: Policy updates approved by board after LTBT consultationv2.0, v2.1: Policy changes proposed by CEO and RSO, approved by Board | Stated | Stated | Stated | – | – | – | – | – | – |
| Who decides CISO and CEO convened to decide on weight deletion | Stated | Not found | – | – | – | – | – | – | – |
| Exception Emergency loosening of restrictions | Stated | – | – | – | – | – | – | – | – |
| Exception No unilateral, unconditional commitment to industry-wide recommendations | – | – | – | – | Stated | – | – | – | – |
| Exception Required Safeguards may be lowered if another actor passes a threshold | – | Stated | Stated | Stated | – | – | – | – | – |
| Exception May deploy and train above threshold once ASL-3 Required Safeguards met | – | Stated | Stated | Stated | Not found | – | – | – | – |
| Exception ASL-3 Security Standard alone suffices to continue training | – | Stated | – | – | – | – | – | – | – |
| Exception Tiered access for vetted users | Stated | – | – | – | – | – | – | – | – |
| Evaluation timing First area of evaluation effort is bioweapons risk, with threat models and capabilities set in consultation with biosecurity experts | Stated | – | – | – | – | – | – | – | – |
| Reporting A list of specific CBRN capabilities of concern is maintained, treated as sensitive, and planned to be shared with AI Safety Institutes and the Frontier Model Forum | – | Stated | – | – | – | – | – | – | – |
| Reporting At the novel chemical/biological threshold: identify the most concerning threat pathways, make policy recommendations for early detection and response, and share them with policymakers | – | – | – | – | Stated | – | – | – | – |
v1.0Responsible Scaling Policy (2023)
Earliest edition of this framework recorded here.
Provisions · 12 quoted
- Threshold or triggerASL-2 illustration: a system giving bioweapon-related information not findable via a search engine, but too unreliably to be useful“an AI system that can provide bioweapon-related information that couldn’t be found via a search engine, but does so too unreliably to be useful in practice”PDF p. 4 (printed p. 4), AI Safety Level table, ASL-2 row, “Dangerous Capabilities” columnInspect claim & evidence ↗
- Threshold or triggerEarly guess at ASL-4: AI models have become the primary source of national security risk in a major area, such as biological weapons“AI models have become the primary source of national security risk in a major area (such as cyberattacks or biological weapons)”PDF p. 14 (printed p. 14), “Early Thoughts on ASL-4 and Higher”, bullet “Critical catastrophic misuse risk”, first sentenceInspect claim & evidence ↗
- Threshold or triggerASL-3 misuse capability: substantially increased catastrophic misuse risk“Access to the model would substantially increase the risk of deliberately-caused catastrophic harm, either by proliferating capabilities, lowering costs, or enabling new methods of attack. This increase in risk is measured relative to today’s baseline level of risk that comes from e.g. access to search engines and textbooks.”PDF p. 6 (printed p. 6), section 'ASL-3 Commitments', subsection 'ASL-3 Capabilities and Threat Models', numbered item 1 ('Capabilities that significantly increase risk of misuse catastrophe'), first and second sentencesInspect claim & evidence ↗
- Required actionASL-3 deployment red-teaming must cover at least extreme CBRN risks and cybersecurity“Misuse domains should at a minimum include causes of extreme CBRN risks, and cybersecurity.”PDF p. 8 (printed p. 8), “ASL-3 Deployment Measures”, bullet “Successfully pass red-teaming”, second sentenceInspect claim & evidence ↗
- Required actionPause scaling or delay deployment when safety procedures lag“Anthropic’s commitment to follow the ASL scheme thus implies that we commit to pause the scaling2 and/or delay the deployment of new models whenever our scaling ability outstrips our ability to comply with the safety procedures for the corresponding ASL.”PDF p. 2 (printed p. 2), section 'Framework', paragraph beginning 'Complying with higher ASLs', second sentenceInspect claim & evidence ↗
- Required actionPause training before capability outstrips Containment Measures“We commit to pause training before a model's capability level outstrips the Containment Measures we have implemented.”PDF p. 4 (printed p. 4), section 'Initial Commitments', numbered item 4 ('Evaluation protocol'), second sentenceInspect claim & evidence ↗
- Who decidesASL evaluation results shared with board and LTBT“Share results of ASL evaluations promptly with Anthropic's governing bodies, including the board of directors and LTBT, in order to sufficiently inform them of changes to our risk profile.”Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 10 (printed p. 10), section 'Procedural Commitments', numbered item 6Inspect claim & evidence ↗
- Who decidesPolicy updates approved by board after LTBT consultation“Follow an "Update Process" for this document, including approval by the board of directors, following consultation with the Long-Term Benefit Trust (LTBT).”Decides: Board of Directors · Consulted: Long-Term Benefit TrustPDF p. 10 (printed p. 10), section 'Procedural Commitments', numbered item 1, first sentenceInspect claim & evidence ↗
- Who decidesCISO and CEO convened to decide on weight deletion“If the model has already surpassed the next ASL during training, immediately lock down access to the weights. Stakeholders including the CISO and CEO should be immediately convened to determine whether the level of danger merits deletion of the weights.”Decides: CISO (among convened stakeholders) · Decides: CEO (among convened stakeholders)PDF p. 13 (printed p. 13), section 'Evaluation Protocol', bullet 'Response policy', step (2c), first and second sentencesInspect claim & evidence ↗
- ExceptionEmergency loosening of restrictions“we could envisage a substantial loosening of these restrictions as an emergency response. Such action would only be taken in consultation with governmental authorities, and the compelling case for it would be presented publicly to the extent possible.”PDF p. 10, Procedural Commitments, item 1 (“Update Process”), second sub-bullet, from the second half of the first sentenceInspect claim & evidence ↗
- ExceptionTiered access for vetted users“In limited cases, models with capabilities relevant to catastrophic harm may be made available to a select group of vetted users with a legitimate and beneficial use-case that cannot be separated from dangerous capabilities, and only if such access can be granted safely and with sufficient oversight.”PDF p. 9 (printed p. 9), section 'ASL-3 Commitments', subsection 'ASL-3 Deployment Measures', bullet 'Tiered access', first sentenceInspect claim & evidence ↗
- Evaluation timingFirst area of evaluation effort is bioweapons risk, with threat models and capabilities set in consultation with biosecurity experts“Our first area of effort is in evaluating bioweapons risks where we will determine threat models and capabilities in consultation with a number of world-class biosecurity experts.”PDF p. 7 (printed p. 7), section “ASL-3 Capabilities and Threat Models”, item 1, paragraph following the misuse thresholdInspect claim & evidence ↗
Links itself to external commitments or laws
Date basis and other records
Placed on the timeline by its effective date. Initial public policy dated September 19, 2023; original entity and publication claim retained.
- Anthropic RSP v1.0 says its commitments are designed in the spirit of the Responsible Scaling Policy framework being developed by Paul Christiano and ARC Evals.2023-09-19 · publication · Stated in source · Supported Inspect claim & evidence ↗
- The RSP announcement explicitly credited ARC Evals’ framework as inspiring Anthropic’s approach.2023-09-19 · event · Stated in source · Supported Inspect claim & evidence ↗
v2.0Anthropic Responsible Scaling Policy — v2.0
Recorded changes from v1.0
- Inferred document comparisonProvision · Threshold or trigger: CBRN weapons Capability Thresholdv2.0's threshold concerns CBRN weapons specifically, defined as significant help to individuals or groups with basic technical backgrounds in creating/obtaining and deploying them; v1.0's ASL-3 misuse capability was defined as model access substantially increasing the risk of deliberately-caused catastrophic harm generally, measured against a search-engine and textbook baseline.2024-10-15 · effective · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Required action: Pause training until ASL-3 Security Standard implementedv2.0 makes the training pause conditional on a model in pretraining reaching capabilities comparable to or greater than a model that requires the ASL-3 Security Standard and continues it until that standard is implemented and established as sufficient for the model, within §6.2, which applies where a model requires the ASL-3 Required Safeguards but Anthropic is unable to implement them immediately; v1.0 committed to pause training before a model’s capability level outstrips the Containment Measures Anthropic has implemented.2024-10-15 · effective · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Who decides: Policy changes proposed by CEO and RSO, approved by Boardv2.0 states that policy changes are proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors in consultation with the LTBT; v1.0's Update Process named approval by the board of directors following consultation with the LTBT and named no proposer.2024-10-15 · effective · Inferred · Supported Inspect claim & evidence ↗
- Assessed effectUnresolvedDid RSP v2.0’s changes to threshold and mitigation specification reduce the verifiability of Anthropic’s safety commitments relative to v1.0?2024-10-15 · effective · Question posed by Selekoa · Unresolved Inspect claim & evidence ↗
- Official changelogRSP v2.0 changes “ASL” to refer to groups of safeguards, rather than also referring to models.2024-10-15 · effective · Stated in source · Supported Inspect claim & evidence ↗
Provisions · 12 quoted · 1 not found
- Threshold or triggerCBRN threshold assessed against 2023-level online resources, with funding and up to a year but no initial specialised expertise“comparing what potential attackers could achieve with full model access versus 2023-level online resources, assuming they have funding and up to one year of time to invest, but no initial specialized expertise”PDF p. 20 (printed p. 16), Appendix C: Detailed Capability Thresholds, paragraph “Chemical, Biological, Radiological, and Nuclear (CBRN) weapons”, second sentenceInspect claim & evidence ↗
- Threshold or triggerCBRN weapons Capability Threshold“The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.”PDF p. 7 (printed p. 3), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', Capability Thresholds columnInspect claim & evidence ↗
- Required actionCBRN Capability Threshold requires the ASL-3 Deployment Standard and the ASL-3 Security Standard“The ASL-3 Deployment Standard and the ASL-3 Security Standard, which protect against misuse and model-weight theft by non-state adversaries, are required.”PDF p. 7 (printed p. 3), §2 Capability Thresholds and Required Safeguards, table row “Chemical, Biological, Radiological, and Nuclear (CBRN) weapons”, Required Safeguards column, second sentenceInspect claim & evidence ↗
- Required actionCommitment not to train or deploy without adequate safeguards“In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.”PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentenceInspect claim & evidence ↗
- Required actionPause training until ASL-3 Security Standard implemented“If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.”PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentenceInspect claim & evidence ↗
- Required actionRestrict deployment and scaling if safeguards showing fails“If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.”PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the bulleted process)Inspect claim & evidence ↗
- Who decidesCEO and RSO deployment decision shared with Board and LTBT“If the CEO and RSO decide to proceed with deployment and training, they will share their decision–as well as the underlying Capability Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.”Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 13 (printed p. 9), §4.3 Safeguards Decision, fourth bulletInspect claim & evidence ↗
- Who decidesPolicy changes proposed by CEO and RSO, approved by Board“Changes to this policy will be proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors, in consultation with the Long-Term Benefit Trust.”Recommends: CEO · Recommends: Responsible Scaling Officer · Decides: Board of Directors · Consulted: Long-Term Benefit TrustPDF p. 16 (printed p. 12), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentenceInspect claim & evidence ↗
- ExceptionRequired Safeguards may be lowered if another actor passes a threshold“In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.”PDF p. 16, footnote 18, second sentenceInspect claim & evidence ↗
- ExceptionMay deploy and train above threshold once ASL-3 Required Safeguards met“If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.”PDF p. 13 (printed p. 9), §4.3 Safeguards Decision, first paragraph, first sentenceInspect claim & evidence ↗
- ExceptionASL-3 Security Standard alone suffices to continue training“We consider implementation of the ASL-3 Security Standard alone sufficient to continue training, regardless of whether the ASL-3 Deployment Standard is satisfied.”PDF p. 15 (printed p. 11), footnote 14 (attached to the §6.2 'Monitoring pretraining' bullet), first sentenceInspect claim & evidence ↗
- ReportingA list of specific CBRN capabilities of concern is maintained, treated as sensitive, and planned to be shared with AI Safety Institutes and the Frontier Model Forum“we maintain a current list of specific CBRN capabilities of concern … we plan to share them with organizations such as AI Safety Institutes and the Frontier Model Forum”PDF p. 20 (printed p. 16), Appendix C, footnote 21Inspect claim & evidence ↗
- Not found in the inspected textCISO and CEO convened to decide on weight deletionInspected: RSP v2.0 (effective October 15, 2024), whole text layer, PDF pp. 1–22: cover, summary and contents (pp. 1–4); Introduction and §§1–7 (pp. 5–17); Appendices A–C (pp. 18–20); Changelog (pp. 21–22).Inspect claim & evidence ↗
Links itself to external commitments or laws
- Anthropic’s Responsible Scaling Policy v2.0 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024).2024-10-15 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Anthropic’s Responsible Scaling Policy v2.0 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023).2024-10-15 · effective · Stated in source · Supported Inspect claim & evidence ↗
Date basis
Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v2.1Anthropic Responsible Scaling Policy — v2.1
Recorded changes from v2.0
- Official changelogThe RSP v2.1 change log states that the update adds a new capability threshold related to CBRN development, defining capabilities that could substantially uplift the development capabilities of moderately resourced state programs.2025-03-31 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Who decides: CEO and RSO deployment decision shared with Board and LTBTIn the safeguards decision, v2.1 has the CEO and RSO share the underlying Safeguards Report with the Board and LTBT; v2.0's sentence named the underlying Capability Report.2025-03-31 · effective · Inferred · Supported Inspect claim & evidence ↗
- Official changelogRSP v2.1 separates AI R&D thresholds for automating entry-level research and dramatically accelerating effective scaling.2025-03-31 · effective · Stated in source · Supported Inspect claim & evidence ↗
Provisions · 10 quoted
- Threshold or triggerCBRN-4: substantial uplift to the CBRN development capabilities of moderately resourced state programs“The ability to substantially uplift CBRN development capabilities of moderately resourced state programs (with relevant expert teams), such as by novel weapons design, substantially accelerating existing processes, or dramatic reduction in technical barriers.”PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row “Chemical, Biological, Radiological, and Nuclear (CBRN) weapons”, entry “CBRN-4”, Capability Thresholds columnInspect claim & evidence ↗
- Threshold or triggerCBRN-3 Capability Threshold“The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.”PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds columnInspect claim & evidence ↗
- Required actionCBRN-4 is expected to require the ASL-4 Deployment and Security Standards, not yet specified“We expect this threshold will require the ASL-4 Deployment and Security Standards. We plan to add more information about what those entail in a future update.”PDF p. 8 (printed p. 4), §2, table row “CBRN weapons”, entry “CBRN-4”, Required Safeguards columnInspect claim & evidence ↗
- Required actionCommitment not to train or deploy without adequate safeguards“In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.”PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentenceInspect claim & evidence ↗
- Required actionPause training until ASL-3 Security Standard implemented“If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.”PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentenceInspect claim & evidence ↗
- Required actionRestrict deployment and scaling if safeguards showing fails“If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.”PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the numbered process)Inspect claim & evidence ↗
- Who decidesCEO and RSO deployment decision shared with Board and LTBT“If the CEO and RSO decide to proceed with deployment and training, they will share their decision–as well as the underlying Safeguards Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.”Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 14 (printed p. 10), §4.3 Safeguards Decision, item 4Inspect claim & evidence ↗
- Who decidesPolicy changes proposed by CEO and RSO, approved by Board“Changes to this policy will be proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors, in consultation with the Long-Term Benefit Trust.”Recommends: CEO · Recommends: Responsible Scaling Officer · Decides: Board of Directors · Consulted: Long-Term Benefit TrustPDF p. 17 (printed p. 13), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentenceInspect claim & evidence ↗
- ExceptionRequired Safeguards may be lowered if another actor passes a threshold“In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.”PDF p. 17, footnote 17, second sentenceInspect claim & evidence ↗
- ExceptionMay deploy and train above threshold once ASL-3 Required Safeguards met“If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.”PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, first paragraph, first sentenceInspect claim & evidence ↗
Links itself to external commitments or laws
- Anthropic’s Responsible Scaling Policy v2.1 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024).2025-03-31 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Anthropic’s Responsible Scaling Policy v2.1 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023).2025-03-31 · effective · Stated in source · Supported Inspect claim & evidence ↗
Date basis
Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v2.2Anthropic Responsible Scaling Policy — v2.2
Recorded changes from v2.1
- Official changelogThe RSP v2.2 change log gives, as one of the two reasons it states for excluding sophisticated and state-compromised insiders from the ASL-3 Security Standard, that the CBRN-3 threat models entail large numbers of users having access to unguarded models, which it says is more likely to occur through a universal jailbreak than via model theft.2025-05-14 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogRSP v2.2 excludes sophisticated insiders and state-compromised insiders from the ASL-3 Security Standard.2025-05-14 · effective · Stated in source · Supported Inspect claim & evidence ↗
Provisions · 7 quoted
- Threshold or triggerCBRN-3 Capability Threshold“The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.”PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds columnInspect claim & evidence ↗
- Required actionCommitment not to train or deploy without adequate safeguards“In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.”PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentenceInspect claim & evidence ↗
- Required actionPause training until ASL-3 Security Standard implemented“If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.”PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentenceInspect claim & evidence ↗
- Required actionRestrict deployment and scaling if safeguards showing fails“If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.”PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the numbered process)Inspect claim & evidence ↗
- Who decidesCEO and RSO deployment decision shared with Board and LTBT“If the CEO and RSO decide to proceed with deployment and training, they will share their decision– as well as the underlying Safeguards Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.”Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 14 (printed p. 10), §4.3 Safeguards Decision, item 4Inspect claim & evidence ↗
- ExceptionRequired Safeguards may be lowered if another actor passes a threshold“In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.”PDF p. 17, footnote 17, second sentenceInspect claim & evidence ↗
- ExceptionMay deploy and train above threshold once ASL-3 Required Safeguards met“If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.”PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, first paragraph, first sentenceInspect claim & evidence ↗
Links itself to external commitments or laws
- Anthropic’s Responsible Scaling Policy v2.2 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024).2025-05-14 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Anthropic’s Responsible Scaling Policy v2.2 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023).2025-05-14 · effective · Stated in source · Supported Inspect claim & evidence ↗
Date basis
Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v3.0Anthropic Responsible Scaling Policy — v3.0
Recorded changes from v2.2
- Inferred document comparisonProvision · Who decides: CEO and RSO Risk Report decisions shared with Board, LTBTv3.0 has the CEO and RSO, following approval of a Risk Report, promptly share their decision(s), the Risk Report and internal feedback with the Board and LTBT; v2.2 had them, on deciding to proceed with deployment and training, share that decision with the Safeguards Report and internal and any external feedback with the Board and LTBT before moving forward.2026-02-24 · effective · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Threshold or trigger: Non-novel chemical/biological weapons production thresholdv3.0's threshold covers significant help to individuals or groups with basic technical backgrounds in creating/obtaining and deploying chemical and/or biological weapons with serious potential for catastrophic damages; v2.2's CBRN-3 threshold covered the same help for CBRN weapons without that qualifier.2026-02-24 · effective · Inferred · Supported Inspect claim & evidence ↗
- Assessed effectUnresolvedWhether RSP v3.0’s new roadmap and transparency mechanisms compensate for its reduced unilateral commitments, in the policy’s overall capacity to secure risk mitigation, remains unsettled.2026-02-24 · effective · Question posed by Selekoa · Unresolved Inspect claim & evidence ↗
- Publisher statementRSP v3.0 separates Anthropic’s own mitigation plans from its recommendations for industry-wide mitigation.2026-02-24 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Publisher statementRSP v3.0 introduces Risk Reports discussing model risks and development or deployment determinations.2026-02-24 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Publisher statementRSP v3.0 introduces Frontier Safety Roadmaps.2026-02-24 · effective · Stated in source · Supported Inspect claim & evidence ↗
Provisions · 9 quoted · 4 not found
- Threshold or triggerAutomated R&D threshold: two years' progress in one year“Our working operationalization is to trigger this risk threshold at the point where we determine that a model could compress two years of 2018 – 2024 AI progress into a single year.”PDF p. 8 (printed p. 8), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column, third paragraph, first sentenceInspect claim & evidence ↗
- Threshold or triggerNon-novel chemical/biological weapons production threshold“AI systems with the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy chemical and/or biological weapons with serious potential for catastrophic damages.”PDF p. 6 (printed p. 6), §1 Our Recommendations for Industry-Wide Safety, table row 'Non-novel chemical/biological weapons production', left column ('Capability or usage threshold')Inspect claim & evidence ↗
- Required actionDelay development and deployment when Anthropic is in the lead“We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment columnInspect claim & evidence ↗
- Required actionMeet or exceed competitors' risk reduction posture“For our highly capable frontier models, we will meet or exceed the overall risk reduction posture of these competitors, as far as we can tell based on our best efforts to assess that posture.”PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Competitors have strong safety measures', Commitment column, first sentenceInspect claim & evidence ↗
- Required actionGeneral upleveling: effort to match competitor mitigation, no necessary delay“We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.”PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'General upleveling', Commitment columnInspect claim & evidence ↗
- Who decidesCEO and RSO Risk Report decisions shared with Board, LTBT“Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.”Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 12 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification')Inspect claim & evidence ↗
- Who decidesBoard and LTBT approval when marginal risk analysis is central“In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling OfficerPDF p. 12 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')Inspect claim & evidence ↗
- ExceptionNo unilateral, unconditional commitment to industry-wide recommendations“In particular, we cannot unilaterally and unconditionally commit to staying in line with the industry-wide recommendations in the right column.”PDF p. 4 (printed p. 4), §1 Our Recommendations for Industry-Wide Safety, second paragraph, second sentenceInspect claim & evidence ↗
- ReportingAt the novel chemical/biological threshold: identify the most concerning threat pathways, make policy recommendations for early detection and response, and share them with policymakers“we will identify the most concerning specific threat pathways, create policy recommendations for early detection and response for such threats, and share this content with policymakers”PDF p. 7 (printed p. 7), §1 Our Recommendations for Industry-Wide Safety, threshold table, row “Novel chemical/biological weapons production”, middle column (“Mitigations—our plan as a company”), second paragraphInspect claim & evidence ↗
- Not found in the inspected textCommitment not to train or deploy without adequate safeguardsInspected: RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports, 3.1–3.6.3 (pp. 10–15); §4 Governance (p. 15); Appendix A: Commitments Related to Competitors and Appendix B: Notes on ASLs (p. 16); Changelog (pp. 17–19).Inspect claim & evidence ↗
- Not found in the inspected textPause training until ASL-3 Security Standard implementedInspected: RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19).Inspect claim & evidence ↗
- Not found in the inspected textRestrict deployment and scaling if safeguards showing failsInspected: RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19).Inspect claim & evidence ↗
- Not found in the inspected textMay deploy and train above threshold once ASL-3 Required Safeguards metInspected: RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19).Inspect claim & evidence ↗
Date basis
Placed on the timeline by its effective date. The cover effective date and release announcement publication date both identify February 24, 2026.
v3.1Anthropic Responsible Scaling Policy — v3.1
Provisions · 4 quoted · 1 not found
- Threshold or triggerAutomated R&D threshold: researcher substitution or dramatic acceleration“We will consider this threshold to be met if we determine that either (1) our models would be able to fully substitute for our entire set of Research Scientists and Research Engineers, at competitive costs”PDF p. 8 (printed p. 8), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column, third paragraph (sentence continues on PDF p. 9)Inspect claim & evidence ↗
- Required actionDelay development and deployment when Anthropic is in the lead“We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment columnInspect claim & evidence ↗
- Who decidesCEO and RSO Risk Report decisions shared with Board, LTBT“Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.”Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification')Inspect claim & evidence ↗
- Who decidesBoard and LTBT approval when marginal risk analysis is central“In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling OfficerPDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')Inspect claim & evidence ↗
- Not found in the inspected textCommitment not to train or deploy without adequate safeguardsInspected: RSP v3.1 (effective April 2, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10); §2–§3 Risk Reports (pp. 11–15); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 17–20).Inspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v3.2Anthropic Responsible Scaling Policy — v3.2
Recorded changes from v3.1
Provisions · 6 quoted · 1 not found
- Threshold or triggerNovel chemical/biological weapons production threshold“AI systems with the ability to significantly help threat actors (for example, moderately resourced expert-backed teams) create/obtain and deploy chemical and/or biological weapons with potential for catastrophic damages far beyond those of past catastrophes such as COVID-19.”PDF p. 7 (printed p. 7), §1 Our Recommendations for Industry-Wide Safety, table row 'Novel chemical/biological weapons production', left column ('Capability or usage threshold')Inspect claim & evidence ↗
- Required actionDelay development and deployment when Anthropic is in the lead“We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment columnInspect claim & evidence ↗
- Who decidesCEO and RSO Risk Report decisions shared with Board, LTBT“Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.”Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification')Inspect claim & evidence ↗
- Who decidesRegular LTBT briefings on Risk Report plans and developments“We will regularly brief the LTBT on plans and developments related to our Risk Reports, including model training, capability evals, mitigations, and risk analyses.”Informed: Long-Term Benefit TrustPDF p. 16 (printed p. 15), §4 Governance, numbered item 2 ('Long Term Benefit Trust')Inspect claim & evidence ↗
- Who decidesExternal review of a Risk Report on LTBT request“In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.”Decides: Long-Term Benefit TrustPDF p. 14 (printed p. 13), §3.6 External Review, final paragraph before §3.6.1Inspect claim & evidence ↗
- Who decidesBoard and LTBT approval when marginal risk analysis is central“In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling OfficerPDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')Inspect claim & evidence ↗
- Not found in the inspected textCommitment not to train or deploy without adequate safeguardsInspected: RSP v3.2 (effective April 29, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 18–20).Inspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v3.3Anthropic Responsible Scaling Policy — v3.3
Recorded changes from v3.2
- Official changelogThe RSP v3.3 change log states that the update revises Anthropic’s threshold for novel chemical/biological weapons production to better track the threat model of concern, and refines its approach to off-cycle updates regarding the risks of individual models.2026-05-26 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogProvision · Threshold or trigger: Novel chemical/biological weapons production thresholdv3.3’s threshold covers AI systems that can functionally substitute for the scarce human expertise that is currently the primary barrier to novel development of chemical and biological weapons with potential for catastrophic harm (footnoted as consequences comparable to or worse than COVID-19); that is, a well-resourced team could use the model for the end-to-end agent design and deployment, including formulation and dissemination, that would otherwise require recruiting one of a small number of world-leading specialists. v3.2’s threshold covered AI systems able to significantly help threat actors, such as moderately resourced expert-backed teams, create or obtain and deploy such weapons with potential for catastrophic damages far beyond past catastrophes such as COVID-19.2026-05-26 · effective · Stated in source · Supported Inspect claim & evidence ↗
Provisions · 6 quoted · 1 not found
- Threshold or triggerAutomated R&D threshold: when dramatic acceleration counts as occurring“We would consider scenario (2) to have occurred where (a) we observe or expect double the rate of progress8 in AI aggregate capabilities compared to the rate we’d expect in the absence of significant AI contributions to AI R&D”PDF p. 9 (printed p. 9), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column ('Capability or usage threshold'), paragraph beginning 'We would consider scenario (2)', to the end of condition (a)Inspect claim & evidence ↗
- Threshold or triggerNovel chemical/biological weapons production threshold“AI systems that can functionally substitute for the scarce human expertise that is currently the primary barrier to novel development of chemical and biological weapons with potential for catastrophic harm.”PDF p. 7 (printed p. 7), §1 Our Recommendations for Industry-Wide Safety, table row 'Novel chemical/biological weapons production', left column, first sentenceInspect claim & evidence ↗
- Required actionDelay development and deployment when Anthropic is in the lead“We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment columnInspect claim & evidence ↗
- Who decidesCEO and RSO Risk Report decisions shared with Board, LTBT“Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.”Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification')Inspect claim & evidence ↗
- Who decidesExternal review of a Risk Report on LTBT request“In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.”Decides: Long-Term Benefit TrustPDF p. 14 (printed p. 13), §3.6 External Review, final paragraph before §3.6.1Inspect claim & evidence ↗
- Who decidesBoard and LTBT approval when marginal risk analysis is central“In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling OfficerPDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')Inspect claim & evidence ↗
- Not found in the inspected textCommitment not to train or deploy without adequate safeguardsInspected: RSP v3.3 (effective May 26, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10, columns on p. 9 read individually because the text layer interleaves them); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 18–20).Inspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
v3.4Anthropic Responsible Scaling Policy — v3.4
Recorded changes from v3.3
- Official changelogProvision · Threshold or trigger: Automated R&D threshold: when dramatic acceleration counts as occurringv3.4 counts the dramatic-acceleration scenario of the Automated R&D threshold as having occurred where the observed or expected doubling of AI progress is measured against both the rate Anthropic would expect and the fastest rate of extended progress it has observed (over at least three model generations) without significant AI contributions to AI R&D, and where continuing the trend “seems likely to lead to” even greater acceleration; v3.3 measured the doubling against the expected rate alone, and continuing the trend “could lead to” even greater acceleration.2026-07-08 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogRSP v3.4 allows a Risk Report coverage date up to 30 days before publication.2026-07-08 · effective · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogRSP v3.4 changes fully unredacted Risk Report sharing to at least 200 employees, instead of all regular-clearance staff.2026-07-08 · effective · Stated in source · Supported Inspect claim & evidence ↗
Provisions · 5 quoted · 1 not found
- Threshold or triggerAutomated R&D threshold: when dramatic acceleration counts as occurring“We would consider scenario (2) to have occurred where (a) we observe or expect double the rate of progress8 in AI aggregate capabilities compared to both the rate we’d expect and the fastest rate of extended progress9 we’ve observed in the absence of significant AI contributions to AI R&D”PDF p. 9 (printed p. 9), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column ('Capability or usage threshold'), paragraph beginning 'We would consider scenario (2)', to the end of condition (a); footnote 9Inspect claim & evidence ↗
- Required actionDelay development and deployment when Anthropic is in the lead“We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”PDF p. 17 (printed p. 17), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment columnInspect claim & evidence ↗
- Who decidesCEO and RSO Risk Report decisions shared with Board, LTBT“Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.”Decides: CEO · Decides: Responsible Scaling Officer · Informed: Board of Directors · Informed: Long-Term Benefit TrustPDF p. 13 (printed p. 13), §3.4 Procedures, item 4 ('Governance notification')Inspect claim & evidence ↗
- Who decidesExternal review of a Risk Report on LTBT request“In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.”Decides: Long-Term Benefit TrustPDF p. 14 (printed p. 14), §3.6 External Review, final paragraph before §3.6.1Inspect claim & evidence ↗
- Who decidesBoard and LTBT approval when marginal risk analysis is central“In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”Decides: Board of Directors · Decides: Long-Term Benefit Trust · Decides: CEO · Decides: Responsible Scaling OfficerPDF p. 14 (printed p. 14), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')Inspect claim & evidence ↗
- Not found in the inspected textCommitment not to train or deploy without adequate safeguardsInspected: RSP v3.4 (effective July 8, 2026), whole text layer, PDF pp. 1–21: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10, columns on p. 9 read individually because the text layer interleaves them); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A and Appendix B (p. 17); Changelog (pp. 18–21).Inspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
Open questions and source limits
Two questions remain open. Did the v2.0 revision make Anthropic’s commitments less verifiable? Do v3.0’s roadmap and transparency mechanisms compensate for its reduced unilateral commitments? Each record keeps the published assessments as context, because none directly opposes another on the same question. The changes to the text are recorded separately.
Records: RSP · v2.0 → changes from → RSP · 2023 · RSP · v3.0 → changes from → RSP · v2.2
Most Responsible Scaling Policy revisions are identified by their effective dates. Where no publication day was established, none is inferred.
Records: Anthropic → published → RSP · v2.0 · Anthropic → published → RSP · v2.1 · Anthropic → published → RSP · v2.2 · Anthropic → published → RSP · v3.1 · Anthropic → published → RSP · v3.2 · Anthropic → published → RSP · v3.3 · Anthropic → published → RSP · v3.4
Google DeepMind · Frontier Safety Framework
Published by Google DeepMind. 4 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 22 tracked provisions
“Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
| Provision | v1.0 | v2.0 | v3.0 | v3.1 |
|---|---|---|---|---|
| Threshold or trigger v1.0: Early warning evaluations with a pass conditionv2.0: Early warning evaluations with an alert thresholdv3.0: Alert thresholds for early warning evaluationsv3.1: Alert thresholds drawing on evaluations and other information | Stated | Stated | Stated | Stated |
| Threshold or trigger Autonomy level 1 CCL | Stated | Not found | – | – |
| Threshold or trigger Bio amateur enablement level 1: significantly enabling a non-expert to develop known biothreats | Stated | – | – | – |
| Threshold or trigger Bio expert enablement level 1: significantly enabling an expert to develop novel biothreats | Stated | – | – | – |
| Threshold or trigger CBRN uplift 1: significant assistance to a low-resourced actor, resulting in a substantial increase in ability to cause a mass casualty event | – | Stated | – | – |
| Threshold or trigger CBRN uplift TCL: uplift to low to medium resourced actors in reference scenarios, resulting in material risk of CBRN attacks causing significant but not severe harm | – | – | – | Stated |
| Threshold or trigger Evaluation every 6x effective compute and 3 months’ fine-tuning | Stated | Not found | – | – |
| Required action CBRN uplift 1 recommended security level: controls and detections generally aligned with RAND SL 2 | – | Stated | – | – |
| Required action v3.0: Framework updated at least once a yearv3.1: Framework reviewed at least once a year | – | – | Stated | Stated |
| Required action v1.0: Hold on deployment or development if mitigations not readyv2.0: Response plan may put deployment or development on hold | Stated | Stated | Not found | – |
| Required action v1.0: Response plan when evaluation thresholds are reachedv2.0, v3.0, v3.1: Proximity and risk assessment informing a response plan | Stated | Stated | Stated | Stated |
| Required action v3.0: Response plan where capabilities remain distant from a CCLv3.1: Response plan may update the alert threshold | – | – | Stated | Stated |
| Who decides v2.0: Disclosure to government authoritiesv3.0, v3.1: Information sharing with government authorities | – | Stated | Stated | Stated |
| Who decides v2.0: Pre-deployment safety case review by corporate governance bodyv3.0: Pre-deployment safety case review by governance functionv3.1: Pre-deployment residual risk review by governance function | – | Stated | Stated | Stated |
| Who decides Corporate governance bodies approve response plans | – | Stated | Not found | – |
| Exception Adoption of protocols may depend on industry-wide adoption | – | Stated | Not found | – |
| Exception Alternative security adequacy assessment for risk acceptance | – | – | Stated | – |
| Exception Misuse deployment-mitigation criterion limited to external deployment | – | – | Stated | Stated |
| Exception Low-risk external deployments may skip critical capability assessment | – | – | – | Stated |
| Exception Recommended security levels may be adjusted | – | Stated | Stated | – |
| Risk domain Biosecurity risk domain: risks of models assisting in the development, preparation and/or execution of a biological attack | Stated | – | – | – |
| Risk domain CBRN risk domain: risks of models assisting in the development, preparation and/or execution of a CBRN attack | – | Stated | – | – |
v1.0Frontier Safety Framework (2024)
Earliest edition of this framework recorded here.
Provisions · 8 quoted
- Threshold or triggerEarly warning evaluations with a pass condition“we will define a set of evaluations called “early warning evaluations,” with a specific “pass” condition that flags when a CCL may be reached before the evaluations are run again.”PDF p. 2 (printed p. 2), Framework, component “2 - Evaluating frontier models”, first paragraph, second sentenceInspect claim & evidence ↗
- Threshold or triggerAutonomy level 1 CCL“Autonomy level 1: Capable of expanding its effective capacity in the world by autonomously acquiring resources and using them to run and sustain additional copies of itself on hardware it rents.”PDF p. 5 (printed p. 5), Critical Capability Levels table, Autonomy row, “Critical capability level” columnInspect claim & evidence ↗
- Threshold or triggerBio amateur enablement level 1: significantly enabling a non-expert to develop known biothreats“Bio amateur enablement level 1: Capable of significantly enabling a non-expert to develop known biothreats that could increase their ability to cause severe harm compared to other means.”PDF p. 5 (printed p. 5), Critical Capability Levels table, Biosecurity row, “Critical capability level” column, first entryInspect claim & evidence ↗
- Threshold or triggerBio expert enablement level 1: significantly enabling an expert to develop novel biothreats“Bio expert enablement level 1: Capable of significantly enabling an expert (i.e. PhD or above) to develop novel biothreats that could result in an incident of high severity.”PDF p. 5 (printed p. 5), Critical Capability Levels table, Biosecurity row, “Critical capability level” column, second entryInspect claim & evidence ↗
- Threshold or triggerEvaluation every 6x effective compute and 3 months’ fine-tuning“We are aiming to evaluate our models every 6x in effective compute3 and for every 3 months of fine-tuning progress.”PDF p. 2 (printed p. 2), Framework, component “2 - Evaluating frontier models”, second paragraph, first sentenceInspect claim & evidence ↗
- Required actionHold on deployment or development if mitigations not ready“A model may reach evaluation thresholds before mitigations at appropriate levels are ready. If this happens, we would put on hold further deployment or development, or implement additional protocols”PDF p. 2 (printed p. 2), Framework, component “3 - Applying mitigations”, third paragraph, first sentence and opening of second sentenceInspect claim & evidence ↗
- Required actionResponse plan when evaluation thresholds are reached“When a model reaches evaluation thresholds (i.e. passes a set of early warning evaluations), we will formulate a response plan based on the analysis of the CCL and evaluation results.”PDF p. 2 (printed p. 2), Framework, component “3 - Applying mitigations”, first paragraph, first sentenceInspect claim & evidence ↗
- Risk domainBiosecurity risk domain: risks of models assisting in the development, preparation and/or execution of a biological attack“Biosecurity: Risks of models assisting in the development, preparation and/or execution of a biological attack.”PDF p. 5 (printed p. 5), Critical Capability Levels table, “Risk domain” column, Biosecurity rowInspect claim & evidence ↗
Date basis
Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
v2.0Google DeepMind Frontier Safety Framework — v2.0
Recorded changes from v1.0
- Inferred document comparisonWhere the Frontier Safety Framework v1.0 set two Critical Capability Levels in a Biosecurity risk domain, one for enabling a non-expert and one for enabling an expert, v2.0 sets a single level, CBRN uplift 1, in a combined chemical, biological, radiological and nuclear risk domain.2025-02-04 · publication · Inferred · Supported Inspect claim & evidence ↗
- Publisher statementFSF v2.0 introduces recommended security levels for Critical Capability Levels.2025-02-04 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Required action: Response plan may put deployment or development on holdv2.0 states that where a model flagged by an alert threshold is assessed to pose risks for which readily available mitigations may not be sufficient, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied; v1.0 stated that if a model reached evaluation thresholds before mitigations at appropriate levels were ready, Google DeepMind would put further deployment or development on hold or implement additional protocols.2025-02-04 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Required action: Proximity and risk assessment informing a response planv2.0 states that on reaching an alert threshold for a CCL the model's proximity to the CCL is assessed and the risk analysed, involving internal and external experts as needed, to inform the formulation and application of a response plan; v1.0 stated that on reaching evaluation thresholds a response plan would be formulated based on the analysis of the CCL and evaluation results.2025-02-04 · publication · Inferred · Supported Inspect claim & evidence ↗
Provisions · 11 quoted · 2 not found
- Threshold or triggerEarly warning evaluations with an alert threshold“we will define a set of evaluations called “early warning evaluations,” with a specific “alert threshold” that flags when a CCL may be reached before the evaluations are run again.”PDF p. 3 (printed p. 3), Framework, component “2 - Assessing the Capabilities of Frontier Models”, second paragraph, first sentenceInspect claim & evidence ↗
- Threshold or triggerCBRN uplift 1: significant assistance to a low-resourced actor, resulting in a substantial increase in ability to cause a mass casualty event“CBRN uplift 1: Can be used to significantly assist a low-resourced actor with dual-use scientific protocols, resulting in a substantial increase in ability to cause a mass casualty event.”PDF p. 5 (printed p. 5), Table 1: Misuse CCLs and Security Mitigations, CBRN row, “Critical capability level” columnInspect claim & evidence ↗
- Required actionCBRN uplift 1 recommended security level: controls and detections generally aligned with RAND SL 2“Security controls and detections at a level generally aligned with RAND SL 2”PDF p. 5 (printed p. 5), Table 1, CBRN row, “Recommended security level and rationale” column, first lineInspect claim & evidence ↗
- Required actionResponse plan may put deployment or development on hold“If this happens, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied.”PDF p. 3 (printed p. 3), Framework, component “3 - Applying Mitigations”, third paragraph, second sentenceInspect claim & evidence ↗
- Required actionProximity and risk assessment informing a response plan“When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.”PDF p. 3 (printed p. 3), component “3 - Applying Mitigations”, first paragraph, first two sentencesInspect claim & evidence ↗
- Who decidesDisclosure to government authorities“If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share information with appropriate government authorities where it will facilitate the development of safe AI.”Decides: Google DeepMind · Informed: Appropriate government authoritiesGovernance and Accountability, “Disclosure”, first sentence: PDF p. 8 in the Internet Archive capture of 2025-02-05; PDF pp. 7–8 in the served file, where a page break and footnote 14 interrupt the sentence after “facilitate the”Inspect claim & evidence ↗
- Who decidesPre-deployment safety case review by corporate governance body“Pre-deployment review of safety case: general availability deployment8 of a model takes place only after the appropriate corporate governance body determines the safety case regarding each CCL the model has reached to be adequate.”Decides: Appropriate corporate governance bodyPDF p. 4 (printed p. 4), Misuse, Mitigation Approach, “Deployment Mitigations”, numbered step 2Inspect claim & evidence ↗
- Who decidesCorporate governance bodies approve response plans“For Google models, when alert thresholds are reached, the response plan will be reviewed and approved by appropriate corporate governance bodies such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council.”Decides: Appropriate corporate governance bodies, such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance CouncilPDF p. 7 (printed p. 7), Governance and Accountability, “Governance” paragraph, first sentenceInspect claim & evidence ↗
- ExceptionAdoption of protocols may depend on industry-wide adoption“our adoption of the protocols described in this Framework may depend on whether such organizations across the field adopt similar protocols.”PDF p. 1 (unnumbered), opening section, paragraph beginning “The safety of frontier AI systems is a global public good”, last sentence, final clauseInspect claim & evidence ↗
- ExceptionRecommended security levels may be adjusted“This may occur if, for example, a model does not possess capabilities meaningfully different from other widely available models that have not demonstrably caused or contributed to severe risks,”PDF p. 5 (printed p. 5), Misuse, Misuse Critical Capability Levels, paragraph beginning “These recommended security levels”, second sentenceInspect claim & evidence ↗
- Risk domainCBRN risk domain: risks of models assisting in the development, preparation and/or execution of a CBRN attack“CBRN: Risks of models assisting in the development, preparation, and/or execution of a chemical, biological, radiological, or nuclear (“CBRN”) attack.”PDF p. 2 (printed p. 2), list of misuse risk domains, first bulletInspect claim & evidence ↗
- Not found in the inspected textAutonomy level 1 CCLInspected: Whole document in both copies (2025-02-05 capture PDF pp. 1–8; served copy PDF pp. 1–9), including Table 1 (Misuse CCLs, PDF pp. 5–6), Table 2 (Deceptive Alignment CCLs, PDF p. 7) and all footnotesInspect claim & evidence ↗
- Not found in the inspected textEvaluation every 6x effective compute and 3 months’ fine-tuningInspected: Whole document in both copies (2025-02-05 capture PDF pp. 1–8; served copy PDF pp. 1–9): all sections, Tables 1–2, footnotes and the served copy’s Updates and changes pageInspect claim & evidence ↗
Date basis
Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
v3.0Google DeepMind Frontier Safety Framework — v3.0
Recorded changes from v2.0
- Inferred document comparisonThe Frontier Safety Framework v3.0 defines its CBRN risk domain as risks of models assisting in the development, preparation and/or execution of a CBRN threat, where v2.0 defined the same domain as risks of assisting in a CBRN attack.2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗
- Publisher statementFSF v3.0 introduces a Critical Capability Level for harmful manipulation.2025-09-22 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Threshold or trigger: Alert thresholds for early warning evaluationsv3.0’s alert thresholds for its early warning evaluations are designed to flag when a CCL may be reached before a risk assessment is conducted again, and its Note on Machine Learning R&D CCLs adds that the alert threshold may be defined based on sources of information about Google DeepMind’s own progress at accelerating ML R&D, rather than on evaluation scores; v2.0’s alert threshold flagged when a CCL may be reached before the evaluations are run again, and v2.0 contains no such note.2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Who decides: Information sharing with government authoritiesv3.0 aims to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI; v2.0 aimed to share information with them where it will facilitate the development of safe AI. The triggering assessment (a CCL posing an unmitigated and material risk to overall public safety) is worded the same.2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Who decides: Pre-deployment safety case review by governance functionv3.0 makes external deployments of a model conditional on the appropriate governance function determining the safety case for each CCL reached to be adequate; v2.0 made general availability deployment conditional on the appropriate corporate governance body making that determination.2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Exception: Recommended security levels may be adjustedv3.0's example for adjusting recommended security levels refers to models with capabilities not meaningfully different from other publicly available models that have weaker security applied, adding that the marginal benefit of higher security is then limited; v2.0's example referred to other widely available models that have not demonstrably caused or contributed to severe risks.2025-09-22 · publication · Inferred · Supported Inspect claim & evidence ↗
Provisions · 9 quoted · 3 not found
- Threshold or triggerAlert thresholds for early warning evaluations“Central to our model evaluations are “early warning evaluations,” to assess the proximity of the model to a CCL. We define “alert thresholds” for these evaluations that are designed to flag when a CCL may be reached before a risk assessment is conducted again.”PDF p. 5 (printed p. 5), §1.3 Outline of Our Risk Assessment Process, “Analysis” bullet, first and second sentencesInspect claim & evidence ↗
- Required actionFramework updated at least once a year“The Frontier Safety Framework will be updated at least once a year”PDF p. 16 (printed p. 16), §5.1 Updates, first sentenceInspect claim & evidence ↗
- Required actionProximity and risk assessment informing a response plan“When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.”PDF p. 6 (printed p. 6), §1.4 Response Plans and Mitigations, second paragraph, first two sentencesInspect claim & evidence ↗
- Required actionResponse plan where capabilities remain distant from a CCL“Where model capabilities remain quite distant from a CCL, a response plan may involve the adoption of additional capability assessment processes to flag when heightened mitigations are required.”PDF p. 6 (printed p. 6), §1.4 Response Plans and Mitigations, second paragraph, third sentenceInspect claim & evidence ↗
- Who decidesInformation sharing with government authorities“If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.”Decides: Google DeepMind · Informed: Appropriate government authoritiesPDF p. 16 (printed p. 16), §5.2 Disclosures, first paragraph, first sentenceInspect claim & evidence ↗
- Who decidesPre-deployment safety case review by governance function“Pre-deployment review of safety case: external deployments of a model take place only after the appropriate governance function determines the safety case regarding each CCL the model has reached to be adequate.”Decides: Appropriate governance functionPDF p. 9 (printed p. 9), §2.1.2 Deployment Mitigations, numbered step 2, first sentenceInspect claim & evidence ↗
- ExceptionAlternative security adequacy assessment for risk acceptance“or we otherwise assess that the level of security applied is adequate, e.g. if they match or exceed the level of security applied to other models with similar capabilities or risk profiles, or we assess that the benefits of the open release of model weights outweigh the risks.”PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse-CCL bullet (begins PDF p. 6), second sub-bullet, from “or we otherwise assess”Inspect claim & evidence ↗
- ExceptionMisuse deployment-mitigation criterion limited to external deployment“This is required only for external deployment, not further development.”PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse CCL bullet, first sub-bullet, final sentenceInspect claim & evidence ↗
- ExceptionRecommended security levels may be adjusted“This may occur if, for example, a model does not possess capabilities meaningfully different from other publicly available models that have weaker security applied (in which case the marginal benefit of higher security is limited),”PDF p. 9 (printed p. 9), §2.2 Misuse Critical Capability Levels, second paragraph, second sentenceInspect claim & evidence ↗
- Not found in the inspected textPutting deployment or development on hold pending mitigationsInspected: PDF pp. 1–16, all sections, tables and footnotesInspect claim & evidence ↗
- Not found in the inspected textResponse plans approved by named corporate governance bodiesInspected: PDF pp. 1–16, all sections, tables and footnotesInspect claim & evidence ↗
- Not found in the inspected textAdoption of protocols dependent on industry-wide adoptionInspected: PDF pp. 1–16, all sections, tables and footnotesInspect claim & evidence ↗
Date basis
Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
v3.1Google DeepMind Frontier Safety Framework — v3.1
Recorded changes from v3.0
- Official changelogThe Frontier Safety Framework v3.1 change notes state that the update raises the recommended level of security for the CBRN, Cyber and Harmful Manipulation Critical Capability Levels to Security Level 2+.2026-04-17 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogFSF v3.1 introduces CBRN Tracked Capability Levels.2026-04-17 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Threshold or trigger: Alert thresholds drawing on evaluations and other informationv3.1 defines alert thresholds for CCLs that may draw on evaluation results, expert assessments and other sources of information and flag when a CCL may be reached before a critical capability assessment is conducted again; v3.0 defined alert thresholds for its early warning evaluations that flag when a CCL may be reached before a risk assessment is conducted again, with a separate note allowing the ML R&D alert threshold to be defined from information on Google DeepMind’s own ML R&D progress rather than evaluation scores.2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Exception: Misuse deployment-mitigation criterion limited to external deploymentv3.1's misuse deployment-mitigation criterion is stated to be required only for external deployment, not internal deployment or further development, and its ML R&D criterion for external and high-risk internal deployment; v3.0's misuse criterion was stated to be required only for external deployment, not further development, and its ML R&D criterion for external and large scale internal deployment.2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Required action: Framework reviewed at least once a yearv3.1 states that the Framework will be reviewed at least once a year; v3.0 stated that it will be updated at least once a year.2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Who decides: Pre-deployment residual risk review by governance functionv3.1 makes external deployments conditional on the appropriate governance function determining the residual risk to be acceptable, including a safety case where a CCL has been reached; v3.0 made them conditional on that function determining the safety case regarding each CCL the model has reached to be adequate.2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Required action: Response plan may update the alert thresholdv3.1 states that if risks remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate; v3.0 stated that where capabilities remain quite distant from a CCL, a response plan may involve adopting additional capability assessment processes to flag when heightened mitigations are required.2026-04-17 · publication · Inferred · Supported Inspect claim & evidence ↗
Provisions · 9 quoted
- Threshold or triggerAlert thresholds drawing on evaluations and other information“For CCLs, we define “alert thresholds,” which may draw on evaluation results, expert assessments, and other sources of information; that are designed to flag when a CCL may be reached before a critical capability assessment is conducted again.”PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, third paragraph, second sentenceInspect claim & evidence ↗
- Threshold or triggerCBRN uplift TCL: uplift to low to medium resourced actors in reference scenarios, resulting in material risk of CBRN attacks causing significant but not severe harm“CBRN uplift TCL: Provides low to medium resourced actors uplift in reference scenarios, resulting in material risk of CBRN attacks that could result in significant but not severe harm.”PDF p. 11 (printed p. 11), §2.2.1 Chemical, Biological, Radiological or Nuclear, paragraph “CBRN Tracked Capability Level”Inspect claim & evidence ↗
- Required actionFramework reviewed at least once a year“The Frontier Safety Framework will be reviewed at least once a year”PDF p. 17 (printed p. 17), §5.1 Updates, first sentenceInspect claim & evidence ↗
- Required actionProximity and risk assessment informing a response plan“When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.”PDF p. 6 (printed p. 6), §1.3.3 Risk Mitigation, second paragraph, first two sentencesInspect claim & evidence ↗
- Required actionResponse plan may update the alert threshold“However, if we assess that risks stemming from the model remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate.”PDF p. 6 (printed p. 6), §1.3.3 Risk Mitigation, second paragraph, fourth sentenceInspect claim & evidence ↗
- Who decidesInformation sharing with government authorities“If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.”Decides: Google DeepMind · Informed: Appropriate government authoritiesPDF p. 17 (printed p. 17), §5.2 Disclosures, first sentenceInspect claim & evidence ↗
- Who decidesPre-deployment residual risk review by governance function“Pre-deployment review of residual risk assessment: external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).”Decides: Appropriate governance functionPDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, numbered step 2, first sentenceInspect claim & evidence ↗
- ExceptionMisuse deployment-mitigation criterion limited to external deployment“This is required only for external deployment, not internal deployment or further development.”PDF p. 7 (printed p. 7), §1.3.5 Risk Acceptance Determination, misuse T/CCL bullet, first sub-bullet, final sentenceInspect claim & evidence ↗
- ExceptionLow-risk external deployments may skip critical capability assessment“may not be conducted for low-risk external deployments (e.g. to a small number of trusted testers) if the appropriate governance function determines the residual risk of such deployments to be acceptable even if the model has reached a T/CCL (including with a safety case where a CCL has been reached).”PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, footnote 4Inspect claim & evidence ↗
Date basis
Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
OpenAI · Preparedness Framework
Published by OpenAI. 2 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 14 tracked provisions
“Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
| Provision | Beta | Version 2 |
|---|---|---|
| Threshold or trigger Risk gradation scale from “low” to “critical” | Stated | – |
| Required action Beta: Further development only at post-mitigation “high” or belowVersion 2: Critical capability requires safeguards during development | Stated | Stated |
| Required action Beta: Deployment only at post-mitigation “medium” or belowVersion 2: No deployment at High until risks sufficiently minimized | Stated | Stated · assessed Contested |
| Who decides Beta: SAG recommends; Leadership decides; Board may overruleVersion 2: Leadership approves or rejects SAG recommendations; SSC oversight | Stated | Stated |
| Who decides Leadership may decide without SAG participation | Stated | – |
| Who decides SAG makes final determination on ambiguous coverage | – | Stated |
| Who decides The Safety Advisory Group may obtain independent expert opinion in domains of relevant risk, biological risk among them | – | Stated |
| Exception Capabilities-enhancing development only if reasonably assured safe | Stated | – |
| Exception Safeguard adjustment if another developer lacks comparable safeguards | – | Stated |
| Exception Development restriction does not preclude safety-enhancing development | Stated | Not found |
| Risk domain Biological and Chemical tracked category: capabilities that can reduce barriers to creating and using biological or chemical weapons | – | Stated |
| Risk domain CBRN tracked risk category: risks related to model-assisted creation of chemical, biological, radiological and/or nuclear threats | Stated | – |
| Evaluation timing Biological capability evaluations test both information provision and integration with relevant tools | – | Stated |
| Evaluation timing Biological capability evaluations are prioritised and used as the indicators for the category’s High and Critical capabilities | – | Stated |
BetaOpenAI Preparedness Framework — Beta
Earliest edition of this framework recorded here.
Provisions · 8 quoted
- Threshold or triggerRisk gradation scale from “low” to “critical”“In general, “low” on this gradation scale is meant to indicate that the corresponding category of risks is not yet a significant problem, while “critical” represents the maximal level of concern.”PDF p. 5 (printed p. 5), “Tracked Risk Categories”, second paragraph, third (final) sentenceInspect claim & evidence ↗
- Required actionFurther development only at post-mitigation “high” or below“Only models with a post-mitigation score of "high" or below can be developed further.”PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, first sentenceInspect claim & evidence ↗
- Required actionDeployment only at post-mitigation “medium” or below“Only models with a post-mitigation score of "medium" or below can be deployed.”PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting deployment”, first sentenceInspect claim & evidence ↗
- Who decidesSAG recommends; Leadership decides; Board may overrule“(2) there is an advisory group (Safety Advisory Group) that has a sufficient diversity of perspectives and technical expertise to provide nuanced input and recommendations, and (3) there is a final decision-maker (OpenAI Leadership, with the option for the OpenAI Board of Directors to overrule).”Recommends: Safety Advisory Group (SAG) · Decides: OpenAI Leadership · Can overrule: OpenAI Board of DirectorsPDF p. 22 (printed p. 22), Governance › “Operations”, opening paragraph, second sentence, items (2) and (3)Inspect claim & evidence ↗
- Who decidesLeadership may decide without SAG participation“For the avoidance of doubt, Leadership can also make decisions without the SAG’s participation, i.e., the SAG does not have the ability to “filibuster”Decides: OpenAI LeadershipPDF p. 24 (printed p. 24), Governance › Operations › “Decision process”, fourth itemInspect claim & evidence ↗
- ExceptionCapabilities-enhancing development only if reasonably assured safe“We would also focus our efforts as a company towards solving these safety challenges and only continue with capabilities-enhancing development if we can reasonably assure ourselves (via the operationalization processes) that it is safe to do so.”PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, fourth sentenceInspect claim & evidence ↗
- ExceptionDevelopment restriction does not preclude safety-enhancing development“Note that this should not preclude safety-enhancing development.”PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, third sentenceInspect claim & evidence ↗
- Risk domainCBRN tracked risk category: risks related to model-assisted creation of chemical, biological, radiological and/or nuclear threats“CBRN is focused on risks related to model-assisted creation of chemical, biological, radiological, and/or nuclear threats.”PDF p. 9 (printed p. 9), Tracked Risk Categories, “CBRN (chemical, biological, radiological, nuclear)”, opening sentenceInspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its published date. The sourced publication date does not establish an implementation or effective date.
Version 2OpenAI Preparedness Framework — Version 2
Recorded changes from Beta
- Official changelogPreparedness Version 2 moves handling of persuasion risks outside the Preparedness Framework.2025-04-15 · revision · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogPreparedness Version 2 introduces Research Categories for capabilities requiring further threat-model and measurement work.2025-04-15 · revision · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogPreparedness Version 2 removes the terms “low” and “medium” while defining High and Critical capability thresholds.2025-04-15 · revision · Stated in source · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Required action: Critical capability requires safeguards during developmentVersion 2 states that if a model under development reaches a Critical capability threshold, safeguards are also required to sufficiently minimize the associated risks during development, irrespective of deployment plans; the Beta states that only models with a post-mitigation score of “high” or below can be developed further.2025-04-15 · revision · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Who decides: Leadership approves or rejects SAG recommendations; SSC oversightVersion 2’s passage states that OpenAI Leadership can approve or reject the SAG’s recommendations and that the Board’s Safety and Security Committee provides oversight of these decisions; the Beta’s passage names OpenAI Leadership as final decision-maker with the option for the OpenAI Board of Directors to overrule.2025-04-15 · revision · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Required action: No deployment at High until risks sufficiently minimizedVersion 2 states that models reaching a High capability threshold are not deployed until the associated risks they pose are sufficiently minimized; the Beta states that only models with a post-mitigation score of “medium” or below can be deployed.2025-04-15 · revision · Inferred · Supported Inspect claim & evidence ↗
Provisions · 9 quoted · 1 not found · 1 disputed assessment
- Required actionCritical capability requires safeguards during development“If a model under development reaches a Critical capability threshold, we also require safeguards to sufficiently minimize the associated risks during development, irrespective of deployment plans.”PDF p. 4 (printed p. 3), §1 Introduction, third bullet (“Safeguard against severe harms”), third sentenceInspect claim & evidence ↗
- Required actionNo deployment at High until risks sufficiently minimized“We do not deploy models that reach a High capability threshold until the associated risks that they pose are sufficiently minimized.”PDF p. 4 (printed p. 3), §1 Introduction, third bullet (“Safeguard against severe harms”), second sentenceInspect claim & evidence ↗
- Who decidesLeadership approves or rejects SAG recommendations; SSC oversight“OpenAI Leadership can approve or reject these recommendations, and our Board’s Safety and Security Committee provides oversight of these decisions.”Recommends: Safety Advisory Group (SAG) · Decides: OpenAI Leadership · Informed: Safety and Security Committee of the OpenAI Board of DirectorsPDF p. 4 (printed p. 3), §1 Introduction, final paragraph, second sentenceInspect claim & evidence ↗
- Who decidesSAG makes final determination on ambiguous coverage“In cases of ambiguity about whether a model is covered by the Preparedness Framework, the SAG is responsible for making the final determination.”Decides: Safety Advisory Group (SAG)PDF p. 10 (printed p. 9), §3.2 Testing scope, final paragraphInspect claim & evidence ↗
- Who decidesThe Safety Advisory Group may obtain independent expert opinion in domains of relevant risk, biological risk among them“The purpose of this input is to add independent analysis from individuals or organizations with deep expertise in domains of relevant risks (e.g., biological risk).”PDF p. 14 (printed p. 13), §4 Governance, item “Independent expert opinion on the evidence being produced to SAG”, second sentenceInspect claim & evidence ↗
- ExceptionSafeguard adjustment if another developer lacks comparable safeguards“If we are able to rigorously confirm that such a scenario has occurred, then we could adjust accordingly the level of safeguards that we require in that capability area, but only if:”PDF p. 13 (printed p. 12), §4.3 Marginal risk, first paragraph, third sentence (up to the colon introducing three bullets)Inspect claim & evidence ↗
- Risk domainBiological and Chemical tracked category: capabilities that can reduce barriers to creating and using biological or chemical weapons“Biological and Chemical capabilities that, in addition to unlocking discoveries and cures, can also reduce barriers to creating and using biological or chemical weapons.”PDF p. 2 (printed p. 1), opening page, first bullet of the Tracked Categories listInspect claim & evidence ↗
- Evaluation timingBiological capability evaluations test both information provision and integration with relevant tools“To assess the degree to which a covered system can reduce the barriers to creating a biological weapon, our current evaluations test both how capable the system is at providing useful information to someone creating a weapon and how capable it is of directly integrating with relevant tools”PDF p. 10 (printed p. 9), §3.1 box “An example of a Tracked Category capability evaluation”, first sentenceInspect claim & evidence ↗
- Evaluation timingBiological capability evaluations are prioritised and used as the indicators for the category’s High and Critical capabilities“We will build safeguards against both biological and chemical threats. Given the higher potential severity of biological threats relative to chemical ones, we will prioritize Biological capability evaluations and these will be used as indicators for High and Critical capabilities for the category.”PDF p. 6 (printed p. 5), footnote 5 to the Biological and Chemical row of Table 1Inspect claim & evidence ↗
- Assessment of this required action provisionContestedPreparedness Framework v2’s governance arrangements permit OpenAI Leadership to deploy models with High capabilities without safeguards that sufficiently minimize their associated risks.Holds: Coggins et al. (arXiv) · Disputes: OpenAIInspect claim & evidence ↗
- Not found in the inspected textDevelopment restriction does not preclude safety-enhancing developmentInspected: Version 2, both copies (Internet Archive capture of 2025-04-15 and current file), PDF pp. 1–22: §§1–5, Tables 1–3 and Appendices A (Change log), B (Decision-making practices) and CInspect claim & evidence ↗
Date basis
Placed on the timeline by its revised date. Cover last-updated date and dated publication announcement both identify April 15, 2025; no distinct effective date is asserted.
Open questions and source limits
No OpenAI text inspected so far names the December 2023 Beta as the edition that Version 2 replaces, so the replacement record is unresolved and carries context evidence only. A separate question is contested: whether Version 2’s governance arrangements let OpenAI Leadership deploy High-capability models without sufficient safeguards. The two sides are an academic analysis of leadership discretion and OpenAI’s stated predeployment requirement. The rule’s text itself is recorded as a supported provision.
Records: Preparedness · Version 2 → supersedes version → Preparedness · Beta · Preparedness · Version 2 → has a disputed assessment of its provision → Whether Version 2’s governance arrangements permit OpenAI Leadership to deploy High-capability models without sufficient safeguards
OpenAI · Frontier Governance Framework
Published by OpenAI. 1 recorded edition, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 8 tracked provisions
“Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
| Provision | May 2026 edition |
|---|---|
| Threshold or trigger Models treated as crossing threshold when not ruled out | Stated |
| Threshold or trigger Systemic risk: over 50 fatalities or $1 billion | Stated |
| Required action No deployment above acceptable residual risk without mitigation | Stated |
| Who decides Material FGF updates presented to two boards for oversight | Stated |
| Who decides Safety Advisory Group and external experts inform risk acceptance | Stated |
| Who decides Legal function oversees FGF updates and determines required ones | Stated |
| Who decides Who may propose updates to the FGF | Stated |
| Exception Acceptable residual risk permits development, internal use, deployment | Stated |
May 2026 editionOpenAI Frontier Governance Framework — May 2026 edition
Earliest edition of this framework recorded here.
Provisions · 8 quoted
- Threshold or triggerModels treated as crossing threshold when not ruled out“For example, out of an abundance of caution we have treated models as crossing a capability threshold in circumstances where we are unable to rule out that a new threshold had been reached, even in the absence of direct evidence that it has occurred.”PDF p. 8 (printed p. 06), §2.3 Systemic risk acceptance determination, first paragraph, final sentenceInspect claim & evidence ↗
- Threshold or triggerSystemic risk: over 50 fatalities or $1 billion“including risks that a model will materially contribute to greater than 50 fatalities or $1 billion of property damages or losses arising from a single incident.”PDF p. 5 (printed p. 03), §2.1 Systemic risk identification, first paragraph, second sentence (from “including”)Inspect claim & evidence ↗
- Required actionNo deployment above acceptable residual risk without mitigation“If residual risks associated with the model exceed acceptable risk levels, the model is not deployed unless additional mitigation measures are implemented that sufficiently minimize risk.”PDF p. 13 (printed p. 11), §2.5 Safety mitigations, first paragraph, third sentenceInspect claim & evidence ↗
- Who decidesMaterial FGF updates presented to two boards for oversight“Material updates will be presented to the Safety and Security Committee of the board of directors of the OpenAI Foundation and to the board of directors of OpenAI Ireland Limited for oversight”Informed: Safety and Security Committee of the OpenAI Foundation board of directors · Informed: Board of directors of OpenAI Ireland LimitedPDF p. 21 (printed p. 19), §7.1 Update and approval process, fourth (final) sentence, up to “for oversight”Inspect claim & evidence ↗
- Who decidesSafety Advisory Group and external experts inform risk acceptance“We document a justification for why the systemic risks stemming from the model are acceptable, including reasonably foreseeable conditions under which the justification may no longer hold, as informed by recommendations from OpenAI’s Safety Advisory Group and external experts, as available and appropriate.”Recommends: OpenAI Safety Advisory Group · Recommends: External experts (as available and appropriate)PDF p. 13 (printed p. 11), §2.5 Safety mitigations, second paragraph, second sentenceInspect claim & evidence ↗
- Who decidesLegal function oversees FGF updates and determines required ones“OpenAI’s Legal function, in collaboration with relevant internal stakeholders, will oversee the process for FGF updates, including determining which updates are required”Decides: OpenAI Legal function (which updates are required)PDF p. 21 (printed p. 19), §7.1 Update and approval process, second sentence, up to “required”Inspect claim & evidence ↗
- Who decidesWho may propose updates to the FGF“Updates to this FGF may be proposed by Open AI’s Safety Advisory Group, Head of Safety Systems, Head of Preparedness, Chief Information Security Officer, Chief Compliance Officer, General Counsel, or executive leadership.”Recommends: OpenAI Safety Advisory Group · Recommends: Head of Safety Systems · Recommends: Head of Preparedness · Recommends: Chief Information Security Officer · Recommends: Chief Compliance Officer · Recommends: General Counsel · Recommends: Executive leadershipPDF p. 21 (printed p. 19), §7.1 Update and approval process, first sentenceInspect claim & evidence ↗
- ExceptionAcceptable residual risk permits development, internal use, deployment“Where the residual risk falls within acceptable levels, taking into account appropriate safety margins, the model may be approved for continued development and internal use (where applicable), and may be deployed under this Frontier Governance Framework.”PDF p. 13 (printed p. 11), §2.5 Safety mitigations, second paragraph, first sentenceInspect claim & evidence ↗
Links itself to external commitments or laws
- OpenAI’s Frontier Governance Framework (May 2026 edition) states that, under the EU General-Purpose AI Code of Practice, it serves as OpenAI’s publicly available summary of its Safety & Security Framework. It also lists, among the cases in which it will not consider an update of a Model Report necessary, a model considered similarly safe or safer under Appendix 2.2 of the Code of Practice.2026-05-28 · publication · Stated in source · Supported Inspect claim & evidence ↗
- OpenAI’s Frontier Governance Framework (May 2026 edition) states that it covers frontier models as defined under California’s TFAIA and general-purpose models with systemic risk under the EU AI Act.2026-05-28 · publication · Stated in source · Supported Inspect claim & evidence ↗
- OpenAI's Frontier Governance Framework (May 2026 edition) states that, under California's TFAIA, it is OpenAI's Frontier AI Framework.2026-05-28 · publication · Stated in source · Supported Inspect claim & evidence ↗
Date basis and other records
Placed on the timeline by its published date. Publication date comes from the release announcement; the PDF cover has no separate version date.
Open questions and source limits
The Frontier Governance Framework is recorded as applying relevant parts of the continuing Preparedness approach. Its announcement names no Preparedness version. The link therefore points to the Preparedness framework as a whole rather than to Version 2, and the new framework is not recorded as its successor.
Records: FGF · May 2026 edition → applies parts of → Preparedness family
xAI · Frontier AI Framework
Published by xAI. 2 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 12 tracked provisions
“Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
| Provision | December 2025 edition | June 2026 edition |
|---|---|---|
| Threshold or trigger Bio/chem deployment criterion: answer rate below 1 in 20 | Stated | Not found |
| Threshold or trigger Deployment criterion: MASK dishonesty rate below 1 in 2 | Stated | Not found |
| Threshold or trigger Acceptance criteria with security margin for each risk | – | Stated |
| Required action For biological and chemical weapons, xAI identifies critical steps at which it restricts its models from providing detailed information or substantial assistance | Stated | – |
| Required action December 2025 edition: Heightened safeguards apply to prompts posing a foreseeable and non-trivial risk of weapons of mass destruction, including CBRN weaponsJune 2026 edition: Heightened safeguards for prompts demonstrating WMD intent | Stated | Stated |
| Required action Proceed only if systemic risks are determined acceptable | – | Stated |
| Required action Documented Security Goal naming targeted threat actors | – | Stated |
| Exception Deployment benefits may outweigh benchmark-identified risks | Stated | Not found |
| Exception Vetted, highly trusted users may receive responses | Stated | – |
| Exception Vetted, highly trusted users may be allowed to receive responses that heightened safeguards would otherwise restrict | Stated | – |
| Risk domain Without safeguards, advanced AI models could lower the barrier to entry for actors seeking CBRN or cyber weapons | Stated | – |
| Statement CBRN risks: refusal safeguards and continued assessment of their robustness | – | Stated |
December 2025 editionxAI Frontier Artificial Intelligence Framework — December 2025 edition
Earliest edition of this framework recorded here.
Provisions · 8 quoted
- Threshold or triggerBio/chem deployment criterion: answer rate below 1 in 20“We developed an internal benchmark of benign and restricted biology and chemistry related queries in collaboration with SecureBio. Our risk acceptance criteria for system deployment is maintaining an answer rate of less than 1 out of 20 on restricted queries.”PDF p. 6 (no printed page numbers), “Addressing Risks of Malicious Use” › “2. Risk Assessment”, paragraph beginning “Thresholds:”, first and second sentencesInspect claim & evidence ↗
- Threshold or triggerDeployment criterion: MASK dishonesty rate below 1 in 2“Our risk acceptance criteria for system deployment is maintaining a dishonesty rate of less than 1 out of 2 on MASK.”PDF p. 7 (no printed page numbers), “Addressing Risks of Loss of Control” › “2. Risk Assessment”, paragraph beginning “Thresholds:”, first sentenceInspect claim & evidence ↗
- Required actionFor biological and chemical weapons, xAI identifies critical steps at which it restricts its models from providing detailed information or substantial assistance“In the setting of biological and chemical weapons, xAI considers critical steps where we restrict xAI models from providing detailed information or substantial assistance”PDF p. 5 (no printed page numbers), “Addressing Risks of Malicious Use” › “2. Risk Assessment”, paragraph introducing the restricted critical stepsInspect claim & evidence ↗
- Required actionHeightened safeguards apply to prompts posing a foreseeable and non-trivial risk of weapons of mass destruction, including CBRN weapons“Under this FAIF, xAI’s models apply heightened safeguards if they receive user prompts that pose a foreseeable and non-trivial risk of resulting in large-scale violence, terrorism, or the use, development, or proliferation of weapons of mass destruction, including CBRN weapons, and major cyber attacks on critical infrastructure.”PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, second paragraph, first sentenceInspect claim & evidence ↗
- ExceptionDeployment benefits may outweigh benchmark-identified risks“It is conceivable that for a particular modality and/or type of release, the expected benefits of model deployment may outweigh the risks identified by a particular benchmark.”PDF p. 10 (no printed page numbers), “Operational and Societal Risks” › “5. Deployment Decisions”, second paragraph, sixth sentenceInspect claim & evidence ↗
- ExceptionVetted, highly trusted users may receive responses“However, we may selectively allow xAI’s models to respond to such requests from some vetted, highly trusted users (such as trusted third-party safety auditors or large enterprise customers under contract) whom we know to be using those capabilities for benign or beneficial purposes”PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, third paragraph, single sentence, up to “purposes”Inspect claim & evidence ↗
- ExceptionVetted, highly trusted users may be allowed to receive responses that heightened safeguards would otherwise restrict“we may selectively allow xAI’s models to respond to such requests from some vetted, highly trusted users (such as trusted third-party safety auditors or large enterprise customers under contract) whom we know to be using those capabilities for benign or beneficial purposes”PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, third paragraph, first sentenceInspect claim & evidence ↗
- Risk domainWithout safeguards, advanced AI models could lower the barrier to entry for actors seeking CBRN or cyber weapons“advanced AI models could lower the barrier to entry for bad actors seeking to develop chemical, biological, radiological, or nuclear (“CBRN”) or cyber weapons, and could help automate knowledge compilation to swiftly overcome bottlenecks to weapons development”PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, first paragraph, second sentenceInspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its revised date. The printed update date is retained; it is not silently treated as publication. The URL filename says December 31; the visible document says last updated December 30.
June 2026 editionxAI Frontier Artificial Intelligence Framework — June 2026 edition
Recorded changes
Coverage gap. No record yet says which earlier edition, if any, this edition replaced.
Provisions · 5 quoted · 3 not found
- Threshold or triggerAcceptance criteria with security margin for each risk“xAI applies a systemic risk acceptance criteria to each identified risk, incorporating a margin of security, to determine whether each identified systemic risk and the overall systemic risk are acceptable”PDF p. 5 (no printed page numbers), §2.3 Systemic risk acceptance determination (the first of two sections numbered 2.3), first sentence, up to “acceptable”Inspect claim & evidence ↗
- Required actionHeightened safeguards for prompts demonstrating WMD intent“Under this FAIF, xAI’s models apply heightened safeguards if they receive user prompts that demonstrate intent to engage in the development, use, , or proliferation of weapons of mass destruction, including CBRN agents.”PDF p. 3 (no printed page numbers), §2.1 Risk Identification › “(a) Addressing CBRN Risks”, second paragraph, first sentenceInspect claim & evidence ↗
- Required actionProceed only if systemic risks are determined acceptable“xAI will only proceed with the development, the making available on the market, and/or the use of the model, if the systemic risks stemming from the model are determined to be acceptable.”PDF p. 6 (no printed page numbers), §2.3 Systemic risk acceptance determination (the first of two sections numbered 2.3), fourth paragraph, first sentenceInspect claim & evidence ↗
- Required actionDocumented Security Goal naming targeted threat actors“xAI will maintain a documented Security Goal that identifies the threat actors against which mitigations are designed to protect against, including sophisticated non-state actors, insider threats, state-sponsored actors and other foreseeable actors.”PDF p. 7 (no printed page numbers), §2.4 Security mitigations, first paragraph, first sentenceInspect claim & evidence ↗
- StatementCBRN risks: refusal safeguards and continued assessment of their robustnessPDF pp. 2–4; §2.1(a)Inspect claim & evidence ↗
- Not found in the inspected textBio/chem deployment criterion: answer rate below 1 in 20Inspected: June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 GovernanceInspect claim & evidence ↗
- Not found in the inspected textDeployment criterion: MASK dishonesty rate below 1 in 2Inspected: June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 GovernanceInspect claim & evidence ↗
- Not found in the inspected textDeployment benefits may outweigh benchmark-identified risksInspected: June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 GovernanceInspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its effective date. The stated effective date is retained; a separate publication day is not inferred.
Open questions and source limits
No record links the June 2026 edition to the December 2025 edition as its replacement, because no explicit statement that one supersedes the other was found. The one recorded difference was inferred by comparing the two documents. It is not based on a statement by xAI.
Records: FAIF · June 2026 edition → changes from → FAIF · December 2025 edition · xAI → published → FAIF · December 2025 edition · xAI → published → FAIF · June 2026 edition
The December 2025 edition is identified by its printed “last updated” date. The file name carries a different day, as the date note records. Neither edition has an established publication day of its own.
Records: xAI → published → FAIF · December 2025 edition · xAI → published → FAIF · June 2026 edition
Meta · Frontier AI / Advanced AI Scaling Framework
Published by Meta. 2 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 13 tracked provisions
“Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
| Provision | v1.1 | v2.0 |
|---|---|---|
| Threshold or trigger v1.1: Critical risk threshold (unique, unmitigable enablement)v2.0: Critical risk threshold (development contribution or unmitigable unique enablement) | Stated | Stated |
| Threshold or trigger v1.1: High risk threshold (significant uplift without enabling execution)v2.0: High risk threshold (deployment could substantially contribute) | Stated | Stated |
| Threshold or trigger v1.1: Moderate risk threshold (no significant uplift)v2.0: Moderate or lower risk threshold (no substantial contribution) | Stated | Stated |
| Required action v1.1: Stop development at unmitigable critical riskv2.0: Critical: continue development only with validated safeguards | Stated | Stated |
| Required action Pause development to investigate remaining barriers | Stated | Not found |
| Required action v1.1: No external release at high risk thresholdv2.0: High: deploy only with validated mitigations | Stated | Stated |
| Who decides Deployment follows consultation and Chief AI Officer approval | – | Stated |
| Who decides v1.1: Leadership team decides on releasev2.0: Chief AI Officer or Director of Alignment and Risk decides | Stated | Stated |
| Who decides Chief AI Officer and Director assign risk threshold | – | Stated |
| Who decides Senior-level decision-makers approve final uplift assessment | Stated | Not found |
| Exception High-threshold model deployed externally only with strong mitigation evidence | – | Stated |
| Statement Chemical and biological assessments: methods combined, and capability and refusal both assessed | – | Stated |
| Statement Chemical and biological risk in scope: capability-triggered red teaming and a release decision on residual risk | Stated | – |
v1.1Meta Frontier AI Framework — Version 1.1
Earliest edition of this framework recorded here.
Provisions · 9 quoted
- Threshold or triggerCritical risk threshold (unique, unmitigable enablement)“The model would uniquely enable the execution of at least one of the threat scenarios that have been identified as potentially sufficient to produce a catastrophic outcome and that risk cannot be mitigated in the proposed deployment context.”PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Critical row, Risk Threshold column (text below the measure label 'Stop development')Inspect claim & evidence ↗
- Threshold or triggerHigh risk threshold (significant uplift without enabling execution)“The model provides significant uplift towards execution of a threat scenario (i.e. significantly enhances performance on key capabilities or tasks needed to produce a catastrophic outcome) but does not enable execution of any threat scenario that has been identified as potentially sufficient to produce a catastrophic outcome.”PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, High row, Risk Threshold column (text below the measure label 'Do not release')Inspect claim & evidence ↗
- Threshold or triggerModerate risk threshold (no significant uplift)“The model would not provide significant uplift towards execution of a threat scenario.”PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Moderate row, Risk Threshold column (text below the measure label 'Release')Inspect claim & evidence ↗
- Required actionStop development at unmitigable critical risk“If a frontier AI is assessed to have reached the critical risk threshold and cannot be mitigated, we will stop development and implement the measures outlined in Table 1.”PDF p. 12 (printed p. 12), §3.3 Risk thresholds, first paragraph, third sentenceInspect claim & evidence ↗
- Required actionPause development to investigate remaining barriers“If a model appears to uniquely enable the execution of a threat scenario we will pause development while we investigate whether barriers to realizing the catastrophic outcome remain.”PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Critical row, Measures column, first bullet, second sentenceInspect claim & evidence ↗
- Required actionNo external release at high risk threshold“If the results of our evaluations indicate that a frontier AI has a “high” risk threshold by providing significant uplift towards realization of a catastrophic outcome we will not release the frontier AI externally.”PDF p. 17 (printed p. 17), §4.2 Evaluation and mitigation, paragraph beginning 'We may take into account monetary costs', second sentenceInspect claim & evidence ↗
- Who decidesLeadership team decides on release“Informed by this analysis, a leadership team will either request further testing or information, require additional mitigations or improvements, or they will approve the model for release.”Decides: leadership teamPDF p. 8 (printed p. 8), §2.1.3 Decide, 'Make a decision on release', second sentenceInspect claim & evidence ↗
- Who decidesSenior-level decision-makers approve final uplift assessment“A final assessment of uplift is approved by senior-level decision-makers through our AI Risk process (see Section 2.1).”Decides: Senior-level decision-makers (AI Risk process)PDF p. 13 (printed p. 13), §3.3 Risk thresholds, footnote 7 (attached to Table 1, High row, Risk Threshold column), third and final sentenceInspect claim & evidence ↗
- StatementChemical and biological risk in scope: capability-triggered red teaming and a release decision on residual riskPDF pp. 3, 8, 13 and 16–18; §2.1.2 and Table 1Inspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its published date. Publication date from Meta’s dated announcement of February 3, 2025; Meta’s v2 change log also dates the initial version February 3, 2025. The earliest archive capture of the file is 2025-02-13; a revised expression under the same label followed by 2025-03-28.
v2.0Meta Advanced AI Scaling Framework — Version 2
Recorded changes from v1.1
- Official changelogProvision · Who decides: Chief AI Officer or Director of Alignment and Risk decidesv2 names the Chief AI Officer or the Director of Alignment and Risk as determining whether to request further testing or information, require additional mitigations or improvements, or approve the model for deployment, whereas v1.1 assigns these choices to 'a leadership team' and refers to approval for release.2026-04-08 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogProvision · Required action: Critical: continue development only with validated safeguardsv2 states that, should either critical-threshold scenario arise, development continues only if risk assessments are complete and safeguards are defined, implemented and validated to reduce risk to the moderate or lower threshold, whereas v1.1 states that Meta will stop development and implement the Table 1 measures if a frontier AI reaches the critical threshold and cannot be mitigated.2026-04-08 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogProvision · Threshold or trigger: Critical risk threshold (development contribution or unmitigable unique enablement)v2's critical threshold has two alternative conditions (continued development could substantially contribute to any threat scenario, or the model could uniquely enable a threat scenario and the risk cannot be mitigated in the proposed deployment context), whereas v1.1's Table 1 critical row states only the uniquely-enable condition (the model would uniquely enable execution of at least one identified threat scenario and that risk cannot be mitigated in the proposed deployment context).2026-04-08 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Official changelogProvision · Required action: High: deploy only with validated mitigationsv2’s high-threshold measure, labelled Deploy with mitigations, is to proceed with deployment of the Frontier AI only if sufficient mitigations are defined, implemented and validated to reduce risk to that of a moderate or lower model, whereas v1.1 states that a frontier AI at the high risk threshold will not be released externally, and its Table 1 pairs the high threshold’s Do not release label with the measure of implementing mitigations to reduce risk to moderate levels.2026-04-08 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Threshold or trigger: High risk threshold (deployment could substantially contribute)v2's high threshold applies where deployment of the Frontier AI could substantially contribute to any threat scenario associated with a catastrophic outcome, whereas v1.1's applies where the model provides significant uplift towards execution of a threat scenario but does not enable execution of any threat scenario identified as potentially sufficient to produce a catastrophic outcome.2026-04-08 · publication · Inferred · Supported Inspect claim & evidence ↗
- Inferred document comparisonProvision · Threshold or trigger: Moderate or lower risk threshold (no substantial contribution)v2.0's lowest threshold, 'Moderate or lower' with the measure label 'Deploy', applies where the Frontier AI shows relevant capabilities but could not substantially contribute to any threat scenario associated with a catastrophic outcome across plausible deployment and development scenarios, whereas v1.1's 'Moderate' threshold, with the measure label 'Release', applies where the model would not provide significant uplift towards execution of a threat scenario.2026-04-08 · publication · Inferred · Supported Inspect claim & evidence ↗
Provisions · 10 quoted · 2 not found
- Threshold or triggerCritical risk threshold (development contribution or unmitigable unique enablement)“Moreover, if continued development of the model could substantially contribute to any threat scenario, or if the model could uniquely enable a threat scenario and the risk cannot be mitigated in the proposed deployment context, the model meets the critical risk threshold.”PDF p. 26 (printed p. 26), §4.2 Evaluation and mitigation, final sentence of the paragraph continued from PDF p. 25Inspect claim & evidence ↗
- Threshold or triggerHigh risk threshold (deployment could substantially contribute)“Deployment of the Frontier AI could substantially contribute to any threat scenario associated with a catastrophic outcome.”PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1: Risk Thresholds for Frontier AI, High row, Risk Threshold columnInspect claim & evidence ↗
- Threshold or triggerModerate or lower risk threshold (no substantial contribution)“The Frontier AI shows relevant capabilities, but could not substantially contribute to any threat scenario associated with a catastrophic outcome, across plausible deployment and development scenarios.”PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1: Risk Thresholds for Frontier AI, 'Moderate or lower' row, Risk Threshold columnInspect claim & evidence ↗
- Required actionCritical: continue development only with validated safeguards“Should either scenario arise, we will only continue development of the Frontier AI if our risk assessments are complete and safeguards are defined, implemented and validated to reduce risk to the moderate or lower risk threshold.”PDF p. 17 (printed p. 17), §3.3 Risk Thresholds, final sentence of the paragraph beginning on PDF p. 16 ('First, a Frontier AI meets the critical risk threshold…')Inspect claim & evidence ↗
- Required actionHigh: deploy only with validated mitigations“Proceed with deployment of the Frontier AI only if sufficient mitigations are defined, implemented and validated to reduce risk to that of a moderate or lower model.”PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1, High row, Measures column, under the label 'Deploy with mitigations'Inspect claim & evidence ↗
- Who decidesDeployment follows consultation and Chief AI Officer approval“with model deployment following appropriate consultation with relevant teams and with the approval of the Chief AI Officer.”Decides: Chief AI Officer · Consulted: Relevant teamsPDF p. 10 (printed p. 10), §2.3 Accountability, second paragraph, second sentence (closing clause)Inspect claim & evidence ↗
- Who decidesChief AI Officer or Director of Alignment and Risk decides“Informed by this analysis, the Chief AI Officer or the Director of Alignment and Risk will determine whether to request further testing or information, require additional mitigations or improvements, or approve the model for deployment.”Decides: Chief AI Officer · Decides: Director of Alignment and RiskPDF p. 7 (printed p. 7), §2.1.3 Decide, 'Make a decision on deployment', second sentenceInspect claim & evidence ↗
- Who decidesChief AI Officer and Director assign risk threshold“Based on this pre-mitigation risk assessment, the Chief AI Officer and Director of Alignment and Risk2 will assign a risk threshold.”Decides: Chief AI Officer · Decides: Director of Alignment and RiskPDF p. 6 (printed p. 6), §2.1.2 Evaluate and Mitigate, 'Evaluate for performance and safety', paragraph beginning 'These assessments typically use a version of the Frontier AI', second sentenceInspect claim & evidence ↗
- ExceptionHigh-threshold model deployed externally only with strong mitigation evidence“In the case where pre-mitigation testing suggests that a model has crossed the high risk threshold, we will not deploy the model externally unless we have strong additional evidence that mitigations are sufficiently robust to adversarial attacks that the fully mitigated model is reduced to moderate or lower levels.”PDF p. 32 (printed p. 32), §4.2.2 Chemical and Biological Risks, 'Mitigation strategies', third paragraphInspect claim & evidence ↗
- StatementChemical and biological assessments: methods combined, and capability and refusal both assessedPDF pp. 1 and 31–32; §4.2.2Inspect claim & evidence ↗
- Not found in the inspected textPause development to investigate remaining barriersInspected: PDF pp. 1–44, all sections, including Table 1 (PDF p. 15), §3.3 Risk Thresholds (PDF pp. 15–17), §4.2 Evaluation and mitigation (PDF pp. 25–38) and Appendix II – Change log (PDF p. 44)Inspect claim & evidence ↗
- Not found in the inspected textSenior-level decision-makers approve final uplift assessmentInspected: PDF pp. 1–44, all sections, footnotes and Appendix II – Change logInspect claim & evidence ↗
Date basis
Placed on the timeline by its published date. Publication date from Meta’s dated announcement of April 8, 2026; the framework’s own change log dates the version April 7, 2026.
Open questions and source limits
Two different texts carry the Version 1.1 label: the earliest archive capture (2025-02-13) and a revised wording captured from 2025-03-28 onwards. The provisions quote the earlier text. No announcement of the revision was found.
Records: Meta → published → Meta FAF · v1.1
Microsoft · Frontier Governance Framework
Published by Microsoft. 2 recorded editions, oldest first. An edition is shown as replacing another only where a record says so.
Provisions across editions · 13 tracked provisions
“Stated” means the edition’s quoted text contains the provision. “Not found” means it was not found in the inspected part of the edition, which is not a claim that it was deleted. A dash means nothing is recorded for that edition.
| Provision | Feb 2025 (Version 1) | Feb 2026 |
|---|---|---|
| Threshold or trigger CBRN Critical: meaningful uplift to an expert developing a highly dangerous novel threat, or significantly lower barriers for a low-skilled actor to develop and deliver a known CBRN threat; further review and mitigations required | Stated | – |
| Threshold or trigger CBRN weapons High risk-level capability thresholds | Stated | Stated |
| Threshold or trigger CBRN Medium: some assistance increasing an existing expert’s ability to develop a known CBRN threat; deployment allowed under the Responsible AI Program | Stated | – |
| Required action High or critical risk: review and mitigations before deployment | Stated | Stated |
| Required action High-risk models: security against cybercrime groups and insiders | Stated | Stated |
| Required action Incident response and reports for serious or critical incidents | – | Stated |
| Required action Pause development and deployment if risk cannot be mitigated | Stated | Stated |
| Who decides Executive Officers make final deployment decision | Stated | Stated |
| Who decides Independent internal experts decide on external evaluators | – | Stated |
| Who decides Chief Responsible AI Officer reviews updates before adoption | Stated | Stated |
| Exception Low or medium risk models may be deployed | Stated | Stated |
| Evaluation timing Leading-indicator screening is intended to move towards direct assessment of tracked capabilities such as CBRN weapon development | Stated | – |
| Revision A change-log entry recording a change to the CBRN capability thresholds | – | Not found |
Feb 2025 (Version 1)Microsoft Frontier Governance Framework — Version 1 (February 2025)
Earliest edition of this framework recorded here.
Provisions · 10 quoted
- Threshold or triggerCBRN Critical: meaningful uplift to an expert developing a highly dangerous novel threat, or significantly lower barriers for a low-skilled actor to develop and deliver a known CBRN threat; further review and mitigations required“The model provides a meaningful uplift to an expert’s ability to develop a highly dangerous novel threat or significantly lowers the barriers to a low-skilled actor developing and delivering a known CBRN threat.”PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, Critical row, Capability threshold columnInspect claim & evidence ↗
- Threshold or triggerCBRN weapons High risk-level capability thresholds“The model provides a meaningful uplift to an expert’s (PhD level education in related fields) ability to develop and deliver a novel CBRN threat. The model provides a meaningful uplift to a medium-skilled actor’s (e.g., STEM education) ability to develop and deliver a known CBRN threat.”PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, High row, Capability threshold column (both statements)Inspect claim & evidence ↗
- Threshold or triggerCBRN Medium: some assistance increasing an existing expert’s ability to develop a known CBRN threat; deployment allowed under the Responsible AI Program“The model provides some assistance increasing the ability of an existing expert (PhD level education in related fields) to develop a known CBRN threat.”PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, Medium row, Capability threshold columnInspect claim & evidence ↗
- Required actionHigh or critical risk: review and mitigations before deployment“Models assessed as having a high or critical risk are subject to further review and safety and security mitigations prior to deployment.”PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', third sentenceInspect claim & evidence ↗
- Required actionHigh-risk models: security against cybercrime groups and insiders“Models posing high-risk on one or more tracked capability will be subject to security measures protective against most cybercrime groups and insider threats.”PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph (section begins on PDF p. 7), first sentenceInspect claim & evidence ↗
- Required actionPause development and deployment if risk cannot be mitigated“If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.”PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentenceInspect claim & evidence ↗
- Who decidesExecutive Officers make final deployment decision“The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.”Decides: Executive Officers responsible for Microsoft’s AI governance program (or their delegates)PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentenceInspect claim & evidence ↗
- Who decidesChief Responsible AI Officer reviews updates before adoption“Any updates to our practices will be reviewed by Microsoft’s Chief Responsible AI Officer prior to their adoption.”Consulted: Chief Responsible AI OfficerPDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentenceInspect claim & evidence ↗
- ExceptionLow or medium risk models may be deployed“Models assessed as posing low or medium risk may be deployed with appropriate safeguards as outlined below.”PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', second sentenceInspect claim & evidence ↗
- Evaluation timingLeading-indicator screening is intended to move towards direct assessment of tracked capabilities such as CBRN weapon development“we intend to move this leading indicator screening toward a more direct assessment of tracked capabilities such as CBRN weapon development, offensive cyberoperations, and advanced autonomy”PDF p. 6 (printed p. 5), §3 Capability assessment, paragraph on leading indicator assessments, second sentenceInspect claim & evidence ↗
Links itself to external commitments or laws
Date basis
Placed on the timeline by its published date. Page footers read “Version 1 (February 2025)” and the change log dates the first version 8 February 2025. No separate dated announcement was located; the earliest archive capture is 2025-02-26, so publication is dated only to the month.
Feb 2026Microsoft Frontier Governance Framework — February 2026
Recorded changes from Feb 2025 (Version 1)
Coverage gap. No change from the previous edition is recorded yet. That does not mean nothing changed.
Provisions · 9 quoted · 1 not found
- Threshold or triggerCBRN weapons High risk-level capability thresholds“The model provides a meaningful uplift to an expert’s (PhD level education in related fields) ability to develop and deliver a novel CBRN threat. The model provides a meaningful uplift to a medium-skilled actor’s (e.g., STEM education) ability to develop and deliver a known CBRN threat.”PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, High row, Capability threshold column (both statements)Inspect claim & evidence ↗
- Required actionHigh or critical risk: review and mitigations before deployment“Models assessed as having a high or critical risk are subject to further review and safety and security mitigations prior to deployment.”PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', third sentenceInspect claim & evidence ↗
- Required actionHigh-risk models: security against cybercrime groups and insiders“Models posing high-risk on one or more tracked high-risk capability will be subject to security measures protective against most cybercrime groups and insider threats.”PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph, first sentenceInspect claim & evidence ↗
- Required actionIncident response and reports for serious or critical incidents“Where we or others identify serious or critical incidents that may pose public safety or national security risks, we operationalize incident response policies and processes, conduct investigations, provide reports to regulatory authorities and impacted customers as appropriate”PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, 'Monitoring, response, and remediation' bullet, fourth sentence (first part)Inspect claim & evidence ↗
- Required actionPause development and deployment if risk cannot be mitigated“If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.”PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentenceInspect claim & evidence ↗
- Who decidesExecutive Officers make final deployment decision“The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.”Decides: Executive Officers responsible for Microsoft’s AI governance program (or their delegates)PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentenceInspect claim & evidence ↗
- Who decidesIndependent internal experts decide on external evaluators“The decision to involve qualified and expert external actors that meet relevant security standards, including those with domain-specific expertise, is made by internal experts who are independent from the model development team.”Decides: Internal experts independent from the model development teamPDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, 'Capability evaluation' bullet, fifth sentenceInspect claim & evidence ↗
- Who decidesChief Responsible AI Officer reviews updates before adoption“Any updates to our practices will be reviewed by Microsoft’s Chief Responsible AI Officer prior to their adoption.”Consulted: Chief Responsible AI OfficerPDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentenceInspect claim & evidence ↗
- ExceptionLow or medium risk models may be deployed“Models assessed as posing low or medium risk may be deployed with appropriate safeguards as outlined below.”PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', second sentenceInspect claim & evidence ↗
- Not found in the inspected textA change-log entry recording a change to the CBRN capability thresholdsInspected: PDF p. 16 (printed p. 15), Appendix II – Change log, entry “February 2026”, all six bulletsInspect claim & evidence ↗
Links itself to external commitments or laws
- Microsoft’s Frontier Governance Framework (February 2026) describes itself in its change log as a one-year update following finalisation of the EU Code of Practice for General Purpose AI, the New York RAISE Act and California’s Transparency in Frontier Artificial Intelligence Act.2026-02 · revision · Stated in source · Supported Inspect claim & evidence ↗
- Microsoft’s Frontier Governance Framework, February 2026 edition, states that the framework has its genesis in the voluntary Frontier AI Safety Commitments that Microsoft and fifteen other AI labs made in May 2024.2026-02 · revision · Stated in source · Supported Inspect claim & evidence ↗
- Microsoft’s Frontier Governance Framework (February 2026) runs a leading indicator assessment on any model in scope for frontier model requirements under applicable laws, naming the EU AI Act among them.2026-02 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Microsoft’s Frontier Governance Framework (February 2026) names New York’s RAISE Act among the laws whose frontier model requirements trigger its leading indicator assessment, and its change log describes the edition as a one-year update following finalisation of the RAISE Act, among other texts.2026-02 · publication · Stated in source · Supported Inspect claim & evidence ↗
- Microsoft's Frontier Governance Framework (February 2026) explicitly references California's TFAIA in two places. Its change log describes the edition as a one-year update following finalisation of the EU GPAI Code of Practice, New York's RAISE Act and TFAIA. Its leading-indicator assessment is run on any model in scope for frontier-model requirements under applicable laws, and it names TFAIA among those laws.2026-02 · revision · Stated in source · Supported Inspect claim & evidence ↗
Date basis
Placed on the timeline by its revised date. The edition’s footers and change log date it February 2026. A publication date is not established: the file was last modified 2026-03-24 and first captured 2026-04-24.
Open questions and source limits
The February 2026 edition is identified by its version month. Its publication date is not established. The file was last modified on 2026-03-24 and first captured on 2026-04-24.