Frontier AI safety frameworks, edition by edition, 2023–2026

v1.0 Stated ↗

• Paraphrase: The edition says Anthropic’s ongoing work defines three factors in turn for each domain of interest, and names CBRN and cyber risks as those domains.

  PDF p. 20 (printed p. 20), Appendices, 'ASL-3 Evaluations for Misuse Risks', second paragraph, first sentence

v2.0 Stated ↗

• Paraphrase: The edition sets a CBRN weapons Capability Threshold: the ability to significantly help people with basic technical backgrounds create or obtain and deploy CBRN weapons.

  PDF p. 7 (printed p. 3), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', Capability Thresholds column

v2.1 Stated ↗

• Paraphrase: The edition’s CBRN-3 Capability Threshold is the ability to significantly help people with basic technical backgrounds create or obtain and deploy CBRN weapons.

  PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds column

v2.2 Stated ↗ · same recorded passage as v2.1

• Paraphrase: The edition’s CBRN-3 Capability Threshold is the ability to significantly help people with basic technical backgrounds create or obtain and deploy CBRN weapons.

  PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds column

v3.0 Stated ↗

• Paraphrase: The edition’s threshold table has a row titled “Non-novel chemical/biological weapons production”.

  PDF p. 6, §1 Our Recommendations for Industry-Wide Safety, threshold table, row title, left column ('Capability or usage threshold')

• Paraphrase: The next row, “Novel chemical/biological weapons production”, concerns AI systems able to give significant help to threat actors in making or obtaining and deploying chemical or biological weapons whose potential damage would greatly exceed earlier catastrophes like COVID-19.

  PDF p. 7, §1, threshold table, next row title, left column

v3.1 Stated ↗

• Paraphrase: The “Non-novel chemical/biological weapons production” row of the threshold table concerns AI systems able to give significant help to people with a basic technical background in making or obtaining and deploying chemical or biological weapons with serious catastrophic potential.

  PDF p. 6, §1 Our Recommendations for Industry-Wide Safety, threshold table, row 'Non-novel chemical/biological weapons production', left column ('Capability or usage threshold')

v3.2 Stated ↗

• Paraphrase: The edition’s threshold table has a row titled “Non-novel chemical/biological weapons production”.

  PDF p. 6, §1 Our Recommendations for Industry-Wide Safety, threshold table, row title, left column ('Capability or usage threshold')

• Paraphrase: The next row, “Novel chemical/biological weapons production”, concerns AI systems able to give significant help to threat actors in making or obtaining and deploying chemical or biological weapons whose potential damage would greatly exceed earlier catastrophes like COVID-19.

  PDF p. 7, §1, threshold table, next row title, left column

v3.3 Stated ↗

• Paraphrase: The “Non-novel chemical/biological weapons production” row of the threshold table concerns AI systems able to give significant help to people with a basic technical background in making or obtaining and deploying chemical or biological weapons with serious catastrophic potential.

  PDF p. 6, §1 Our Recommendations for Industry-Wide Safety, threshold table, row 'Non-novel chemical/biological weapons production', left column ('Capability or usage threshold')

v3.4 Stated ↗ · same recorded passage as v3.3

• Paraphrase: The “Non-novel chemical/biological weapons production” row of the threshold table concerns AI systems able to give significant help to people with a basic technical background in making or obtaining and deploying chemical or biological weapons with serious catastrophic potential.

  PDF p. 6, §1 Our Recommendations for Industry-Wide Safety, threshold table, row 'Non-novel chemical/biological weapons production', left column ('Capability or usage threshold')

v1.0 Stated ↗

• Paraphrase: The edition says Anthropic’s ongoing work defines three factors in turn for each domain of interest, and names CBRN and cyber risks as those domains.

  PDF p. 20 (printed p. 20), Appendices, 'ASL-3 Evaluations for Misuse Risks', second paragraph, first sentence

v2.0 Stated ↗

• Paraphrase: The edition lists cyber operations under “Ongoing Assessment”: the capacity to substantially strengthen or automate sophisticated, destructive cyberattacks.

  PDF p. 8 (printed p. 4), §2, table 'Capabilities / Ongoing Assessment', row 'Cyber Operations'

v2.1 Stated ↗ · same recorded passage as v2.0

• Paraphrase: The edition lists cyber operations under “Ongoing Assessment”: the capacity to substantially strengthen or automate sophisticated, destructive cyberattacks.

  PDF p. 9 (printed p. 5), §2, table 'Capabilities / Ongoing Assessment', row 'Cyber Operations'

v2.2 Stated ↗ · same recorded passage as v2.1

• Paraphrase: The edition lists cyber operations under “Ongoing Assessment”: the capacity to substantially strengthen or automate sophisticated, destructive cyberattacks.

  PDF p. 9 (printed p. 5), §2, table 'Capabilities / Ongoing Assessment', row 'Cyber Operations'

v3.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.1 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.2 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.3 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.4 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v1.0 Stated ↗

• Paraphrase: The edition names “Autonomous replication in the lab” as an ASL-3 capability: a model showing early signs of being able to replicate itself autonomously, defined by an aggregate success rate of 50% across the tasks in its appendix on autonomy evaluations.

  PDF p. 7 (printed p. 7), 'ASL-3 Commitments' › 'ASL-3 Capabilities and Threat Models', numbered item 2, first sentence

v2.0 Stated ↗

• Paraphrase: The edition’s Autonomous AI R&D Capability Threshold is the ability to automate fully an entry-level, remote-only researcher’s work at Anthropic, or to dramatically accelerate the rate of effective scaling.

  PDF p. 7 (printed p. 3), §2, table row 'Autonomous AI Research and Development (AI R&D)', Capability Thresholds column

v2.1 Stated ↗

• Paraphrase: The edition defines AI R&D-4 as fully automating an entry-level, remote-only Anthropic researcher’s work, and AI R&D-5 as dramatically accelerating effective scaling: an observed or projected one-year rise in effective training compute, for the most capable model in the world, equal to two years of average progress, early 2018–early 2024.

  PDF p. 20 (printed p. 16), Appendix C Detailed Capability Thresholds, 'Autonomous AI Research and Development', entry 'AI R&D-4' (first sentence) and entry 'AI R&D-5' (first and second sentences)

v2.2 Stated ↗ · same recorded passage as v2.1

• Paraphrase: The edition defines AI R&D-4 as fully automating an entry-level, remote-only Anthropic researcher’s work, and AI R&D-5 as dramatically accelerating effective scaling: an observed or projected one-year rise in effective training compute, for the most capable model in the world, equal to two years of average progress, early 2018–early 2024.

  PDF p. 20 (printed p. 16), Appendix C Detailed Capability Thresholds, 'Autonomous AI Research and Development', entry 'AI R&D-4' (first sentence) and entry 'AI R&D-5' (first and second sentences)

v3.0 Stated ↗

• Paraphrase: The edition’s threshold table has a row titled “Automated R&D in key domains”.

  PDF p. 8, §1, threshold table, row title, left column

v3.1 Stated ↗

• Paraphrase: The “Automated R&D in key domains” row of the threshold table concerns AI systems capable of fully automating, or dramatically speeding up, the work of large teams of leading human researchers in domains where rapid progress could threaten international security or quickly disrupt the global balance of power.

  PDF p. 8, §1, threshold table, row 'Automated R&D in key domains', left column, first sentence

v3.2 Stated ↗

• Paraphrase: The edition’s threshold table has a row titled “Automated R&D in key domains”.

  PDF p. 8, §1, threshold table, row title, left column

v3.3 Stated ↗

• Paraphrase: The “Automated R&D in key domains” row of the threshold table concerns AI systems capable of fully automating, or dramatically speeding up, the work of large teams of leading human researchers in domains where rapid progress could threaten international security or quickly disrupt the global balance of power.

  PDF p. 8, §1, threshold table, row 'Automated R&D in key domains', left column, first sentence

v3.4 Stated ↗ · same recorded passage as v3.3

• Paraphrase: The “Automated R&D in key domains” row of the threshold table concerns AI systems capable of fully automating, or dramatically speeding up, the work of large teams of leading human researchers in domains where rapid progress could threaten international security or quickly disrupt the global balance of power.

  PDF p. 8, §1, threshold table, row 'Automated R&D in key domains', left column, first sentence

v1.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Stated, partly ↗

• Paraphrase: In a footnote the edition acknowledges potential risks from highly persuasive AI models and says it believes the capability is not yet understood well enough to include in its current commitments.

  PDF p. 8 (printed p. 4), §2, footnote 3

v2.1 Stated, partly ↗ · same recorded passage as v2.0

• Paraphrase: In a footnote the edition acknowledges potential risks from highly persuasive AI models and says it believes the capability is not yet understood well enough to include in its current commitments.

  PDF p. 9 (printed p. 5), §2, footnote 2

v2.2 Stated, partly ↗ · same recorded passage as v2.1

• Paraphrase: In a footnote the edition acknowledges potential risks from highly persuasive AI models and says it believes the capability is not yet understood well enough to include in its current commitments.

  PDF p. 9 (printed p. 5), §2, footnote 2

v3.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.1 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.2 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.3 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.4 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v1.0 Stated, partly ↗

• Paraphrase: Under the “Autonomy and replication” risk source, the edition says scaled systems may become capable of greater autonomy that lets them proliferate and, because current methods for steering them are imperfect, could potentially act against what their designers or users intend.

  PDF p. 3 (printed p. 3), Framework › 'Sources of Catastrophic Risk', second bullet ('Autonomy and replication'), first sentence

v2.0 Stated, partly ↗

• Paraphrase: The edition says it expects to refine the framework further as future risks arise, giving as an example the risk of an AI system trying to subvert its operators’ goals.

  PDF p. 6 (printed p. 2), §1 Background, paragraph after the Deployment/Security Standards bullets

v2.1 Stated, partly ↗ · same recorded passage as v2.0

• Paraphrase: The edition says it expects to refine the framework further as future risks arise, giving as an example the risk of an AI system trying to subvert its operators’ goals.

  PDF p. 6 (printed p. 2), §1 Background, paragraph after the Deployment/Security Standards bullets

v2.2 Stated, partly ↗ · same recorded passage as v2.1

• Paraphrase: The edition says it expects to refine the framework further as future risks arise, giving as an example the risk of an AI system trying to subvert its operators’ goals.

  PDF p. 6 (printed p. 2), §1 Background, paragraph after the Deployment/Security Standards bullets

v3.0 Stated ↗

• Paraphrase: The edition’s threshold table has a row titled “High-stakes sabotage opportunities”.

  PDF p. 7, §1, threshold table, row title, left column

v3.1 Stated ↗ · same recorded passage as v3.0

• Paraphrase: The edition’s threshold table has a row titled “High-stakes sabotage opportunities”.

  PDF p. 7, §1, threshold table, row title, left column (“Capability or usage threshold”)

v3.2 Stated ↗ · same recorded passage as v3.1

• Paraphrase: The edition’s threshold table has a row titled “High-stakes sabotage opportunities”.

  PDF p. 7, §1, threshold table, row title, left column

v3.3 Stated ↗

• Paraphrase: The edition’s threshold table has a row titled “Misaligned AI systems in high-stakes settings”.

  PDF p. 7, §1, threshold table, row title, left column (“Capability or usage threshold”)

v3.4 Stated ↗ · same recorded passage as v3.3

• Paraphrase: The edition’s threshold table has a row titled “Misaligned AI systems in high-stakes settings”.

  PDF p. 7, §1, threshold table, row title, left column (“Capability or usage threshold”)

v1.0 Stated ↗

• Paraphrase: The edition sets out AI safety levels (ASLs) as capability thresholds representing rising potential risk, each level calling for stricter safety, security and operational measures than the level below.

  PDF p. 2 (printed p. 2), Framework, first paragraph, second sentence

v2.0 Stated ↗

• Paraphrase: The edition says a Capability Threshold acts as the trigger for moving up from ASL-N to the ASL-N+1 Standard (in some cases directly to ASL-N+2 or higher).

  PDF p. 7 (printed p. 3), §1 Background, final paragraph, third sentence

v2.1 Stated ↗

• Paraphrase: The edition’s CBRN-3 Capability Threshold is the ability to significantly help people with basic technical backgrounds create or obtain and deploy CBRN weapons.

  PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds column

• Paraphrase: The edition defines AI R&D-4 as fully automating an entry-level, remote-only Anthropic researcher’s work, and AI R&D-5 as dramatically accelerating effective scaling: an observed or projected one-year rise in effective training compute, for the most capable model in the world, equal to two years of average progress, early 2018–early 2024.

  PDF p. 20 (printed p. 16), Appendix C Detailed Capability Thresholds, 'Autonomous AI Research and Development', entry 'AI R&D-4' (first sentence) and entry 'AI R&D-5' (first and second sentences)

v2.2 Stated ↗ · same recorded passage as v2.1

• Paraphrase: The edition’s CBRN-3 Capability Threshold is the ability to significantly help people with basic technical backgrounds create or obtain and deploy CBRN weapons.

  PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds column

• Paraphrase: The edition defines AI R&D-4 as fully automating an entry-level, remote-only Anthropic researcher’s work, and AI R&D-5 as dramatically accelerating effective scaling: an observed or projected one-year rise in effective training compute, for the most capable model in the world, equal to two years of average progress, early 2018–early 2024.

  PDF p. 20 (printed p. 16), Appendix C Detailed Capability Thresholds, 'Autonomous AI Research and Development', entry 'AI R&D-4' (first sentence) and entry 'AI R&D-5' (first and second sentences)

v3.0 Stated ↗

• Paraphrase: The edition says the left column of its three-column table sets out the capability thresholds at which heightened mitigations would be needed.

  PDF p. 4, §1 Our Recommendations for Industry-Wide Safety, first paragraph

v3.1 Stated ↗ · same recorded passage as v3.0

• Paraphrase: The edition says the left column of its three-column table sets out the capability thresholds at which heightened mitigations would be needed.

  PDF p. 4, §1 Our Recommendations for Industry-Wide Safety, first paragraph

v3.2 Stated ↗ · same recorded passage as v3.1

• Paraphrase: The edition says the left column of its three-column table sets out the capability thresholds at which heightened mitigations would be needed.

  PDF p. 4, §1 Our Recommendations for Industry-Wide Safety, first paragraph

v3.3 Stated ↗ · same recorded passage as v3.2

• Paraphrase: The edition says the left column of its three-column table sets out the capability thresholds at which heightened mitigations would be needed.

  PDF p. 4, §1 Our Recommendations for Industry-Wide Safety, first paragraph

v3.4 Stated ↗ · same recorded passage as v3.3

• Paraphrase: The edition says the left column of its three-column table sets out the capability thresholds at which heightened mitigations would be needed.

  PDF p. 4, §1 Our Recommendations for Industry-Wide Safety, first paragraph

v1.0 Stated ↗

• Paraphrase: The edition’s misuse criterion for an ASL-3 model is that access to it would substantially raise the risk of deliberately caused catastrophic harm, measured against the present baseline level of risk.

  PDF p. 6 (printed p. 6), 'ASL-3 Commitments' › 'ASL-3 Capabilities and Threat Models', numbered item 1, first and second sentences

v2.0 Stated ↗

• Paraphrase: The edition defines a Capability Threshold as a prespecified capability level that, once reached, signals a meaningful rise in risk if the model stays under existing safeguards, and a matching need to move to a higher ASL Standard.

  PDF p. 7 (printed p. 3), §1 Background, final paragraph, second sentence

v2.1 Stated ↗ · same recorded passage as v2.0

• Paraphrase: The edition defines a Capability Threshold as a prespecified capability level that, once reached, signals a meaningful rise in risk if the model stays under existing safeguards, and a matching need to move to a higher ASL Standard.

  PDF p. 7 (printed p. 3), first paragraph (continuing §1 Background), second sentence

v2.2 Stated ↗ · same recorded passage as v2.1

• Paraphrase: The edition defines a Capability Threshold as a prespecified capability level that, once reached, signals a meaningful rise in risk if the model stays under existing safeguards, and a matching need to move to a higher ASL Standard.

  PDF p. 7 (printed p. 3), first paragraph (continuing §1 Background), second sentence

v3.0 Stated, partly ↗

• Paraphrase: The edition says Anthropic cannot yet give detailed advance specifics of which evaluations will decide whether a risk threshold has been passed.

  PDF p. 4, §1, third paragraph, first sentence

• Paraphrase: For the Automated R&D threshold, the edition’s working operationalization is to trigger it when Anthropic determines that a model could fit two years’ worth of AI progress, at the 2018–2024 rate, into a single year.

  PDF p. 8, §1, threshold table, row 'Automated R&D in key domains', left column, paragraph beginning 'Our working operationalization'

v3.1 Stated, partly ↗

• Paraphrase: The edition says Anthropic cannot yet give detailed advance specifics of which evaluations will decide whether a risk threshold has been passed.

  PDF p. 4, §1, third paragraph, first sentence

• Paraphrase: Under the Automated R&D row, the edition will consider the threshold met if Anthropic determines that its models could fully replace all of its Research Scientists and Research Engineers at competitive cost, which it glosses as within a factor of five.

  PDF pp. 8–9, §1, threshold table, row 'Automated R&D in key domains', left column, paragraph beginning 'We will consider this threshold', condition (1)

v3.2 Stated, partly ↗ · same recorded passage as v3.1

• Paraphrase: The edition says Anthropic cannot yet give detailed advance specifics of which evaluations will decide whether a risk threshold has been passed.

  PDF p. 4, §1, third paragraph, first sentence

• Paraphrase: Under the Automated R&D row, the edition will consider the threshold met if Anthropic determines that its models could fully replace all of its Research Scientists and Research Engineers at competitive cost, which it glosses as within a factor of five.

  PDF pp. 8–9, §1, threshold table, row 'Automated R&D in key domains', left column, paragraph beginning 'We will consider this threshold', condition (1)

v3.3 Stated, partly ↗

• Paraphrase: The edition says Anthropic cannot yet give detailed advance specifics of which evaluations will decide whether a risk threshold has been passed.

  PDF p. 4, §1, third paragraph, first sentence

• Paraphrase: Anthropic would count scenario (2) as met where it observes or expects aggregate AI progress at double the rate expected without major AI contributions to AI R&D, and the doubling is plausibly “substantially attributable” to R&D automation, such that continuing the trend could bring further acceleration.

  PDF pp. 9–10, §1, threshold table, row 'Automated R&D in key domains', left column, paragraph beginning 'We would consider scenario (2)', conditions (a) and (b)

v3.4 Stated, partly ↗

• Paraphrase: The edition says Anthropic cannot yet give detailed advance specifics of which evaluations will decide whether a risk threshold has been passed.

  PDF p. 4, §1, third paragraph, first sentence

• Paraphrase: Anthropic would count scenario (2) as met where it observes or expects aggregate AI progress at double both the expected rate and the fastest “extended progress” rate without major AI contributions to AI R&D, and the doubling is plausibly “substantially attributable” to R&D automation, such that further acceleration seems likely.

  PDF pp. 9–10, §1, threshold table, row 'Automated R&D in key domains', left column, paragraph beginning 'We would consider scenario (2)', conditions (a) and (b), and footnote 9

v1.0 Stated ↗

• “the Containment Measures we commit to implement before training such a model, and the Deployment Measures we commit to take before deploying it”

  PDF p. 3 (printed p. 3), 'Initial Commitments', numbered item 2 ('ASL-3')

v2.0 Stated ↗

• “The ASL-3 Deployment Standard and the ASL-3 Security Standard … are required.”

  PDF p. 7 (printed p. 3), §2, table row 'CBRN weapons', Required Safeguards column

v2.1 Stated ↗ · same recorded passage as v2.0

• “The ASL-3 Deployment Standard and the ASL-3 Security Standard … are required.”

  PDF p. 8 (printed p. 4), §2, table row 'CBRN', entry 'CBRN-3', Required Safeguards column

v2.2 Stated ↗ · same recorded passage as v2.1

• “The ASL-3 Deployment Standard and the ASL-3 Security Standard … are required.”

  PDF p. 8 (printed p. 4), §2, table row 'CBRN', entry 'CBRN-3', Required Safeguards column

v3.0 Stated ↗

• “We will maintain or improve on our ASL-3 protections, which include classifier guards at least as robust as our initial Constitutional Classifiers”

  PDF p. 6, §1, threshold table, row 'Non-novel chemical/biological weapons production', middle column ('Mitigations—our plan as a company')

v3.1 Stated ↗ · same recorded passage as v3.0

• “We will maintain or improve on our ASL-3 protections, which include classifier guards at least as robust as our initial Constitutional Classifiers”

  PDF p. 6, §1, threshold table, row 'Non-novel chemical/biological weapons production', middle column ('Mitigations—our plan as a company')

v3.2 Stated ↗ · same recorded passage as v3.1

• “We will maintain or improve on our ASL-3 protections, which include classifier guards at least as robust as our initial Constitutional Classifiers”

  PDF p. 6, §1, threshold table, row 'Non-novel chemical/biological weapons production', middle column ('Mitigations—our plan as a company')

v3.3 Stated ↗ · same recorded passage as v3.2

• “We will maintain or improve on our ASL-3 protections, which include classifier guards at least as robust as our initial Constitutional Classifiers”

  PDF p. 6, §1, threshold table, row 'Non-novel chemical/biological weapons production', middle column ('Mitigations—our plan as a company')

v3.4 Stated ↗ · same recorded passage as v3.3

• “We will maintain or improve on our ASL-3 protections, which include classifier guards at least as robust as our initial Constitutional Classifiers”

  PDF p. 6, §1, threshold table, row 'Non-novel chemical/biological weapons production', middle column ('Mitigations—our plan as a company')

v1.0 Stated ↗

• “Anthropic’s commitment to follow the ASL scheme thus implies that we commit to pause the scaling2 and/or delay the deployment of new models whenever our scaling ability outstrips our ability to comply with the safety procedures for the corresponding ASL.”

  PDF p. 2 (printed p. 2), section 'Framework', paragraph beginning 'Complying with higher ASLs', second sentence

v2.0 Stated ↗

• “If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.”

  PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the bulleted process)

• “If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.”

  PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence

v2.1 Stated ↗ · same recorded passage as v2.0

• “If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.”

  PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the numbered process)

• “If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.”

  PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence

v2.2 Stated ↗ · same recorded passage as v2.1

• “If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.”

  PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the numbered process)

• “If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.”

  PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence

v3.0 Stated ↗

• “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”

  PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column

v3.1 Stated ↗

• “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”

  PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column

• “the commitments below do not preclude us from taking cautionary action, such as refraining from training or deploying models, in other circumstances.”

  PDF p. 16 (printed p. 15), Appendix A: Commitments Related to Competitors, introductory paragraph, second-to-last sentence

v3.2 Stated ↗ · same recorded passage as v3.1

• “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”

  PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column

• “the commitments below do not preclude us from taking cautionary action, such as refraining from training or deploying models, in other circumstances.”

  PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, introductory paragraph, second-to-last sentence

v3.3 Stated ↗ · same recorded passage as v3.2

• “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”

  PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column

• “the commitments below do not preclude us from taking cautionary action, such as refraining from training or deploying models, in other circumstances.”

  PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, introductory paragraph, second-to-last sentence

v3.4 Stated ↗ · same recorded passage as v3.3

• “We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.”

  PDF p. 17 (printed p. 17), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column

• “the commitments below do not preclude us from taking cautionary action, such as refraining from training or deploying models, in other circumstances.”

  PDF p. 17 (printed p. 17), Appendix A: Commitments Related to Competitors, introductory paragraph, second-to-last sentence

v1.0 Stated, partly ↗

• “If the model has already surpassed the next ASL during training, immediately lock down access to the weights. Stakeholders including the CISO and CEO should be immediately convened to determine whether the level of danger merits deletion of the weights.”

  PDF p. 13 (printed p. 13), section 'Evaluation Protocol', bullet 'Response policy', step (2c), first and second sentences

v2.0 Stated ↗

• “Safeguards Report(s) will be escalated to the CEO and the Responsible Scaling Officer, who will (1) make the ultimate determination”

  PDF p. 13 (printed p. 9), §4.3 Safeguards Decision, second bullet

v2.1 Stated ↗ · same recorded passage as v2.0

• “Safeguards Report(s) will be escalated to the CEO and the Responsible Scaling Officer, who will (1) make the ultimate determination”

  PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, numbered item 2

v2.2 Stated ↗ · same recorded passage as v2.1

• “Safeguards Report(s) will be escalated to the CEO and the Responsible Scaling Officer, who will (1) make the ultimate determination”

  PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, numbered item 2

v3.0 Stated ↗

• “CEO and RSO will make the ultimate determination regarding the adequacy of the risk assessment and any downstream deployment or development plans.”

  PDF p. 12, §3.4 Procedures, item 3 ('Executive approval'), second sentence

v3.1 Stated ↗ · same recorded passage as v3.0

• “CEO and RSO will make the ultimate determination regarding the adequacy of the risk assessment and any downstream deployment or development plans.”

  PDF p. 13 (printed p. 12), §3.4 Procedures, item 3 ('Executive approval'), second sentence

v3.2 Stated ↗ · same recorded passage as v3.1

• “CEO and RSO will make the ultimate determination regarding the adequacy of the risk assessment and any downstream deployment or development plans.”

  PDF p. 13 (printed p. 12), §3.4 Procedures, item 3 ('Executive approval'), second sentence

v3.3 Stated ↗ · same recorded passage as v3.2

• “CEO and RSO will make the ultimate determination regarding the adequacy of the risk assessment and any downstream deployment or development plans.”

  PDF p. 13 (printed p. 12), §3.4 Procedures, item 3 ('Executive approval'), second sentence

v3.4 Stated ↗ · same recorded passage as v3.3

• “CEO and RSO will make the ultimate determination regarding the adequacy of the risk assessment and any downstream deployment or development plans.”

  PDF p. 13, §3.4 Procedures, item 3 ('Executive approval'), second sentence

v1.0 Stated, partly ↗

• “Share results of ASL evaluations promptly with Anthropic's governing bodies, including the board of directors and LTBT, in order to sufficiently inform them of changes to our risk profile.”

  PDF p. 10 (printed p. 10), section 'Procedural Commitments', numbered item 6

v2.0 Stated, partly ↗

• “If the CEO and RSO decide to proceed with deployment and training, they will share their decision–as well as the underlying Capability Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.”

  PDF p. 13 (printed p. 9), §4.3 Safeguards Decision, fourth bullet

v2.1 Stated, partly ↗

• “If the CEO and RSO decide to proceed with deployment and training, they will share their decision–as well as the underlying Safeguards Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.”

  PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, item 4

v2.2 Stated, partly ↗

• “If the CEO and RSO decide to proceed with deployment and training, they will share their decision– as well as the underlying Safeguards Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.”

  PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, item 4

v3.0 Stated ↗

• “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”

  PDF p. 12 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')

v3.1 Stated ↗ · same recorded passage as v3.0

• “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”

  PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')

v3.2 Stated ↗

• “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”

  PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')

• “In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.”

  PDF p. 14 (printed p. 13), §3.6 External Review, final paragraph before §3.6.1

v3.3 Stated ↗ · same recorded passage as v3.2

• “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”

  PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')

• “In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.”

  PDF p. 14 (printed p. 13), §3.6 External Review, final paragraph before §3.6.1

v3.4 Stated ↗ · same recorded passage as v3.3

• “In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.”

  PDF p. 14 (printed p. 14), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')

• “In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.”

  PDF p. 14 (printed p. 14), §3.6 External Review, final paragraph before §3.6.1

v1.0 Stated ↗

• Paraphrase: The edition says that during training and fine-tuning Anthropic will evaluate its models for next-ASL capabilities each time effective compute grows fourfold, including mid-training, and every three months.

  PDF p. 12 (printed p. 12), Evaluation Protocol, bullet 'Timing', first sentence

v2.0 Stated ↗

• Paraphrase: The edition treats a model as “notably more capable”, which triggers a comprehensive assessment, when it scores notably higher in automated testing of risk-relevant domains (an Effective Compute increase of at least 4x) or six months of finetuning and elicitation improvements have accumulated.

  PDF p. 9 (printed p. 5), §3.1 Preliminary Assessment, definition of “notably more capable” and numbered items 1–2

v2.1 Stated ↗

• Paraphrase: The edition treats a model as “notably more capable”, which triggers a comprehensive assessment, when it performs notably better in automated testing of risk-relevant domains (an Effective Compute increase of at least 4x) or six months of finetuning and elicitation improvements have accumulated.

  PDF p. 10 (printed p. 6), §3.1 Preliminary Assessment, definition of “notably more capable” and numbered items 1–2

v2.2 Stated ↗

• Paraphrase: The edition treats a model as “notably more capable”, which triggers a comprehensive assessment, when it scores notably higher in automated testing of risk-relevant domains (an Effective Compute increase of at least 4x) or six months of finetuning and elicitation improvements have accumulated.

  PDF p. 10 (printed p. 6), §3.1 Preliminary Assessment, definition of “notably more capable” and numbered items 1–2

v3.0 Stated, partly ↗

• Paraphrase: The edition says a Risk Report will be published every three to six months.

  PDF p. 10, §3.1 Scope and Timing, paragraph 'Timing'

v3.1 Stated, partly ↗ · same recorded passage as v3.0

• Paraphrase: The edition says a Risk Report will be published every three to six months.

  PDF p. 11 (printed p. 10), §3.1 Scope and Timing, paragraph 'Timing'

v3.2 Stated, partly ↗ · same recorded passage as v3.1

• Paraphrase: The edition says a Risk Report will be published every three to six months.

  PDF p. 11 (printed p. 10), §3.1 Scope and Timing, paragraph 'Timing'

v3.3 Stated, partly ↗ · same recorded passage as v3.2

• Paraphrase: The edition says a Risk Report will be published every three to six months.

  PDF p. 11 (printed p. 10), §3.1 Scope and Timing, paragraph 'Timing'

v3.4 Stated, partly ↗ · same recorded passage as v3.3

• Paraphrase: The edition says a Risk Report will be published every three to six months.

  PDF p. 11, §3.1 Scope and Timing, paragraph 'Timing'

v1.0 Stated, partly ↗

• “to avoid a “race to the bottom”, the latter should not include the effects of other companies’ language models”

  PDF p. 5 (printed p. 5), ASL-2 Commitments, footnote 5, third sentence

• “a clearly bad actor (such as a rogue state) is scaling in so reckless a manner … we could envisage a substantial loosening of these restrictions”

  PDF p. 10 (printed p. 10), Procedural Commitments, item 1 ('Update Process'), second sub-bullet, first sentence

v2.0 Stated ↗

• “It is possible at some point in the future that another actor in the frontier AI ecosystem will pass, or be on track to imminently pass, a Capability Threshold without implementing measures equivalent to the Required Safeguards”

  PDF p. 16 (printed p. 12), footnote 18 (attached to §7.1 item 7 'Policy changes'), first and second sentences

v2.1 Stated ↗ · same recorded passage as v2.0

• “It is possible at some point in the future that another actor in the frontier AI ecosystem will pass, or be on track to imminently pass, a Capability Threshold without implementing measures equivalent to the Required Safeguards”

  PDF p. 17 (printed p. 13), footnote 17 (attached to §7.1 item 7 'Policy changes'), first and second sentences

v2.2 Stated ↗ · same recorded passage as v2.1

• “It is possible at some point in the future that another actor in the frontier AI ecosystem will pass, or be on track to imminently pass, a Capability Threshold without implementing measures equivalent to the Required Safeguards”

  PDF p. 17 (printed p. 13), footnote 17 (attached to §7.1 item 7 'Policy changes'), first and second sentences

v3.0 Stated ↗

• “For our highly capable frontier models, we will meet or exceed the overall risk reduction posture of these competitors, as far as we can tell based on our best efforts to assess that posture.”

  PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Competitors have strong safety measures', Commitment column, first sentence

• “We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.”

  PDF p. 16, Appendix A, table row 'General upleveling', Commitment column, second sentence

v3.1 Stated ↗

• “we will meet or exceed the overall risk reduction posture of these competitors”

  PDF p. 17 (printed p. 16), Appendix A, table row 'Competitors have strong safety measures', Commitment column, first sentence

• “We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.”

  PDF p. 17 (printed p. 16), Appendix A, table row 'General upleveling', Commitment column, second sentence

v3.2 Stated ↗ · same recorded passage as v3.1

• “we will meet or exceed the overall risk reduction posture of these competitors”

  PDF p. 17 (printed p. 16), Appendix A, table row 'Competitors have strong safety measures', Commitment column, first sentence

• “We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.”

  PDF p. 17 (printed p. 16), Appendix A, table row 'General upleveling', Commitment column, second sentence

v3.3 Stated ↗ · same recorded passage as v3.2

• “we will meet or exceed the overall risk reduction posture of these competitors”

  PDF p. 17 (printed p. 16), Appendix A, table row 'Competitors have strong safety measures', Commitment column, first sentence

• “We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.”

  PDF p. 17 (printed p. 16), Appendix A, table row 'General upleveling', Commitment column, second sentence

v3.4 Stated ↗ · same recorded passage as v3.3

• “we will meet or exceed the overall risk reduction posture of these competitors”

  PDF p. 17, Appendix A, table row 'Competitors have strong safety measures', Commitment column, first sentence

• “We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.”

  PDF p. 17, Appendix A, table row 'General upleveling', Commitment column, second sentence

v1.0 Stated ↗

• “In limited cases, models with capabilities relevant to catastrophic harm may be made available to a select group of vetted users with a legitimate and beneficial use-case that cannot be separated from dangerous capabilities, and only if such access can be granted safely and with sufficient oversight.”

  PDF p. 9 (printed p. 9), section 'ASL-3 Commitments', subsection 'ASL-3 Deployment Measures', bullet 'Tiered access', first sentence

v2.0 Stated ↗

• “where this policy is unintentionally ambiguous, we will act in accordance with the Responsible Scaling Officer or CEO’s judgment”

  PDF p. 15 (printed p. 11), §7.1, footnote 17

v2.1 Stated ↗ · same recorded passage as v2.0

• “where this policy is unintentionally ambiguous, we will act in accordance with the Responsible Scaling Officer or CEO’s judgment”

  PDF p. 16 (printed p. 12), §7.1, footnote 16

v2.2 Stated ↗ · same recorded passage as v2.1

• “where this policy is unintentionally ambiguous, we will act in accordance with the Responsible Scaling Officer or CEO’s judgment”

  PDF p. 16 (printed p. 12), §7.1, footnote 16

v3.0 Stated ↗

• “These are not hard commitments but rather public goals”

  PDF p. 3, Introduction, paragraph on Frontier Safety Roadmaps, final sentence

• “making judgment calls on policy interpretation and application”

  PDF p. 15, §4 Governance, item 1 ('Responsible Scaling Officer'), duty (6)

v3.1 Stated ↗ · same recorded passage as v3.0

• “These are not hard commitments but rather public goals”

  PDF p. 3, Introduction, paragraph on Frontier Safety Roadmaps, final sentence

• “making judgment calls on policy interpretation and application”

  PDF p. 16 (printed p. 15), §4 Governance, item 1 ('Responsible Scaling Officer'), duty (6)

v3.2 Stated ↗ · same recorded passage as v3.1

• “These are not hard commitments but rather public goals”

  PDF p. 3, Introduction, paragraph on Frontier Safety Roadmaps, final sentence

• “making judgment calls on policy interpretation and application”

  PDF p. 16 (printed p. 15), §4 Governance, item 1 ('Responsible Scaling Officer'), duty (6)

v3.3 Stated ↗ · same recorded passage as v3.2

• “These are not hard commitments but rather public goals”

  PDF p. 3, Introduction, paragraph on Frontier Safety Roadmaps, final sentence

• “making judgment calls on policy interpretation and application”

  PDF p. 16 (printed p. 15), §4 Governance, item 1 ('Responsible Scaling Officer'), duty (6)

v3.4 Stated ↗

• “not hard commitments but rather public goals”

  PDF p. 3, Introduction, paragraph on Frontier Safety Roadmaps, final sentence

• “making judgment calls on policy interpretation and application”

  PDF p. 16, §4 Governance, item 1 ('Responsible Scaling Officer'), duty (6)

v1.0 Stated ↗

• Paraphrase: The edition says the Responsible Scaling Officer will report each quarter to the board and the LTBT on implementation status, noting any deficiencies in implementation.

  PDF p. 10 (printed p. 10), Procedural Commitments, numbered item 7 ('Responsible Scaling Officer'), second sentence

v2.0 Stated ↗

• Paraphrase: The edition says Anthropic will share summaries of its Capability Reports and Safeguards Reports with regular-clearance staff, with highly sensitive information redacted.

  PDF p. 16 (printed p. 12), §7.1 Internal Governance, numbered item 3 ('Transparency'), first sentence

v2.1 Stated ↗ · same recorded passage as v2.0

• Paraphrase: The edition says Anthropic will share summaries of its Capability Reports and Safeguards Reports with regular-clearance staff, with highly sensitive information redacted.

  PDF p. 16 (printed p. 12), §7.1 Internal Governance, numbered item 3 ('Transparency'), first sentence

v2.2 Stated ↗ · same recorded passage as v2.1

• Paraphrase: The edition says Anthropic will share summaries of its Capability Reports and Safeguards Reports with regular-clearance staff, with highly sensitive information redacted.

  PDF p. 16 (printed p. 12), §7.1 Internal Governance, numbered item 3 ('Transparency'), first sentence

v3.0 Stated ↗

• Paraphrase: The edition says final Risk Reports, without redactions, will be shared with Anthropic’s regular-clearance staff.

  PDF p. 15, §4 Governance, item 2 ('Internal transparency')

v3.1 Stated ↗ · same recorded passage as v3.0

• Paraphrase: The edition says final Risk Reports, without redactions, will be shared with Anthropic’s regular-clearance staff.

  PDF p. 16 (printed p. 15), §4 Governance, item 2 ('Internal transparency')

v3.2 Stated ↗

• Paraphrase: The edition says final Risk Reports, without redactions, will be shared with Anthropic’s regular-clearance staff.

  PDF p. 16 (printed p. 15), §4 Governance, item 3 ('Internal transparency')

• Paraphrase: The edition says Anthropic will brief the LTBT regularly on plans and developments relating to its Risk Reports, including model training.

  PDF p. 16 (printed p. 15), §4 Governance, item 2 ('Long Term Benefit Trust')

v3.3 Stated ↗ · same recorded passage as v3.2

• Paraphrase: The edition says final Risk Reports, without redactions, will be shared with Anthropic’s regular-clearance staff.

  PDF p. 16 (printed p. 15), §4 Governance, item 3 ('Internal transparency')

• Paraphrase: The edition says Anthropic will brief the LTBT regularly on plans and developments relating to its Risk Reports, including model training.

  PDF p. 16 (printed p. 15), §4 Governance, item 2 ('Long Term Benefit Trust')

v3.4 Stated ↗

• Paraphrase: The edition says final Risk Reports without redactions will be shared with many Anthropic employees (at least 200).

  PDF p. 16, §4 Governance, item 3 ('Internal transparency')

• Paraphrase: The edition says Anthropic will brief the LTBT regularly on plans and developments relating to its Risk Reports, including model training.

  PDF p. 16, §4 Governance, item 2 ('Long Term Benefit Trust')

v1.0 Stated ↗

• Paraphrase: The edition lists among its procedural commitments making evaluation results public after a model is deployed, where possible: sometimes in the first model card, otherwise after a delay if that serves a broad safety interest.

  PDF p. 10 (printed p. 10), Procedural Commitments, numbered item 5

v2.0 Stated ↗

• Paraphrase: The edition says Anthropic will publicly release key information on the evaluation and deployment of its models, excluding sensitive details.

  PDF p. 16 (printed p. 12), §7.2 Transparency and External Input, numbered item 1 ('Public disclosures'), first sentence

v2.1 Stated ↗ · same recorded passage as v2.0

• Paraphrase: The edition says Anthropic will publicly release key information on the evaluation and deployment of its models, excluding sensitive details.

  PDF p. 17 (printed p. 13), §7.2 Transparency and External Input, numbered item 1 ('Public disclosures'), first sentence

v2.2 Stated ↗ · same recorded passage as v2.1

• Paraphrase: The edition says Anthropic will publicly release key information on the evaluation and deployment of its models, excluding sensitive details.

  PDF p. 17 (printed p. 13), §7.2 Transparency and External Input, numbered item 1 ('Public disclosures'), first sentence

v3.0 Stated ↗

• Paraphrase: The edition says Anthropic will make a version of its Risk Report public.

  PDF p. 13, §3.5 Publication and Redactions, first sentence

v3.1 Stated ↗ · same recorded passage as v3.0

• Paraphrase: The edition says Anthropic will make a version of its Risk Report public.

  PDF p. 14 (printed p. 13), §3.5 Publication and Redactions, first sentence

v3.2 Stated ↗ · same recorded passage as v3.1

• Paraphrase: The edition says Anthropic will make a version of its Risk Report public.

  PDF p. 14 (printed p. 13), §3.5 Publication and Redactions, first sentence

v3.3 Stated ↗

• Paraphrase: The edition says a public version of each Risk Report will be published.

  PDF p. 14 (printed p. 13), §3.5 Publication and Redactions, first sentence

v3.4 Stated ↗

• Paraphrase: The edition says a public version of each Risk Report will be published.

  PDF p. 14, §3.5 Publication and Redactions, first sentence

• Paraphrase: The edition says the existence of every redaction in the public version will be disclosed.

  PDF p. 14, §3.5 Publication and Redactions, paragraph after the list of redaction reasons

v1.0 Stated ↗

• Paraphrase: The edition lists among its procedural commitments an “Update Process” for the document, under which the board of directors approves changes after consulting the Long-Term Benefit Trust.

  PDF p. 10 (printed p. 10), Procedural Commitments, numbered item 1, first sentence

v2.0 Stated ↗

• Paraphrase: The edition says the CEO and the Responsible Scaling Officer will propose changes to the policy and the Board of Directors will approve them, consulting the Long-Term Benefit Trust.

  PDF p. 16 (printed p. 12), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentence

v2.1 Stated ↗ · same recorded passage as v2.0

• Paraphrase: The edition says the CEO and the Responsible Scaling Officer will propose changes to the policy and the Board of Directors will approve them, consulting the Long-Term Benefit Trust.

  PDF p. 17 (printed p. 13), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentence

v2.2 Stated ↗ · same recorded passage as v2.1

• Paraphrase: The edition says the CEO and the Responsible Scaling Officer will propose changes to the policy and the Board of Directors will approve them, consulting the Long-Term Benefit Trust.

  PDF p. 17 (printed p. 13), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentence

v3.0 Stated ↗

• Paraphrase: The edition says the CEO and RSO will propose any change to the RSP, and the Board will approve it in consultation with the LTBT.

  PDF p. 15, §4 Governance, item 7 ('Policy changes'), first sentence

v3.1 Stated ↗ · same recorded passage as v3.0

• Paraphrase: The edition says the CEO and RSO will propose any change to the RSP, and the Board will approve it in consultation with the LTBT.

  PDF p. 16 (printed p. 15), §4 Governance, item 7 ('Policy changes'), first sentence

v3.2 Stated ↗ · same recorded passage as v3.1

• Paraphrase: The edition says the CEO and RSO will propose any change to the RSP, and the Board will approve it in consultation with the LTBT.

  PDF p. 16 (printed p. 15), §4 Governance, item 8 ('Policy changes'), first sentence

v3.3 Stated ↗ · same recorded passage as v3.2

• Paraphrase: The edition says the CEO and RSO will propose any change to the RSP, and the Board will approve it in consultation with the LTBT.

  PDF p. 16 (printed p. 15), §4 Governance, item 8 ('Policy changes'), first sentence

v3.4 Stated ↗ · same recorded passage as v3.3

• Paraphrase: The edition says the CEO and RSO will propose any change to the RSP, and the Board will approve it in consultation with the LTBT.

  PDF p. 16, §4 Governance, item 8 ('Policy changes'), first sentence

v1.0 Does not apply

First edition in this framework; there is no earlier edition.

v2.0 Stated ↗

• Paraphrase: The changelog says the term “ASL” now names sets of technical and operational safeguards, where it earlier also named models.

  PDF p. 21 (printed p. 17), Changelog, October 15, 2024 entry, paragraph 'ASL definition changed', first sentence

v2.1 Stated ↗

• Paraphrase: The v2.1 changelog says the existing AI R&D capability thresholds have been split into two separate levels.

  PDF p. 22 (printed p. 18), Changelog, March 31, 2025 (RSP v2.1) entry, paragraph 'New Capability Thresholds', second sentence

v2.2 Stated ↗

• Paraphrase: The v2.2 changelog says the update places sophisticated insiders, and insiders compromised by states, outside the ASL-3 Security Standard.

  PDF p. 23 (printed p. 19), Changelog, May 14, 2025 (RSP v2.2) entry, paragraph 'ASL-3 Security', first sentence

v3.0 Stated ↗

• Paraphrase: The v3.0 changelog entry describes the update as a comprehensive rewrite of the RSP.

  PDF p. 19, Changelog, entry 'February 24, 2026 (RSP v3.0)'

• Paraphrase: The Introduction says the edition now separates the plans Anthropic expects to achieve as a company, whatever other companies do, from its more ambitious recommendations for the whole industry.

  PDF p. 3, Introduction, paragraph beginning 'We now separate'

v3.1 Stated ↗

• Paraphrase: The v3.1 changelog entry says the revision addresses how the Automated R&D threshold is operationalized, how internal feedback on Risk Reports is used, and that Anthropic may consider a pause in development or deployment when the Appendix A commitments have not been triggered.

  PDF p. 20 (printed p. 19), Changelog, entry 'April 2, 2026 (RSP v3.1)', first sentence

v3.2 Stated ↗

• Paraphrase: The v3.2 changelog entry says the update gives the LTBT authority to ask for external review of Risk Reports and to approve Anthropic’s choice of external reviewers, and makes formal a requirement for regular briefings to the LTBT.

  PDF p. 20 (printed p. 19), Changelog, entry 'April 29, 2026 (RSP v3.2)'

v3.3 Stated ↗

• Paraphrase: The v3.3 changelog entry lists three changes: a revised novel chemical/biological weapons threshold, intended to follow the threat model of concern more closely; a refined approach to off-cycle updates on individual models’ risks; and minor terminology changes.

  PDF p. 20 (printed p. 19), Changelog, entry 'May 26, 2026 (RSP v3.3)'

v3.4 Stated ↗

• Paraphrase: The v3.4 changelog entry says the update makes five changes, the first being a revision of the Automated R&D capability threshold.

  PDF p. 20, Changelog, entry 'July 8, 2026 (RSP v3.4)', lead-in and item 1

• Paraphrase: Item 2 says fully unredacted Risk Reports must now go to at least 200 Anthropic employees, not to all staff with regular clearance.

  PDF p. 21, Changelog, entry 'July 8, 2026 (RSP v3.4)', item 2, first sentence

v1.0 Stated ↗

• Paraphrase: The edition says its first CCLs cover four domains: Autonomy, Biosecurity, Cybersecurity and “Machine Learning R&D”.

  PDF p. 1 (printed p. 1), opening section, second paragraph, third sentence

• Paraphrase: Under Future work, the edition says Google DeepMind's existing model evaluations, which it is already implementing, currently cover powerful capabilities in the chemical, radiological and nuclear domains, and that these domains are possible candidates for inclusion in the Framework.

  PDF p. 6 (printed p. 6), Future work, bullet 'Updated set of risks and mitigations', second sub-bullet

v2.0 Stated ↗

• Paraphrase: The edition says the misuse CCLs in its table were identified by continuing analysis of three domains: CBRN, Cyber and “Machine Learning R&D”.

  PDF p. 4 (printed p. 4), Misuse Critical Capability Levels, first paragraph, first sentence

v3.0 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that severe risks from future models may be likeliest in four domains: CBRN, cyber, harmful manipulation and “machine learning R&D”.

  PDF p. 5 (printed p. 5), §1.3 Outline of Our Risk Assessment Process, 'Identification' bullet, first sentence

v3.1 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and in “machine learning R&D and misalignment”.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

v1.0 Stated ↗

• Paraphrase: The edition says its first CCLs cover four domains: Autonomy, Biosecurity, Cybersecurity and “Machine Learning R&D”.

  PDF p. 1 (printed p. 1), opening section, second paragraph, third sentence

v2.0 Stated ↗

• Paraphrase: The edition says the misuse CCLs in its table were identified by continuing analysis of three domains: CBRN, Cyber and “Machine Learning R&D”.

  PDF p. 4 (printed p. 4), Misuse Critical Capability Levels, first paragraph, first sentence

v3.0 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that severe risks from future models may be likeliest in four domains: CBRN, cyber, harmful manipulation and “machine learning R&D”.

  PDF p. 5 (printed p. 5), §1.3 Outline of Our Risk Assessment Process, 'Identification' bullet, first sentence

v3.1 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and in “machine learning R&D and misalignment”.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

v1.0 Stated ↗

• Paraphrase: The edition says its first CCLs cover four domains: Autonomy, Biosecurity, Cybersecurity and “Machine Learning R&D”.

  PDF p. 1 (printed p. 1), opening section, second paragraph, third sentence

• Paraphrase: A footnote defines “Autonomy” as the possible misuse of models with substantial capacity for agency and flexible use of actions and tools across long time horizons and several domains.

  PDF p. 2 (printed p. 2), footnote 2

v2.0 Stated ↗

• Paraphrase: The edition says the misuse CCLs in its table were identified by continuing analysis of three domains: CBRN, Cyber and “Machine Learning R&D”.

  PDF p. 4 (printed p. 4), Misuse Critical Capability Levels, first paragraph, first sentence

• Paraphrase: A footnote to Table 1 says the edition drops the Autonomy risk domain that “Frontier Safety Framework version 1.0” contained.

  PDF p. 5 (printed p. 5), Table 1, footnote 9, first sentence

v3.0 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that severe risks from future models may be likeliest in four domains: CBRN, cyber, harmful manipulation and “machine learning R&D”.

  PDF p. 5 (printed p. 5), §1.3 Outline of Our Risk Assessment Process, 'Identification' bullet, first sentence

v3.1 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and in “machine learning R&D and misalignment”.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

v1.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.0 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that severe risks from future models may be likeliest in four domains: CBRN, cyber, harmful manipulation and “machine learning R&D”.

  PDF p. 5 (printed p. 5), §1.3 Outline of Our Risk Assessment Process, 'Identification' bullet, first sentence

• Paraphrase: A note on harmful manipulation says both the CCL and the assessment of risk in this domain are exploratory and open to further research.

  PDF p. 10 (printed p. 10), §2.2.3 Harmful Manipulation, Note, second sentence

v3.1 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and machine learning R&D and misalignment.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

• Paraphrase: A note on harmful manipulation says both the CCL and the assessment of risk in this domain are exploratory and open to further research.

  PDF p. 12 (printed p. 12), §2.2.3 Harmful Manipulation, Note, second sentence

v1.0 Stated, partly ↗

• Paraphrase: Under Future work, the edition lists misaligned AI as a possible addition: guarding against AI systems that act adversarially towards people may need further Framework components.

  PDF p. 6 (printed p. 6), Future work, bullet 'Updated set of risks and mitigations', first sub-bullet

v2.0 Stated ↗

• Paraphrase: The edition says that, besides misuse risk, it includes an exploratory section on deceptive alignment risk.

  PDF p. 1 (printed p. 1, unnumbered), opening section, third paragraph, second sentence

v3.0 Stated ↗

• Paraphrase: The edition says that for misalignment risk it sets out an exploratory approach.

  PDF p. 4 (printed p. 4), §1.2 Critical Capability Levels, fifth paragraph, first sentence

• Paraphrase: A footnote says misalignment risk is left out of the list of identified risk domains because it is exploratory.

  PDF p. 5 (printed p. 5), §1.3, footnote 4

v3.1 Stated ↗

• Paraphrase: The edition says Google DeepMind has determined, on early research, that significant or severe risks from future models may be likeliest in CBRN, cyber, harmful manipulation, and in “machine learning R&D and misalignment”.

  PDF p. 5 (printed p. 5), §1.3.1 Risk Identification, fourth sentence

v1.0 Stated ↗

• Paraphrase: The edition says the Framework is organised around capability thresholds it calls “Critical Capability Levels”.

  PDF p. 2 (printed p. 2), Framework, component '1 - Critical Capability Levels', first sentence

v2.0 Stated ↗

• Paraphrase: The edition sets out two groups of CCLs: misuse CCLs, which can signal a heightened risk that misuse causes severe harm if left unaddressed, and deceptive alignment CCLs.

  PDF p. 2 (printed p. 2), Framework, component '1 - Critical Capability Levels', second paragraph

v3.0 Stated ↗

• Paraphrase: The edition describes three sets of CCLs: misuse, machine learning R&D and misalignment.

  PDF p. 4 (printed p. 4), §1.2 Critical Capability Levels, second paragraph

v3.1 Stated ↗

• Paraphrase: The edition names two kinds of capability level: “Tracked Capability Levels (TCLs)”, at which models may pose significant risks, and “Critical Capability Levels (CCLs)”, at which they may pose severe risks.

  PDF p. 2 (printed p. 2), Overview, third paragraph, first sentence

• Paraphrase: The edition says it sets TCLs for CBRN risk and for ML R&D and misalignment risks.

  PDF p. 4 (printed p. 4), §1.2, last paragraph, third sentence

v1.0 Stated ↗

• Paraphrase: The edition defines CCLs as levels of capability at which, without mitigations, models may pose heightened risk, and sets each as the minimum capability a model needs to cause harm along the main identified paths.

  PDF p. 2 (printed p. 2), Framework, component '1 - Critical Capability Levels', second and third sentences

v2.0 Stated ↗

• Paraphrase: The edition defines CCLs as levels of capability at which AI models or systems without mitigations may present a heightened risk of severe harm.

  PDF p. 2 (printed p. 2), Framework, component '1 - Critical Capability Levels', first paragraph, second sentence

v3.0 Stated ↗

• Paraphrase: The edition defines CCLs as levels of capability at which frontier AI models or systems without mitigations may present a heightened risk of severe harm.

  PDF p. 4 (printed p. 4), §1.2 Critical Capability Levels, first paragraph, second sentence

v3.1 Stated ↗

• Paraphrase: The edition defines CCLs as levels of capability at which frontier AI models or systems, absent mitigations, may present a heightened risk of severe harm.

  PDF p. 4 (printed p. 4), §1.2, first paragraph, second sentence

• Paraphrase: The glossary defines TCLs as levels of capability at which, without mitigations, such models or systems may present a heightened risk of harm that is significant but not severe.

  PDF p. 18, glossary, entry for Tracked Capability Levels

v1.0 Stated, partly ↗

• “When a model reaches evaluation thresholds (i.e. passes a set of early warning evaluations), we will formulate a response plan based on the analysis of the CCL and evaluation results.”

  PDF p. 2 (printed p. 2), Framework, component '3 - Applying mitigations', first paragraph, first sentence

• “we will develop mitigation plans that map the CCLs to the security and deployment levels described.”

  PDF p. 6 (printed p. 6), Future work, bullet 'Mitigation plans', last sentence

v2.0 Stated ↗

• “The following deployment mitigation process will be applied to models reaching a CCL”

  PDF p. 4 (printed p. 4), Misuse, Mitigation Approach, 'Deployment Mitigations', first sentence

• “We recommend a security level to each of these CCLs”

  PDF p. 4 (printed p. 4), Misuse Critical Capability Levels, first paragraph, third sentence

v3.0 Stated ↗

• “The following mitigation process for external deployments will be applied to models reaching a misuse CCL”

  PDF p. 8 (printed p. 8), §2.1.2 Deployment Mitigations, first sentence

• “The following mitigation process will be applied for deployments of a model reaching a ML R&D CCL.”

  PDF p. 12 (printed p. 12), §3.1.2 Deployment Mitigations, first sentence

v3.1 Stated ↗

• “The following mitigation process for external deployments will be applied to models reaching a misuse T/CCL”

  PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, first sentence

• “We recommend a security level for each CCL”

  PDF p. 11 (printed p. 11), §2.2 Misuse Capability Levels, first paragraph, third sentence

v1.0 Stated ↗

• “A model may reach evaluation thresholds before mitigations at appropriate levels are ready. If this happens, we would put on hold further deployment or development, or implement additional protocols”

  PDF p. 2 (printed p. 2), Framework, component '3 - Applying mitigations', third paragraph, first sentence and opening of second sentence

v2.0 Stated ↗

• “If this happens, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied.”

  PDF p. 3 (printed p. 3), Framework, component '3 - Applying Mitigations', third paragraph, second sentence

v3.0 Stated ↗

• “Pre-deployment review of safety case: external deployments of a model take place only after the appropriate governance function determines the safety case regarding each CCL the model has reached to be adequate.”

  PDF p. 9 (printed p. 9), §2.1.2 Deployment Mitigations, numbered step 2, first sentence

• “This is required only for external deployment, not further development.”

  PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse CCL bullet, first sub-bullet, final sentence

v3.1 Stated ↗

• “Pre-deployment review of residual risk assessment: external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).”

  PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, numbered step 2, first sentence

v1.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Stated ↗

• “For Google models, when alert thresholds are reached, the response plan will be reviewed and approved by appropriate corporate governance bodies such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council.”

  PDF p. 7 (printed p. 7), Governance and Accountability, “Governance” paragraph, first sentence

• “Pre-deployment review of safety case: general availability deployment8 of a model takes place only after the appropriate corporate governance body determines the safety case regarding each CCL the model has reached to be adequate.”

  PDF p. 4 (printed p. 4), Misuse, Mitigation Approach, “Deployment Mitigations”, numbered step 2

v3.0 Stated ↗

• “Pre-deployment review of safety case: external deployments of a model take place only after the appropriate governance function determines the safety case regarding each CCL the model has reached to be adequate.”

  PDF p. 9 (printed p. 9), §2.1.2 Deployment Mitigations, numbered step 2, first sentence

• “We then determine whether the model has met or will meet a CCL”

  PDF p. 5 (printed p. 5), §1.3, 'Acceptance determination and mitigations' bullet, first sentence

v3.1 Stated ↗

• “Pre-deployment review of residual risk assessment: external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).”

  PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, numbered step 2, first sentence

v1.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.1 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v1.0 Stated ↗

• Paraphrase: The edition says Google DeepMind aims to evaluate its models at every sixfold increase in effective compute and after every three months of fine-tuning progress.

  PDF p. 2 (printed p. 2), Framework, component '2 - Evaluating frontier models', second paragraph, first sentence

v2.0 Stated ↗

• Paraphrase: The edition says Google DeepMind intends to evaluate its most capable frontier models on a regular basis, to check whether their capabilities are nearing a CCL.

  PDF p. 3 (printed p. 3), Framework, component '2 - Assessing the Capabilities of Frontier Models', first paragraph, first sentence

v3.0 Stated ↗

• Paraphrase: The edition says Google DeepMind conducts a risk assessment for a new frontier AI model's first external deployment.

  PDF p. 4 (printed p. 4), §1.3 Outline of Our Risk Assessment Process, first paragraph, second sentence

v3.1 Stated ↗

• Paraphrase: Google DeepMind conducts a critical capability assessment before a new frontier AI model’s first external deployment; under footnote 4, one may be skipped for a low-risk external deployment if the appropriate governance function finds its residual risk acceptable, even at a reached T/CCL (with a safety case at a CCL).

  PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, first paragraph, second sentence, and footnote 4

v1.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Stated ↗

• “our adoption of the protocols described in this Framework may depend on whether such organizations across the field adopt similar protocols.”

  PDF p. 1 (printed p. 1, unnumbered), opening section, paragraph beginning 'The safety of frontier AI systems', last sentence, final clause

• “This may occur if, for example, a model does not possess capabilities meaningfully different from other widely available models that have not demonstrably caused or contributed to severe risks,”

  PDF p. 5 (printed p. 5), Misuse, Misuse Critical Capability Levels, paragraph beginning “These recommended security levels”, second sentence

v3.0 Stated ↗

• “This may occur if, for example, a model does not possess capabilities meaningfully different from other publicly available models that have weaker security applied (in which case the marginal benefit of higher security is limited),”

  PDF p. 9 (printed p. 9), §2.2 Misuse Critical Capability Levels, second paragraph, second sentence

• “if other models are similarly capable and have few mitigations, then the marginal risk added by our release is likely low”

  PDF p. 7 (printed p. 7), §1.6, misuse CCL bullet, first sub-bullet, parenthetical example

v3.1 Stated ↗

• “if other models are similarly capable and have few mitigations, then the marginal risk added by our external deployment is likely low”

  PDF p. 7 (printed p. 7), §1.3.5 Risk Acceptance Determination, misuse T/CCL bullet, first sub-bullet, parenthetical example

• “a model does not possess capabilities meaningfully different from other publicly available models that have weaker security applied”

  PDF p. 11 (printed p. 11), §2.2 Misuse Capability Levels, second paragraph, second sentence

v1.0 Stated ↗

• “the mitigation options listed below are illustrative and will need to be tailored to different use cases and risks.”

  PDF p. 4 (printed p. 4), Deployment Mitigations, introductory paragraph, last sentence

v2.0 Stated ↗

• “or if we assess that the benefits of the open release of model weights outweigh the risks.”

  PDF p. 5 (printed p. 5), Misuse Critical Capability Levels, paragraph beginning 'These recommended security levels', second sentence, final clause

v3.0 Stated ↗

• “or we otherwise assess that the level of security applied is adequate, e.g. if they match or exceed the level of security applied to other models with similar capabilities or risk profiles, or we assess that the benefits of the open release of model weights outweigh the risks.”

  PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse-CCL bullet (begins PDF p. 6), second sub-bullet, from “or we otherwise assess”

v3.1 Stated ↗

• “A critical capability assessment may not be conducted for low-risk external deployments (e.g. to a small number of trusted testers)”

  PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, footnote 4

v1.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Stated, partly ↗

• Paraphrase: The edition says that, for Google models reaching alert thresholds, appropriate corporate governance bodies will review and approve the response plan; the “Google DeepMind AGI Safety Council” is one example given.

  PDF p. 7 (printed p. 7), Governance and Accountability, 'Governance', first sentence

v3.0 Stated, partly ↗

• Paraphrase: The edition says material safety-case updates will be sent for review to the appropriate governance function.

  PDF pp. 9–13 (printed pp. 9 and 13), §2.1.2 and §3.1.2 Deployment Mitigations, numbered step 3, second sentence (identical in both)

v3.1 Stated, partly ↗ · same recorded passage as v3.0

• Paraphrase: The edition says material safety-case updates will be sent for review to the appropriate governance function.

  PDF pp. 10–14 (printed pp. 10 and 14), §2.1.2 and §3.1.2 Deployment Mitigations, numbered step 3, second sentence (identical in both)

v1.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Stated ↗

• Paraphrase: The edition says that if Google DeepMind assesses a model as having reached a CCL presenting a material, unmitigated risk to public safety overall, it aims to give information to appropriate government authorities where doing so will help the development of safe AI.

  PDF p. 7 (printed p. 7), Governance and Accountability, 'Disclosure', first sentence (continues on PDF p. 8)

v3.0 Stated ↗

• Paraphrase: The edition says that if Google DeepMind assesses a model as having reached a CCL presenting a material, unmitigated risk to public safety overall, it aims to give relevant information to appropriate government authorities where doing so will help the safety of frontier AI.

  PDF p. 16 (printed p. 16), §5.2 Disclosures, first paragraph, first sentence

v3.1 Stated ↗

• Paraphrase: The edition says that if Google DeepMind assesses a model as having reached a CCL presenting a material, unmitigated risk to public safety overall, it aims to give relevant information to appropriate government authorities where this will help frontier AI safety.

  PDF p. 17 (printed p. 17), §5.2 Disclosures, first sentence

v1.0 Stated ↗

• Paraphrase: The edition says the Framework will be reviewed periodically and that Google DeepMind expects it to change substantially as understanding of frontier-model risks and benefits improves.

  PDF p. 1 (printed p. 1), opening section, third paragraph, third sentence

• Paraphrase: Under Future work, the edition says substantive revisions will be published as appropriate.

  PDF p. 6 (printed p. 6), Future work, second paragraph, second sentence

v2.0 Stated ↗

• Paraphrase: The edition says Google DeepMind will review the Framework from time to time and expects it to change substantially.

  PDF p. 1 (printed p. 1, unnumbered), opening section, last paragraph, third sentence

v3.0 Stated ↗

• Paraphrase: The edition says the Framework will be updated no less than once a year.

  PDF p. 16 (printed p. 16), §5.1 Updates, first sentence

• Paraphrase: The edition says the appropriate corporate governance bodies will review the updated version and the framework assessment.

  PDF p. 16 (printed p. 16), §5.1 Updates, last sentence

v3.1 Stated ↗

• Paraphrase: The edition says the Framework will be reviewed no less than once a year.

  PDF p. 17 (printed p. 17), §5.1 Updates, first sentence

• Paraphrase: The edition says the appropriate corporate governance bodies will review the updated version and the framework assessment.

  PDF p. 17 (printed p. 17), §5.1 Updates, last sentence

v1.0 Does not apply

First edition in this framework; there is no earlier edition.

v2.0 Stated ↗

• Paraphrase: A footnote to Table 1 says the edition drops the Autonomy risk domain that “Frontier Safety Framework version 1.0” contained.

  PDF p. 5 (printed p. 5), Table 1, footnote 9, first sentence

v3.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v3.1 Stated ↗

• Paraphrase: The Version 3.1 changelog entry says the edition introduced CBRN TCLs and outlined a process for mitigation and risk acceptance.

  PDF p. 17 (printed p. 17), §5.3 Past Updates and Changes, Version 3.1 (April 17, 2026), first bullet

• Paraphrase: The Version 3.1 changelog entry says the earlier exploratory Misalignment risk domain was folded into one domain, “ML R&D and Misalignment”.

  PDF p. 17 (printed p. 17), §5.3, Version 3.1, second bullet

v1.1 Stated ↗

• Paraphrase: Among its chemical and biological outcomes, the edition lists the spread of known medium-impact chemical and biological weapons to actors of low and moderate skill.

  PDF p. 15 (printed p. 15), §3.4.2, outcome CB 1

v2.0 Stated ↗

• Paraphrase: The edition says the Framework currently concentrates on catastrophic risk in three areas: chemical and biological, cybersecurity, and “Loss of Control”.

  PDF p. 1 (unnumbered opening page), second paragraph, second sentence

• Paraphrase: The edition says radiological and nuclear risks are further possible sources of risk from Frontier AI that have been identified.

  PDF p. 36 (printed p. 36), §4.2.4 Emerging Evaluations and Outcomes, 'Radiological and nuclear', first sentence

v1.1 Stated ↗

• Paraphrase: Among its cyber outcomes, the edition lists one in which critical zero-day vulnerabilities in widely used current software that follows security best practices are discovered automatically and exploited reliably before defenders are able to find and patch them.

  PDF p. 14 (printed p. 14), §3.4.1, outcome Cyber 2

v2.0 Stated ↗

• Paraphrase: The edition says the Framework currently concentrates on catastrophic risk in three areas: chemical and biological, cybersecurity, and “Loss of Control”.

  PDF p. 1 (unnumbered opening page), second paragraph, second sentence

v1.1 Stated ↗

• Paraphrase: In its cyber outcomes table, the edition lists autonomous cyber operations among the enabling capabilities.

  PDF p. 14 (printed p. 14), §3.4.1, cyber outcomes table, enabling capabilities column

v2.0 Stated ↗

• Paraphrase: The edition says the Framework currently concentrates on catastrophic risk in three areas: chemical and biological, cybersecurity, and “Loss of Control”.

  PDF p. 1 (unnumbered opening page), second paragraph, second sentence

• Paraphrase: For the outcome “Loss of Control 1”, the edition gives as a threat scenario that AI development speeds up so that new capabilities and behaviours appear faster than the organisation's evaluation processes.

  PDF pp. 22–23, §3.4.3 Loss of Control, table row 'Loss of Control 1', Potential Threat Scenario column

• Paraphrase: In the same row, the edition lists “Autonomous AI R&D” as an example enabling capability: the ability to complete, autonomously and consistently, tasks representative of a researcher's work to advance AI development.

  PDF pp. 22–23, §3.4.3 Loss of Control, table row 'Loss of Control 1', Example Enabling Capabilities column

v1.1 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v1.1 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Stated ↗

• Paraphrase: The edition names the outcome “Loss of Control 2” as losing the ability to monitor how AI behaves in operation, with the threat scenario that AI disables or corrupts monitors so as to reduce oversight and achieve its objectives.

  PDF p. 23, §3.4.3 Loss of Control, table row 'Loss of Control 2', Outcome and Potential Threat Scenario columns

• Paraphrase: The edition says physical autonomy is now a further, nascent outcome of Frontier AI.

  PDF p. 36 (printed p. 36), §4.2.4 Emerging Evaluations and Outcomes, 'Physical autonomy', first sentence

v1.1 Stated ↗

• Paraphrase: In the Moderate row of the risk-threshold table, under the measure “Release”, the edition says the model would not give significant uplift towards carrying out a threat scenario.

  PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Moderate row, Risk Threshold column (text below the measure label 'Release')

v2.0 Stated ↗

• Paraphrase: The edition says Meta reports its risk assessment of the model, for plausible contexts of deployment, at one of three levels: “critical”, “high”, or “moderate or lower”.

  PDF p. 8 (printed p. 8), §2.2.1 Preparedness Reports, fourth paragraph, second sentence (opening)

v1.1 Stated ↗

• Paraphrase: In the High row of the risk-threshold table, under “Do not release”, the edition says the model gives significant uplift towards carrying out a threat scenario, but does not enable any identified scenario that could potentially suffice for a catastrophic outcome.

  PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, High row, Risk Threshold column (text below the measure label 'Do not release')

• Paraphrase: In the Critical row of Table 1, under “Stop development”, the edition says the model would uniquely enable carrying out at least one identified threat scenario that could potentially suffice for a catastrophic outcome, and that this risk is not one that can be mitigated in the deployment context proposed.

  PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Critical row, Risk Threshold column (text below the measure label 'Stop development')

• Paraphrase: The edition says its high and moderate thresholds are defined by how much uplift a frontier AI gives towards realising a threat scenario.

  PDF p. 12 (printed p. 12), §3.3 Risk thresholds

v2.0 Stated ↗

• Paraphrase: The edition says Meta defines its thresholds by how far Frontier AI would make a substantial contribution to carrying out any identified threat scenario that could on its own lead to a catastrophic outcome.

  PDF p. 3 (printed p. 3), §1.1 Scope, third paragraph, first sentence (opening)

v1.1 Stated ↗

• “Access is limited to a core research team, alongside security protections to prevent hacking or exfiltration.”

  PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, High row, Measures column, security mitigations

v2.0 Stated ↗

• “Proceed with deployment of the Frontier AI only if sufficient mitigations are defined, implemented and validated to reduce risk to that of a moderate or lower model.”

  PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1, High row, Measures column, under the label 'Deploy with mitigations'

v1.1 Stated ↗

• “If a frontier AI is assessed to have reached the critical risk threshold and cannot be mitigated, we will stop development and implement the measures outlined in Table 1.”

  PDF p. 12 (printed p. 12), §3.3 Risk thresholds, first paragraph, third sentence

• “If the results of our evaluations indicate that a frontier AI has a “high” risk threshold by providing significant uplift towards realization of a catastrophic outcome we will not release the frontier AI externally.”

  PDF p. 17 (printed p. 17), §4.2 Evaluation and mitigation, paragraph beginning 'We may take into account monetary costs', second sentence

• “If a model appears to uniquely enable the execution of a threat scenario we will pause development while we investigate whether barriers to realizing the catastrophic outcome remain.”

  PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Critical row, Measures column, first bullet, second sentence

v2.0 Stated ↗

• “Should either scenario arise, we will only continue development of the Frontier AI if our risk assessments are complete and safeguards are defined, implemented and validated to reduce risk to the moderate or lower risk threshold.”

  PDF p. 17 (printed p. 17), §3.3 Risk Thresholds, final sentence of the paragraph beginning on PDF p. 16 ('First, a Frontier AI meets the critical risk threshold…')

v1.1 Stated ↗

• “Informed by this analysis, a leadership team will either request further testing or information, require additional mitigations or improvements, or they will approve the model for release.”

  PDF p. 8 (printed p. 8), §2.1.3 Decide, 'Make a decision on release', second sentence

• “A final assessment of uplift is approved by senior-level decision-makers through our AI Risk process (see Section 2.1).”

  PDF p. 13 (printed p. 13), §3.3 Risk thresholds, footnote 7 (attached to Table 1, High row, Risk Threshold column), third and final sentence

v2.0 Stated ↗

• “Based on this pre-mitigation risk assessment, the Chief AI Officer and Director of Alignment and Risk2 will assign a risk threshold.”

  PDF p. 6 (printed p. 6), §2.1.2 Evaluate and Mitigate, 'Evaluate for performance and safety', paragraph beginning 'These assessments typically use a version of the Frontier AI', second sentence

• “Informed by this analysis, the Chief AI Officer or the Director of Alignment and Risk will determine whether to request further testing or information, require additional mitigations or improvements, or approve the model for deployment.”

  PDF p. 7 (printed p. 7), §2.1.3 Decide, 'Make a decision on deployment', second sentence

v1.1 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Stated, partly ↗

• “Meta’s Board of Directors provides oversight of the company’s product and regulatory compliance”

  PDF p. 10 (printed p. 10), §2.3 Accountability, third paragraph, final sentence

v1.1 Stated ↗

• Paraphrase: The edition says evaluations are typically run again when a frontier AI is close to finishing, or has finished, its training.

  PDF p. 18 (printed p. 18), §4.2 Evaluation and mitigation

v2.0 Stated ↗

• Paraphrase: The edition says Meta typically repeats evaluations when a Frontier AI model is close to finishing, or has finished, training.

  PDF p. 26 (printed p. 26), §4.2 Evaluation and mitigation, sixth paragraph, first sentence

v1.1 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v2.0 Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

v1.1 Stated ↗

• “insofar as is technically feasible and commercially practicable”

  PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Critical row, Measures column, security mitigations (qualifying clause)

v2.0 Stated ↗

• “Final deployment decisions may also consider additional factors beyond those covered in this Framework.”

  PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1, note below the Measures column, second sentence

v1.1 Stated ↗

• Paraphrase: The edition says its risk assessment process records the strategies used to mitigate risk, and the risks that remain, across a set of risk categories that apply.

  PDF p. 7 (printed p. 7), §2.1.2 (risk assessment process)

v2.0 Stated ↗

• Paraphrase: The edition says that, under the reporting protocol, every report will in the end be submitted to three recipients: Meta's internal governance function, its “Chief AI Officer”, and its “Director of Alignment and Risk”.

  PDF p. 10 (printed p. 10), §2.3.1 Reporting, second sentence

v1.1 Stated ↗

• Paraphrase: The edition says Meta plans to go on sharing pertinent information on the responsible development and evaluation of its models.

  PDF p. 9 (printed p. 9), §2.2

v2.0 Stated ↗

• Paraphrase: The edition says Meta will publish, in a timely manner and in connection with deployment, a preparedness report for every closed or open release of Frontier AI.

  PDF p. 7 (printed p. 7), §2.2.1 Preparedness Reports, first sentence

v1.1 Stated ↗

• Paraphrase: The edition says Meta will update its Framework on the basis of the observations described in that section.

  PDF p. 19 (printed p. 19), §5.1

v2.0 Stated ↗

• Paraphrase: The edition says Meta will update the Framework at least every twelve months, or sooner on the stated trigger; the “Director of Alignment and Risk” and the “Chief AI Officer” are to confirm the update, which Meta will then publish.

  PDF p. 40 (printed p. 40), §5.1 Updates to our Framework, first paragraph, fourth to sixth sentences

v1.1 Does not apply

First edition in this framework; there is no earlier edition.

v2.0 Stated ↗

• Paraphrase: The change log for version 2.0 says the primary standard for the high and critical thresholds changed from “uniquely enable” to “substantially contribute to”.

  PDF p. 44 (printed p. 44), Appendix II – Change log, entry 'April 7, 2026 (Advanced AI Scaling Framework v2.0)', sub-bullet 'Updated risk threshold language'

• Paraphrase: The same entry says the critical threshold's measure changed from “Stop” to “Develop with Mitigations” and the high threshold's measure from “Do not release” to “Deploy with mitigations”.

  PDF p. 44, same entry, sub-bullet 'Revised thresholds', first and second sentences

Feb 2025 (Version 1) Stated ↗

• Paraphrase: The edition lists chemical, biological, radiological and nuclear (“CBRN”) weapons as a tracked high-risk capability: a model's ability to give an actor significant uplift in developing and deploying such a weapon.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', first bullet

Feb 2026 Stated ↗ · same recorded passage as Feb 2025 (Version 1)

• Paraphrase: The edition lists chemical, biological, radiological and nuclear (“CBRN”) weapons as a tracked high-risk capability: a model's ability to give an actor significant uplift in developing and deploying such a weapon.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', first bullet

Feb 2025 (Version 1) Stated ↗

• Paraphrase: The edition lists “Offensive cyberoperations” as a tracked high-risk capability: a model's ability to give an actor significant uplift in carrying out cyberattacks that are highly disruptive or destructive, critical infrastructure included.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', second bullet

Feb 2026 Stated ↗ · same recorded passage as Feb 2025 (Version 1)

• Paraphrase: The edition lists “Offensive cyberoperations” as a tracked high-risk capability: a model's ability to give an actor significant uplift in carrying out cyberattacks that are highly disruptive or destructive, critical infrastructure included.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', second bullet

Feb 2025 (Version 1) Stated ↗

• Paraphrase: The edition lists “Advanced autonomy” as a tracked high-risk capability: a model's ability to carry out expert-level tasks on its own, AI research and development among them.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', third bullet

Feb 2026 Stated ↗ · same recorded passage as Feb 2025 (Version 1)

• Paraphrase: The edition lists “Advanced autonomy” as a tracked high-risk capability: a model's ability to carry out expert-level tasks on its own, AI research and development among them.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', third bullet

Feb 2025 (Version 1) Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

Feb 2026 Stated ↗

• Paraphrase: The edition lists “Harmful manipulation” as a tracked high-risk capability: a model's ability to distort human behaviour or beliefs strategically and at scale.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', fifth bullet

Feb 2025 (Version 1) Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

Feb 2026 Stated ↗

• Paraphrase: The edition lists “Loss of control” as a tracked high-risk capability: the ability of a model to undermine effective control by humans through adaptive, deceptive or self-reinforcing means, so that once deployed it can no longer reliably be directed, modified or shut down.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, 'Tracked high-risk capabilities', fourth bullet

Feb 2025 (Version 1) Stated ↗

• Paraphrase: The edition says the framework assesses whether a tracked capability presents a risk to public safety or national security that is low, medium, high or critical.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, paragraph after the tracked-capabilities list, first sentence

Feb 2026 Stated ↗ · same recorded passage as Feb 2025 (Version 1)

• Paraphrase: The edition says the framework assesses whether a tracked capability presents a risk to public safety or national security that is low, medium, high or critical.

  PDF p. 4 (printed p. 3), §2 Capabilities and risks, paragraph after the tracked-capabilities list, first sentence

Feb 2025 (Version 1) Stated, partly ↗

• Paraphrase: In the High row of the CBRN capability table, the edition describes the threshold as a model that meaningfully increases the ability of an expert (with PhD-level education in a related field) to develop a novel CBRN threat and deliver it.

  PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, High row, Capability threshold column (first statement)

Feb 2026 Stated, partly ↗ · same recorded passage as Feb 2025 (Version 1)

• Paraphrase: In the High row of the CBRN capability table, the edition describes the threshold as a model that meaningfully increases the ability of an expert (with PhD-level education in a related field) to develop a novel CBRN threat and deliver it.

  PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, High row, Capability threshold column (first statement)

Feb 2025 (Version 1) Stated ↗

• “Models posing high-risk on one or more tracked capability will be subject to security measures protective against most cybercrime groups and insider threats.”

  PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph (section begins on PDF p. 7), first sentence

Feb 2026 Stated ↗

• “Models posing high-risk on one or more tracked high-risk capability will be subject to security measures protective against most cybercrime groups and insider threats.”

  PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph, first sentence

Feb 2025 (Version 1) Stated ↗

• “If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.”

  PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentence

Feb 2026 Stated ↗ · same recorded passage as Feb 2025 (Version 1)

• “If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.”

  PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentence

Feb 2025 (Version 1) Stated ↗

• “The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.”

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentence

Feb 2026 Stated ↗ · same recorded passage as Feb 2025 (Version 1)

• “The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.”

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentence

Feb 2025 (Version 1) Stated, partly ↗

• “This framework is subject to Microsoft’s broader corporate governance procedures, including independent internal audit and board oversight.”

  PDF p. 10 (printed p. 9), §5 Governance, 'Oversight and reporting channels', first sentence

Feb 2026 Stated, partly ↗ · same recorded passage as Feb 2025 (Version 1)

• “This framework is subject to Microsoft’s broader corporate governance procedures, including independent internal audit and board oversight.”

  PDF p. 10 (printed p. 9), §5 Governance, 'Oversight and reporting channels', first sentence

Feb 2025 (Version 1) Stated ↗

• Paraphrase: The edition says the leading indicator assessment runs at three points: during pre-training, once pre-training has finished, and before deployment.

  PDF p. 6 (printed p. 5), §3 Evaluation and assessment, paragraph continued from PDF p. 5, first sentence

• Paraphrase: The edition says that, once a first deeper capability assessment has been done, Microsoft will repeat such assessments periodically and at least every six months.

  PDF p. 7 (printed p. 6), §3, Deeper capability assessment, 'Timing of deeper capability assessment'

Feb 2026 Stated ↗

• Paraphrase: The edition says the leading indicator assessment runs at four points: during pre-training, once pre-training has finished, after post-training, and before deployment.

  PDF p. 6 (printed p. 5), §3 Evaluation and assessment, second paragraph, first sentence

• Paraphrase: The edition says that, once a first deeper capability assessment has been done, Microsoft will repeat such assessments if the risk profile of the deployed model changes materially, giving fine-tuning as an example.

  PDF p. 7 (printed p. 6), §3, Deeper capability assessment, 'Timing of deeper capability assessment'

Feb 2025 (Version 1) Stated, partly ↗

• “considers the marginal capability uplift … including currently available open-weights models.”

  PDF p. 7 (printed p. 6), §3, Deeper capability assessment, 'Holistic risk assessment' bullet, final sentence

Feb 2026 Stated, partly ↗ · same recorded passage as Feb 2025 (Version 1)

• “considers the marginal capability uplift … including currently available open-weights models.”

  PDF p. 7 (printed p. 6), §3, Deeper capability assessment, 'Holistic risk assessment' bullet, final sentence

Feb 2025 (Version 1) Stated ↗

• “We use qualitative capability thresholds to guide this classification process as they offer important flexibility across different models and contexts”

  PDF p. 6 (printed p. 5), §3, Deeper capability assessment, first paragraph, second sentence

• “the marginal benefits of a model outweigh any residual risk”

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, first paragraph, numbered point 2)

Feb 2026 Stated ↗

• “the marginal benefits of a model outweigh any residual risk”

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, first paragraph, numbered point 2)

Feb 2025 (Version 1) Stated ↗

• Paraphrase: The edition says documentation of the capability assessments before and after mitigation will go to the “Executive Officers” responsible for Microsoft's AI governance programme, or their delegates.

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, first paragraph

Feb 2026 Stated ↗ · same recorded passage as Feb 2025 (Version 1)

• Paraphrase: The edition says documentation of the capability assessments before and after mitigation will go to the “Executive Officers” responsible for Microsoft's AI governance programme, or their delegates.

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, first paragraph

Feb 2025 (Version 1) Stated ↗

• Paraphrase: The edition says Microsoft will share publicly information on the model’s capabilities and limitations, on relevant evaluations and on its risk classification, while taking care to protect commercially sensitive information and to minimise information hazards capable of creating safety and security risks.

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, third paragraph, first sentence

Feb 2026 Stated ↗

• Paraphrase: The edition says Microsoft will share publicly information on the model’s capabilities and limitations, on relevant evaluations and on its risk classification, while taking care to protect commercially sensitive information and to minimise information hazards capable of creating safety and security risks.

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, third paragraph, first sentence

• Paraphrase: The edition says Microsoft will report information on tracked high-risk capabilities where regulation requires it and as appropriate for managing frontier risks effectively.

  PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, third paragraph, second sentence

Feb 2025 (Version 1) Stated ↗

• Paraphrase: The edition says Microsoft will discuss explicitly, every six months, how the framework may need improving.

  PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', second sentence

• Paraphrase: The edition says Microsoft's Chief Responsible AI Officer will review any updates to its practices before they are adopted.

  PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentence

Feb 2026 Stated ↗

• Paraphrase: The edition says Microsoft will discuss explicitly, at least every twelve months, how the framework may need improving.

  PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', second sentence

• Paraphrase: The edition says Microsoft's Chief Responsible AI Officer will review any updates to its practices before they are adopted.

  PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentence

• Paraphrase: The edition says every material revision will be published within 30 days of its adoption.

  PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fifth sentence

Feb 2025 (Version 1) Does not apply

First edition in this framework; there is no earlier edition.

Feb 2026 Stated ↗

• Paraphrase: The change log for February 2026 lists the addition of two tracked high-risk capabilities: harmful manipulation, and the loss of control.

  PDF p. 16 (printed p. 15), Appendix II – Change log, 'February 2026' row, first bullet

May 2026 edition Stated ↗

• Paraphrase: The edition says its processes for assessing and mitigating systemic risk span key risk categories, among them “cybersecurity”, “CBRN” (chemical, biological, radiological and nuclear), “harmful manipulation” and “loss of control risks”.

  PDF p. 3 (printed p. 01), §1 Introduction, second paragraph, second sentence

• Paraphrase: The edition says OpenAI builds its safeguards principally against biological and chemical threats.

  PDF p. 10 (printed p. 08), §2.4 Risk tiers › 'CBRN', first paragraph, second sentence

May 2026 edition Stated ↗

• Paraphrase: The edition says its processes for assessing and mitigating systemic risk span key risk categories, among them “cybersecurity”, “CBRN” (chemical, biological, radiological and nuclear), “harmful manipulation” and “loss of control risks”.

  PDF p. 3 (printed p. 01), §1 Introduction, second paragraph, second sentence

May 2026 edition Stated ↗

• Paraphrase: The edition says its processes for assessing and mitigating systemic risk span key risk categories, among them “cybersecurity”, “CBRN” (chemical, biological, radiological and nuclear), “harmful manipulation” and “loss of control risks”.

  PDF p. 3 (printed p. 01), §1 Introduction, second paragraph, second sentence

• Paraphrase: The edition says that its loss-of-control risk tiers, apart from those for risks related to AI self-improvement, are still exploratory and may change substantially.

  PDF p. 12 (printed p. 10), §2.4 Risk tiers › 'Loss of control', first paragraph, final sentence

May 2026 edition Stated ↗

• Paraphrase: The edition says its processes for assessing and mitigating systemic risk span key risk categories, among them “cybersecurity”, “CBRN” (chemical, biological, radiological and nuclear), “harmful manipulation” and “loss of control risks”.

  PDF p. 3 (printed p. 01), §1 Introduction, second paragraph, second sentence

• Paraphrase: The edition says OpenAI's approach to harmful manipulation is still exploratory.

  PDF p. 11 (printed p. 09), §2.4 Risk tiers › 'Harmful manipulation', first sentence

May 2026 edition Stated, partly ↗

• Paraphrase: The edition says loss-of-control risks may arise from misalignment with what humans intend or value, from self-improvement, from deception by the model, or from autonomous self-improvement.

  PDF p. 12 (printed p. 10), §2.4 Risk tiers › 'Loss of control', first paragraph, second sentence

May 2026 edition Stated ↗

• Paraphrase: The edition says OpenAI has set up a system of tiers for cyber offense systemic risks, and introduces the table of those tiers.

  PDF p. 9 (printed p. 07), §2.4 Risk tiers › 'Cyber offense', introductory paragraph

May 2026 edition Stated ↗

• Paraphrase: The edition says systemic risks are estimated, where appropriate and practicable, with risk tiers that describe in concrete terms what an AI system might help someone do, or might do itself, that could meaningfully increase the risk of severe harm.

  PDF p. 7 (printed p. 05), §2.2 Systemic risk analysis

May 2026 edition Stated ↗

• “OpenAI tailors these measures to the capability of a model and its deployment, as appropriate, to mitigate systemic risks to acceptable levels.”

  PDF p. 13 (printed p. 11), §2.5 Safety mitigations, first paragraph, second sentence

May 2026 edition Stated ↗

• “If residual risks associated with the model exceed acceptable risk levels, the model is not deployed unless additional mitigation measures are implemented that sufficiently minimize risk.”

  PDF p. 13 (printed p. 11), §2.5 Safety mitigations, first paragraph, third sentence

May 2026 edition Stated, partly ↗

• “We document a justification for why the systemic risks stemming from the model are acceptable, including reasonably foreseeable conditions under which the justification may no longer hold, as informed by recommendations from OpenAI’s Safety Advisory Group and external experts, as available and appropriate.”

  PDF p. 13 (printed p. 11), §2.5 Safety mitigations, second paragraph, second sentence

• “Additional detail about our deployment governance can be found in Appendix B of the PF.”

  PDF p. 20 (printed p. 18), §6 Allocation of responsibility for risk management, final sentence

May 2026 edition Stated ↗

• “The board of directors of OpenAI Ireland Limited exercise systemic risk oversight under this Framework for EU purposes.”

  PDF p. 20 (printed p. 18), §6 Allocation of responsibility for risk management, final paragraph

May 2026 edition Stated ↗

• Paraphrase: The edition states that models within the Framework's scope go through a suite of scalable evaluations before deployment.

  PDF p. 8 (printed p. 06), §2.3 Systemic risk acceptance determination, second paragraph, first sentence

May 2026 edition Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

May 2026 edition Stated ↗

• “also reflects a holistic judgment based on the totality of available evidence”

  PDF p. 8 (printed p. 06), §2.3 Systemic risk acceptance determination, final paragraph, final sentence

• “We will not consider an update necessary if (1) the model’s capabilities have not materially changed since the last update”

  PDF p. 18 (printed p. 16), §4 Model reporting › 'Model report updates', final sentence

May 2026 edition Stated, partly ↗

• Paraphrase: The edition says OpenAI documents a justification of why a model’s systemic risks are acceptable, which includes the reasonably foreseeable conditions under which that justification may stop holding, informed by recommendations from its Safety Advisory Group and outside experts, “as available and appropriate”.

  PDF p. 13 (printed p. 11), §2.5 Safety mitigations, second paragraph, second sentence

May 2026 edition Stated ↗

• Paraphrase: The edition says that, for models within the Framework’s scope, OpenAI also publishes details of the assessments in system cards or other reports when a model launches.

  PDF p. 18 (printed p. 16), §4 Model reporting, first paragraph, first and second sentences

• Paraphrase: The edition says that for an incident found to be reportable, OpenAI will collect information from its investigation and remediation to report to the appropriate authorities by the required deadlines.

  PDF p. 15 (printed p. 13), §2.6 › 'External reporting', second sentence

May 2026 edition Stated ↗

• Paraphrase: The edition says material updates will be presented for oversight to the OpenAI Foundation board's Safety and Security Committee and to OpenAI Ireland Limited's board of directors.

  PDF p. 21 (printed p. 19), §7.1 Update and approval process, fourth (final) sentence, up to 'for oversight'

• Paraphrase: The edition says a Framework Assessment will be completed by OpenAI at least every 12 months, counted from when the EU Code of Practice and the TFAIA took effect.

  PDF p. 22 (printed p. 20), §7.2 Framework assessment, first sentence

May 2026 edition Does not apply

First edition in this framework; there is no earlier edition.

Beta Stated ↗

• Paraphrase: The edition describes its CBRN category as concerned with risks of models helping to create chemical, biological, radiological or nuclear threats.

  PDF p. 9, Tracked Risk Categories › 'CBRN (chemical, biological, radiological, nuclear)', opening sentence

Version 2 Stated ↗

• Paraphrase: The edition lists Biological and Chemical capabilities as a Tracked Category, describing them as capabilities that can also make it easier to create and use biological or chemical weapons.

  PDF p. 2 (printed p. 1), opening page, first bullet of the Tracked Categories list

• Paraphrase: The edition states that Nuclear and Radiological capabilities have become a Research Category.

  PDF p. 9 (printed p. 8), §2.3 Research Categories, box 'Changes to Tracked Categories in version 2', second paragraph

Beta Stated ↗

• Paraphrase: The edition describes its Cybersecurity category as concerned with risks of the model being used for cyber-exploitation that disrupts the confidentiality, integrity or availability of computer systems.

  PDF p. 8, Tracked Risk Categories › 'Cybersecurity', opening sentence

Version 2 Stated ↗

• Paraphrase: The edition lists Cybersecurity capabilities as a Tracked Category, describing them as capabilities that can also bring new risks of cyberattacks at scale and of exploiting vulnerabilities.

  PDF p. 2 (printed p. 1), opening page, second bullet of the Tracked Categories list

Beta Stated ↗

• Paraphrase: The edition says it counts autonomous replication, adaptation and AI research and development within the model autonomy risk category.

  PDF p. 12, Tracked Risk Categories › 'Unknown unknowns', second paragraph, final sentence

Version 2 Stated ↗

• Paraphrase: The edition lists AI Self-improvement capabilities as a Tracked Category, describing them as capabilities that could also pose new challenges to humans controlling AI systems.

  PDF p. 2 (printed p. 1), opening page, third bullet of the Tracked Categories list

Beta Stated ↗

• Paraphrase: The edition describes its Persuasion category as concerned with risks of convincing people, through static or interactive model-generated content, to change their beliefs or to act on them.

  PDF p. 10, Tracked Risk Categories › 'Persuasion', opening sentence

Version 2 Stated, partly ↗

• Paraphrase: The edition states that risks in the Persuasion category do not meet its criteria for inclusion in the Framework.

  PDF p. 9 (printed p. 8), §2.3, box 'Changes to Tracked Categories in version 2', 'Persuasion' paragraph, final sentence

Beta Stated, partly ↗

• Paraphrase: The edition says it counts deception and social engineering evaluations within the persuasion risk category.

  PDF p. 12, Tracked Risk Categories › 'Unknown unknowns', second paragraph, final sentence

Version 2 Stated ↗

• Paraphrase: The edition lists Undermining Safeguards as a Research Category: a model's ability and propensity to act so as to undermine the safeguards placed on it.

  PDF p. 8 (printed p. 7), Table 2 'Research Categories', fourth row

Beta Stated ↗

• Paraphrase: The edition says that, on its gradation scale, 'low' generally marks a category of risk that does not yet pose a significant problem, and 'critical' the highest level of concern.

  PDF p. 5, Tracked Risk Categories, second paragraph, final sentence

Version 2 Stated ↗

• Paraphrase: The edition defines High capability thresholds as capabilities that markedly raise existing vectors of risk for severe harm, and Critical capability thresholds as capabilities carrying a meaningful risk of a threat vector for severe harm that is qualitatively new and without ready precedent.

  PDF p. 5 (printed p. 4), §2.2 Tracked Categories, first paragraph

Beta Stated ↗

• Paraphrase: The edition defines catastrophic risk, its focus, as any risk that could cause economic damage of hundreds of billions of dollars or severe harm to, or the death of, many people.

  PDF p. 2, Introduction, footnote 1

Version 2 Stated ↗

• Paraphrase: The edition says capability thresholds describe in concrete terms what an AI system might help someone do, or might do itself, that could meaningfully increase the risk of severe harm.

  PDF p. 5 (printed p. 4), §2.2 Tracked Categories, first paragraph, third sentence

Beta Stated ↗

• “we will ensure that our security is hardened in a way that is designed to prevent our mitigations and controls from being circumvented via exfiltration”

  PDF p. 20, Governance › Safety baselines › 'Asset Protection', first sentence

Version 2 Stated ↗

• “Covered systems that cross this capability threshold are required to have robust and effective safeguards … before they are deployed and appropriate security controls as they are developed.”

  PDF p. 5 (printed p. 4), §2.2 Tracked Categories, first paragraph, sentence following the definition of High capability thresholds

Beta Stated ↗

• “Only models with a post-mitigation score of "medium" or below can be deployed.”

  PDF p. 21, Governance › Safety baselines › 'Restricting deployment', first sentence

• “Only models with a post-mitigation score of "high" or below can be developed further.”

  PDF p. 21, Governance › Safety baselines › 'Restricting development', first sentence

Version 2 Stated ↗

• “We do not deploy models that reach a High capability threshold until the associated risks that they pose are sufficiently minimized.”

  PDF p. 4 (printed p. 3), §1 Introduction, third bullet ('Safeguard against severe harms'), second sentence

• “If a model under development reaches a Critical capability threshold, we also require safeguards to sufficiently minimize the associated risks during development, irrespective of deployment plans.”

  PDF p. 4 (printed p. 3), §1 Introduction, third bullet

Beta Stated ↗

• “The OpenAI Leadership, i.e., the CEO or a person designated by them, serves as the default decision-maker on all decisions”

  PDF p. 23, Governance › Operations › Parties, paragraph on OpenAI Leadership

Version 2 Stated ↗

• “OpenAI Leadership can approve or reject these recommendations, and our Board’s Safety and Security Committee provides oversight of these decisions.”

  PDF p. 4 (printed p. 3), §1 Introduction, final paragraph, second sentence

Beta Stated ↗

• “Where necessary, the BoD may reverse a decision and/or mandate a revised course of action”

  PDF p. 24, Governance › Operations › 'Decision process', third paragraph

Version 2 Stated ↗

• “OpenAI Leadership can approve or reject these recommendations, and our Board’s Safety and Security Committee provides oversight of these decisions.”

  PDF p. 4 (printed p. 3), §1 Introduction, final paragraph, second sentence

• “Where necessary, the Board may reverse a decision and/or mandate a revised course of action.”

  PDF p. 16 (printed p. 15), Appendix B 'Decision-making practices', paragraph on the Safety and Security Committee, final sentence

Beta Stated ↗

• Paraphrase: The edition says evaluations will be run continually, as often as needed to detect any non-trivial change in capability before, during and after training, and that this would include any effective-compute increase of more than 2x or any major algorithmic breakthrough.

  PDF p. 13, Scorecard › 'Evaluating pre-mitigation risk', final two sentences

Version 2 Stated ↗

• Paraphrase: The edition states that every covered model goes through the suite of Scalable Evaluations before deployment.

  PDF p. 10 (printed p. 9), §3.3 Capability threshold determinations, first sentence

Beta Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

Version 2 Stated ↗

• “another frontier AI model developer might develop or release a system with High or Critical capability … without instituting comparable safeguards”

  PDF p. 13 (printed p. 12), §4.3 Marginal risk, first paragraph, first sentence

• “If we are able to rigorously confirm that such a scenario has occurred, then we could adjust accordingly the level of safeguards that we require in that capability area, but only if:”

  PDF p. 13 (printed p. 12), §4.3 Marginal risk, first paragraph

Beta Stated ↗

• “Note that this should not preclude safety-enhancing development.”

  PDF p. 21, Governance › Safety baselines › 'Restricting development', third sentence

• “For the avoidance of doubt, Leadership can also make decisions without the SAG’s participation, i.e., the SAG does not have the ability to “filibuster”

  PDF p. 24, Governance › Operations › 'Decision process', third paragraph, parenthetical

Version 2 Stated ↗

• “OpenAI Leadership can also make decisions without the SAG’s participation”

  PDF p. 16 (printed p. 15), Appendix B, SAG responsibilities, fifth bullet

Beta Stated ↗

• Paraphrase: The edition lists among the Preparedness team’s responsibilities a monthly report to the SAG, Leadership and the Board of Directors that synthesises its work and any possible protective actions; the SAG Chair, OpenAI Leadership or the Board may adjust that cadence as needed.

  PDF p. 23, Governance › Operations › 'Process', Preparedness team responsibilities, fifth item

Version 2 Stated ↗

• Paraphrase: The edition says OpenAI will keep a record of relevant reports to the SAG and of the SAG's decisions and reasoning.

  PDF p. 13 (printed p. 12), §5.1 Internal governance, 'Internal Transparency', first sentence

Beta Not found in the recorded search ↗

No passage meeting the criterion was found in the recorded search.

Version 2 Stated ↗

• Paraphrase: The edition says OpenAI will release information about its Preparedness Framework results for major deployments.

  PDF p. 13 (printed p. 12), §5.2 Transparency and external participation, 'Public disclosures', first sentence

Beta Stated ↗

• Paraphrase: The edition says that if the Preparedness team or any other team decides the Framework needs changes, it will set out the case for the change in its report.

  PDF p. 23, Governance › Operations › 'Process', final paragraph, first sentence

Version 2 Stated ↗

• Paraphrase: The edition says OpenAI will review the Framework for continued sufficiency, and may update it, at least once a year.

  PDF p. 16 (printed p. 15), Appendix B, 'Updates to the Preparedness Framework', third sentence

Beta Does not apply

First edition in this framework; there is no earlier edition.

Version 2 Stated ↗

• Paraphrase: The change log states that the terms 'low' and 'medium' are dropped, because those two levels played no operational part in its Preparedness work.

  PDF p. 15 (printed p. 14), Appendix A 'Change log', item 2, final sentence