{"entities":[{"id":"openai","name":"OpenAI"},{"id":"anthropic","name":"Anthropic"},{"id":"google-deepmind","name":"Google DeepMind"},{"id":"xai","name":"xAI"},{"id":"microsoft","name":"Microsoft"},{"id":"rsp-2023","name":"Responsible Scaling Policy (2023)","shortName":"RSP · 2023"},{"id":"fsf-2024","name":"Frontier Safety Framework (2024)"},{"id":"rsp-v2-0","name":"Anthropic Responsible Scaling Policy — v2.0","shortName":"RSP · v2.0"},{"id":"rsp-v2-1","name":"Anthropic Responsible Scaling Policy — v2.1","shortName":"RSP · v2.1"},{"id":"rsp-v2-2","name":"Anthropic Responsible Scaling Policy — v2.2","shortName":"RSP · v2.2"},{"id":"rsp-v3-0","name":"Anthropic Responsible Scaling Policy — v3.0","shortName":"RSP · v3.0"},{"id":"rsp-v3-1","name":"Anthropic Responsible Scaling Policy — v3.1","shortName":"RSP · v3.1"},{"id":"rsp-v3-2","name":"Anthropic Responsible Scaling Policy — v3.2","shortName":"RSP · v3.2"},{"id":"rsp-v3-3","name":"Anthropic Responsible Scaling Policy — v3.3","shortName":"RSP · v3.3"},{"id":"rsp-v3-4","name":"Anthropic Responsible Scaling Policy — v3.4","shortName":"RSP · v3.4"},{"id":"fsf-v2-0","name":"Google DeepMind Frontier Safety Framework — v2.0"},{"id":"fsf-v3-0","name":"Google DeepMind Frontier Safety Framework — v3.0"},{"id":"fsf-v3-1","name":"Google DeepMind Frontier Safety Framework — v3.1"},{"id":"preparedness-beta-2023","name":"OpenAI Preparedness Framework — Beta","shortName":"Preparedness · Beta"},{"id":"preparedness-v2","name":"OpenAI Preparedness Framework — Version 2","shortName":"Preparedness · Version 2"},{"id":"frontier-governance-2026","name":"OpenAI Frontier Governance Framework — May 2026 edition","shortName":"FGF · May 2026 edition"},{"id":"faif-2025","name":"xAI Frontier Artificial Intelligence Framework — December 2025 edition","shortName":"FAIF · December 2025 edition"},{"id":"faif-2026","name":"xAI Frontier Artificial Intelligence Framework — June 2026 edition","shortName":"FAIF · June 2026 edition"},{"id":"openai-preparedness","shortName":"Preparedness family"},{"id":"meta","name":"Meta"},{"id":"meta-faf-v1-1","name":"Meta Frontier AI Framework — Version 1.1","shortName":"Meta FAF · v1.1"},{"id":"meta-aasf-v2-0","name":"Meta Advanced AI Scaling Framework — Version 2"},{"id":"ms-fgf-2025","name":"Microsoft Frontier Governance Framework — Version 1 (February 2025)"},{"id":"ms-fgf-2026","name":"Microsoft Frontier Governance Framework — February 2026","shortName":"Microsoft FGF · Feb 2026"}],"claims":[{"id":"anthropic-rsp-2023","statement":"Anthropic announced publication of its initial Responsible Scaling Policy."},{"id":"rsp-credits-arc-2023","statement":"The RSP announcement explicitly credited ARC Evals’ framework as inspiring Anthropic’s approach.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-credits-arc-2023","evidence-rsp-credits-arc-2023-timing"]},{"id":"deepmind-fsf-2024","statement":"Google DeepMind introduced its initial Frontier Safety Framework."},{"id":"issued-rsp-2-0","statement":"Anthropic published Responsible Scaling Policy v2.0, identified by its effective date of 2024-10-15."},{"id":"issued-rsp-2-1","statement":"Anthropic published Responsible Scaling Policy v2.1, identified by its effective date of 2025-03-31."},{"id":"issued-rsp-2-2","statement":"Anthropic published Responsible Scaling Policy v2.2, identified by its effective date of 2025-05-14."},{"id":"issued-rsp-3-0","statement":"Anthropic published Responsible Scaling Policy v3.0, identified by its effective date of 2026-02-24."},{"id":"issued-rsp-3-1","statement":"Anthropic published Responsible Scaling Policy v3.1, identified by its effective date of 2026-04-02."},{"id":"issued-rsp-3-2","statement":"Anthropic published Responsible Scaling Policy v3.2, identified by its effective date of 2026-04-29."},{"id":"issued-rsp-3-3","statement":"Anthropic published Responsible Scaling Policy v3.3, identified by its effective date of 2026-05-26."},{"id":"issued-rsp-3-4","statement":"Anthropic published Responsible Scaling Policy v3.4, identified by its effective date of 2026-07-08."},{"id":"issued-fsf-2-0","statement":"Google DeepMind published Frontier Safety Framework v2.0, identified by its publication date of 2025-02-04."},{"id":"issued-fsf-3-0","statement":"Google DeepMind published Frontier Safety Framework v3.0, identified by its publication date of 2025-09-22."},{"id":"issued-fsf-3-1","statement":"Google DeepMind published Frontier Safety Framework v3.1, identified by its publication date of 2026-04-17."},{"id":"issued-pf-beta","statement":"OpenAI published Preparedness Framework Beta, identified by its publication date of 2023-12-18."},{"id":"issued-pf-2","statement":"OpenAI published Preparedness Framework Version 2, identified by its revision date of 2025-04-15."},{"id":"issued-fgf-2026","statement":"OpenAI published Frontier Governance Framework May 2026 edition, identified by its publication date of 2026-05-28."},{"id":"issued-faif-2025","statement":"xAI published Frontier Artificial Intelligence Framework December 2025 edition, identified by its revision date of 2025-12-30."},{"id":"issued-faif-2026","statement":"xAI published Frontier Artificial Intelligence Framework June 2026 edition, identified by its effective date of 2026-06-30."},{"id":"supersedes-rsp-2-0","statement":"Responsible Scaling Policy v2.0 replaces v1.0 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-rsp-2-1","statement":"Responsible Scaling Policy v2.1 replaces v2.0 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-rsp-2-2","statement":"Responsible Scaling Policy v2.2 replaces v2.1 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-rsp-3-0","statement":"Responsible Scaling Policy v3.0 replaces v2.2 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-rsp-3-1","statement":"Responsible Scaling Policy v3.1 replaces v3.0 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-rsp-3-2","statement":"Responsible Scaling Policy v3.2 replaces v3.1 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-rsp-3-3","statement":"Responsible Scaling Policy v3.3 replaces v3.2 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-rsp-3-4","statement":"Responsible Scaling Policy v3.4 replaces v3.3 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-fsf-2-0","statement":"Frontier Safety Framework v2.0 replaces v1.0 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-fsf-3-0","statement":"Frontier Safety Framework v3.0 replaces v2.0 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-fsf-3-1","statement":"Frontier Safety Framework v3.1 replaces v3.0 in the publisher’s documented framework version sequence.","resolution":"supported"},{"id":"supersedes-pf-2","statement":"Preparedness Framework Version 2 replaces Beta in the publisher’s documented framework version sequence.","resolution":"unresolved"},{"id":"fgf-applies-preparedness","statement":"OpenAI describes its Frontier Governance Framework as applying relevant parts of its continuing Preparedness approach to specific regulatory obligations.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fgf-applies-preparedness"]},{"id":"rsp-v2-asl-meaning","statement":"RSP v2.0 changes “ASL” to refer to groups of safeguards, rather than also referring to models.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v2-asl-meaning"],"attributes":{"changeBasis":"changelog"}},{"id":"rsp-v2-1-rd-thresholds","statement":"RSP v2.1 separates AI R&D thresholds for automating entry-level research and dramatically accelerating effective scaling.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v2-1-rd-thresholds"],"attributes":{"changeBasis":"changelog"}},{"id":"rsp-v2-2-insider-scope","statement":"RSP v2.2 excludes sophisticated insiders and state-compromised insiders from the ASL-3 Security Standard.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v2-2-insider-scope"],"attributes":{"changeBasis":"changelog"}},{"id":"rsp-v3-roadmaps","statement":"RSP v3.0 introduces Frontier Safety Roadmaps.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v3-roadmaps"],"attributes":{"changeBasis":"publisher_statement"}},{"id":"rsp-v3-risk-reports","statement":"RSP v3.0 introduces Risk Reports discussing model risks and development or deployment determinations.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v3-risk-reports"],"attributes":{"changeBasis":"publisher_statement"}},{"id":"rsp-v3-2-reviewer-approval","statement":"RSP v3.2 gives the Long-Term Benefit Trust authority to approve the selection of external Risk Report reviewers.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v3-2-reviewer-approval"],"attributes":{"changeBasis":"changelog"}},{"id":"rsp-v3-4-internal-reports","statement":"RSP v3.4 changes fully unredacted Risk Report sharing to at least 200 employees, instead of all regular-clearance staff.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v3-4-internal-reports"],"attributes":{"changeBasis":"changelog"}},{"id":"rsp-v3-4-coverage-date","statement":"RSP v3.4 allows a Risk Report coverage date up to 30 days before publication.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v3-4-coverage-date"],"attributes":{"changeBasis":"changelog"}},{"id":"fsf-v2-security-levels","statement":"FSF v2.0 introduces recommended security levels for Critical Capability Levels.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fsf-v2-security-levels"],"attributes":{"changeBasis":"publisher_statement"}},{"id":"fsf-v3-harmful-manipulation","statement":"FSF v3.0 introduces a Critical Capability Level for harmful manipulation.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fsf-v3-harmful-manipulation"],"attributes":{"changeBasis":"publisher_statement"}},{"id":"fsf-v3-1-cbrn-tcls","statement":"FSF v3.1 introduces CBRN Tracked Capability Levels.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fsf-v3-1-cbrn-tcls"],"attributes":{"changeBasis":"changelog"}},{"id":"pf-v2-threshold-terms","statement":"Preparedness Version 2 removes the terms “low” and “medium” while defining High and Critical capability thresholds.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-pf-v2-threshold-terms"],"attributes":{"changeBasis":"changelog"}},{"id":"pf-v2-research-categories","statement":"Preparedness Version 2 introduces Research Categories for capabilities requiring further threat-model and measurement work.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-pf-v2-research-categories"],"attributes":{"changeBasis":"changelog"}},{"id":"pf-v2-persuasion-scope","statement":"Preparedness Version 2 moves handling of persuasion risks outside the Preparedness Framework.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-pf-v2-persuasion-scope"],"attributes":{"changeBasis":"changelog"}},{"id":"faif-2026-compliance-sentence","statement":"The June 2026 FAIF does not contain the December 2025 edition’s sentence asserting compliance with California’s TFAIA.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-faif-2026-compliance-sentence","evidence-faif-2026-compliance-sentence-2"],"attributes":{"changeBasis":"document_comparison"}},{"id":"rsp-v3-company-industry-split","statement":"RSP v3.0 separates Anthropic’s own mitigation plans from its recommendations for industry-wide mitigation.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-rsp-v3-company-industry-split"],"attributes":{"changeBasis":"publisher_statement"}},{"id":"eval-i-rsp-christiano-credit","statement":"Anthropic RSP v1.0 says its commitments are designed in the spirit of the Responsible Scaling Policy framework being developed by Paul Christiano and ARC Evals.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-eval-i-rsp-christiano-credit"]},{"id":"issued-meta-faf-v1-1","statement":"Meta published its Frontier AI Framework, Version 1.1, identified by its announcement date of 2025-02-03."},{"id":"issued-meta-aasf-v2-0","statement":"Meta published Version 2 of its framework, renamed the Advanced AI Scaling Framework, identified by its announcement date of 2026-04-08."},{"id":"supersedes-meta-aasf-v2-0","statement":"Meta’s Advanced AI Scaling Framework, Version 2, replaces the Frontier AI Framework, Version 1.1, in the publisher’s documented framework sequence.","resolution":"supported"},{"id":"issued-ms-fgf-2025","statement":"Microsoft published the first edition of its Frontier Governance Framework in February 2025."},{"id":"issued-ms-fgf-2026","statement":"Microsoft published a February 2026 edition of its Frontier Governance Framework, identified by its version date of February 2026."},{"id":"supersedes-ms-fgf-2026","statement":"Microsoft’s February 2026 Frontier Governance Framework replaces the February 2025 first edition in the publisher’s documented framework sequence.","resolution":"supported"},{"id":"rsp-v2-0-assessed-weakening","statement":"Did RSP v2.0’s changes to threshold and mitigation specification reduce the verifiability of Anthropic’s safety commitments relative to v1.0?","derivation":"posed","resolution":"unresolved","editorialState":"seed","evidenceIds":["evidence-rsp-v2-0-assessed-weakening-saferai-title","evidence-rsp-v2-0-assessed-weakening-saferai","evidence-rsp-v2-0-assessed-weakening-anthropic"],"attributes":{"changeBasis":"assessment"}},{"id":"rsp-v3-0-assessed-weakening","statement":"Whether RSP v3.0’s new roadmap and transparency mechanisms compensate for its reduced unilateral commitments, in the policy’s overall capacity to secure risk mitigation, remains unsettled.","derivation":"posed","resolution":"unresolved","editorialState":"seed","evidenceIds":["evidence-rsp-v3-0-assessed-weakening-govai-future","evidence-rsp-v3-0-assessed-weakening-time-assessment","evidence-rsp-v3-0-assessed-weakening-kaplan","evidence-rsp-v3-0-assessed-weakening-anthropic","evidence-rsp-v3-0-assessed-weakening-kaplan-u-turn","evidence-rsp-v3-0-assessed-weakening-time","evidence-rsp-v3-0-assessed-weakening-govai-concern","evidence-rsp-v3-0-assessed-weakening-govai-balance","evidence-rsp-v3-0-assessed-weakening-govai-mitigations","evidence-rsp-v3-0-assessed-weakening-anthropic-realistic","evidence-rsp-v3-0-assessed-weakening-anthropic-goals","evidence-rsp-v3-0-assessed-weakening-karnofsky-forcing","evidence-rsp-v3-0-assessed-weakening-kaplan-unilateral","evidence-rsp-v3-0-assessed-weakening-karnofsky-unilateral"],"attributes":{"changeBasis":"assessment"}},{"id":"prov-rsp-2023-misuse-uplift-threshold","statement":"RSP v1.0 states that one capability qualifying a model as ASL-3 is that access to it would substantially increase the risk of deliberately-caused catastrophic harm, by proliferating capabilities, lowering costs or enabling new methods of attack, measured relative to the baseline risk from, e.g., search engines and textbooks.","resolution":"supported","evidenceIds":["evidence-prov-rsp-2023-misuse-uplift-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-misuse-uplift-threshold"}}},{"id":"prov-rsp-2023-no-train-deploy-without-safeguards","statement":"RSP v1.0 states that Anthropic commits to pause scaling and/or delay the deployment of new models whenever its scaling ability outstrips its ability to comply with the safety procedures for the corresponding ASL.","resolution":"supported","evidenceIds":["evidence-prov-rsp-2023-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"prov-rsp-2023-policy-change-approval","statement":"RSP v1.0 states that Anthropic will follow an Update Process for the policy that includes approval by the board of directors following consultation with the Long-Term Benefit Trust.","resolution":"supported","evidenceIds":["evidence-prov-rsp-2023-policy-change-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-policy-change-approval","parties":[{"role":"decides","actor":"Board of Directors"},{"role":"consulted","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-2023-trusted-user-access","statement":"RSP v1.0 states that, in limited cases, models with capabilities relevant to catastrophic harm may be made available to a select group of vetted users with a legitimate and beneficial use-case that cannot be separated from dangerous capabilities, and only if such access can be granted safely and with sufficient oversight.","resolution":"supported","evidenceIds":["evidence-prov-rsp-2023-trusted-user-access"],"attributes":{"provision":{"kind":"exception","key":"rsp-trusted-user-access"}}},{"id":"prov-rsp-v2-0-misuse-uplift-threshold","statement":"RSP v2.0 states that its CBRN weapons Capability Threshold is the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-misuse-uplift-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-misuse-uplift-threshold"}}},{"id":"prov-rsp-v2-0-no-train-deploy-without-safeguards","statement":"RSP v2.0 states that its Responsible Scaling Policy, released in September 2023, is a public commitment not to train or deploy models capable of causing catastrophic harm unless Anthropic has implemented safety and security measures that will keep risks below acceptable levels.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"prov-rsp-v2-0-ceo-rso-decision-board-ltbt-informed","statement":"RSP v2.0 states that if the CEO and RSO decide to proceed with deployment and training, they will share their decision, with the underlying Capability Report and internal and any external feedback, with the Board of Directors and the Long-Term Benefit Trust before moving forward.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-ceo-rso-decision-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed","parties":[{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"},{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v2-1-misuse-uplift-threshold","statement":"RSP v2.1 states that its CBRN-3 Capability Threshold is the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-1-misuse-uplift-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-misuse-uplift-threshold"}}},{"id":"prov-rsp-v2-1-no-train-deploy-without-safeguards","statement":"RSP v2.1 states that its Responsible Scaling Policy, released in September 2023, is a public commitment not to train or deploy models capable of causing catastrophic harm unless Anthropic has implemented safety and security measures that will keep risks below acceptable levels.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-1-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"prov-rsp-v2-1-ceo-rso-decision-board-ltbt-informed","statement":"RSP v2.1 states that if the CEO and RSO decide to proceed with deployment and training, they will share their decision, with the underlying Safeguards Report and internal and any external feedback, with the Board of Directors and the Long-Term Benefit Trust before moving forward.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-1-ceo-rso-decision-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed","parties":[{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"},{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v2-2-misuse-uplift-threshold","statement":"RSP v2.2 states that its CBRN-3 Capability Threshold is the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-2-misuse-uplift-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-misuse-uplift-threshold"}}},{"id":"prov-rsp-v2-2-no-train-deploy-without-safeguards","statement":"RSP v2.2 states that its Responsible Scaling Policy, released in September 2023, is a public commitment not to train or deploy models capable of causing catastrophic harm unless Anthropic has implemented safety and security measures that will keep risks below acceptable levels.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-2-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"prov-rsp-v2-2-ceo-rso-decision-board-ltbt-informed","statement":"RSP v2.2 states that if the CEO and RSO decide to proceed with deployment and training, they will share their decision, with the underlying Safeguards Report and internal and any external feedback, with the Board of Directors and the Long-Term Benefit Trust before moving forward.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-2-ceo-rso-decision-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed","parties":[{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"},{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-0-misuse-uplift-threshold","statement":"RSP v3.0 states that its non-novel chemical/biological weapons production threshold covers AI systems with the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy chemical and/or biological weapons with serious potential for catastrophic damages.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-0-misuse-uplift-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-misuse-uplift-threshold"}}},{"id":"prov-rsp-v3-0-automated-rd-threshold","statement":"RSP v3.0 states that its working operationalization triggers the Automated R&D in key domains threshold at the point where Anthropic determines that a model could compress two years of 2018–2024 AI progress into a single year.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-0-automated-rd-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-automated-rd-threshold"}}},{"id":"prov-rsp-v3-0-ceo-rso-decision-board-ltbt-informed","statement":"RSP v3.0 states that, following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report and internal feedback with both the Board and the LTBT.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-0-ceo-rso-decision-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed","parties":[{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"},{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-0-competitor-lead-delay","statement":"RSP v3.0 states that, in the scenario where Anthropic is in the lead, it will require a strong argument that catastrophic risk is contained, along the lines of its industry-wide recommendations, and will delay AI development and deployment as needed to achieve this until and unless it no longer believes it has a significant lead.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-0-competitor-lead-delay"],"attributes":{"provision":{"kind":"required_action","key":"rsp-competitor-lead-delay"}}},{"id":"prov-rsp-v3-1-automated-rd-threshold","statement":"RSP v3.1 states that one of two alternative conditions for considering the Automated R&D threshold met is that Anthropic's models would be able to fully substitute for its entire set of Research Scientists and Research Engineers, at competitive costs.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-1-automated-rd-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-automated-rd-threshold"}}},{"id":"prov-rsp-v3-1-ceo-rso-decision-board-ltbt-informed","statement":"RSP v3.1 states that, following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report and internal feedback with both the Board and the LTBT.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-1-ceo-rso-decision-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed","parties":[{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"},{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-1-competitor-lead-delay","statement":"RSP v3.1 states that, in the scenario where Anthropic is in the lead, it will require a strong argument that catastrophic risk is contained, along the lines of its industry-wide recommendations, and will delay AI development and deployment as needed to achieve this until and unless it no longer believes it has a significant lead.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-1-competitor-lead-delay"],"attributes":{"provision":{"kind":"required_action","key":"rsp-competitor-lead-delay"}}},{"id":"prov-rsp-v3-1-marginal-risk-board-ltbt-approval","statement":"RSP v3.1 states that, where marginal risk analysis plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT, rather than just the CEO and RSO, will be required.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-1-marginal-risk-board-ltbt-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-marginal-risk-board-ltbt-approval","parties":[{"role":"decides","actor":"Board of Directors"},{"role":"decides","actor":"Long-Term Benefit Trust"},{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"}]}}},{"id":"prov-rsp-v3-2-novel-cb-threshold","statement":"RSP v3.2 states that its novel chemical/biological weapons production threshold covers AI systems with the ability to significantly help threat actors (for example, moderately resourced expert-backed teams) create/obtain and deploy chemical and/or biological weapons with potential for catastrophic damages far beyond those of past catastrophes such as COVID-19.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-2-novel-cb-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-novel-cb-threshold"}}},{"id":"prov-rsp-v3-2-ceo-rso-decision-board-ltbt-informed","statement":"RSP v3.2 states that, following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report and internal feedback with both the Board and the LTBT.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-2-ceo-rso-decision-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed","parties":[{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"},{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-2-competitor-lead-delay","statement":"RSP v3.2 states that, in the scenario where Anthropic is in the lead, it will require a strong argument that catastrophic risk is contained, along the lines of its industry-wide recommendations, and will delay AI development and deployment as needed to achieve this until and unless it no longer believes it has a significant lead.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-2-competitor-lead-delay"],"attributes":{"provision":{"kind":"required_action","key":"rsp-competitor-lead-delay"}}},{"id":"prov-rsp-v3-3-novel-cb-threshold","statement":"RSP v3.3 states that its novel chemical/biological weapons production threshold covers AI systems that can functionally substitute for the scarce human expertise that is currently the primary barrier to novel development of chemical and biological weapons with potential for catastrophic harm.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-3-novel-cb-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-novel-cb-threshold"}}},{"id":"prov-rsp-v3-3-ceo-rso-decision-board-ltbt-informed","statement":"RSP v3.3 states that, following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report and internal feedback with both the Board and the LTBT.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-3-ceo-rso-decision-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed","parties":[{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"},{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-3-competitor-lead-delay","statement":"RSP v3.3 states that, in the scenario where Anthropic is in the lead, it will require a strong argument that catastrophic risk is contained, along the lines of its industry-wide recommendations, and will delay AI development and deployment as needed to achieve this until and unless it no longer believes it has a significant lead.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-3-competitor-lead-delay"],"attributes":{"provision":{"kind":"required_action","key":"rsp-competitor-lead-delay"}}},{"id":"prov-rsp-v3-3-marginal-risk-board-ltbt-approval","statement":"RSP v3.3 states that, where marginal risk analysis plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT, rather than just the CEO and RSO, will be required.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-3-marginal-risk-board-ltbt-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-marginal-risk-board-ltbt-approval","parties":[{"role":"decides","actor":"Board of Directors"},{"role":"decides","actor":"Long-Term Benefit Trust"},{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"}]}}},{"id":"prov-rsp-v3-4-ceo-rso-decision-board-ltbt-informed","statement":"RSP v3.4 states that, following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report and internal feedback with both the Board and the LTBT.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-4-ceo-rso-decision-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed","parties":[{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"},{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-4-competitor-lead-delay","statement":"RSP v3.4 states that, in the scenario where Anthropic is in the lead, it will require a strong argument that catastrophic risk is contained, along the lines of its industry-wide recommendations, and will delay AI development and deployment as needed to achieve this until and unless it no longer believes it has a significant lead.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-4-competitor-lead-delay"],"attributes":{"provision":{"kind":"required_action","key":"rsp-competitor-lead-delay"}}},{"id":"prov-fsf-2024-alert-threshold","statement":"FSF v1.0 states that Google DeepMind will define a set of “early warning evaluations” with a specific “pass” condition that flags when a CCL may be reached before the evaluations are run again.","resolution":"supported","evidenceIds":["evidence-prov-fsf-2024-alert-threshold"],"attributes":{"provision":{"kind":"threshold","key":"fsf-alert-threshold"}}},{"id":"prov-fsf-2024-evaluation-interval","statement":"FSF v1.0 states that Google DeepMind is aiming to evaluate its models every 6x in effective compute and for every 3 months of fine-tuning progress.","resolution":"supported","evidenceIds":["evidence-prov-fsf-2024-evaluation-interval"],"attributes":{"provision":{"kind":"threshold","key":"fsf-evaluation-interval"}}},{"id":"prov-fsf-2024-response-plan","statement":"FSF v1.0 states that when a model reaches evaluation thresholds (passes a set of early warning evaluations), Google DeepMind will formulate a response plan based on the analysis of the CCL and evaluation results.","resolution":"supported","evidenceIds":["evidence-prov-fsf-2024-response-plan"],"attributes":{"provision":{"kind":"required_action","key":"fsf-response-plan"}}},{"id":"prov-fsf-2024-hold-pending-mitigations","statement":"FSF v1.0 states that if a model reaches evaluation thresholds before mitigations at appropriate levels are ready, Google DeepMind would put on hold further deployment or development, or implement additional protocols.","resolution":"supported","evidenceIds":["evidence-prov-fsf-2024-hold-pending-mitigations"],"attributes":{"provision":{"kind":"required_action","key":"fsf-hold-pending-mitigations"}}},{"id":"prov-fsf-2024-autonomy-ccl","statement":"FSF v1.0 states that the Autonomy level 1 CCL denotes a model capable of expanding its effective capacity in the world by autonomously acquiring resources and using them to run and sustain additional copies of itself on hardware it rents.","resolution":"supported","evidenceIds":["evidence-prov-fsf-2024-autonomy-ccl"],"attributes":{"provision":{"kind":"threshold","key":"fsf-autonomy-ccl"}}},{"id":"prov-fsf-v2-0-alert-threshold","statement":"FSF v2.0 states that Google DeepMind will define a set of “early warning evaluations” with a specific “alert threshold” that flags when a CCL may be reached before the evaluations are run again.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v2-0-alert-threshold"],"attributes":{"provision":{"kind":"threshold","key":"fsf-alert-threshold"}}},{"id":"prov-fsf-v2-0-hold-pending-mitigations","statement":"FSF v2.0 states that if a model flagged by an alert threshold is assessed to pose risks for which readily available mitigations may not be sufficient, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v2-0-hold-pending-mitigations"],"attributes":{"provision":{"kind":"required_action","key":"fsf-hold-pending-mitigations"}}},{"id":"prov-fsf-v2-0-response-plan-approval","statement":"FSF v2.0 states that, for Google models, when alert thresholds are reached the response plan will be reviewed and approved by appropriate corporate governance bodies such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v2-0-response-plan-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"fsf-response-plan-approval","parties":[{"role":"decides","actor":"Appropriate corporate governance bodies, such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council"}]}}},{"id":"prov-fsf-v2-0-pre-deployment-review","statement":"FSF v2.0 states that general availability deployment of a model takes place only after the appropriate corporate governance body determines the safety case regarding each CCL the model has reached to be adequate.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v2-0-pre-deployment-review"],"attributes":{"provision":{"kind":"decision_authority","key":"fsf-pre-deployment-review","parties":[{"role":"decides","actor":"Appropriate corporate governance body"}]}}},{"id":"prov-fsf-v2-0-adoption-conditional-on-industry","statement":"FSF v2.0 states that Google DeepMind’s adoption of the protocols described in the Framework may depend on whether relevant organizations across the field adopt similar protocols.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v2-0-adoption-conditional-on-industry"],"attributes":{"provision":{"kind":"exception","key":"fsf-adoption-conditional-on-industry"}}},{"id":"prov-fsf-v3-0-alert-threshold","statement":"FSF v3.0 states that early warning evaluations assess the proximity of a model to a CCL and that the alert thresholds defined for them are designed to flag when a CCL may be reached before a risk assessment is conducted again.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-alert-threshold"],"attributes":{"provision":{"kind":"threshold","key":"fsf-alert-threshold"}}},{"id":"prov-fsf-v3-0-pre-deployment-review","statement":"FSF v3.0 states that, in the deployment mitigation process for misuse CCLs, external deployments of a model take place only after the appropriate governance function determines the safety case regarding each CCL the model has reached to be adequate.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-pre-deployment-review"],"attributes":{"provision":{"kind":"decision_authority","key":"fsf-pre-deployment-review","parties":[{"role":"decides","actor":"Appropriate governance function"}]}}},{"id":"prov-fsf-v3-0-government-disclosure","statement":"FSF v3.0 states that if Google DeepMind assesses that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, it aims to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-government-disclosure"],"attributes":{"provision":{"kind":"decision_authority","key":"fsf-government-disclosure","parties":[{"role":"decides","actor":"Google DeepMind"},{"role":"informed","actor":"Appropriate government authorities"}]}}},{"id":"prov-fsf-v3-0-alternative-security-adequacy","statement":"FSF v3.0 states that, among its example conditions for deeming a model that has reached a misuse CCL to pose an acceptable level of risk, the security condition is met if security mitigations reach the recommended security level or if Google DeepMind otherwise assesses the level of security applied to be adequate, e.g. if the mitigations match or exceed the security applied to other models with similar capabilities or risk profiles, or if it assesses that the benefits of open release of the model weights outweigh the risks.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-alternative-security-adequacy"],"attributes":{"provision":{"kind":"exception","key":"fsf-alternative-security-adequacy"}}},{"id":"prov-fsf-v3-1-alert-threshold","statement":"FSF v3.1 states that, for CCLs, Google DeepMind defines alert thresholds, which may draw on evaluation results, expert assessments and other sources of information, designed to flag when a CCL may be reached before a critical capability assessment is conducted again.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-1-alert-threshold"],"attributes":{"provision":{"kind":"threshold","key":"fsf-alert-threshold"}}},{"id":"prov-fsf-v3-1-pre-deployment-review","statement":"FSF v3.1 states that, in the deployment mitigation process for misuse T/CCLs, external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable, including a safety case where a CCL has been reached.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-1-pre-deployment-review"],"attributes":{"provision":{"kind":"decision_authority","key":"fsf-pre-deployment-review","parties":[{"role":"decides","actor":"Appropriate governance function"}]}}},{"id":"prov-fsf-v3-1-low-risk-deployment-exemption","statement":"FSF v3.1 states that a critical capability assessment may not be conducted for low-risk external deployments (e.g. to a small number of trusted testers) if the appropriate governance function determines the residual risk of such deployments to be acceptable, even if the model has reached a T/CCL (including with a safety case where a CCL has been reached).","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-1-low-risk-deployment-exemption"],"attributes":{"provision":{"kind":"exception","key":"fsf-low-risk-deployment-exemption"}}},{"id":"prov-preparedness-beta-2023-risk-level-scale","statement":"Preparedness Framework (Beta) states that “low” on its risk gradation scale is in general meant to indicate that the corresponding category of risks is not yet a significant problem, while “critical” represents the maximal level of concern.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-beta-2023-risk-level-scale"],"attributes":{"provision":{"kind":"threshold","key":"pf-risk-level-scale"}}},{"id":"prov-preparedness-beta-2023-high-deployment-restriction","statement":"Preparedness Framework (Beta) states that only models with a post-mitigation score of “medium” or below can be deployed.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-beta-2023-high-deployment-restriction"],"attributes":{"provision":{"kind":"required_action","key":"pf-high-deployment-restriction"}}},{"id":"prov-preparedness-beta-2023-critical-development-restriction","statement":"Preparedness Framework (Beta) states that only models with a post-mitigation score of “high” or below can be developed further.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-beta-2023-critical-development-restriction"],"attributes":{"provision":{"kind":"required_action","key":"pf-critical-development-restriction"}}},{"id":"prov-preparedness-beta-2023-safety-enhancing-development-exception","statement":"Preparedness Framework (Beta) states that its development restriction should not preclude safety-enhancing development.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-beta-2023-safety-enhancing-development-exception"],"attributes":{"provision":{"kind":"exception","key":"pf-safety-enhancing-development-exception"}}},{"id":"prov-preparedness-beta-2023-final-decision-authority","statement":"Preparedness Framework (Beta) states that there is an advisory group, the Safety Advisory Group, to provide nuanced input and recommendations, and a final decision-maker, OpenAI Leadership, with the option for the OpenAI Board of Directors to overrule.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-beta-2023-final-decision-authority"],"attributes":{"provision":{"kind":"decision_authority","key":"pf-final-decision-authority","parties":[{"role":"recommends","actor":"Safety Advisory Group (SAG)"},{"role":"decides","actor":"OpenAI Leadership"},{"role":"can_overrule","actor":"OpenAI Board of Directors"}]}}},{"id":"prov-preparedness-v2-high-deployment-restriction","statement":"Preparedness Framework Version 2 commits OpenAI not to deploy a model that reaches a High capability threshold until the associated risks are sufficiently minimized.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-v2-high-deployment-restriction"],"attributes":{"provision":{"kind":"required_action","key":"pf-high-deployment-restriction"}}},{"id":"assessed-preparedness-v2-high-deployment-mitigation","statement":"Preparedness Framework v2’s governance arrangements permit OpenAI Leadership to deploy models with High capabilities without safeguards that sufficiently minimize their associated risks.","resolution":"contested","evidenceIds":["evidence-assessed-preparedness-v2-high-deployment-mitigation-coggins-conclusion","evidence-assessed-preparedness-v2-high-deployment-mitigation-coggins-ceo","evidence-assessed-preparedness-v2-high-deployment-mitigation-openai","evidence-assessed-preparedness-v2-high-deployment-mitigation-agent-card","evidence-assessed-preparedness-v2-high-deployment-mitigation-openai-high"],"attributes":{"provision":{"kind":"required_action","key":"pf-high-deployment-restriction"}}},{"id":"prov-frontier-governance-2026-systemic-risk-definition","statement":"Frontier Governance Framework (May 2026) states that its definition of systemic risk includes risks that a model will materially contribute to greater than 50 fatalities or $1 billion of property damages or losses arising from a single incident.","resolution":"supported","evidenceIds":["evidence-prov-frontier-governance-2026-systemic-risk-definition"],"attributes":{"provision":{"kind":"threshold","key":"fgf-systemic-risk-definition"}}},{"id":"prov-frontier-governance-2026-residual-risk-deployment-gate","statement":"Frontier Governance Framework (May 2026) states that if residual risks associated with a model exceed acceptable risk levels, the model is not deployed unless additional mitigation measures are implemented that sufficiently minimize risk.","resolution":"supported","evidenceIds":["evidence-prov-frontier-governance-2026-residual-risk-deployment-gate"],"attributes":{"provision":{"kind":"required_action","key":"fgf-residual-risk-deployment-gate"}}},{"id":"prov-frontier-governance-2026-acceptable-risk-may-proceed","statement":"Frontier Governance Framework (May 2026) states that where residual risk falls within acceptable levels, taking into account appropriate safety margins, the model may be approved for continued development and internal use (where applicable) and may be deployed under the Framework.","resolution":"supported","evidenceIds":["evidence-prov-frontier-governance-2026-acceptable-risk-may-proceed"],"attributes":{"provision":{"kind":"exception","key":"fgf-acceptable-risk-may-proceed"}}},{"id":"prov-frontier-governance-2026-risk-acceptance-recommendations","statement":"Frontier Governance Framework (May 2026) states that OpenAI documents a justification for why a model’s systemic risks are acceptable, including reasonably foreseeable conditions under which it may no longer hold, as informed by recommendations from OpenAI’s Safety Advisory Group and external experts, as available and appropriate.","resolution":"supported","evidenceIds":["evidence-prov-frontier-governance-2026-risk-acceptance-recommendations"],"attributes":{"provision":{"kind":"decision_authority","key":"fgf-risk-acceptance-recommendations","parties":[{"role":"recommends","actor":"OpenAI Safety Advisory Group"},{"role":"recommends","actor":"External experts (as available and appropriate)"}]}}},{"id":"prov-frontier-governance-2026-material-update-oversight","statement":"Frontier Governance Framework (May 2026) states that material updates to it will be presented to the Safety and Security Committee of the board of directors of the OpenAI Foundation and to the board of directors of OpenAI Ireland Limited for oversight.","resolution":"supported","evidenceIds":["evidence-prov-frontier-governance-2026-material-update-oversight"],"attributes":{"provision":{"kind":"decision_authority","key":"fgf-material-update-oversight","parties":[{"role":"informed","actor":"Safety and Security Committee of the OpenAI Foundation board of directors"},{"role":"informed","actor":"Board of directors of OpenAI Ireland Limited"}]}}},{"id":"prov-faif-2025-bio-chem-acceptance-criterion","statement":"FAIF (December 2025) states that xAI developed an internal benchmark of benign and restricted biology and chemistry related queries in collaboration with SecureBio and that its risk acceptance criteria for system deployment is maintaining an answer rate of less than 1 out of 20 on restricted queries.","resolution":"supported","evidenceIds":["evidence-prov-faif-2025-bio-chem-acceptance-criterion"],"attributes":{"provision":{"kind":"threshold","key":"faif-bio-chem-acceptance-criterion"}}},{"id":"prov-faif-2025-mask-acceptance-criterion","statement":"FAIF (December 2025) states that its risk acceptance criteria for system deployment is maintaining a dishonesty rate of less than 1 out of 2 on MASK.","resolution":"supported","evidenceIds":["evidence-prov-faif-2025-mask-acceptance-criterion"],"attributes":{"provision":{"kind":"threshold","key":"faif-mask-acceptance-criterion"}}},{"id":"prov-faif-2025-benefits-may-outweigh-benchmark-risks","statement":"FAIF (December 2025) states that it is conceivable that, for a particular modality and/or type of release, the expected benefits of model deployment may outweigh the risks identified by a particular benchmark.","resolution":"supported","evidenceIds":["evidence-prov-faif-2025-benefits-may-outweigh-benchmark-risks"],"attributes":{"provision":{"kind":"exception","key":"faif-benefits-may-outweigh-benchmark-risks"}}},{"id":"prov-faif-2026-proceed-only-if-acceptable","statement":"FAIF (June 2026) states that xAI will only proceed with the development, the making available on the market, and/or the use of the model if the systemic risks stemming from the model are determined to be acceptable.","resolution":"supported","evidenceIds":["evidence-prov-faif-2026-proceed-only-if-acceptable"],"attributes":{"provision":{"kind":"required_action","key":"faif-proceed-only-if-acceptable"}}},{"id":"prov-faif-2026-heightened-safeguards","statement":"FAIF (June 2026) states that xAI’s models apply heightened safeguards if they receive user prompts that demonstrate intent to engage in the development, use or proliferation of weapons of mass destruction, including CBRN agents.","resolution":"supported","evidenceIds":["evidence-prov-faif-2026-heightened-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"faif-heightened-safeguards"}}},{"id":"prov-faif-2026-systemic-risk-acceptance-criteria","statement":"FAIF (June 2026) states that xAI applies a systemic risk acceptance criteria to each identified risk, incorporating a margin of security, to determine whether each identified systemic risk and the overall systemic risk are acceptable.","resolution":"supported","evidenceIds":["evidence-prov-faif-2026-systemic-risk-acceptance-criteria"],"attributes":{"provision":{"kind":"threshold","key":"faif-systemic-risk-acceptance-criteria"}}},{"id":"prov-faif-2026-security-standard","statement":"FAIF (June 2026) states that xAI will maintain a documented Security Goal that identifies the threat actors against which mitigations are designed to protect, including sophisticated non-state actors, insider threats, state-sponsored actors and other foreseeable actors.","resolution":"supported","evidenceIds":["evidence-prov-faif-2026-security-standard"],"attributes":{"provision":{"kind":"required_action","key":"faif-security-standard"}}},{"id":"prov-meta-faf-v1-1-critical-threshold","statement":"Frontier AI Framework v1.1 states that a model is at the critical risk threshold when it would uniquely enable the execution of at least one threat scenario identified as potentially sufficient to produce a catastrophic outcome and that risk cannot be mitigated in the proposed deployment context.","resolution":"supported","evidenceIds":["evidence-prov-meta-faf-v1-1-critical-threshold"],"attributes":{"provision":{"kind":"threshold","key":"meta-critical-threshold"}}},{"id":"prov-meta-faf-v1-1-critical-development-measure","statement":"Frontier AI Framework v1.1 states that if a frontier AI is assessed to have reached the critical risk threshold and cannot be mitigated, Meta will stop development and implement the measures outlined in Table 1.","resolution":"supported","evidenceIds":["evidence-prov-meta-faf-v1-1-critical-development-measure"],"attributes":{"provision":{"kind":"required_action","key":"meta-critical-development-measure"}}},{"id":"prov-meta-faf-v1-1-high-threshold","statement":"Frontier AI Framework v1.1 states that a model is at the high risk threshold when it provides significant uplift towards execution of a threat scenario but does not enable execution of any threat scenario identified as potentially sufficient to produce a catastrophic outcome.","resolution":"supported","evidenceIds":["evidence-prov-meta-faf-v1-1-high-threshold"],"attributes":{"provision":{"kind":"threshold","key":"meta-high-threshold"}}},{"id":"prov-meta-faf-v1-1-high-deployment-measure","statement":"Frontier AI Framework v1.1 states that if evaluation results indicate a frontier AI has a “high” risk threshold by providing significant uplift towards realization of a catastrophic outcome, Meta will not release it externally.","resolution":"supported","evidenceIds":["evidence-prov-meta-faf-v1-1-high-deployment-measure"],"attributes":{"provision":{"kind":"required_action","key":"meta-high-deployment-measure"}}},{"id":"prov-meta-faf-v1-1-approval-decision-authority","statement":"Frontier AI Framework v1.1 states that, informed by the residual risk analysis, a leadership team will either request further testing or information, require additional mitigations or improvements, or approve the model for release.","resolution":"supported","evidenceIds":["evidence-prov-meta-faf-v1-1-approval-decision-authority"],"attributes":{"provision":{"kind":"decision_authority","key":"meta-approval-decision-authority","parties":[{"role":"decides","actor":"leadership team"}]}}},{"id":"prov-meta-aasf-v2-0-critical-threshold","statement":"Advanced AI Scaling Framework v2 states that a model meets the critical risk threshold if its continued development could substantially contribute to any threat scenario, or if it could uniquely enable a threat scenario and the risk cannot be mitigated in the proposed deployment context.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-critical-threshold"],"attributes":{"provision":{"kind":"threshold","key":"meta-critical-threshold"}}},{"id":"prov-meta-aasf-v2-0-critical-development-measure","statement":"Advanced AI Scaling Framework v2 states that, should either critical-threshold scenario arise, Meta will only continue development of the Frontier AI if its risk assessments are complete and safeguards are defined, implemented and validated to reduce risk to the moderate or lower risk threshold.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-critical-development-measure"],"attributes":{"provision":{"kind":"required_action","key":"meta-critical-development-measure"}}},{"id":"prov-meta-aasf-v2-0-high-threshold","statement":"Advanced AI Scaling Framework v2 states that the high risk threshold applies where deployment of the Frontier AI could substantially contribute to any threat scenario associated with a catastrophic outcome.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-high-threshold"],"attributes":{"provision":{"kind":"threshold","key":"meta-high-threshold"}}},{"id":"prov-meta-aasf-v2-0-high-deployment-measure","statement":"Advanced AI Scaling Framework v2 states that the measure at the high risk threshold is to proceed with deployment of the Frontier AI only if sufficient mitigations are defined, implemented and validated to reduce risk to that of a moderate or lower model.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-high-deployment-measure"],"attributes":{"provision":{"kind":"required_action","key":"meta-high-deployment-measure"}}},{"id":"prov-meta-aasf-v2-0-approval-decision-authority","statement":"Advanced AI Scaling Framework v2 states that, informed by the residual risk analysis, the Chief AI Officer or the Director of Alignment and Risk will determine whether to request further testing or information, require additional mitigations or improvements, or approve the model for deployment.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-approval-decision-authority"],"attributes":{"provision":{"kind":"decision_authority","key":"meta-approval-decision-authority","parties":[{"role":"decides","actor":"Chief AI Officer"},{"role":"decides","actor":"Director of Alignment and Risk"}]}}},{"id":"prov-ms-fgf-2025-cbrn-high-threshold","statement":"The February 2025 edition of the Frontier Governance Framework states that the High risk level for CBRN weapons is described by two capability statements: a meaningful uplift to an expert’s (PhD level education in related fields) ability to develop and deliver a novel CBRN threat, and a meaningful uplift to a medium-skilled actor’s (e.g., STEM education) ability to develop and deliver a known CBRN threat.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2025-cbrn-high-threshold"],"attributes":{"provision":{"kind":"threshold","key":"msfgf-cbrn-high-threshold"}}},{"id":"prov-ms-fgf-2025-low-medium-deployment","statement":"The February 2025 edition of the Frontier Governance Framework states that models assessed as posing low or medium risk may be deployed with appropriate safeguards as outlined in the framework.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2025-low-medium-deployment"],"attributes":{"provision":{"kind":"exception","key":"msfgf-low-medium-deployment"}}},{"id":"prov-ms-fgf-2025-high-critical-predeployment-review","statement":"The February 2025 edition of the Frontier Governance Framework states that models assessed as having a high or critical risk are subject to further review and safety and security mitigations prior to deployment.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2025-high-critical-predeployment-review"],"attributes":{"provision":{"kind":"required_action","key":"msfgf-high-critical-predeployment-review"}}},{"id":"prov-ms-fgf-2025-pause-unmitigable-risk","statement":"The February 2025 edition of the Frontier Governance Framework states that if Microsoft identifies, during implementation of the framework, a risk it cannot sufficiently mitigate, it will pause development and deployment until mitigation practices evolve to meet the risk.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2025-pause-unmitigable-risk"],"attributes":{"provision":{"kind":"required_action","key":"msfgf-pause-unmitigable-risk"}}},{"id":"prov-ms-fgf-2025-deployment-decision-authority","statement":"The February 2025 edition of the Frontier Governance Framework states that the Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2025-deployment-decision-authority"],"attributes":{"provision":{"kind":"decision_authority","key":"msfgf-deployment-decision-authority","parties":[{"role":"decides","actor":"Executive Officers responsible for Microsoft’s AI governance program (or their delegates)"}]}}},{"id":"prov-ms-fgf-2026-cbrn-high-threshold","statement":"The February 2026 edition of the Frontier Governance Framework states that the High risk level for CBRN weapons is described by two capability statements: a meaningful uplift to an expert’s (PhD level education in related fields) ability to develop and deliver a novel CBRN threat, and a meaningful uplift to a medium-skilled actor’s (e.g., STEM education) ability to develop and deliver a known CBRN threat.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-cbrn-high-threshold"],"attributes":{"provision":{"kind":"threshold","key":"msfgf-cbrn-high-threshold"}}},{"id":"prov-ms-fgf-2026-low-medium-deployment","statement":"The February 2026 edition of the Frontier Governance Framework states that models assessed as posing low or medium risk may be deployed with appropriate safeguards as outlined in the framework.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-low-medium-deployment"],"attributes":{"provision":{"kind":"exception","key":"msfgf-low-medium-deployment"}}},{"id":"prov-ms-fgf-2026-high-critical-predeployment-review","statement":"The February 2026 edition of the Frontier Governance Framework states that models assessed as having a high or critical risk are subject to further review and safety and security mitigations prior to deployment.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-high-critical-predeployment-review"],"attributes":{"provision":{"kind":"required_action","key":"msfgf-high-critical-predeployment-review"}}},{"id":"prov-ms-fgf-2026-pause-unmitigable-risk","statement":"The February 2026 edition of the Frontier Governance Framework states that if Microsoft identifies, during implementation of the framework, a risk it cannot sufficiently mitigate, it will pause development and deployment until mitigation practices evolve to meet the risk.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-pause-unmitigable-risk"],"attributes":{"provision":{"kind":"required_action","key":"msfgf-pause-unmitigable-risk"}}},{"id":"prov-ms-fgf-2026-deployment-decision-authority","statement":"The February 2026 edition of the Frontier Governance Framework states that the Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-deployment-decision-authority"],"attributes":{"provision":{"kind":"decision_authority","key":"msfgf-deployment-decision-authority","parties":[{"role":"decides","actor":"Executive Officers responsible for Microsoft’s AI governance program (or their delegates)"}]}}},{"id":"absent-rsp-v3-0-no-train-deploy-without-safeguards","statement":"No passage stating the provision “Commitment not to train or deploy without adequate safeguards” was found in RSP · v3.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v3-0-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"absent-rsp-v3-1-no-train-deploy-without-safeguards","statement":"No passage stating the provision “Commitment not to train or deploy without adequate safeguards” was found in RSP · v3.1 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v3-1-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"absent-rsp-v3-2-no-train-deploy-without-safeguards","statement":"No passage stating the provision “Commitment not to train or deploy without adequate safeguards” was found in RSP · v3.2 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v3-2-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"absent-rsp-v3-3-no-train-deploy-without-safeguards","statement":"No passage stating the provision “Commitment not to train or deploy without adequate safeguards” was found in RSP · v3.3 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v3-3-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"absent-rsp-v3-4-no-train-deploy-without-safeguards","statement":"No passage stating the provision “Commitment not to train or deploy without adequate safeguards” was found in RSP · v3.4 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v3-4-no-train-deploy-without-safeguards"],"attributes":{"provision":{"kind":"required_action","key":"rsp-no-train-deploy-without-safeguards"}}},{"id":"absent-fsf-v2-0-evaluation-interval","statement":"No passage stating the provision “Evaluation every 6x effective compute and 3 months’ fine-tuning” was found in FSF · v2.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-fsf-v2-0-evaluation-interval"],"attributes":{"provision":{"kind":"threshold","key":"fsf-evaluation-interval"}}},{"id":"absent-fsf-v2-0-autonomy-ccl","statement":"No passage stating the provision “Autonomy level 1 CCL” was found in FSF · v2.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-fsf-v2-0-autonomy-ccl"],"attributes":{"provision":{"kind":"threshold","key":"fsf-autonomy-ccl"}}},{"id":"absent-fsf-v3-0-hold-pending-mitigations","statement":"No passage stating the provision “Putting deployment or development on hold pending mitigations” was found in FSF · v3.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-fsf-v3-0-hold-pending-mitigations"],"attributes":{"provision":{"kind":"required_action","key":"fsf-hold-pending-mitigations"}}},{"id":"absent-fsf-v3-0-response-plan-approval","statement":"No passage stating the provision “Response plans approved by named corporate governance bodies” was found in FSF · v3.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-fsf-v3-0-response-plan-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"fsf-response-plan-approval"}}},{"id":"absent-fsf-v3-0-adoption-conditional-on-industry","statement":"No passage stating the provision “Adoption of protocols dependent on industry-wide adoption” was found in FSF · v3.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-fsf-v3-0-adoption-conditional-on-industry"],"attributes":{"provision":{"kind":"exception","key":"fsf-adoption-conditional-on-industry"}}},{"id":"absent-preparedness-v2-safety-enhancing-development-exception","statement":"No passage stating the provision “Development restriction does not preclude safety-enhancing development” was found in Preparedness · Version 2 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-preparedness-v2-safety-enhancing-development-exception"],"attributes":{"provision":{"kind":"exception","key":"pf-safety-enhancing-development-exception"}}},{"id":"absent-faif-2026-bio-chem-acceptance-criterion","statement":"No passage stating the provision “Bio/chem deployment criterion: answer rate below 1 in 20” was found in FAIF · June 2026 edition within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-faif-2026-bio-chem-acceptance-criterion"],"attributes":{"provision":{"kind":"threshold","key":"faif-bio-chem-acceptance-criterion"}}},{"id":"absent-faif-2026-mask-acceptance-criterion","statement":"No passage stating the provision “Deployment criterion: MASK dishonesty rate below 1 in 2” was found in FAIF · June 2026 edition within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-faif-2026-mask-acceptance-criterion"],"attributes":{"provision":{"kind":"threshold","key":"faif-mask-acceptance-criterion"}}},{"id":"absent-faif-2026-benefits-may-outweigh-benchmark-risks","statement":"No passage stating the provision “Deployment benefits may outweigh benchmark-identified risks” was found in FAIF · June 2026 edition within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-faif-2026-benefits-may-outweigh-benchmark-risks"],"attributes":{"provision":{"kind":"exception","key":"faif-benefits-may-outweigh-benchmark-risks"}}},{"id":"provchange-rsp-v2-0-misuse-uplift-threshold","statement":"v2.0's threshold concerns CBRN weapons specifically, defined as significant help to individuals or groups with basic technical backgrounds in creating/obtaining and deploying them; v1.0's ASL-3 misuse capability was defined as model access substantially increasing the risk of deliberately-caused catastrophic harm generally, measured against a search-engine and textbook baseline.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v2-0-misuse-uplift-threshold-later","evidence-provchange-rsp-v2-0-misuse-uplift-threshold-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"threshold","key":"rsp-misuse-uplift-threshold"}}},{"id":"provchange-rsp-v2-1-ceo-rso-decision-board-ltbt-informed","statement":"In the safeguards decision, v2.1 has the CEO and RSO share the underlying Safeguards Report with the Board and LTBT; v2.0's sentence named the underlying Capability Report.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v2-1-ceo-rso-decision-board-ltbt-informed-later","evidence-provchange-rsp-v2-1-ceo-rso-decision-board-ltbt-informed-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed"}}},{"id":"provchange-rsp-v3-0-misuse-uplift-threshold","statement":"v3.0's threshold covers significant help to individuals or groups with basic technical backgrounds in creating/obtaining and deploying chemical and/or biological weapons with serious potential for catastrophic damages; v2.2's CBRN-3 threshold covered the same help for CBRN weapons without that qualifier.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v3-0-misuse-uplift-threshold-later","evidence-provchange-rsp-v3-0-misuse-uplift-threshold-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"threshold","key":"rsp-misuse-uplift-threshold"}}},{"id":"provchange-rsp-v3-0-ceo-rso-decision-board-ltbt-informed","statement":"v3.0 has the CEO and RSO, following approval of a Risk Report, promptly share their decision(s), the Risk Report and internal feedback with the Board and LTBT; v2.2 had them, on deciding to proceed with deployment and training, share that decision with the Safeguards Report and internal and any external feedback with the Board and LTBT before moving forward.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v3-0-ceo-rso-decision-board-ltbt-informed-later","evidence-provchange-rsp-v3-0-ceo-rso-decision-board-ltbt-informed-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"decision_authority","key":"rsp-ceo-rso-decision-board-ltbt-informed"}}},{"id":"provchange-rsp-v3-1-automated-rd-threshold","statement":"v3.1 treats the Automated R&D threshold as met if Anthropic determines either that its models could fully substitute for its entire set of Research Scientists and Research Engineers at competitive costs (within a factor of 5) or that AI progress is dramatically accelerating for reasons likely related to automation of AI R&D (an observed or expected doubling of the rate of progress plausibly attributable to that automation); v3.0's working operationalization triggered it where a model could compress two years of 2018–2024 AI progress into one year.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v3-1-automated-rd-threshold-later","evidence-provchange-rsp-v3-1-automated-rd-threshold-earlier","evidence-provchange-rsp-v3-1-automated-rd-threshold-changelog"],"attributes":{"changeBasis":"changelog","provision":{"kind":"threshold","key":"rsp-automated-rd-threshold"}}},{"id":"provchange-rsp-v3-3-novel-cb-threshold","statement":"v3.3’s threshold covers AI systems that can functionally substitute for the scarce human expertise that is currently the primary barrier to novel development of chemical and biological weapons with potential for catastrophic harm (footnoted as consequences comparable to or worse than COVID-19); that is, a well-resourced team could use the model for the end-to-end agent design and deployment, including formulation and dissemination, that would otherwise require recruiting one of a small number of world-leading specialists. v3.2’s threshold covered AI systems able to significantly help threat actors, such as moderately resourced expert-backed teams, create or obtain and deploy such weapons with potential for catastrophic damages far beyond past catastrophes such as COVID-19.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v3-3-novel-cb-threshold-later","evidence-provchange-rsp-v3-3-novel-cb-threshold-earlier","evidence-provchange-rsp-v3-3-novel-cb-threshold-changelog"],"attributes":{"changeBasis":"changelog","provision":{"kind":"threshold","key":"rsp-novel-cb-threshold"}}},{"id":"provchange-fsf-v2-0-hold-pending-mitigations","statement":"v2.0 states that where a model flagged by an alert threshold is assessed to pose risks for which readily available mitigations may not be sufficient, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied; v1.0 stated that if a model reached evaluation thresholds before mitigations at appropriate levels were ready, Google DeepMind would put further deployment or development on hold or implement additional protocols.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v2-0-hold-pending-mitigations-later","evidence-provchange-fsf-v2-0-hold-pending-mitigations-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"required_action","key":"fsf-hold-pending-mitigations"}}},{"id":"provchange-fsf-v3-0-alert-threshold","statement":"v3.0’s alert thresholds for its early warning evaluations are designed to flag when a CCL may be reached before a risk assessment is conducted again, and its Note on Machine Learning R&D CCLs adds that the alert threshold may be defined based on sources of information about Google DeepMind’s own progress at accelerating ML R&D, rather than on evaluation scores; v2.0’s alert threshold flagged when a CCL may be reached before the evaluations are run again, and v2.0 contains no such note.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-0-alert-threshold-later","evidence-provchange-fsf-v3-0-alert-threshold-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"threshold","key":"fsf-alert-threshold"}}},{"id":"provchange-fsf-v3-1-alert-threshold","statement":"v3.1 defines alert thresholds for CCLs that may draw on evaluation results, expert assessments and other sources of information and flag when a CCL may be reached before a critical capability assessment is conducted again; v3.0 defined alert thresholds for its early warning evaluations that flag when a CCL may be reached before a risk assessment is conducted again, with a separate note allowing the ML R&D alert threshold to be defined from information on Google DeepMind’s own ML R&D progress rather than evaluation scores.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-1-alert-threshold-later","evidence-provchange-fsf-v3-1-alert-threshold-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"threshold","key":"fsf-alert-threshold"}}},{"id":"provchange-fsf-v3-0-pre-deployment-review","statement":"v3.0 makes external deployments of a model conditional on the appropriate governance function determining the safety case for each CCL reached to be adequate; v2.0 made general availability deployment conditional on the appropriate corporate governance body making that determination.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-0-pre-deployment-review-later","evidence-provchange-fsf-v3-0-pre-deployment-review-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"decision_authority","key":"fsf-pre-deployment-review"}}},{"id":"provchange-fsf-v3-1-pre-deployment-review","statement":"v3.1 makes external deployments conditional on the appropriate governance function determining the residual risk to be acceptable, including a safety case where a CCL has been reached; v3.0 made them conditional on that function determining the safety case regarding each CCL the model has reached to be adequate.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-1-pre-deployment-review-later","evidence-provchange-fsf-v3-1-pre-deployment-review-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"decision_authority","key":"fsf-pre-deployment-review"}}},{"id":"provchange-preparedness-v2-high-deployment-restriction","statement":"Version 2 states that models reaching a High capability threshold are not deployed until the associated risks they pose are sufficiently minimized; the Beta states that only models with a post-mitigation score of “medium” or below can be deployed.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-preparedness-v2-high-deployment-restriction-later","evidence-provchange-preparedness-v2-high-deployment-restriction-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"required_action","key":"pf-high-deployment-restriction"}}},{"id":"provchange-meta-aasf-v2-0-critical-threshold","statement":"v2's critical threshold has two alternative conditions (continued development could substantially contribute to any threat scenario, or the model could uniquely enable a threat scenario and the risk cannot be mitigated in the proposed deployment context), whereas v1.1's Table 1 critical row states only the uniquely-enable condition (the model would uniquely enable execution of at least one identified threat scenario and that risk cannot be mitigated in the proposed deployment context).","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-meta-aasf-v2-0-critical-threshold-later","evidence-provchange-meta-aasf-v2-0-critical-threshold-earlier","evidence-provchange-meta-aasf-v2-0-critical-threshold-changelog"],"attributes":{"changeBasis":"changelog","provision":{"kind":"threshold","key":"meta-critical-threshold"}}},{"id":"provchange-meta-aasf-v2-0-critical-development-measure","statement":"v2 states that, should either critical-threshold scenario arise, development continues only if risk assessments are complete and safeguards are defined, implemented and validated to reduce risk to the moderate or lower threshold, whereas v1.1 states that Meta will stop development and implement the Table 1 measures if a frontier AI reaches the critical threshold and cannot be mitigated.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-meta-aasf-v2-0-critical-development-measure-later","evidence-provchange-meta-aasf-v2-0-critical-development-measure-earlier","evidence-provchange-meta-aasf-v2-0-critical-development-measure-changelog"],"attributes":{"changeBasis":"changelog","provision":{"kind":"required_action","key":"meta-critical-development-measure"}}},{"id":"provchange-meta-aasf-v2-0-high-threshold","statement":"v2's high threshold applies where deployment of the Frontier AI could substantially contribute to any threat scenario associated with a catastrophic outcome, whereas v1.1's applies where the model provides significant uplift towards execution of a threat scenario but does not enable execution of any threat scenario identified as potentially sufficient to produce a catastrophic outcome.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-meta-aasf-v2-0-high-threshold-later","evidence-provchange-meta-aasf-v2-0-high-threshold-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"threshold","key":"meta-high-threshold"}}},{"id":"provchange-meta-aasf-v2-0-high-deployment-measure","statement":"v2’s high-threshold measure, labelled Deploy with mitigations, is to proceed with deployment of the Frontier AI only if sufficient mitigations are defined, implemented and validated to reduce risk to that of a moderate or lower model, whereas v1.1 states that a frontier AI at the high risk threshold will not be released externally, and its Table 1 pairs the high threshold’s Do not release label with the measure of implementing mitigations to reduce risk to moderate levels.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-meta-aasf-v2-0-high-deployment-measure-later","evidence-provchange-meta-aasf-v2-0-high-deployment-measure-earlier","evidence-provchange-meta-aasf-v2-0-high-deployment-measure-changelog"],"attributes":{"changeBasis":"changelog","provision":{"kind":"required_action","key":"meta-high-deployment-measure"}}},{"id":"provchange-meta-aasf-v2-0-approval-decision-authority","statement":"v2 names the Chief AI Officer or the Director of Alignment and Risk as determining whether to request further testing or information, require additional mitigations or improvements, or approve the model for deployment, whereas v1.1 assigns these choices to 'a leadership team' and refers to approval for release.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-meta-aasf-v2-0-approval-decision-authority-later","evidence-provchange-meta-aasf-v2-0-approval-decision-authority-earlier","evidence-provchange-meta-aasf-v2-0-approval-decision-authority-changelog"],"attributes":{"changeBasis":"changelog","provision":{"kind":"decision_authority","key":"meta-approval-decision-authority"}}},{"id":"prov-rsp-2023-emergency-loosening","statement":"RSP v1.0 states that in a situation of extreme emergency, such as a clearly bad actor (for example a rogue state) scaling so recklessly that it is likely to lead to imminent global catastrophe if not stopped, and where AI itself is helpful in such defence, Anthropic could envisage a substantial loosening of “these restrictions” as an emergency response, taken only in consultation with governmental authorities and with the compelling case for it presented publicly to the extent possible.","resolution":"supported","evidenceIds":["evidence-prov-rsp-2023-emergency-loosening","evidence-prov-rsp-2023-emergency-loosening-condition"],"attributes":{"provision":{"kind":"exception","key":"rsp-emergency-loosening"}}},{"id":"prov-rsp-v2-0-lower-safeguards-if-others-pass","statement":"RSP v2.0 states that if another actor in the frontier AI ecosystem passes, or is on track to imminently pass, a Capability Threshold without measures equivalent to the Required Safeguards, Anthropic might decide to lower the Required Safeguards because the incremental increase in risk attributable to it would be small.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-lower-safeguards-if-others-pass","evidence-prov-rsp-v2-0-lower-safeguards-if-others-pass-scenario"],"attributes":{"provision":{"kind":"exception","key":"rsp-lower-safeguards-if-others-pass"}}},{"id":"prov-rsp-v2-1-lower-safeguards-if-others-pass","statement":"RSP v2.1 states that if another actor in the frontier AI ecosystem passes, or is on track to imminently pass, a Capability Threshold without measures equivalent to the Required Safeguards, Anthropic might decide to lower the Required Safeguards because the incremental increase in risk attributable to it would be small.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-1-lower-safeguards-if-others-pass","evidence-prov-rsp-v2-1-lower-safeguards-if-others-pass-scenario"],"attributes":{"provision":{"kind":"exception","key":"rsp-lower-safeguards-if-others-pass"}}},{"id":"prov-rsp-v2-2-lower-safeguards-if-others-pass","statement":"RSP v2.2 states that if another actor in the frontier AI ecosystem passes, or is on track to imminently pass, a Capability Threshold without measures equivalent to the Required Safeguards, Anthropic might decide to lower the Required Safeguards because the incremental increase in risk attributable to it would be small.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-2-lower-safeguards-if-others-pass","evidence-prov-rsp-v2-2-lower-safeguards-if-others-pass-scenario"],"attributes":{"provision":{"kind":"exception","key":"rsp-lower-safeguards-if-others-pass"}}},{"id":"prov-fsf-v2-0-government-disclosure","statement":"FSF v2.0 states that if Google DeepMind assesses that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, it aims to share information with appropriate government authorities where it will facilitate the development of safe AI.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v2-0-government-disclosure"],"attributes":{"provision":{"kind":"decision_authority","key":"fsf-government-disclosure","parties":[{"role":"decides","actor":"Google DeepMind"},{"role":"informed","actor":"Appropriate government authorities"}]}}},{"id":"prov-rsp-v3-3-automated-rd-threshold","statement":"RSP v3.3 states that it would consider the dramatic-acceleration scenario of the Automated R&D threshold to have occurred where, among other conditions, Anthropic observes or expects double the rate of progress in AI aggregate capabilities compared to the rate it would expect in the absence of significant AI contributions to AI R&D.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-3-automated-rd-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-automated-rd-threshold"}}},{"id":"prov-rsp-v3-4-automated-rd-threshold","statement":"RSP v3.4 states that it would consider the dramatic-acceleration scenario of the Automated R&D threshold to have occurred where, among other conditions, Anthropic observes or expects double the rate of progress in AI aggregate capabilities compared to both the rate it would expect and the fastest rate of extended progress it has observed in the absence of significant AI contributions to AI R&D.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-4-automated-rd-threshold"],"attributes":{"provision":{"kind":"threshold","key":"rsp-automated-rd-threshold"}}},{"id":"prov-rsp-2023-pause-training","statement":"RSP v1.0 states that Anthropic commits to pause training before a model's capability level outstrips the Containment Measures it has implemented.","resolution":"supported","evidenceIds":["evidence-prov-rsp-2023-pause-training"],"attributes":{"provision":{"kind":"required_action","key":"rsp-pause-training"}}},{"id":"prov-rsp-2023-board-ltbt-informed","statement":"RSP v1.0 states that Anthropic will share results of ASL evaluations promptly with its governing bodies, including the board of directors and the LTBT, to inform them of changes to its risk profile.","resolution":"supported","evidenceIds":["evidence-prov-rsp-2023-board-ltbt-informed"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-board-ltbt-informed","parties":[{"role":"informed","actor":"Board of Directors"},{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-2023-weights-deletion-decision","statement":"RSP v1.0 states that if a model has already surpassed the next ASL during training, access to the weights is to be locked down immediately and stakeholders including the CISO and CEO should be convened immediately to determine whether the level of danger merits deletion of the weights.","resolution":"supported","evidenceIds":["evidence-prov-rsp-2023-weights-deletion-decision"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-weights-deletion-decision","parties":[{"role":"decides","actor":"CISO (among convened stakeholders)"},{"role":"decides","actor":"CEO (among convened stakeholders)"}]}}},{"id":"prov-rsp-v2-0-pause-training","statement":"RSP v2.0 states that if a model in pretraining has capabilities comparable to or greater than the model that requires the ASL-3 Security Standard, Anthropic will pause training until it has implemented the ASL-3 Security Standard and established that it is sufficient for the model.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-pause-training"],"attributes":{"provision":{"kind":"required_action","key":"rsp-pause-training"}}},{"id":"prov-rsp-v2-1-pause-training","statement":"RSP v2.1 states that if a model in pretraining has capabilities comparable to or greater than the model that requires the ASL-3 Security Standard, Anthropic will pause training until it has implemented the ASL-3 Security Standard and established that it is sufficient for the model.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-1-pause-training"],"attributes":{"provision":{"kind":"required_action","key":"rsp-pause-training"}}},{"id":"prov-rsp-v2-2-pause-training","statement":"RSP v2.2 states that if a model in pretraining has capabilities comparable to or greater than the model that requires the ASL-3 Security Standard, Anthropic will pause training until it has implemented the ASL-3 Security Standard and established that it is sufficient for the model.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-2-pause-training"],"attributes":{"provision":{"kind":"required_action","key":"rsp-pause-training"}}},{"id":"prov-rsp-v2-0-restrict-and-pause","statement":"RSP v2.0 states that if Anthropic is unable to make the showing required in its Safeguards Decision process, it will restrict model deployment and further scaling.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-restrict-and-pause"],"attributes":{"provision":{"kind":"required_action","key":"rsp-restrict-and-pause"}}},{"id":"prov-rsp-v2-1-restrict-and-pause","statement":"RSP v2.1 states that if Anthropic is unable to make the showing required in its Safeguards Decision process, it will restrict model deployment and further scaling.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-1-restrict-and-pause"],"attributes":{"provision":{"kind":"required_action","key":"rsp-restrict-and-pause"}}},{"id":"prov-rsp-v2-2-restrict-and-pause","statement":"RSP v2.2 states that if Anthropic is unable to make the showing required in its Safeguards Decision process, it will restrict model deployment and further scaling.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-2-restrict-and-pause"],"attributes":{"provision":{"kind":"required_action","key":"rsp-restrict-and-pause"}}},{"id":"prov-rsp-v2-0-may-proceed-with-safeguards","statement":"RSP v2.0 states that if, after its evaluations, Anthropic determines that it has met the ASL-3 Required Safeguards, it may proceed with deploying and training models above the Capability Threshold, provided it has also conducted a follow-up capability assessment.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-may-proceed-with-safeguards"],"attributes":{"provision":{"kind":"exception","key":"rsp-may-proceed-with-safeguards"}}},{"id":"prov-rsp-v2-1-may-proceed-with-safeguards","statement":"RSP v2.1 states that if, after its evaluations, Anthropic determines that it has met the ASL-3 Required Safeguards, it may proceed with deploying and training models above the Capability Threshold, provided it has also conducted a follow-up capability assessment.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-1-may-proceed-with-safeguards"],"attributes":{"provision":{"kind":"exception","key":"rsp-may-proceed-with-safeguards"}}},{"id":"prov-rsp-v2-2-may-proceed-with-safeguards","statement":"RSP v2.2 states that if, after its evaluations, Anthropic determines that it has met the ASL-3 Required Safeguards, it may proceed with deploying and training models above the Capability Threshold, provided it has also conducted a follow-up capability assessment.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-2-may-proceed-with-safeguards"],"attributes":{"provision":{"kind":"exception","key":"rsp-may-proceed-with-safeguards"}}},{"id":"prov-rsp-v2-0-security-alone-continue-training","statement":"RSP v2.0 states that Anthropic considers implementation of the ASL-3 Security Standard alone sufficient to continue training, regardless of whether the ASL-3 Deployment Standard is satisfied.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-security-alone-continue-training"],"attributes":{"provision":{"kind":"exception","key":"rsp-security-alone-continue-training"}}},{"id":"prov-rsp-v2-0-policy-change-approval","statement":"RSP v2.0 states that changes to the policy will be proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors, in consultation with the Long-Term Benefit Trust.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-0-policy-change-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-policy-change-approval","parties":[{"role":"recommends","actor":"CEO"},{"role":"recommends","actor":"Responsible Scaling Officer"},{"role":"decides","actor":"Board of Directors"},{"role":"consulted","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v2-1-policy-change-approval","statement":"RSP v2.1 states that changes to the policy will be proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors, in consultation with the Long-Term Benefit Trust.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v2-1-policy-change-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-policy-change-approval","parties":[{"role":"recommends","actor":"CEO"},{"role":"recommends","actor":"Responsible Scaling Officer"},{"role":"decides","actor":"Board of Directors"},{"role":"consulted","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-0-industry-commitment-limit","statement":"RSP v3.0 states that Anthropic cannot unilaterally and unconditionally commit to staying in line with the industry-wide recommendations in the right column of its threshold table.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-0-industry-commitment-limit"],"attributes":{"provision":{"kind":"exception","key":"rsp-industry-commitment-limit"}}},{"id":"prov-rsp-v3-0-competitor-parity","statement":"RSP v3.0 states that, in the scenario where competitors have strong safety measures, Anthropic will, for its highly capable frontier models, meet or exceed the overall risk reduction posture of these competitors as far as it can tell from its best efforts to assess that posture, and that until it is able to do so it will delay AI development and deployment as needed to achieve this.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-0-competitor-parity","evidence-prov-rsp-v3-0-competitor-parity-delay"],"attributes":{"provision":{"kind":"required_action","key":"rsp-competitor-parity"}}},{"id":"prov-rsp-v3-0-competitor-upleveling","statement":"RSP v3.0 states that, where a competitor has implemented a qualifying risk mitigation, Anthropic will make a significant effort to meet or exceed that performance standard but will not necessarily delay AI development and deployment in this scenario.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-0-competitor-upleveling"],"attributes":{"provision":{"kind":"required_action","key":"rsp-competitor-upleveling"}}},{"id":"prov-rsp-v3-0-marginal-risk-board-ltbt-approval","statement":"RSP v3.0 states that, where marginal risk analysis plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT, rather than just the CEO and RSO, will be required.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-0-marginal-risk-board-ltbt-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-marginal-risk-board-ltbt-approval","parties":[{"role":"decides","actor":"Board of Directors"},{"role":"decides","actor":"Long-Term Benefit Trust"},{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"}]}}},{"id":"prov-rsp-v3-2-marginal-risk-board-ltbt-approval","statement":"RSP v3.2 states that, where marginal risk analysis plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT, rather than just the CEO and RSO, will be required.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-2-marginal-risk-board-ltbt-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-marginal-risk-board-ltbt-approval","parties":[{"role":"decides","actor":"Board of Directors"},{"role":"decides","actor":"Long-Term Benefit Trust"},{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"}]}}},{"id":"prov-rsp-v3-4-marginal-risk-board-ltbt-approval","statement":"RSP v3.4 states that, where marginal risk analysis plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT, rather than just the CEO and RSO, will be required.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-4-marginal-risk-board-ltbt-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-marginal-risk-board-ltbt-approval","parties":[{"role":"decides","actor":"Board of Directors"},{"role":"decides","actor":"Long-Term Benefit Trust"},{"role":"decides","actor":"CEO"},{"role":"decides","actor":"Responsible Scaling Officer"}]}}},{"id":"prov-rsp-v3-2-ltbt-review-request","statement":"RSP v3.2 states that, upon the LTBT's request, Anthropic will conduct a public or private external review of its Risk Report or sections of it, subject to the procedures outlined in the policy.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-2-ltbt-review-request"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ltbt-review-request","parties":[{"role":"decides","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-3-ltbt-review-request","statement":"RSP v3.3 states that, upon the LTBT's request, Anthropic will conduct a public or private external review of its Risk Report or sections of it, subject to the procedures outlined in the policy.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-3-ltbt-review-request"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ltbt-review-request","parties":[{"role":"decides","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-4-ltbt-review-request","statement":"RSP v3.4 states that, upon the LTBT's request, Anthropic will conduct a public or private external review of its Risk Report or sections of it, subject to the procedures outlined in the policy.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-4-ltbt-review-request"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ltbt-review-request","parties":[{"role":"decides","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-rsp-v3-2-ltbt-regular-briefing","statement":"RSP v3.2 states that Anthropic will regularly brief the LTBT on plans and developments related to its Risk Reports, including model training, capability evaluations, mitigations and risk analyses.","resolution":"supported","evidenceIds":["evidence-prov-rsp-v3-2-ltbt-regular-briefing"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-ltbt-regular-briefing","parties":[{"role":"informed","actor":"Long-Term Benefit Trust"}]}}},{"id":"prov-fsf-v2-0-response-plan","statement":"FSF v2.0 states that when a model reaches an alert threshold for a CCL, Google DeepMind will assess the model's proximity to the CCL and analyse the risk posed, involving internal and external experts as needed, and that this will inform the formulation and application of a response plan.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v2-0-response-plan"],"attributes":{"provision":{"kind":"required_action","key":"fsf-response-plan"}}},{"id":"prov-fsf-v3-0-response-plan","statement":"FSF v3.0 states that when a model reaches an alert threshold for a CCL, Google DeepMind will assess the model's proximity to the CCL and analyse the risk posed, involving internal and external experts as needed, and that this will inform the formulation and application of a response plan.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-response-plan"],"attributes":{"provision":{"kind":"required_action","key":"fsf-response-plan"}}},{"id":"prov-fsf-v3-1-response-plan","statement":"FSF v3.1 states that when a model reaches an alert threshold for a CCL, Google DeepMind will assess the model's proximity to the CCL and analyse the risk posed, involving internal and external experts as needed, and that this will inform the formulation and application of a response plan.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-1-response-plan"],"attributes":{"provision":{"kind":"required_action","key":"fsf-response-plan"}}},{"id":"prov-fsf-v3-0-response-plan-distant-from-ccl","statement":"FSF v3.0 states that where model capabilities remain quite distant from a CCL, a response plan may involve the adoption of additional capability assessment processes to flag when heightened mitigations are required.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-response-plan-distant-from-ccl"],"attributes":{"provision":{"kind":"required_action","key":"fsf-response-plan-distant-from-ccl"}}},{"id":"prov-fsf-v3-1-response-plan-distant-from-ccl","statement":"FSF v3.1 states that if Google DeepMind assesses that risks stemming from the model remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-1-response-plan-distant-from-ccl"],"attributes":{"provision":{"kind":"required_action","key":"fsf-response-plan-distant-from-ccl"}}},{"id":"prov-fsf-v2-0-security-level-adjustment","statement":"FSF v2.0 states that an adjustment of its recommended security levels may occur if, for example, a model does not possess capabilities meaningfully different from other widely available models that have not demonstrably caused or contributed to severe risks.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v2-0-security-level-adjustment"],"attributes":{"provision":{"kind":"exception","key":"fsf-security-level-adjustment"}}},{"id":"prov-fsf-v3-0-security-level-adjustment","statement":"FSF v3.0 states that an adjustment of its recommended security levels may occur if, for example, a model does not possess capabilities meaningfully different from other publicly available models that have weaker security applied, in which case the marginal benefit of higher security is limited.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-security-level-adjustment"],"attributes":{"provision":{"kind":"exception","key":"fsf-security-level-adjustment"}}},{"id":"prov-fsf-v3-0-deployment-mitigation-scope","statement":"FSF v3.0 states, of its misuse risk acceptance criterion on deployment mitigations, that this is required only for external deployment, not further development.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-deployment-mitigation-scope"],"attributes":{"provision":{"kind":"exception","key":"fsf-deployment-mitigation-scope"}}},{"id":"prov-fsf-v3-1-deployment-mitigation-scope","statement":"FSF v3.1 states, of its misuse risk acceptance criterion on deployment mitigations, that this is required only for external deployment, not internal deployment or further development.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-1-deployment-mitigation-scope"],"attributes":{"provision":{"kind":"exception","key":"fsf-deployment-mitigation-scope"}}},{"id":"prov-fsf-v3-1-government-disclosure","statement":"FSF v3.1 states that if Google DeepMind assesses that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, it aims to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-1-government-disclosure"],"attributes":{"provision":{"kind":"decision_authority","key":"fsf-government-disclosure","parties":[{"role":"decides","actor":"Google DeepMind"},{"role":"informed","actor":"Appropriate government authorities"}]}}},{"id":"prov-fsf-v3-0-framework-update-review","statement":"FSF v3.0 states that the Frontier Safety Framework will be updated at least once a year.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-0-framework-update-review"],"attributes":{"provision":{"kind":"required_action","key":"fsf-framework-update-review"}}},{"id":"prov-fsf-v3-1-framework-update-review","statement":"FSF v3.1 states that the Frontier Safety Framework will be reviewed at least once a year.","resolution":"supported","evidenceIds":["evidence-prov-fsf-v3-1-framework-update-review"],"attributes":{"provision":{"kind":"required_action","key":"fsf-framework-update-review"}}},{"id":"prov-preparedness-beta-2023-leadership-without-sag","statement":"Preparedness Framework (Beta) states, for the avoidance of doubt, that Leadership can also make decisions without the SAG’s participation, i.e., the SAG does not have the ability to “filibuster”.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-beta-2023-leadership-without-sag"],"attributes":{"provision":{"kind":"decision_authority","key":"pf-leadership-without-sag","parties":[{"role":"decides","actor":"OpenAI Leadership"}]}}},{"id":"prov-preparedness-beta-2023-capabilities-development-condition","statement":"Preparedness Framework (Beta) states that OpenAI would also focus its efforts as a company towards solving these safety challenges and only continue with capabilities-enhancing development if it can reasonably assure itself (via the operationalization processes) that it is safe to do so.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-beta-2023-capabilities-development-condition"],"attributes":{"provision":{"kind":"exception","key":"pf-capabilities-development-condition"}}},{"id":"prov-preparedness-v2-final-decision-authority","statement":"Preparedness Framework Version 2 states that OpenAI Leadership can approve or reject the Safety Advisory Group’s recommendations and that the Board’s Safety and Security Committee provides oversight of these decisions.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-v2-final-decision-authority"],"attributes":{"provision":{"kind":"decision_authority","key":"pf-final-decision-authority","parties":[{"role":"recommends","actor":"Safety Advisory Group (SAG)"},{"role":"decides","actor":"OpenAI Leadership"},{"role":"informed","actor":"Safety and Security Committee of the OpenAI Board of Directors"}]}}},{"id":"prov-preparedness-v2-critical-development-restriction","statement":"Preparedness Framework Version 2 states that if a model under development reaches a Critical capability threshold, OpenAI also requires safeguards to sufficiently minimize the associated risks during development, irrespective of deployment plans.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-v2-critical-development-restriction"],"attributes":{"provision":{"kind":"required_action","key":"pf-critical-development-restriction"}}},{"id":"prov-preparedness-v2-marginal-risk-adjustment","statement":"Preparedness Framework Version 2 states that if OpenAI is able to rigorously confirm that such a scenario (another frontier AI developer developing or releasing a system with High or Critical capability in a Tracked Category without comparable safeguards) has occurred, it could adjust accordingly the level of safeguards it requires in that capability area, but only if listed conditions hold.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-v2-marginal-risk-adjustment"],"attributes":{"provision":{"kind":"exception","key":"pf-marginal-risk-adjustment"}}},{"id":"prov-preparedness-v2-sag-determinations","statement":"Preparedness Framework Version 2 states that in cases of ambiguity about whether a model is covered by the Preparedness Framework, the SAG is responsible for making the final determination.","resolution":"supported","evidenceIds":["evidence-prov-preparedness-v2-sag-determinations"],"attributes":{"provision":{"kind":"decision_authority","key":"pf-sag-determinations","parties":[{"role":"decides","actor":"Safety Advisory Group (SAG)"}]}}},{"id":"prov-frontier-governance-2026-update-proposal-process","statement":"Frontier Governance Framework (May 2026) states that updates to it may be proposed by OpenAI’s Safety Advisory Group, Head of Safety Systems, Head of Preparedness, Chief Information Security Officer, Chief Compliance Officer, General Counsel, or executive leadership.","resolution":"supported","evidenceIds":["evidence-prov-frontier-governance-2026-update-proposal-process"],"attributes":{"provision":{"kind":"decision_authority","key":"fgf-update-proposal-process","parties":[{"role":"recommends","actor":"OpenAI Safety Advisory Group"},{"role":"recommends","actor":"Head of Safety Systems"},{"role":"recommends","actor":"Head of Preparedness"},{"role":"recommends","actor":"Chief Information Security Officer"},{"role":"recommends","actor":"Chief Compliance Officer"},{"role":"recommends","actor":"General Counsel"},{"role":"recommends","actor":"Executive leadership"}]}}},{"id":"prov-frontier-governance-2026-update-legal-oversight","statement":"Frontier Governance Framework (May 2026) states that OpenAI’s Legal function, in collaboration with relevant internal stakeholders, will oversee the process for FGF updates, including determining which updates are required.","resolution":"supported","evidenceIds":["evidence-prov-frontier-governance-2026-update-legal-oversight"],"attributes":{"provision":{"kind":"decision_authority","key":"fgf-update-legal-oversight","parties":[{"role":"decides","actor":"OpenAI Legal function (which updates are required)"}]}}},{"id":"prov-frontier-governance-2026-precautionary-threshold-treatment","statement":"Frontier Governance Framework (May 2026) states, as an example, that out of an abundance of caution OpenAI has treated models as crossing a capability threshold in circumstances where it was unable to rule out that a new threshold had been reached, even in the absence of direct evidence that it has occurred.","resolution":"supported","evidenceIds":["evidence-prov-frontier-governance-2026-precautionary-threshold-treatment"],"attributes":{"provision":{"kind":"threshold","key":"fgf-precautionary-threshold-treatment"}}},{"id":"prov-faif-2025-trusted-user-exception","statement":"FAIF (December 2025) states that xAI may selectively allow its models to respond to such requests from some vetted, highly trusted users (such as trusted third-party safety auditors or large enterprise customers under contract) whom it knows to be using those capabilities for benign or beneficial purposes.","resolution":"supported","evidenceIds":["evidence-prov-faif-2025-trusted-user-exception"],"attributes":{"provision":{"kind":"exception","key":"faif-trusted-user-exception"}}},{"id":"prov-meta-faf-v1-1-critical-pause-investigation","statement":"Frontier AI Framework v1.1 states that if a model appears to uniquely enable the execution of a threat scenario, Meta will pause development while it investigates whether barriers to realizing the catastrophic outcome remain.","resolution":"supported","evidenceIds":["evidence-prov-meta-faf-v1-1-critical-pause-investigation"],"attributes":{"provision":{"kind":"required_action","key":"meta-critical-pause-investigation"}}},{"id":"prov-meta-faf-v1-1-uplift-assessment-approval","statement":"Frontier AI Framework v1.1 states that a final assessment of uplift is approved by senior-level decision-makers through Meta's AI Risk process.","resolution":"supported","evidenceIds":["evidence-prov-meta-faf-v1-1-uplift-assessment-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"meta-uplift-assessment-approval","parties":[{"role":"decides","actor":"Senior-level decision-makers (AI Risk process)"}]}}},{"id":"prov-meta-faf-v1-1-moderate-threshold","statement":"Frontier AI Framework v1.1 states, in the Moderate row of Table 1, that the model would not provide significant uplift towards execution of a threat scenario.","resolution":"supported","evidenceIds":["evidence-prov-meta-faf-v1-1-moderate-threshold"],"attributes":{"provision":{"kind":"threshold","key":"meta-moderate-threshold"}}},{"id":"prov-meta-aasf-v2-0-moderate-threshold","statement":"Advanced AI Scaling Framework v2.0 states, in the 'Moderate or lower' row of Table 1, that the Frontier AI shows relevant capabilities but could not substantially contribute to any threat scenario associated with a catastrophic outcome across plausible deployment and development scenarios.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-moderate-threshold"],"attributes":{"provision":{"kind":"threshold","key":"meta-moderate-threshold"}}},{"id":"prov-meta-aasf-v2-0-threshold-assignment-authority","statement":"Advanced AI Scaling Framework v2.0 states that, based on the pre-mitigation risk assessment, the Chief AI Officer and Director of Alignment and Risk will assign a risk threshold.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-threshold-assignment-authority"],"attributes":{"provision":{"kind":"decision_authority","key":"meta-threshold-assignment-authority","parties":[{"role":"decides","actor":"Chief AI Officer"},{"role":"decides","actor":"Director of Alignment and Risk"}]}}},{"id":"prov-meta-aasf-v2-0-accountability-oversight","statement":"Advanced AI Scaling Framework v2.0 states that model deployment follows appropriate consultation with relevant teams and the approval of the Chief AI Officer.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-accountability-oversight"],"attributes":{"provision":{"kind":"decision_authority","key":"meta-accountability-oversight","parties":[{"role":"decides","actor":"Chief AI Officer"},{"role":"consulted","actor":"Relevant teams"}]}}},{"id":"prov-meta-aasf-v2-0-cb-high-external-deployment-exception","statement":"Advanced AI Scaling Framework v2.0 states, for Chemical and Biological Risks, that where pre-mitigation testing suggests a model has crossed the high risk threshold, Meta will not deploy it externally unless it has strong additional evidence that mitigations are sufficiently robust to adversarial attacks that the fully mitigated model is reduced to moderate or lower levels.","resolution":"supported","evidenceIds":["evidence-prov-meta-aasf-v2-0-cb-high-external-deployment-exception"],"attributes":{"provision":{"kind":"exception","key":"meta-cb-high-external-deployment-exception"}}},{"id":"prov-ms-fgf-2025-framework-update-review","statement":"The February 2025 Frontier Governance Framework states that any updates to Microsoft's practices will be reviewed by Microsoft's Chief Responsible AI Officer prior to their adoption.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2025-framework-update-review"],"attributes":{"provision":{"kind":"decision_authority","key":"msfgf-framework-update-review","parties":[{"role":"consulted","actor":"Chief Responsible AI Officer"}]}}},{"id":"prov-ms-fgf-2026-framework-update-review","statement":"The February 2026 Frontier Governance Framework states that any updates to Microsoft's practices will be reviewed by Microsoft's Chief Responsible AI Officer prior to their adoption.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-framework-update-review"],"attributes":{"provision":{"kind":"decision_authority","key":"msfgf-framework-update-review","parties":[{"role":"consulted","actor":"Chief Responsible AI Officer"}]}}},{"id":"prov-ms-fgf-2025-high-risk-security","statement":"The February 2025 Frontier Governance Framework states that models posing high risk on one or more tracked capability will be subject to security measures protective against most cybercrime groups and insider threats.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2025-high-risk-security"],"attributes":{"provision":{"kind":"required_action","key":"msfgf-high-risk-security"}}},{"id":"prov-ms-fgf-2026-high-risk-security","statement":"The February 2026 Frontier Governance Framework states that models posing high risk on one or more tracked high-risk capability will be subject to security measures protective against most cybercrime groups and insider threats.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-high-risk-security"],"attributes":{"provision":{"kind":"required_action","key":"msfgf-high-risk-security"}}},{"id":"prov-ms-fgf-2026-external-evaluator-decision","statement":"The February 2026 Frontier Governance Framework states that the decision to involve qualified and expert external actors that meet relevant security standards is made by internal experts who are independent from the model development team.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-external-evaluator-decision"],"attributes":{"provision":{"kind":"decision_authority","key":"msfgf-external-evaluator-decision","parties":[{"role":"decides","actor":"Internal experts independent from the model development team"}]}}},{"id":"prov-ms-fgf-2026-incident-reporting","statement":"The February 2026 Frontier Governance Framework states that where Microsoft or others identify serious or critical incidents that may pose public safety or national security risks, Microsoft operationalizes incident response policies and processes, conducts investigations, and provides reports to regulatory authorities and impacted customers as appropriate.","resolution":"supported","evidenceIds":["evidence-prov-ms-fgf-2026-incident-reporting"],"attributes":{"provision":{"kind":"required_action","key":"msfgf-incident-reporting"}}},{"id":"absent-rsp-v2-0-weights-deletion-decision","statement":"No passage stating the provision “CISO and CEO convened to decide on weight deletion” was found in RSP · v2.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v2-0-weights-deletion-decision"],"attributes":{"provision":{"kind":"decision_authority","key":"rsp-weights-deletion-decision"}}},{"id":"absent-rsp-v3-0-pause-training","statement":"No passage stating the provision “Pause training until ASL-3 Security Standard implemented” was found in RSP · v3.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v3-0-pause-training"],"attributes":{"provision":{"kind":"required_action","key":"rsp-pause-training"}}},{"id":"absent-rsp-v3-0-restrict-and-pause","statement":"No passage stating the provision “Restrict deployment and scaling if safeguards showing fails” was found in RSP · v3.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v3-0-restrict-and-pause"],"attributes":{"provision":{"kind":"required_action","key":"rsp-restrict-and-pause"}}},{"id":"absent-rsp-v3-0-may-proceed-with-safeguards","statement":"No passage stating the provision “May deploy and train above threshold once ASL-3 Required Safeguards met” was found in RSP · v3.0 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-rsp-v3-0-may-proceed-with-safeguards"],"attributes":{"provision":{"kind":"exception","key":"rsp-may-proceed-with-safeguards"}}},{"id":"absent-meta-aasf-v2-0-critical-pause-investigation","statement":"No passage stating the provision “Pause development to investigate remaining barriers” was found in Meta AASF · v2 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-meta-aasf-v2-0-critical-pause-investigation"],"attributes":{"provision":{"kind":"required_action","key":"meta-critical-pause-investigation"}}},{"id":"absent-meta-aasf-v2-0-uplift-assessment-approval","statement":"No passage stating the provision “Senior-level decision-makers approve final uplift assessment” was found in Meta AASF · v2 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-absent-meta-aasf-v2-0-uplift-assessment-approval"],"attributes":{"provision":{"kind":"decision_authority","key":"meta-uplift-assessment-approval"}}},{"id":"provchange-fsf-v3-0-government-disclosure","statement":"v3.0 aims to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI; v2.0 aimed to share information with them where it will facilitate the development of safe AI. The triggering assessment (a CCL posing an unmitigated and material risk to overall public safety) is worded the same.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-0-government-disclosure-later","evidence-provchange-fsf-v3-0-government-disclosure-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"decision_authority","key":"fsf-government-disclosure"}}},{"id":"provchange-rsp-v3-4-automated-rd-threshold","statement":"v3.4 counts the dramatic-acceleration scenario of the Automated R&D threshold as having occurred where the observed or expected doubling of AI progress is measured against both the rate Anthropic would expect and the fastest rate of extended progress it has observed (over at least three model generations) without significant AI contributions to AI R&D, and where continuing the trend “seems likely to lead to” even greater acceleration; v3.3 measured the doubling against the expected rate alone, and continuing the trend “could lead to” even greater acceleration.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v3-4-automated-rd-threshold-later","evidence-provchange-rsp-v3-4-automated-rd-threshold-earlier","evidence-provchange-rsp-v3-4-automated-rd-threshold-changelog"],"attributes":{"changeBasis":"changelog","provision":{"kind":"threshold","key":"rsp-automated-rd-threshold"}}},{"id":"provchange-rsp-v2-0-pause-training","statement":"v2.0 makes the training pause conditional on a model in pretraining reaching capabilities comparable to or greater than a model that requires the ASL-3 Security Standard and continues it until that standard is implemented and established as sufficient for the model, within §6.2, which applies where a model requires the ASL-3 Required Safeguards but Anthropic is unable to implement them immediately; v1.0 committed to pause training before a model’s capability level outstrips the Containment Measures Anthropic has implemented.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v2-0-pause-training-later","evidence-provchange-rsp-v2-0-pause-training-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"required_action","key":"rsp-pause-training"}}},{"id":"provchange-rsp-v2-0-policy-change-approval","statement":"v2.0 states that policy changes are proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors in consultation with the LTBT; v1.0's Update Process named approval by the board of directors following consultation with the LTBT and named no proposer.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-rsp-v2-0-policy-change-approval-later","evidence-provchange-rsp-v2-0-policy-change-approval-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"decision_authority","key":"rsp-policy-change-approval"}}},{"id":"provchange-fsf-v2-0-response-plan","statement":"v2.0 states that on reaching an alert threshold for a CCL the model's proximity to the CCL is assessed and the risk analysed, involving internal and external experts as needed, to inform the formulation and application of a response plan; v1.0 stated that on reaching evaluation thresholds a response plan would be formulated based on the analysis of the CCL and evaluation results.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v2-0-response-plan-later","evidence-provchange-fsf-v2-0-response-plan-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"required_action","key":"fsf-response-plan"}}},{"id":"provchange-fsf-v3-1-response-plan-distant-from-ccl","statement":"v3.1 states that if risks remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate; v3.0 stated that where capabilities remain quite distant from a CCL, a response plan may involve adopting additional capability assessment processes to flag when heightened mitigations are required.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-1-response-plan-distant-from-ccl-later","evidence-provchange-fsf-v3-1-response-plan-distant-from-ccl-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"required_action","key":"fsf-response-plan-distant-from-ccl"}}},{"id":"provchange-fsf-v3-0-security-level-adjustment","statement":"v3.0's example for adjusting recommended security levels refers to models with capabilities not meaningfully different from other publicly available models that have weaker security applied, adding that the marginal benefit of higher security is then limited; v2.0's example referred to other widely available models that have not demonstrably caused or contributed to severe risks.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-0-security-level-adjustment-later","evidence-provchange-fsf-v3-0-security-level-adjustment-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"exception","key":"fsf-security-level-adjustment"}}},{"id":"provchange-fsf-v3-1-deployment-mitigation-scope","statement":"v3.1's misuse deployment-mitigation criterion is stated to be required only for external deployment, not internal deployment or further development, and its ML R&D criterion for external and high-risk internal deployment; v3.0's misuse criterion was stated to be required only for external deployment, not further development, and its ML R&D criterion for external and large scale internal deployment.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-1-deployment-mitigation-scope-later","evidence-provchange-fsf-v3-1-deployment-mitigation-scope-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"exception","key":"fsf-deployment-mitigation-scope"}}},{"id":"provchange-fsf-v3-1-framework-update-review","statement":"v3.1 states that the Framework will be reviewed at least once a year; v3.0 stated that it will be updated at least once a year.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-fsf-v3-1-framework-update-review-later","evidence-provchange-fsf-v3-1-framework-update-review-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"required_action","key":"fsf-framework-update-review"}}},{"id":"provchange-preparedness-v2-critical-development-restriction","statement":"Version 2 states that if a model under development reaches a Critical capability threshold, safeguards are also required to sufficiently minimize the associated risks during development, irrespective of deployment plans; the Beta states that only models with a post-mitigation score of “high” or below can be developed further.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-preparedness-v2-critical-development-restriction-later","evidence-provchange-preparedness-v2-critical-development-restriction-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"required_action","key":"pf-critical-development-restriction"}}},{"id":"provchange-preparedness-v2-final-decision-authority","statement":"Version 2’s passage states that OpenAI Leadership can approve or reject the SAG’s recommendations and that the Board’s Safety and Security Committee provides oversight of these decisions; the Beta’s passage names OpenAI Leadership as final decision-maker with the option for the OpenAI Board of Directors to overrule.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-preparedness-v2-final-decision-authority-later","evidence-provchange-preparedness-v2-final-decision-authority-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"decision_authority","key":"pf-final-decision-authority"}}},{"id":"provchange-meta-aasf-v2-0-moderate-threshold","statement":"v2.0's lowest threshold, 'Moderate or lower' with the measure label 'Deploy', applies where the Frontier AI shows relevant capabilities but could not substantially contribute to any threat scenario associated with a catastrophic outcome across plausible deployment and development scenarios, whereas v1.1's 'Moderate' threshold, with the measure label 'Release', applies where the model would not provide significant uplift towards execution of a threat scenario.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-provchange-meta-aasf-v2-0-moderate-threshold-later","evidence-provchange-meta-aasf-v2-0-moderate-threshold-earlier"],"attributes":{"changeBasis":"document_comparison","provision":{"kind":"threshold","key":"meta-moderate-threshold"}}},{"id":"sb-link-openai-fgf","statement":"OpenAI's Frontier Governance Framework (May 2026 edition) states that, under California's TFAIA, it is OpenAI's Frontier AI Framework.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-sb-link-openai-fgf-1","evidence-sb-link-openai-fgf-2"],"attributes":{"commitment":{"link":"designated_under"}}},{"id":"sb-link-rsp-v3-0","statement":"Anthropic's Responsible Scaling Policy v3.0 says it uses 'catastrophic risk' in its plain meaning rather than adopting any specific statutory definition. It adds that where laws such as California SB 53 define this or similar terms with specific thresholds, Anthropic addresses those requirements in separate compliance frameworks.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-sb-link-rsp-v3-0-1","evidence-sb-link-rsp-v3-0-2","evidence-sb-link-rsp-v3-0-3"],"attributes":{"commitment":{"link":"names"}}},{"id":"sb-link-faif-2025","statement":"xAI's Frontier Artificial Intelligence Framework (December 2025 edition) states that the FAIF complies with California's Transparency in Frontier Artificial Intelligence Act (Bus. & Prof. Code § 22757.10 et seq.).","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-sb-link-faif-2025-1"],"attributes":{"commitment":{"link":"complies_with"}}},{"id":"sb-link-ms-fgf-2026","statement":"Microsoft's Frontier Governance Framework (February 2026) explicitly references California's TFAIA in two places. Its change log describes the edition as a one-year update following finalisation of the EU GPAI Code of Practice, New York's RAISE Act and TFAIA. Its leading-indicator assessment is run on any model in scope for frontier-model requirements under applicable laws, and it names TFAIA among those laws.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-sb-link-ms-fgf-2026-1","evidence-sb-link-ms-fgf-2026-2"],"attributes":{"commitment":{"link":"responds_to"}}},{"id":"cm-link-rsp-2023-wh","statement":"Anthropic’s Responsible Scaling Policy v1.0 states that its ASL-2 deployment measures overlap substantially with the White House voluntary commitments that Anthropic and other companies made in July, which it says it continues to maintain.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-rsp-2023-wh-1"],"attributes":{"commitment":{"link":"names"}}},{"id":"cm-link-rsp-v2-0-wh","statement":"Anthropic’s Responsible Scaling Policy v2.0 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023).","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-rsp-v2-0-wh-1"],"attributes":{"commitment":{"scope":"helps satisfy","link":"fulfils"}}},{"id":"cm-link-rsp-v2-1-wh","statement":"Anthropic’s Responsible Scaling Policy v2.1 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023).","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-rsp-v2-1-wh-1"],"attributes":{"commitment":{"scope":"helps satisfy","link":"fulfils"}}},{"id":"cm-link-rsp-v2-2-wh","statement":"Anthropic’s Responsible Scaling Policy v2.2 states that the policy also helps satisfy Anthropic’s Voluntary White House Commitments (2023).","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-rsp-v2-2-wh-1"],"attributes":{"commitment":{"scope":"helps satisfy","link":"fulfils"}}},{"id":"cm-link-rsp-v2-0-seoul","statement":"Anthropic’s Responsible Scaling Policy v2.0 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024).","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-rsp-v2-0-seoul-1"],"attributes":{"commitment":{"scope":"helps satisfy","link":"fulfils"}}},{"id":"cm-link-rsp-v2-1-seoul","statement":"Anthropic’s Responsible Scaling Policy v2.1 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024).","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-rsp-v2-1-seoul-1"],"attributes":{"commitment":{"scope":"helps satisfy","link":"fulfils"}}},{"id":"cm-link-rsp-v2-2-seoul","statement":"Anthropic’s Responsible Scaling Policy v2.2 states that the policy also helps satisfy Anthropic’s Frontier AI Safety Commitments (2024).","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-rsp-v2-2-seoul-1"],"attributes":{"commitment":{"scope":"helps satisfy","link":"fulfils"}}},{"id":"cm-link-ms-fgf-2025-seoul","statement":"Microsoft’s Frontier Governance Framework, Version 1 (February 2025), states that the framework has its genesis in the voluntary Frontier AI Safety Commitments that Microsoft and fifteen other AI labs made in May 2024.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-ms-fgf-2025-seoul-1"],"attributes":{"commitment":{"link":"responds_to"}}},{"id":"cm-link-ms-fgf-2026-seoul","statement":"Microsoft’s Frontier Governance Framework, February 2026 edition, states that the framework has its genesis in the voluntary Frontier AI Safety Commitments that Microsoft and fifteen other AI labs made in May 2024.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-ms-fgf-2026-seoul-1"],"attributes":{"commitment":{"link":"responds_to"}}},{"id":"cm-link-meta-faf-v1-1-seoul","statement":"Meta’s Frontier AI Framework v1.1 opens its scope section by stating that, in line with the Frontier AI Safety Commitments, which it says Meta signed in May 2024, the framework relates to Meta’s forthcoming most advanced models and systems.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-meta-faf-v1-1-seoul-1"],"attributes":{"commitment":{"link":"responds_to"}}},{"id":"cm-link-frontier-governance-2026-eu-code","statement":"OpenAI’s Frontier Governance Framework (May 2026 edition) states that, under the EU General-Purpose AI Code of Practice, it serves as OpenAI’s publicly available summary of its Safety & Security Framework. It also lists, among the cases in which it will not consider an update of a Model Report necessary, a model considered similarly safe or safer under Appendix 2.2 of the Code of Practice.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-frontier-governance-2026-eu-code-1","evidence-cm-link-frontier-governance-2026-eu-code-2"],"attributes":{"commitment":{"scope":"as the publicly available summary of its Safety & Security Framework","link":"designated_under"}}},{"id":"cm-link-ms-fgf-2026-eu-code","statement":"Microsoft’s Frontier Governance Framework (February 2026) describes itself in its change log as a one-year update following finalisation of the EU Code of Practice for General Purpose AI, the New York RAISE Act and California’s Transparency in Frontier Artificial Intelligence Act.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-ms-fgf-2026-eu-code-1"],"attributes":{"commitment":{"link":"responds_to"}}},{"id":"cm-link-faif-2026-eu-code","statement":"xAI’s Frontier Artificial Intelligence Framework (effective 30 June 2026) attaches a footnote to its statement of four primary risk domains saying that it follows the Safety and Security chapter of the General-Purpose AI Code of Practice developed under the EU AI Act.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-cm-link-faif-2026-eu-code-1"],"attributes":{"commitment":{"scope":"Safety and Security chapter, for its four primary risk domains","link":"names"}}},{"id":"cmp-rsp-2023-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-2023-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-2023-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"partly"}}}},{"id":"cmp-rsp-2023-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"partly"}}}},{"id":"cmp-rsp-2023-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"partly"}}}},{"id":"cmp-rsp-2023-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"partly"}}}},{"id":"cmp-rsp-v2-0-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"partly"}}}},{"id":"cmp-rsp-v2-1-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"partly"}}}},{"id":"cmp-rsp-v2-2-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-fsf-2024-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"partly"}}}},{"id":"cmp-fsf-2024-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-fsf-2024-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination"}}}},{"id":"cmp-fsf-2024-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight"}}}},{"id":"cmp-fsf-2024-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor"}}}},{"id":"cmp-fsf-2024-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight"}}}},{"id":"cmp-fsf-v2-0-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight"}}}},{"id":"cmp-fsf-v3-0-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight"}}}},{"id":"cmp-fsf-v3-1-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor"}}}},{"id":"cmp-preparedness-beta-2023-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-preparedness-v2-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-preparedness-v2-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-preparedness-v2-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-preparedness-v2-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"stated"}}}},{"id":"cmp-preparedness-v2-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"stated"}}}},{"id":"cmp-preparedness-v2-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"partly"}}}},{"id":"cmp-frontier-governance-2026-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor"}}}},{"id":"cmp-frontier-governance-2026-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-faif-2025-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-faif-2025-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"partly"}}}},{"id":"cmp-faif-2025-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination"}}}},{"id":"cmp-faif-2025-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight"}}}},{"id":"cmp-faif-2025-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor"}}}},{"id":"cmp-faif-2025-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-faif-2026-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"partly"}}}},{"id":"cmp-faif-2026-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-faif-2026-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination"}}}},{"id":"cmp-faif-2026-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight"}}}},{"id":"cmp-faif-2026-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor"}}}},{"id":"cmp-faif-2026-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"partly"}}}},{"id":"cmp-meta-aasf-v2-0-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor"}}}},{"id":"cmp-meta-aasf-v2-0-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"partly"}}}},{"id":"cmp-ms-fgf-2025-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"partly"}}}},{"id":"cmp-ms-fgf-2025-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d3-halt","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-halt","facet":{"id":"D3.halt","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d4-determination","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-determination","facet":{"id":"D4.determination","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight","status":"partly"}}}},{"id":"cmp-ms-fgf-2026-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor","status":"partly"}}}},{"id":"cmp-ms-fgf-2026-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-rsp-2023-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-2023-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-rsp-2023-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-2023-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-rsp-2023-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"partly"}}}},{"id":"cmp-rsp-2023-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-2023-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-rsp-2023-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-rsp-2023-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-2023-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-2023-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"partly"}}}},{"id":"cmp-rsp-v2-0-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"partly"}}}},{"id":"cmp-rsp-v2-0-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v2-0-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"partly"}}}},{"id":"cmp-rsp-v2-1-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"partly"}}}},{"id":"cmp-rsp-v2-1-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v2-1-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"partly"}}}},{"id":"cmp-rsp-v2-2-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"partly"}}}},{"id":"cmp-rsp-v2-2-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v2-2-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber"}}}},{"id":"cmp-rsp-v3-0-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-rsp-v3-0-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-rsp-v3-0-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"partly"}}}},{"id":"cmp-rsp-v3-0-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v3-0-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber"}}}},{"id":"cmp-rsp-v3-1-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-rsp-v3-1-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-rsp-v3-1-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"partly"}}}},{"id":"cmp-rsp-v3-1-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v3-1-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber"}}}},{"id":"cmp-rsp-v3-2-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-rsp-v3-2-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-rsp-v3-2-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"partly"}}}},{"id":"cmp-rsp-v3-2-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v3-2-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber"}}}},{"id":"cmp-rsp-v3-3-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-rsp-v3-3-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-rsp-v3-3-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"partly"}}}},{"id":"cmp-rsp-v3-3-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v3-3-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber"}}}},{"id":"cmp-rsp-v3-4-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-rsp-v3-4-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-rsp-v3-4-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"partly"}}}},{"id":"cmp-rsp-v3-4-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-rsp-v3-4-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-fsf-2024-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-fsf-2024-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-fsf-2024-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-fsf-2024-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-fsf-2024-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"partly"}}}},{"id":"cmp-fsf-2024-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-fsf-2024-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-fsf-2024-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-fsf-2024-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal"}}}},{"id":"cmp-fsf-2024-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external"}}}},{"id":"cmp-fsf-2024-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-fsf-v2-0-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"partly"}}}},{"id":"cmp-fsf-v2-0-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-fsf-v2-0-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"partly"}}}},{"id":"cmp-fsf-v3-0-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-fsf-v3-0-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes"}}}},{"id":"cmp-fsf-v3-1-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"partly"}}}},{"id":"cmp-fsf-v3-1-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-fsf-v3-1-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"partly"}}}},{"id":"cmp-preparedness-beta-2023-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-preparedness-beta-2023-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external"}}}},{"id":"cmp-preparedness-beta-2023-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-preparedness-v2-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-preparedness-v2-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-preparedness-v2-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-preparedness-v2-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"partly"}}}},{"id":"cmp-preparedness-v2-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-preparedness-v2-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-preparedness-v2-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-preparedness-v2-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-preparedness-v2-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-preparedness-v2-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-preparedness-v2-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-preparedness-v2-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"partly"}}}},{"id":"cmp-frontier-governance-2026-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"partly"}}}},{"id":"cmp-frontier-governance-2026-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-frontier-governance-2026-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-faif-2025-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-faif-2025-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-faif-2025-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"partly"}}}},{"id":"cmp-faif-2025-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-faif-2025-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-faif-2025-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"partly"}}}},{"id":"cmp-faif-2025-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-faif-2025-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-faif-2025-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"partly"}}}},{"id":"cmp-faif-2025-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-faif-2025-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-faif-2026-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-faif-2026-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-faif-2026-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-faif-2026-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"stated"}}}},{"id":"cmp-faif-2026-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"partly"}}}},{"id":"cmp-faif-2026-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"partly"}}}},{"id":"cmp-faif-2026-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-faif-2026-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-faif-2026-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-faif-2026-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-faif-2026-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-faif-2026-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes"}}}},{"id":"cmp-meta-faf-v1-1-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-meta-aasf-v2-0-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-meta-aasf-v2-0-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-ms-fgf-2025-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other"}}}},{"id":"cmp-ms-fgf-2025-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-ms-fgf-2025-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-ms-fgf-2025-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d2-levels","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-levels","facet":{"id":"D2.levels","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d2-definition","attributes":{"provision":{"kind":"threshold","key":"comparison-d2-definition","facet":{"id":"D2.definition","status":"partly"}}}},{"id":"cmp-ms-fgf-2026-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"cmp-ms-fgf-2026-d8-changes","attributes":{"provision":{"kind":"revision","key":"comparison-d8-changes","facet":{"id":"D8.changes","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d1-cbrn","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cbrn","facet":{"id":"D1.cbrn","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d1-cyber","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-cyber","facet":{"id":"D1.cyber","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d1-autonomy","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-autonomy","facet":{"id":"D1.autonomy","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d1-persuasion","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-persuasion","facet":{"id":"D1.persuasion"}}}},{"id":"cmp-meta-faf-v1-1-d1-other","attributes":{"provision":{"kind":"risk_domain","key":"comparison-d1-other","facet":{"id":"D1.other"}}}},{"id":"cmp-meta-faf-v1-1-d3-safeguards","attributes":{"provision":{"kind":"required_action","key":"comparison-d3-safeguards","facet":{"id":"D3.safeguards","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d5-cadence","attributes":{"provision":{"kind":"evaluation_timing","key":"comparison-d5-cadence","facet":{"id":"D5.cadence","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d6-competitor","attributes":{"provision":{"kind":"exception","key":"comparison-d6-competitor","facet":{"id":"D6.competitor"}}}},{"id":"cmp-meta-faf-v1-1-d6-discretion","attributes":{"provision":{"kind":"exception","key":"comparison-d6-discretion","facet":{"id":"D6.discretion","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d7-internal","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-internal","facet":{"id":"D7.internal","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d4-oversight","attributes":{"provision":{"kind":"decision_authority","key":"comparison-d4-oversight","facet":{"id":"D4.oversight"}}}},{"id":"cmp-meta-faf-v1-1-d7-external","attributes":{"provision":{"kind":"reporting","key":"comparison-d7-external","facet":{"id":"D7.external","status":"stated"}}}},{"id":"cmp-meta-faf-v1-1-d8-process","attributes":{"provision":{"kind":"revision","key":"comparison-d8-process","facet":{"id":"D8.process","status":"stated"}}}},{"id":"fl-link-preparedness-beta-wh-2023-07","statement":"OpenAI’s Preparedness Framework (Beta) describes the framework as one more way in which OpenAI is meeting the voluntary commitments on safety, security and trust in AI that it made in July 2023.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fl-link-preparedness-beta-wh-2023-07-1"],"attributes":{"commitment":{"link":"fulfils"}}},{"id":"fl-link-ms-fgf-2026-eu-ai-act","statement":"Microsoft’s Frontier Governance Framework (February 2026) runs a leading indicator assessment on any model in scope for frontier model requirements under applicable laws, naming the EU AI Act among them.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fl-link-ms-fgf-2026-eu-ai-act-1"],"attributes":{"commitment":{"scope":"trigger for the leading indicator assessment","link":"names"}}},{"id":"fl-link-ms-fgf-2026-ny-raise","statement":"Microsoft’s Frontier Governance Framework (February 2026) names New York’s RAISE Act among the laws whose frontier model requirements trigger its leading indicator assessment, and its change log describes the edition as a one-year update following finalisation of the RAISE Act, among other texts.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fl-link-ms-fgf-2026-ny-raise-1","evidence-fl-link-ms-fgf-2026-ny-raise-2"],"attributes":{"commitment":{"link":"responds_to"}}},{"id":"fl-link-rsp-v3-1-sb53","statement":"Anthropic’s Responsible Scaling Policy v3.1 keeps the footnote saying that where laws such as California SB 53 define “catastrophic risk” or similar terms with specific thresholds, Anthropic addresses those requirements in separate compliance frameworks.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fl-link-rsp-v3-1-sb53-1"],"attributes":{"commitment":{"link":"names"}}},{"id":"fl-link-rsp-v3-2-sb53","statement":"Anthropic’s Responsible Scaling Policy v3.2 keeps the footnote saying that where laws such as California SB 53 define “catastrophic risk” or similar terms with specific thresholds, Anthropic addresses those requirements in separate compliance frameworks.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fl-link-rsp-v3-2-sb53-1"],"attributes":{"commitment":{"link":"names"}}},{"id":"fl-link-rsp-v3-3-sb53","statement":"Anthropic’s Responsible Scaling Policy v3.3 keeps the footnote saying that where laws such as California SB 53 define “catastrophic risk” or similar terms with specific thresholds, Anthropic addresses those requirements in separate compliance frameworks.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fl-link-rsp-v3-3-sb53-1"],"attributes":{"commitment":{"link":"names"}}},{"id":"fl-link-fgf-2026-eu-ai-act","statement":"OpenAI’s Frontier Governance Framework (May 2026 edition) states that it covers frontier models as defined under California’s TFAIA and general-purpose models with systemic risk under the EU AI Act.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fl-link-fgf-2026-eu-ai-act-1","evidence-fl-link-fgf-2026-eu-ai-act-2","evidence-fl-link-fgf-2026-eu-ai-act-3","evidence-fl-link-fgf-2026-eu-ai-act-4"],"attributes":{"commitment":{"scope":"scope of covered models","link":"names"}}},{"id":"fl-link-rsp-v3-4-sb53","statement":"Anthropic’s Responsible Scaling Policy v3.4 keeps the footnote saying that where laws such as California SB 53 define “catastrophic risk” or similar terms with specific thresholds, Anthropic addresses those requirements in separate compliance frameworks.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-fl-link-rsp-v3-4-sb53-1"],"attributes":{"commitment":{"link":"names"}}},{"id":"ab-fw-rsp-2023-asl2-bio-information-level","statement":"RSP v1.0 illustrates its ASL-2 level with an AI system that can provide bioweapon-related information that could not be found via a search engine, but does so too unreliably to be useful in practice.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-2023-asl2-bio-information-level-1"],"attributes":{"provision":{"kind":"threshold","key":"rsp-asl2-bio-information-level"}}},{"id":"ab-fw-rsp-2023-asl3-redteam-cbrn-domains","statement":"RSP v1.0 states that the misuse domains covered by its ASL-3 deployment red-teaming measure should at a minimum include causes of extreme CBRN risks, and cybersecurity.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-2023-asl3-redteam-cbrn-domains-1"],"attributes":{"provision":{"kind":"required_action","key":"rsp-asl3-redteam-domains"}}},{"id":"ab-fw-rsp-2023-asl4-anticipated-misuse-level","statement":"RSP v1.0 states, as an early guess at what ASL-4 will involve, a critical catastrophic misuse risk in which AI models have become the primary source of national security risk in a major area such as cyberattacks or biological weapons, rather than a significant contributor.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-2023-asl4-anticipated-misuse-level-1"],"attributes":{"provision":{"kind":"threshold","key":"rsp-asl4-anticipated-misuse-level"}}},{"id":"ab-fw-rsp-2023-bio-evaluation-first-area","statement":"RSP v1.0 states that Anthropic’s first area of effort is evaluating bioweapons risks, for which it will determine threat models and capabilities in consultation with a number of world-class biosecurity experts.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-2023-bio-evaluation-first-area-1"],"attributes":{"provision":{"kind":"evaluation_timing","key":"rsp-bio-evaluation-development"}}},{"id":"ab-fw-pf-beta-cbrn-category-definition","statement":"The Preparedness Framework (Beta) defines its CBRN tracked risk category as focused on risks related to model-assisted creation of chemical, biological, radiological and/or nuclear threats.","resolution":"supported","evidenceIds":["evidence-ab-fw-pf-beta-cbrn-category-definition-1"],"attributes":{"provision":{"kind":"risk_domain","key":"pf-cbrn-category-definition"}}},{"id":"ab-fw-fsf-2024-bio-amateur-enablement-level-1","statement":"The Frontier Safety Framework v1.0 states a Critical Capability Level named “Bio amateur enablement level 1”: capable of significantly enabling a non-expert to develop known biothreats that could increase their ability to cause severe harm compared to other means.","resolution":"supported","evidenceIds":["evidence-ab-fw-fsf-2024-bio-amateur-enablement-level-1-1"],"attributes":{"provision":{"kind":"threshold","key":"fsf-bio-amateur-enablement-1"}}},{"id":"ab-fw-fsf-2024-bio-expert-enablement-level-1","statement":"The Frontier Safety Framework v1.0 states a Critical Capability Level named “Bio expert enablement level 1”: capable of significantly enabling an expert, which it glosses as PhD or above, to develop novel biothreats that could result in an incident of high severity.","resolution":"supported","evidenceIds":["evidence-ab-fw-fsf-2024-bio-expert-enablement-level-1-1"],"attributes":{"provision":{"kind":"threshold","key":"fsf-bio-expert-enablement-1"}}},{"id":"ab-fw-fsf-2024-biosecurity-domain-definition","statement":"The Frontier Safety Framework v1.0 defines its Biosecurity risk domain as risks of models assisting in the development, preparation and/or execution of a biological attack.","resolution":"supported","evidenceIds":["evidence-ab-fw-fsf-2024-biosecurity-domain-definition-1"],"attributes":{"provision":{"kind":"risk_domain","key":"fsf-biosecurity-domain-definition"}}},{"id":"ab-fw-rsp-v2-0-cbrn-assessment-baseline","statement":"RSP v2.0 states that it assesses its CBRN weapons Capability Threshold by comparing what potential attackers could achieve with full model access against 2023-level online resources, assuming funding and up to one year of time to invest but no initial specialised expertise.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-v2-0-cbrn-assessment-baseline-1"],"attributes":{"provision":{"kind":"threshold","key":"rsp-cbrn-assessment-baseline"}}},{"id":"ab-fw-rsp-v2-0-cbrn-capabilities-list-sharing","statement":"RSP v2.0 states that Anthropic maintains a current list of specific CBRN capabilities of concern for which it would implement stronger mitigations, treats these lists as sensitive, and plans to share them with organisations such as AI Safety Institutes and the Frontier Model Forum.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-v2-0-cbrn-capabilities-list-sharing-1"],"attributes":{"provision":{"kind":"reporting","key":"rsp-cbrn-capabilities-list-sharing"}}},{"id":"ab-fw-rsp-v2-0-cbrn-required-safeguards","statement":"RSP v2.0 states that the Required Safeguards for its CBRN weapons Capability Threshold are the ASL-3 Deployment Standard and the ASL-3 Security Standard, which it describes as protecting against misuse and model-weight theft by non-state adversaries.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-v2-0-cbrn-required-safeguards-1"],"attributes":{"provision":{"kind":"required_action","key":"rsp-cbrn-required-safeguards"}}},{"id":"ab-fw-fsf-v2-0-cbrn-domain-definition","statement":"The Frontier Safety Framework v2.0 defines its CBRN risk domain as risks of models assisting in the development, preparation and/or execution of a chemical, biological, radiological or nuclear attack.","resolution":"supported","evidenceIds":["evidence-ab-fw-fsf-v2-0-cbrn-domain-definition-1"],"attributes":{"provision":{"kind":"risk_domain","key":"fsf-cbrn-domain-definition"}}},{"id":"ab-fw-fsf-v2-0-cbrn-uplift-1-security-level","statement":"The Frontier Safety Framework v2.0 recommends, for its CBRN uplift 1 Critical Capability Level, security controls and detections at a level generally aligned with RAND SL 2.","resolution":"supported","evidenceIds":["evidence-ab-fw-fsf-v2-0-cbrn-uplift-1-security-level-1"],"attributes":{"provision":{"kind":"required_action","key":"fsf-cbrn-uplift-1-security-level"}}},{"id":"ab-fw-fsf-v2-0-cbrn-uplift-1-threshold","statement":"The Frontier Safety Framework v2.0 states a misuse Critical Capability Level named “CBRN uplift 1”: can be used to significantly assist a low-resourced actor with dual-use scientific protocols, resulting in a substantial increase in ability to cause a mass casualty event.","resolution":"supported","evidenceIds":["evidence-ab-fw-fsf-v2-0-cbrn-uplift-1-threshold-1"],"attributes":{"provision":{"kind":"threshold","key":"fsf-cbrn-uplift-1-threshold"}}},{"id":"ab-fw-fsf-v2-0-replaces-biosecurity-levels-with-cbrn-uplift","statement":"Where the Frontier Safety Framework v1.0 set two Critical Capability Levels in a Biosecurity risk domain, one for enabling a non-expert and one for enabling an expert, v2.0 sets a single level, CBRN uplift 1, in a combined chemical, biological, radiological and nuclear risk domain.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-ab-fw-fsf-v2-0-replaces-biosecurity-levels-with-cbrn-uplift-1","evidence-ab-fw-fsf-v2-0-replaces-biosecurity-levels-with-cbrn-uplift-2"],"attributes":{"changeBasis":"document_comparison"}},{"id":"ab-fw-ms-fgf-2025-cbrn-critical-threshold","statement":"The Frontier Governance Framework of February 2025 defines the Critical CBRN risk level as a model providing a meaningful uplift to an expert’s ability to develop a highly dangerous novel threat, or significantly lowering the barriers to a low-skilled actor developing and delivering a known CBRN threat, and states that further review and mitigations are required at that level.","resolution":"supported","evidenceIds":["evidence-ab-fw-ms-fgf-2025-cbrn-critical-threshold-1","evidence-ab-fw-ms-fgf-2025-cbrn-critical-threshold-2"],"attributes":{"provision":{"kind":"threshold","key":"msfgf-cbrn-critical-threshold"}}},{"id":"ab-fw-ms-fgf-2025-cbrn-medium-threshold","statement":"The Frontier Governance Framework of February 2025 defines the Medium CBRN risk level as a model providing some assistance increasing the ability of an existing expert, which it glosses as PhD level education in related fields, to develop a known CBRN threat, and allows deployment at that level in line with Microsoft’s Responsible AI Program requirements.","resolution":"supported","evidenceIds":["evidence-ab-fw-ms-fgf-2025-cbrn-medium-threshold-1"],"attributes":{"provision":{"kind":"threshold","key":"msfgf-cbrn-medium-threshold"}}},{"id":"ab-fw-ms-fgf-2025-leading-indicator-direction","statement":"The Frontier Governance Framework of February 2025 states that, as evaluations mature, Microsoft intends to move its leading-indicator screening towards a more direct assessment of tracked capabilities such as CBRN weapon development, offensive cyberoperations and advanced autonomy.","resolution":"supported","evidenceIds":["evidence-ab-fw-ms-fgf-2025-leading-indicator-direction-1"],"attributes":{"provision":{"kind":"evaluation_timing","key":"msfgf-leading-indicator-direction"}}},{"id":"ab-fw-rsp-v2-1-adds-cbrn-development-threshold","statement":"The RSP v2.1 change log states that the update adds a new capability threshold related to CBRN development, defining capabilities that could substantially uplift the development capabilities of moderately resourced state programs.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-ab-fw-rsp-v2-1-adds-cbrn-development-threshold-1"],"attributes":{"changeBasis":"changelog"}},{"id":"ab-fw-rsp-v2-1-cbrn-4-expected-safeguards","statement":"RSP v2.1 states that it expects the CBRN-4 threshold to require the ASL-4 Deployment and Security Standards, and that it plans to add more information about what those entail in a future update.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-v2-1-cbrn-4-expected-safeguards-1"],"attributes":{"provision":{"kind":"required_action","key":"rsp-cbrn-4-expected-safeguards"}}},{"id":"ab-fw-rsp-v2-1-cbrn-4-threshold","statement":"RSP v2.1 states a CBRN-4 Capability Threshold: the ability to substantially uplift the CBRN development capabilities of moderately resourced state programs with relevant expert teams, such as by novel weapons design, substantially accelerating existing processes, or dramatically reducing technical barriers.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-v2-1-cbrn-4-threshold-1"],"attributes":{"provision":{"kind":"threshold","key":"rsp-cbrn-4-threshold"}}},{"id":"ab-fw-pf-2-bio-chem-category-definition","statement":"The Preparedness Framework Version 2 describes its Biological and Chemical tracked category as capabilities that, in addition to unlocking discoveries and cures, can also reduce barriers to creating and using biological or chemical weapons.","resolution":"supported","evidenceIds":["evidence-ab-fw-pf-2-bio-chem-category-definition-1"],"attributes":{"provision":{"kind":"risk_domain","key":"pf-bio-chem-category-definition"}}},{"id":"ab-fw-pf-2-bio-evaluation-object","statement":"The Preparedness Framework Version 2 states that, to assess the degree to which a covered system can reduce the barriers to creating a biological weapon, its current evaluations test both how capable the system is at providing useful information and how capable it is of directly integrating with relevant tools.","resolution":"supported","evidenceIds":["evidence-ab-fw-pf-2-bio-evaluation-object-1"],"attributes":{"provision":{"kind":"evaluation_timing","key":"pf-bio-evaluation-object"}}},{"id":"ab-fw-pf-2-bio-evaluation-priority","statement":"The Preparedness Framework Version 2 states that OpenAI will build safeguards against both biological and chemical threats and, given the higher potential severity of biological threats, will prioritise biological capability evaluations, which will be used as indicators for the High and Critical capabilities of the category.","resolution":"supported","evidenceIds":["evidence-ab-fw-pf-2-bio-evaluation-priority-1"],"attributes":{"provision":{"kind":"evaluation_timing","key":"pf-bio-evaluation-priority"}}},{"id":"ab-fw-pf-2-independent-biological-risk-expertise","statement":"The Preparedness Framework Version 2 states that OpenAI’s Safety Advisory Group may obtain independent expert opinion on the evidence produced to it, to add independent analysis from individuals or organisations with deep expertise in domains of relevant risks, biological risk among its examples.","resolution":"supported","evidenceIds":["evidence-ab-fw-pf-2-independent-biological-risk-expertise-1"],"attributes":{"provision":{"kind":"decision_authority","key":"pf-sag-independent-expert-opinion"}}},{"id":"ab-fw-rsp-v2-2-cbrn-3-threat-model-rationale","statement":"The RSP v2.2 change log gives, as one of the two reasons it states for excluding sophisticated and state-compromised insiders from the ASL-3 Security Standard, that the CBRN-3 threat models entail large numbers of users having access to unguarded models, which it says is more likely to occur through a universal jailbreak than via model theft.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-ab-fw-rsp-v2-2-cbrn-3-threat-model-rationale-1","evidence-ab-fw-rsp-v2-2-cbrn-3-threat-model-rationale-2"],"attributes":{"changeBasis":"changelog"}},{"id":"ab-fw-fsf-v3-0-cbrn-domain-attack-to-threat","statement":"The Frontier Safety Framework v3.0 defines its CBRN risk domain as risks of models assisting in the development, preparation and/or execution of a CBRN threat, where v2.0 defined the same domain as risks of assisting in a CBRN attack.","derivation":"inferred","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-ab-fw-fsf-v3-0-cbrn-domain-attack-to-threat-1","evidence-ab-fw-fsf-v3-0-cbrn-domain-attack-to-threat-2"],"attributes":{"changeBasis":"document_comparison"}},{"id":"ab-fw-faif-2025-bio-chem-critical-steps","statement":"The Frontier Artificial Intelligence Framework of December 2025 states that, in the setting of biological and chemical weapons, xAI considers critical steps where it restricts its models from providing detailed information or substantial assistance.","resolution":"supported","evidenceIds":["evidence-ab-fw-faif-2025-bio-chem-critical-steps-1"],"attributes":{"provision":{"kind":"required_action","key":"faif-bio-chem-critical-steps"}}},{"id":"ab-fw-faif-2025-cbrn-barrier-recognition","statement":"The Frontier Artificial Intelligence Framework of December 2025 states that, without any safeguards, xAI recognises that advanced AI models could lower the barrier to entry for bad actors seeking to develop CBRN or cyber weapons and could help automate knowledge compilation to overcome bottlenecks to weapons development.","resolution":"supported","evidenceIds":["evidence-ab-fw-faif-2025-cbrn-barrier-recognition-1"],"attributes":{"provision":{"kind":"risk_domain","key":"faif-cbrn-barrier-recognition"}}},{"id":"ab-fw-faif-2025-heightened-safeguards","statement":"The Frontier Artificial Intelligence Framework of December 2025 states that xAI’s models apply heightened safeguards if they receive user prompts posing a foreseeable and non-trivial risk of resulting in large-scale violence, terrorism, or the use, development or proliferation of weapons of mass destruction, including CBRN weapons, and major cyber attacks on critical infrastructure.","resolution":"supported","evidenceIds":["evidence-ab-fw-faif-2025-heightened-safeguards-1"],"attributes":{"provision":{"kind":"required_action","key":"faif-heightened-safeguards"}}},{"id":"ab-fw-faif-2025-vetted-user-exception","statement":"The Frontier Artificial Intelligence Framework of December 2025 states that xAI may selectively allow its models to respond to requests that heightened safeguards would otherwise restrict, where the requester is among some vetted, highly trusted users known to be using those capabilities for benign or beneficial purposes.","resolution":"supported","evidenceIds":["evidence-ab-fw-faif-2025-vetted-user-exception-1"],"attributes":{"provision":{"kind":"exception","key":"faif-vetted-user-exception"}}},{"id":"ab-fw-rsp-v3-0-novel-cb-threat-pathway-sharing","statement":"RSP v3.0 states that, for its novel chemical/biological weapons production threshold, Anthropic will identify the most concerning specific threat pathways, create policy recommendations for early detection and response, and share this content with policymakers.","resolution":"supported","evidenceIds":["evidence-ab-fw-rsp-v3-0-novel-cb-threat-pathway-sharing-1"],"attributes":{"provision":{"kind":"reporting","key":"rsp-novel-cb-threat-pathway-sharing"}}},{"id":"ab-fw-ms-fgf-2026-changelog-no-cbrn-entry","statement":"No passage recording a change to the CBRN weapons capability thresholds was found in the change log of the Frontier Governance Framework of February 2026 within the inspected scope.","resolution":"supported","evidenceIds":["evidence-ab-fw-ms-fgf-2026-changelog-no-cbrn-entry-1"],"attributes":{"provision":{"kind":"revision","key":"msfgf-changelog-cbrn-entry"}}},{"id":"ab-fw-fsf-v3-1-cbrn-security-level-2-plus","statement":"The Frontier Safety Framework v3.1 change notes state that the update raises the recommended level of security for the CBRN, Cyber and Harmful Manipulation Critical Capability Levels to Security Level 2+.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-ab-fw-fsf-v3-1-cbrn-security-level-2-plus-1","evidence-ab-fw-fsf-v3-1-cbrn-security-level-2-plus-2"],"attributes":{"changeBasis":"changelog"}},{"id":"ab-fw-fsf-v3-1-cbrn-uplift-tcl","statement":"The Frontier Safety Framework v3.1 states a CBRN Tracked Capability Level: providing low to medium resourced actors uplift in reference scenarios, resulting in material risk of CBRN attacks that could result in significant but not severe harm.","resolution":"supported","evidenceIds":["evidence-ab-fw-fsf-v3-1-cbrn-uplift-tcl-1"],"attributes":{"provision":{"kind":"threshold","key":"fsf-cbrn-uplift-tcl"}}},{"id":"ab-fw-rsp-v3-3-revises-novel-cb-threshold-and-off-cycle","statement":"The RSP v3.3 change log states that the update revises Anthropic’s threshold for novel chemical/biological weapons production to better track the threat model of concern, and refines its approach to off-cycle updates regarding the risks of individual models.","derivation":"explicit","resolution":"supported","editorialState":"seed","evidenceIds":["evidence-ab-fw-rsp-v3-3-revises-novel-cb-threshold-and-off-cycle-1"],"attributes":{"changeBasis":"changelog"}},{"id":"ab-fw-meta-faf-v1-1-cb-risk-process","statement":"Frontier AI Framework v1.1 states that chemical and biological risks are within its scope, that red teaming is conducted when relevant capability levels are reached, with external experts where appropriate, and that a release decision is taken on the residual risk left after evaluations and mitigations, with leadership able to require further testing, information or mitigation first.","resolution":"supported","evidenceIds":["evidence-ab-fw-meta-faf-v1-1-cb-risk-process-1"],"attributes":{"provision":{"kind":"statement","key":"meta-faf-v1-1-cb-risk-process"}}},{"id":"ab-fw-meta-aasf-v2-0-cb-assessment-methods","statement":"Advanced AI Scaling Framework v2 states that catastrophic chemical and biological risk is within its scope and that its assessments may combine automated evaluations, red teaming and human studies, assessing both hazardous capability and refusal.","resolution":"supported","evidenceIds":["evidence-ab-fw-meta-aasf-v2-0-cb-assessment-methods-1"],"attributes":{"provision":{"kind":"statement","key":"meta-aasf-v2-0-cb-assessment-methods"}}},{"id":"ab-fw-faif-2026-cbrn-safeguard-assessment","statement":"The June 2026 Frontier Artificial Intelligence Framework states that CBRN risks are one of its named risk domains, that it applies refusal safeguards against malicious use and continues to assess how robust those safeguards are, and that public and internal benchmarks may be used to measure dual-use capability and resistance to facilitation.","resolution":"supported","evidenceIds":["evidence-ab-fw-faif-2026-cbrn-safeguard-assessment-1"],"attributes":{"provision":{"kind":"statement","key":"faif-2026-cbrn-safeguard-assessment"}}}],"sources":[{"id":"source-pf-v2-update","authors":["OpenAI"],"publisher":"OpenAI"},{"id":"source-rsp-1-0","title":"Responsible Scaling Policy — v1.0","versionDate":"2023-09-19","evidenceUrl":"https://www-cdn.anthropic.com/1adf000c8f675958c2ee23805d91aaade1cd4613/responsible-scaling-policy.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20230919161730/https://www-files.anthropic.com/production/files/responsible-scaling-policy-1.0.pdf","archivedAt":"2023-09-19","accessedAt":"2026-09-18"},{"id":"source-rsp-2-0","title":"Responsible Scaling Policy — v2.0","versionDate":"2024-10-15","evidenceUrl":"https://www-cdn.anthropic.com/616dee633636e5bd309cb73aed8622e80fe47839.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20241022154907/https://assets.anthropic.com/m/24a47b00f10301cd/original/Anthropic-Responsible-Scaling-Policy-2024-10-15.pdf","archivedAt":"2024-10-22","accessedAt":"2026-09-18"},{"id":"source-rsp-2-1","title":"Responsible Scaling Policy — v2.1","versionDate":"2025-03-31","evidenceUrl":"https://www-cdn.anthropic.com/17310f6d70ae5627f55313ed067afc1a762a4068.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20250402134435/https://www-cdn.anthropic.com/17310f6d70ae5627f55313ed067afc1a762a4068.pdf","archivedAt":"2025-04-02","accessedAt":"2026-09-18"},{"id":"source-rsp-2-2","title":"Responsible Scaling Policy — v2.2","versionDate":"2025-05-14","evidenceUrl":"https://www-cdn.anthropic.com/872c653b2d0501d6ab44cf87f43e1dc4853e4d37.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20250514223759/https://www-cdn.anthropic.com/872c653b2d0501d6ab44cf87f43e1dc4853e4d37.pdf","archivedAt":"2025-05-14","accessedAt":"2026-09-18"},{"id":"source-rsp-3-0","title":"Responsible Scaling Policy — v3.0","versionDate":"2026-02-24","evidenceUrl":"https://anthropic.com/responsible-scaling-policy/rsp-v3-0","language":"en","archivedUrl":"https://web.archive.org/web/20260224203046/https://www.anthropic.com/responsible-scaling-policy/rsp-v3-0","archivedAt":"2026-02-24","accessedAt":"2026-09-18"},{"id":"source-rsp-3-1","title":"Responsible Scaling Policy — v3.1","versionDate":"2026-04-02","evidenceUrl":"https://www-cdn.anthropic.com/files/4zrzovbb/website/bf04581e4f329735fd90634f6a1962c13c0bd351.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260407193305/https://www-cdn.anthropic.com/files/4zrzovbb/website/bf04581e4f329735fd90634f6a1962c13c0bd351.pdf","archivedAt":"2026-04-07","accessedAt":"2026-09-18"},{"id":"source-rsp-3-2","title":"Responsible Scaling Policy — v3.2","versionDate":"2026-04-29","evidenceUrl":"https://cdn.sanity.io/files/4zrzovbb/website/28c6241900d90410628a8a2003a5572faae4365a.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260505141510/https://cdn.sanity.io/files/4zrzovbb/website/28c6241900d90410628a8a2003a5572faae4365a.pdf","archivedAt":"2026-05-05","accessedAt":"2026-09-18"},{"id":"source-rsp-3-3","title":"Responsible Scaling Policy — v3.3","versionDate":"2026-05-26","evidenceUrl":"https://cdn.sanity.io/files/4zrzovbb/website/c11e84981d0a7281a1b229f3fa6af0da66eaf43f.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260528170023/https://cdn.sanity.io/files/4zrzovbb/website/c11e84981d0a7281a1b229f3fa6af0da66eaf43f.pdf","archivedAt":"2026-05-28","accessedAt":"2026-09-18"},{"id":"source-rsp-3-4","title":"Responsible Scaling Policy — v3.4","versionDate":"2026-07-08","evidenceUrl":"https://cdn.sanity.io/files/4zrzovbb/website/0bacdc8440ea96e62a8766d99ebe1d4eea6d5f3a.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260710234036/https://cdn.sanity.io/files/4zrzovbb/website/0bacdc8440ea96e62a8766d99ebe1d4eea6d5f3a.pdf","archivedAt":"2026-07-10","accessedAt":"2026-09-18"},{"id":"source-fsf-1-0","title":"Frontier Safety Framework — v1.0","versionDate":"2024-05-17","evidenceUrl":"https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/introducing-the-frontier-safety-framework/fsf-technical-report.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20240517140902/https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/introducing-the-frontier-safety-framework/fsf-technical-report.pdf","archivedAt":"2024-05-17","accessedAt":"2026-09-18"},{"id":"source-fsf-2-0","title":"Frontier Safety Framework — v2.0","versionDate":"2025-02-04","evidenceUrl":"https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/updating-the-frontier-safety-framework/Frontier%20Safety%20Framework%202.0.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20250205011727/https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/updating-the-frontier-safety-framework/Frontier%20Safety%20Framework%202.0.pdf","archivedAt":"2025-02-05","accessedAt":"2026-09-18"},{"id":"source-fsf-3-0","title":"Frontier Safety Framework — v3.0","versionDate":"2025-09-22","evidenceUrl":"https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20250922134959/https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3.pdf","archivedAt":"2025-09-22","accessedAt":"2026-09-18"},{"id":"source-fsf-3-1","title":"Frontier Safety Framework — v3.1","versionDate":"2026-04-17","evidenceUrl":"https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260423021420/https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdf","archivedAt":"2026-04-23","accessedAt":"2026-09-18"},{"id":"source-pf-beta","title":"Preparedness Framework — Beta","versionDate":"2023-12-18","evidenceUrl":"https://cdn.openai.com/openai-preparedness-framework-beta.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20231218195930/https://cdn.openai.com/openai-preparedness-framework-beta.pdf","archivedAt":"2023-12-18","accessedAt":"2026-09-18"},{"id":"source-pf-2","title":"Preparedness Framework — Version 2","versionDate":"2025-04-15","evidenceUrl":"https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20250415191354/https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf","archivedAt":"2025-04-15","accessedAt":"2026-09-18"},{"id":"source-fgf-2026","title":"Frontier Governance Framework — May 2026 edition","versionDate":"2026-05-28","evidenceUrl":"https://cdn.openai.com/pdf/e37d949b-8c9f-4d76-b99e-4272f4631a7e/openai-frontier-governance-framework.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260529171758/https://cdn.openai.com/pdf/e37d949b-8c9f-4d76-b99e-4272f4631a7e/openai-frontier-governance-framework.pdf","archivedAt":"2026-05-29","accessedAt":"2026-09-18"},{"id":"source-faif-2025","title":"Frontier Artificial Intelligence Framework — December 2025 edition","versionDate":"2025-12-30","evidenceUrl":"https://data.x.ai/2025-12-31-xai-frontier-artificial-intelligence-framework.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260102171656/https://data.x.ai/2025-12-31-xai-frontier-artificial-intelligence-framework.pdf","archivedAt":"2026-01-02","accessedAt":"2026-09-18"},{"id":"source-faif-2026","title":"Frontier Artificial Intelligence Framework — June 2026 edition","versionDate":"2026-06-30","evidenceUrl":"https://media.x.ai/v1/website/xai-frontier-artificial-intelligence-framework-30-june-2026-99c40684.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260716003429/https://media.x.ai/v1/website/xai-frontier-artificial-intelligence-framework-30-june-2026-99c40684.pdf","archivedAt":"2026-07-16","accessedAt":"2026-09-18"},{"id":"source-meta-faf-v1-1","title":"Frontier AI Framework — Version 1.1","versionDate":"2025-02-03","evidenceUrl":"https://web.archive.org/web/20250213105620/https://ai.meta.com/static-resource/meta-frontier-ai-framework/","language":"en","archivedUrl":"https://web.archive.org/web/20250213105620/https://ai.meta.com/static-resource/meta-frontier-ai-framework/","archivedAt":"2025-02-13","accessedAt":"2026-10-03"},{"id":"source-meta-faf-v1-1-revised","title":"Frontier AI Framework — Version 1.1 (revised expression)","publicationDate":null,"evidenceUrl":"https://web.archive.org/web/20250328093937/https://ai.meta.com/static-resource/meta-frontier-ai-framework/","language":"en","archivedUrl":"https://web.archive.org/web/20250328093937/https://ai.meta.com/static-resource/meta-frontier-ai-framework/","archivedAt":"2025-03-28","accessedAt":"2026-10-03"},{"id":"source-meta-aasf-v2","title":"Advanced AI Scaling Framework — Version 2","versionDate":"2026-04-07","evidenceUrl":"https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2","language":"en","archivedUrl":"https://web.archive.org/web/20260408163104/https://ai.meta.com/static-resource/Meta_Advanced-AI-Scaling-Framework-v2","archivedAt":"2026-04-08","accessedAt":"2026-10-03"},{"id":"source-ms-fgf-2025","title":"Frontier Governance Framework — Version 1 (February 2025)","versionDate":"2025-02-08","evidenceUrl":"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft-Frontier-Governance-Framework.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20250226161803/https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft-Frontier-Governance-Framework.pdf","archivedAt":"2025-02-26","accessedAt":"2026-10-03"},{"id":"source-ms-fgf-2026","title":"Frontier Governance Framework — February 2026","versionDate":"2026-02","evidenceUrl":"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Frontier-Governance-Framework-Feb-2026.pdf","language":"en","archivedUrl":"https://web.archive.org/web/20260424000716/https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Frontier-Governance-Framework-Feb-2026.pdf","archivedAt":"2026-04-24","accessedAt":"2026-10-03"},{"id":"source-coggins-pf-v2","authors":["Sam Coggins","Alexander K. Saeri","Katherine A. Daniell","Lorenn P. Ruster","Jessie Liu","Jenny L. Davis"],"publisher":"arXiv"},{"id":"source-openai-chatgpt-agent-system-card","authors":["OpenAI"],"publisher":"OpenAI"}],"evidence":[{"id":"evidence-rsp-credits-arc-2023","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-credits-arc-2023-timing","support":"context","verification":"machine_checked"},{"id":"evidence-fgf-applies-preparedness","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v2-asl-meaning","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v2-1-rd-thresholds","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v2-2-insider-scope","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v3-roadmaps","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v3-risk-reports","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v3-2-reviewer-approval","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v3-4-internal-reports","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v3-4-coverage-date","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-fsf-v2-security-levels","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-fsf-v3-harmful-manipulation","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-fsf-v3-1-cbrn-tcls","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-pf-v2-threshold-terms","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-pf-v2-research-categories","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-pf-v2-persuasion-scope","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-faif-2026-compliance-sentence","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-faif-2026-compliance-sentence-2","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v3-company-industry-split","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-eval-i-rsp-christiano-credit","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v2-0-assessed-weakening-saferai","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v2-0-assessed-weakening-anthropic","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-time","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-kaplan","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-govai-concern","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-govai-future","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-govai-balance","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-govai-mitigations","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-anthropic","support":"context","verification":"machine_checked"},{"id":"evidence-prov-rsp-2023-misuse-uplift-threshold","support":"supports","locator":"PDF p. 6 (printed p. 6), section 'ASL-3 Commitments', subsection 'ASL-3 Capabilities and Threat Models', numbered item 1 ('Capabilities that significantly increase risk of misuse catastrophe'), first and second sentences","passage":"Access to the model would substantially increase the risk of deliberately-caused catastrophic harm, either by proliferating capabilities, lowering costs, or enabling new methods of attack. This increase in risk is measured relative to today’s baseline level of risk that comes from e.g. access to search engines and textbooks.","passageType":"quote"},{"id":"evidence-prov-rsp-2023-no-train-deploy-without-safeguards","support":"supports","locator":"PDF p. 2 (printed p. 2), section 'Framework', paragraph beginning 'Complying with higher ASLs', second sentence","passage":"Anthropic’s commitment to follow the ASL scheme thus implies that we commit to pause the scaling2 and/or delay the deployment of new models whenever our scaling ability outstrips our ability to comply with the safety procedures for the corresponding ASL.","passageType":"quote"},{"id":"evidence-prov-rsp-2023-policy-change-approval","support":"supports","locator":"PDF p. 10 (printed p. 10), section 'Procedural Commitments', numbered item 1, first sentence","passage":"Follow an \"Update Process\" for this document, including approval by the board of directors, following consultation with the Long-Term Benefit Trust (LTBT).","passageType":"quote"},{"id":"evidence-prov-rsp-2023-trusted-user-access","support":"supports","locator":"PDF p. 9 (printed p. 9), section 'ASL-3 Commitments', subsection 'ASL-3 Deployment Measures', bullet 'Tiered access', first sentence","passage":"In limited cases, models with capabilities relevant to catastrophic harm may be made available to a select group of vetted users with a legitimate and beneficial use-case that cannot be separated from dangerous capabilities, and only if such access can be granted safely and with sufficient oversight.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-misuse-uplift-threshold","support":"supports","locator":"PDF p. 7 (printed p. 3), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', Capability Thresholds column","passage":"The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-no-train-deploy-without-safeguards","support":"supports","locator":"PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentence","passage":"In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-ceo-rso-decision-board-ltbt-informed","support":"supports","locator":"PDF p. 13 (printed p. 9), §4.3 Safeguards Decision, fourth bullet","passage":"If the CEO and RSO decide to proceed with deployment and training, they will share their decision–as well as the underlying Capability Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-1-misuse-uplift-threshold","support":"supports","locator":"PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds column","passage":"The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-1-no-train-deploy-without-safeguards","support":"supports","locator":"PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentence","passage":"In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-1-ceo-rso-decision-board-ltbt-informed","support":"supports","locator":"PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, item 4","passage":"If the CEO and RSO decide to proceed with deployment and training, they will share their decision–as well as the underlying Safeguards Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-2-misuse-uplift-threshold","support":"supports","locator":"PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row 'Chemical, Biological, Radiological, and Nuclear (CBRN) weapons', entry 'CBRN-3', Capability Thresholds column","passage":"The ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy CBRN weapons.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-2-no-train-deploy-without-safeguards","support":"supports","locator":"PDF p. 2 (unnumbered), Executive Summary, first paragraph, first sentence","passage":"In September 2023, we released our Responsible Scaling Policy (RSP), a public commitment not to train or deploy models capable of causing catastrophic harm unless we have implemented safety and security measures that will keep risks below acceptable levels.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-2-ceo-rso-decision-board-ltbt-informed","support":"supports","locator":"PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, item 4","passage":"If the CEO and RSO decide to proceed with deployment and training, they will share their decision– as well as the underlying Safeguards Report, internal feedback, and any external feedback–with the Board of Directors and the Long-Term Benefit Trust before moving forward.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-0-misuse-uplift-threshold","support":"supports","locator":"PDF p. 6 (printed p. 6), §1 Our Recommendations for Industry-Wide Safety, table row 'Non-novel chemical/biological weapons production', left column ('Capability or usage threshold')","passage":"AI systems with the ability to significantly help individuals or groups with basic technical backgrounds (e.g., undergraduate STEM degrees) create/obtain and deploy chemical and/or biological weapons with serious potential for catastrophic damages.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-0-automated-rd-threshold","support":"supports","locator":"PDF p. 8 (printed p. 8), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column, third paragraph, first sentence","passage":"Our working operationalization is to trigger this risk threshold at the point where we determine that a model could compress two years of 2018 – 2024 AI progress into a single year.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-0-ceo-rso-decision-board-ltbt-informed","support":"supports","locator":"PDF p. 12 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification')","passage":"Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-0-competitor-lead-delay","support":"supports","locator":"PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column","passage":"We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-1-automated-rd-threshold","support":"supports","locator":"PDF p. 8 (printed p. 8), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column, third paragraph (sentence continues on PDF p. 9)","passage":"We will consider this threshold to be met if we determine that either (1) our models would be able to fully substitute for our entire set of Research Scientists and Research Engineers, at competitive costs","passageType":"quote"},{"id":"evidence-prov-rsp-v3-1-ceo-rso-decision-board-ltbt-informed","support":"supports","locator":"PDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification')","passage":"Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-1-competitor-lead-delay","support":"supports","locator":"PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column","passage":"We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-1-marginal-risk-board-ltbt-approval","support":"supports","locator":"PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')","passage":"In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-2-novel-cb-threshold","support":"supports","locator":"PDF p. 7 (printed p. 7), §1 Our Recommendations for Industry-Wide Safety, table row 'Novel chemical/biological weapons production', left column ('Capability or usage threshold')","passage":"AI systems with the ability to significantly help threat actors (for example, moderately resourced expert-backed teams) create/obtain and deploy chemical and/or biological weapons with potential for catastrophic damages far beyond those of past catastrophes such as COVID-19.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-2-ceo-rso-decision-board-ltbt-informed","support":"supports","locator":"PDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification')","passage":"Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-2-competitor-lead-delay","support":"supports","locator":"PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column","passage":"We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-3-novel-cb-threshold","support":"supports","locator":"PDF p. 7 (printed p. 7), §1 Our Recommendations for Industry-Wide Safety, table row 'Novel chemical/biological weapons production', left column, first sentence","passage":"AI systems that can functionally substitute for the scarce human expertise that is currently the primary barrier to novel development of chemical and biological weapons with potential for catastrophic harm.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-3-ceo-rso-decision-board-ltbt-informed","support":"supports","locator":"PDF p. 13 (printed p. 12), §3.4 Procedures, item 4 ('Governance notification')","passage":"Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-3-competitor-lead-delay","support":"supports","locator":"PDF p. 17 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column","passage":"We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-3-marginal-risk-board-ltbt-approval","support":"supports","locator":"PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')","passage":"In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-4-ceo-rso-decision-board-ltbt-informed","support":"supports","locator":"PDF p. 13 (printed p. 13), §3.4 Procedures, item 4 ('Governance notification')","passage":"Following approval of a Risk Report, the CEO and RSO will promptly share their decision(s), the underlying Risk Report, and internal feedback with both the Board and the LTBT.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-4-competitor-lead-delay","support":"supports","locator":"PDF p. 17 (printed p. 17), Appendix A: Commitments Related to Competitors, table row 'Anthropic in the lead', Commitment column","passage":"We will require a strong argument that catastrophic risk is contained, along the lines of our recommendations for industry-wide safety (see Section 1). We will delay AI development and deployment as needed to achieve this, until and unless we no longer believe we have a significant lead.","passageType":"quote"},{"id":"evidence-prov-fsf-2024-alert-threshold","support":"supports","locator":"PDF p. 2 (printed p. 2), Framework, component “2 - Evaluating frontier models”, first paragraph, second sentence","passage":"we will define a set of evaluations called “early warning evaluations,” with a specific “pass” condition that flags when a CCL may be reached before the evaluations are run again.","passageType":"quote"},{"id":"evidence-prov-fsf-2024-evaluation-interval","support":"supports","locator":"PDF p. 2 (printed p. 2), Framework, component “2 - Evaluating frontier models”, second paragraph, first sentence","passage":"We are aiming to evaluate our models every 6x in effective compute3 and for every 3 months of fine-tuning progress.","passageType":"quote"},{"id":"evidence-prov-fsf-2024-response-plan","support":"supports","locator":"PDF p. 2 (printed p. 2), Framework, component “3 - Applying mitigations”, first paragraph, first sentence","passage":"When a model reaches evaluation thresholds (i.e. passes a set of early warning evaluations), we will formulate a response plan based on the analysis of the CCL and evaluation results.","passageType":"quote"},{"id":"evidence-prov-fsf-2024-hold-pending-mitigations","support":"supports","locator":"PDF p. 2 (printed p. 2), Framework, component “3 - Applying mitigations”, third paragraph, first sentence and opening of second sentence","passage":"A model may reach evaluation thresholds before mitigations at appropriate levels are ready. If this happens, we would put on hold further deployment or development, or implement additional protocols","passageType":"quote"},{"id":"evidence-prov-fsf-2024-autonomy-ccl","support":"supports","locator":"PDF p. 5 (printed p. 5), Critical Capability Levels table, Autonomy row, “Critical capability level” column","passage":"Autonomy level 1: Capable of expanding its effective capacity in the world by autonomously acquiring resources and using them to run and sustain additional copies of itself on hardware it rents.","passageType":"quote"},{"id":"evidence-prov-fsf-v2-0-alert-threshold","support":"supports","locator":"PDF p. 3 (printed p. 3), Framework, component “2 - Assessing the Capabilities of Frontier Models”, second paragraph, first sentence","passage":"we will define a set of evaluations called “early warning evaluations,” with a specific “alert threshold” that flags when a CCL may be reached before the evaluations are run again.","passageType":"quote"},{"id":"evidence-prov-fsf-v2-0-hold-pending-mitigations","support":"supports","locator":"PDF p. 3 (printed p. 3), Framework, component “3 - Applying Mitigations”, third paragraph, second sentence","passage":"If this happens, the response plan may involve putting deployment or further development on hold until adequate mitigations can be applied.","passageType":"quote"},{"id":"evidence-prov-fsf-v2-0-response-plan-approval","support":"supports","locator":"PDF p. 7 (printed p. 7), Governance and Accountability, “Governance” paragraph, first sentence","passage":"For Google models, when alert thresholds are reached, the response plan will be reviewed and approved by appropriate corporate governance bodies such as the Google DeepMind AGI Safety Council, Google DeepMind Responsibility and Safety Council, and/or Google Trust & Compliance Council.","passageType":"quote"},{"id":"evidence-prov-fsf-v2-0-pre-deployment-review","support":"supports","locator":"PDF p. 4 (printed p. 4), Misuse, Mitigation Approach, “Deployment Mitigations”, numbered step 2","passage":"Pre-deployment review of safety case: general availability deployment8 of a model takes place only after the appropriate corporate governance body determines the safety case regarding each CCL the model has reached to be adequate.","passageType":"quote"},{"id":"evidence-prov-fsf-v2-0-adoption-conditional-on-industry","support":"supports","locator":"PDF p. 1 (unnumbered), opening section, paragraph beginning “The safety of frontier AI systems is a global public good”, last sentence, final clause","passage":"our adoption of the protocols described in this Framework may depend on whether such organizations across the field adopt similar protocols.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-alert-threshold","support":"supports","locator":"PDF p. 5 (printed p. 5), §1.3 Outline of Our Risk Assessment Process, “Analysis” bullet, first and second sentences","passage":"Central to our model evaluations are “early warning evaluations,” to assess the proximity of the model to a CCL. We define “alert thresholds” for these evaluations that are designed to flag when a CCL may be reached before a risk assessment is conducted again.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-pre-deployment-review","support":"supports","locator":"PDF p. 9 (printed p. 9), §2.1.2 Deployment Mitigations, numbered step 2, first sentence","passage":"Pre-deployment review of safety case: external deployments of a model take place only after the appropriate governance function determines the safety case regarding each CCL the model has reached to be adequate.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-government-disclosure","support":"supports","locator":"PDF p. 16 (printed p. 16), §5.2 Disclosures, first paragraph, first sentence","passage":"If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-alternative-security-adequacy","support":"supports","locator":"PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse-CCL bullet (begins PDF p. 6), second sub-bullet, from “or we otherwise assess”","passage":"or we otherwise assess that the level of security applied is adequate, e.g. if they match or exceed the level of security applied to other models with similar capabilities or risk profiles, or we assess that the benefits of the open release of model weights outweigh the risks.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-1-alert-threshold","support":"supports","locator":"PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, third paragraph, second sentence","passage":"For CCLs, we define “alert thresholds,” which may draw on evaluation results, expert assessments, and other sources of information; that are designed to flag when a CCL may be reached before a critical capability assessment is conducted again.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-1-pre-deployment-review","support":"supports","locator":"PDF p. 10 (printed p. 10), §2.1.2 Deployment Mitigations, numbered step 2, first sentence","passage":"Pre-deployment review of residual risk assessment: external deployments of a model take place only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).","passageType":"quote"},{"id":"evidence-prov-fsf-v3-1-low-risk-deployment-exemption","support":"supports","locator":"PDF p. 5 (printed p. 5), §1.3.2 Inherent Risk Assessment, footnote 4","passage":"may not be conducted for low-risk external deployments (e.g. to a small number of trusted testers) if the appropriate governance function determines the residual risk of such deployments to be acceptable even if the model has reached a T/CCL (including with a safety case where a CCL has been reached).","passageType":"quote"},{"id":"evidence-prov-preparedness-beta-2023-risk-level-scale","support":"supports","locator":"PDF p. 5 (printed p. 5), “Tracked Risk Categories”, second paragraph, third (final) sentence","passage":"In general, “low” on this gradation scale is meant to indicate that the corresponding category of risks is not yet a significant problem, while “critical” represents the maximal level of concern.","passageType":"quote"},{"id":"evidence-prov-preparedness-beta-2023-high-deployment-restriction","support":"supports","locator":"PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting deployment”, first sentence","passage":"Only models with a post-mitigation score of \"medium\" or below can be deployed.","passageType":"quote"},{"id":"evidence-prov-preparedness-beta-2023-critical-development-restriction","support":"supports","locator":"PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, first sentence","passage":"Only models with a post-mitigation score of \"high\" or below can be developed further.","passageType":"quote"},{"id":"evidence-prov-preparedness-beta-2023-safety-enhancing-development-exception","support":"supports","locator":"PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, third sentence","passage":"Note that this should not preclude safety-enhancing development.","passageType":"quote"},{"id":"evidence-prov-preparedness-beta-2023-final-decision-authority","support":"supports","locator":"PDF p. 22 (printed p. 22), Governance › “Operations”, opening paragraph, second sentence, items (2) and (3)","passage":"(2) there is an advisory group (Safety Advisory Group) that has a sufficient diversity of perspectives and technical expertise to provide nuanced input and recommendations, and (3) there is a final decision-maker (OpenAI Leadership, with the option for the OpenAI Board of Directors to overrule).","passageType":"quote"},{"id":"evidence-prov-preparedness-v2-high-deployment-restriction","support":"supports","locator":"PDF p. 4 (printed p. 3), §1 Introduction, third bullet (“Safeguard against severe harms”), second sentence","passage":"We do not deploy models that reach a High capability threshold until the associated risks that they pose are sufficiently minimized.","passageType":"quote"},{"id":"evidence-prov-frontier-governance-2026-systemic-risk-definition","support":"supports","locator":"PDF p. 5 (printed p. 03), §2.1 Systemic risk identification, first paragraph, second sentence (from “including”)","passage":"including risks that a model will materially contribute to greater than 50 fatalities or $1 billion of property damages or losses arising from a single incident.","passageType":"quote"},{"id":"evidence-prov-frontier-governance-2026-residual-risk-deployment-gate","support":"supports","locator":"PDF p. 13 (printed p. 11), §2.5 Safety mitigations, first paragraph, third sentence","passage":"If residual risks associated with the model exceed acceptable risk levels, the model is not deployed unless additional mitigation measures are implemented that sufficiently minimize risk.","passageType":"quote"},{"id":"evidence-prov-frontier-governance-2026-acceptable-risk-may-proceed","support":"supports","locator":"PDF p. 13 (printed p. 11), §2.5 Safety mitigations, second paragraph, first sentence","passage":"Where the residual risk falls within acceptable levels, taking into account appropriate safety margins, the model may be approved for continued development and internal use (where applicable), and may be deployed under this Frontier Governance Framework.","passageType":"quote"},{"id":"evidence-prov-frontier-governance-2026-risk-acceptance-recommendations","support":"supports","locator":"PDF p. 13 (printed p. 11), §2.5 Safety mitigations, second paragraph, second sentence","passage":"We document a justification for why the systemic risks stemming from the model are acceptable, including reasonably foreseeable conditions under which the justification may no longer hold, as informed by recommendations from OpenAI’s Safety Advisory Group and external experts, as available and appropriate.","passageType":"quote"},{"id":"evidence-prov-frontier-governance-2026-material-update-oversight","support":"supports","locator":"PDF p. 21 (printed p. 19), §7.1 Update and approval process, fourth (final) sentence, up to “for oversight”","passage":"Material updates will be presented to the Safety and Security Committee of the board of directors of the OpenAI Foundation and to the board of directors of OpenAI Ireland Limited for oversight","passageType":"quote"},{"id":"evidence-prov-faif-2025-bio-chem-acceptance-criterion","support":"supports","locator":"PDF p. 6 (no printed page numbers), “Addressing Risks of Malicious Use” › “2. Risk Assessment”, paragraph beginning “Thresholds:”, first and second sentences","passage":"We developed an internal benchmark of benign and restricted biology and chemistry related queries in collaboration with SecureBio. Our risk acceptance criteria for system deployment is maintaining an answer rate of less than 1 out of 20 on restricted queries.","passageType":"quote"},{"id":"evidence-prov-faif-2025-mask-acceptance-criterion","support":"supports","locator":"PDF p. 7 (no printed page numbers), “Addressing Risks of Loss of Control” › “2. Risk Assessment”, paragraph beginning “Thresholds:”, first sentence","passage":"Our risk acceptance criteria for system deployment is maintaining a dishonesty rate of less than 1 out of 2 on MASK.","passageType":"quote"},{"id":"evidence-prov-faif-2025-benefits-may-outweigh-benchmark-risks","support":"supports","locator":"PDF p. 10 (no printed page numbers), “Operational and Societal Risks” › “5. Deployment Decisions”, second paragraph, sixth sentence","passage":"It is conceivable that for a particular modality and/or type of release, the expected benefits of model deployment may outweigh the risks identified by a particular benchmark.","passageType":"quote"},{"id":"evidence-prov-faif-2026-proceed-only-if-acceptable","support":"supports","locator":"PDF p. 6 (no printed page numbers), §2.3 Systemic risk acceptance determination (the first of two sections numbered 2.3), fourth paragraph, first sentence","passage":"xAI will only proceed with the development, the making available on the market, and/or the use of the model, if the systemic risks stemming from the model are determined to be acceptable.","passageType":"quote"},{"id":"evidence-prov-faif-2026-heightened-safeguards","support":"supports","locator":"PDF p. 3 (no printed page numbers), §2.1 Risk Identification › “(a) Addressing CBRN Risks”, second paragraph, first sentence","passage":"Under this FAIF, xAI’s models apply heightened safeguards if they receive user prompts that demonstrate intent to engage in the development, use, , or proliferation of weapons of mass destruction, including CBRN agents.","passageType":"quote"},{"id":"evidence-prov-faif-2026-systemic-risk-acceptance-criteria","support":"supports","locator":"PDF p. 5 (no printed page numbers), §2.3 Systemic risk acceptance determination (the first of two sections numbered 2.3), first sentence, up to “acceptable”","passage":"xAI applies a systemic risk acceptance criteria to each identified risk, incorporating a margin of security, to determine whether each identified systemic risk and the overall systemic risk are acceptable","passageType":"quote"},{"id":"evidence-prov-faif-2026-security-standard","support":"supports","locator":"PDF p. 7 (no printed page numbers), §2.4 Security mitigations, first paragraph, first sentence","passage":"xAI will maintain a documented Security Goal that identifies the threat actors against which mitigations are designed to protect against, including sophisticated non-state actors, insider threats, state-sponsored actors and other foreseeable actors.","passageType":"quote"},{"id":"evidence-prov-meta-faf-v1-1-critical-threshold","support":"supports","locator":"PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Critical row, Risk Threshold column (text below the measure label 'Stop development')","passage":"The model would uniquely enable the execution of at least one of the threat scenarios that have been identified as potentially sufficient to produce a catastrophic outcome and that risk cannot be mitigated in the proposed deployment context.","passageType":"quote"},{"id":"evidence-prov-meta-faf-v1-1-critical-development-measure","support":"supports","locator":"PDF p. 12 (printed p. 12), §3.3 Risk thresholds, first paragraph, third sentence","passage":"If a frontier AI is assessed to have reached the critical risk threshold and cannot be mitigated, we will stop development and implement the measures outlined in Table 1.","passageType":"quote"},{"id":"evidence-prov-meta-faf-v1-1-high-threshold","support":"supports","locator":"PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, High row, Risk Threshold column (text below the measure label 'Do not release')","passage":"The model provides significant uplift towards execution of a threat scenario (i.e. significantly enhances performance on key capabilities or tasks needed to produce a catastrophic outcome) but does not enable execution of any threat scenario that has been identified as potentially sufficient to produce a catastrophic outcome.","passageType":"quote"},{"id":"evidence-prov-meta-faf-v1-1-high-deployment-measure","support":"supports","locator":"PDF p. 17 (printed p. 17), §4.2 Evaluation and mitigation, paragraph beginning 'We may take into account monetary costs', second sentence","passage":"If the results of our evaluations indicate that a frontier AI has a “high” risk threshold by providing significant uplift towards realization of a catastrophic outcome we will not release the frontier AI externally.","passageType":"quote"},{"id":"evidence-prov-meta-faf-v1-1-approval-decision-authority","support":"supports","locator":"PDF p. 8 (printed p. 8), §2.1.3 Decide, 'Make a decision on release', second sentence","passage":"Informed by this analysis, a leadership team will either request further testing or information, require additional mitigations or improvements, or they will approve the model for release.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-critical-threshold","support":"supports","locator":"PDF p. 26 (printed p. 26), §4.2 Evaluation and mitigation, final sentence of the paragraph continued from PDF p. 25","passage":"Moreover, if continued development of the model could substantially contribute to any threat scenario, or if the model could uniquely enable a threat scenario and the risk cannot be mitigated in the proposed deployment context, the model meets the critical risk threshold.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-critical-development-measure","support":"supports","locator":"PDF p. 17 (printed p. 17), §3.3 Risk Thresholds, final sentence of the paragraph beginning on PDF p. 16 ('First, a Frontier AI meets the critical risk threshold…')","passage":"Should either scenario arise, we will only continue development of the Frontier AI if our risk assessments are complete and safeguards are defined, implemented and validated to reduce risk to the moderate or lower risk threshold.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-high-threshold","support":"supports","locator":"PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1: Risk Thresholds for Frontier AI, High row, Risk Threshold column","passage":"Deployment of the Frontier AI could substantially contribute to any threat scenario associated with a catastrophic outcome.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-high-deployment-measure","support":"supports","locator":"PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1, High row, Measures column, under the label 'Deploy with mitigations'","passage":"Proceed with deployment of the Frontier AI only if sufficient mitigations are defined, implemented and validated to reduce risk to that of a moderate or lower model.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-approval-decision-authority","support":"supports","locator":"PDF p. 7 (printed p. 7), §2.1.3 Decide, 'Make a decision on deployment', second sentence","passage":"Informed by this analysis, the Chief AI Officer or the Director of Alignment and Risk will determine whether to request further testing or information, require additional mitigations or improvements, or approve the model for deployment.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2025-cbrn-high-threshold","support":"supports","locator":"PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, High row, Capability threshold column (both statements)","passage":"The model provides a meaningful uplift to an expert’s (PhD level education in related fields) ability to develop and deliver a novel CBRN threat. The model provides a meaningful uplift to a medium-skilled actor’s (e.g., STEM education) ability to develop and deliver a known CBRN threat.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2025-low-medium-deployment","support":"supports","locator":"PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', second sentence","passage":"Models assessed as posing low or medium risk may be deployed with appropriate safeguards as outlined below.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2025-high-critical-predeployment-review","support":"supports","locator":"PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', third sentence","passage":"Models assessed as having a high or critical risk are subject to further review and safety and security mitigations prior to deployment.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2025-pause-unmitigable-risk","support":"supports","locator":"PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentence","passage":"If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2025-deployment-decision-authority","support":"supports","locator":"PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentence","passage":"The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-cbrn-high-threshold","support":"supports","locator":"PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, High row, Capability threshold column (both statements)","passage":"The model provides a meaningful uplift to an expert’s (PhD level education in related fields) ability to develop and deliver a novel CBRN threat. The model provides a meaningful uplift to a medium-skilled actor’s (e.g., STEM education) ability to develop and deliver a known CBRN threat.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-low-medium-deployment","support":"supports","locator":"PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', second sentence","passage":"Models assessed as posing low or medium risk may be deployed with appropriate safeguards as outlined below.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-high-critical-predeployment-review","support":"supports","locator":"PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, paragraph 'Pre-mitigation capability assessment', third sentence","passage":"Models assessed as having a high or critical risk are subject to further review and safety and security mitigations prior to deployment.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-pause-unmitigable-risk","support":"supports","locator":"PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, paragraph 'Post-mitigation capability assessment and safety buffer', second sentence","passage":"If, during the implementation of this framework, we identify a risk we cannot sufficiently mitigate, we will pause development and deployment until the point at which mitigation practices evolve to meet the risk.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-deployment-decision-authority","support":"supports","locator":"PDF p. 10 (printed p. 9), §5 Governance, Risk-informed deployment decision, second paragraph, first sentence","passage":"The Executive Officers (or their delegates) will make the final decision on whether to approve the recommendation for secure and trustworthy deployment.","passageType":"quote"},{"id":"evidence-absent-rsp-v3-0-no-train-deploy-without-safeguards","support":"supports","locator":"RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports, 3.1–3.6.3 (pp. 10–15); §4 Governance (p. 15); Appendix A: Commitments Related to Competitors and Appendix B: Notes on ASLs (p. 16); Changelog (pp. 17–19)."},{"id":"evidence-absent-rsp-v3-1-no-train-deploy-without-safeguards","support":"supports","locator":"RSP v3.1 (effective April 2, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10); §2–§3 Risk Reports (pp. 11–15); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 17–20)."},{"id":"evidence-absent-rsp-v3-2-no-train-deploy-without-safeguards","support":"supports","locator":"RSP v3.2 (effective April 29, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 18–20)."},{"id":"evidence-absent-rsp-v3-3-no-train-deploy-without-safeguards","support":"supports","locator":"RSP v3.3 (effective May 26, 2026), whole text layer, PDF pp. 1–20: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10, columns on p. 9 read individually because the text layer interleaves them); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A (pp. 16–17); Appendix B (p. 17); Changelog (pp. 18–20)."},{"id":"evidence-absent-rsp-v3-4-no-train-deploy-without-safeguards","support":"supports","locator":"RSP v3.4 (effective July 8, 2026), whole text layer, PDF pp. 1–21: Introduction (pp. 3–4); §1 with the threshold table (pp. 4–10, columns on p. 9 read individually because the text layer interleaves them); §2–§3 Risk Reports (pp. 11–16); §4 Governance (p. 16); Appendix A and Appendix B (p. 17); Changelog (pp. 18–21)."},{"id":"evidence-absent-fsf-v2-0-evaluation-interval","support":"supports","locator":"Whole document in both copies (2025-02-05 capture PDF pp. 1–8; served copy PDF pp. 1–9): all sections, Tables 1–2, footnotes and the served copy’s Updates and changes page"},{"id":"evidence-absent-fsf-v2-0-autonomy-ccl","support":"supports","locator":"Whole document in both copies (2025-02-05 capture PDF pp. 1–8; served copy PDF pp. 1–9), including Table 1 (Misuse CCLs, PDF pp. 5–6), Table 2 (Deceptive Alignment CCLs, PDF p. 7) and all footnotes"},{"id":"evidence-absent-fsf-v3-0-hold-pending-mitigations","support":"supports","locator":"PDF pp. 1–16, all sections, tables and footnotes"},{"id":"evidence-absent-fsf-v3-0-response-plan-approval","support":"supports","locator":"PDF pp. 1–16, all sections, tables and footnotes"},{"id":"evidence-absent-fsf-v3-0-adoption-conditional-on-industry","support":"supports","locator":"PDF pp. 1–16, all sections, tables and footnotes"},{"id":"evidence-absent-preparedness-v2-safety-enhancing-development-exception","support":"supports","locator":"Version 2, both copies (Internet Archive capture of 2025-04-15 and current file), PDF pp. 1–22: §§1–5, Tables 1–3 and Appendices A (Change log), B (Decision-making practices) and C"},{"id":"evidence-absent-faif-2026-bio-chem-acceptance-criterion","support":"supports","locator":"June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 Governance"},{"id":"evidence-absent-faif-2026-mask-acceptance-criterion","support":"supports","locator":"June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 Governance"},{"id":"evidence-absent-faif-2026-benefits-may-outweigh-benchmark-risks","support":"supports","locator":"June 2026 edition, PDF pp. 1–9, whole document: §1 Introduction; §2 Risk Management Framework with §2.1 (a)–(c), §2.2, both sections numbered 2.3 and §2.4; §3 Incident reporting; §4 Governance"},{"id":"evidence-provchange-rsp-v2-0-misuse-uplift-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v2-0-misuse-uplift-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v2-1-ceo-rso-decision-board-ltbt-informed-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v2-1-ceo-rso-decision-board-ltbt-informed-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-0-misuse-uplift-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-0-misuse-uplift-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-0-ceo-rso-decision-board-ltbt-informed-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-0-ceo-rso-decision-board-ltbt-informed-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-1-automated-rd-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-1-automated-rd-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-1-automated-rd-threshold-changelog","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-3-novel-cb-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-3-novel-cb-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-3-novel-cb-threshold-changelog","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v2-0-hold-pending-mitigations-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v2-0-hold-pending-mitigations-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-0-alert-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-0-alert-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-alert-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-alert-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-0-pre-deployment-review-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-0-pre-deployment-review-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-pre-deployment-review-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-pre-deployment-review-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-preparedness-v2-high-deployment-restriction-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-preparedness-v2-high-deployment-restriction-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-critical-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-critical-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-critical-threshold-changelog","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-critical-development-measure-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-critical-development-measure-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-critical-development-measure-changelog","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-high-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-high-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-high-deployment-measure-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-high-deployment-measure-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-high-deployment-measure-changelog","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-approval-decision-authority-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-approval-decision-authority-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-approval-decision-authority-changelog","support":"supports","verification":"machine_checked"},{"id":"evidence-assessed-preparedness-v2-high-deployment-mitigation-coggins-conclusion","support":"context"},{"id":"evidence-assessed-preparedness-v2-high-deployment-mitigation-coggins-ceo","support":"supports"},{"id":"evidence-assessed-preparedness-v2-high-deployment-mitigation-openai","support":"context"},{"id":"evidence-rsp-v2-0-assessed-weakening-saferai-title","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-time-assessment","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-kaplan-u-turn","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-anthropic-realistic","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-anthropic-goals","support":"context","verification":"machine_checked"},{"id":"evidence-prov-rsp-2023-emergency-loosening","support":"supports","locator":"PDF p. 10, Procedural Commitments, item 1 (“Update Process”), second sub-bullet, from the second half of the first sentence","passage":"we could envisage a substantial loosening of these restrictions as an emergency response. Such action would only be taken in consultation with governmental authorities, and the compelling case for it would be presented publicly to the extent possible.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-lower-safeguards-if-others-pass","support":"supports","locator":"PDF p. 16, footnote 18, second sentence","passage":"In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-1-lower-safeguards-if-others-pass","support":"supports","locator":"PDF p. 17, footnote 17, second sentence","passage":"In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-2-lower-safeguards-if-others-pass","support":"supports","locator":"PDF p. 17, footnote 17, second sentence","passage":"In such a scenario, because the incremental increase in risk attributable to us would be small, we might decide to lower the Required Safeguards.","passageType":"quote"},{"id":"evidence-prov-fsf-v2-0-government-disclosure","support":"supports","locator":"Governance and Accountability, “Disclosure”, first sentence: PDF p. 8 in the Internet Archive capture of 2025-02-05; PDF pp. 7–8 in the served file, where a page break and footnote 14 interrupt the sentence after “facilitate the”","passage":"If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share information with appropriate government authorities where it will facilitate the development of safe AI.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-3-automated-rd-threshold","support":"supports","locator":"PDF p. 9 (printed p. 9), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column ('Capability or usage threshold'), paragraph beginning 'We would consider scenario (2)', to the end of condition (a)","passage":"We would consider scenario (2) to have occurred where (a) we observe or expect double the rate of progress8 in AI aggregate capabilities compared to the rate we’d expect in the absence of significant AI contributions to AI R&D","passageType":"quote"},{"id":"evidence-prov-rsp-v3-4-automated-rd-threshold","support":"supports","locator":"PDF p. 9 (printed p. 9), §1 Our Recommendations for Industry-Wide Safety, table row 'Automated R&D in key domains', left column ('Capability or usage threshold'), paragraph beginning 'We would consider scenario (2)', to the end of condition (a); footnote 9","passage":"We would consider scenario (2) to have occurred where (a) we observe or expect double the rate of progress8 in AI aggregate capabilities compared to both the rate we’d expect and the fastest rate of extended progress9 we’ve observed in the absence of significant AI contributions to AI R&D","passageType":"quote"},{"id":"evidence-prov-rsp-2023-pause-training","support":"supports","locator":"PDF p. 4 (printed p. 4), section 'Initial Commitments', numbered item 4 ('Evaluation protocol'), second sentence","passage":"We commit to pause training before a model's capability level outstrips the Containment Measures we have implemented.","passageType":"quote"},{"id":"evidence-prov-rsp-2023-board-ltbt-informed","support":"supports","locator":"PDF p. 10 (printed p. 10), section 'Procedural Commitments', numbered item 6","passage":"Share results of ASL evaluations promptly with Anthropic's governing bodies, including the board of directors and LTBT, in order to sufficiently inform them of changes to our risk profile.","passageType":"quote"},{"id":"evidence-prov-rsp-2023-weights-deletion-decision","support":"supports","locator":"PDF p. 13 (printed p. 13), section 'Evaluation Protocol', bullet 'Response policy', step (2c), first and second sentences","passage":"If the model has already surpassed the next ASL during training, immediately lock down access to the weights. Stakeholders including the CISO and CEO should be immediately convened to determine whether the level of danger merits deletion of the weights.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-pause-training","support":"supports","locator":"PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence","passage":"If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-1-pause-training","support":"supports","locator":"PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence","passage":"If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-2-pause-training","support":"supports","locator":"PDF p. 15 (printed p. 11), §6.2 Restrict Deployment and Further Scaling, bullet 'Monitoring pretraining', third sentence","passage":"If the pretraining model’s capabilities are comparable or greater, we will pause training until we have implemented the ASL-3 Security Standard and established it is sufficient for the model.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-restrict-and-pause","support":"supports","locator":"PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the bulleted process)","passage":"If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-1-restrict-and-pause","support":"supports","locator":"PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the numbered process)","passage":"If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-2-restrict-and-pause","support":"supports","locator":"PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, final sentence (after the numbered process)","passage":"If, however, we are unable to make the showing required above, we will restrict model deployment and further scaling.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-may-proceed-with-safeguards","support":"supports","locator":"PDF p. 13 (printed p. 9), §4.3 Safeguards Decision, first paragraph, first sentence","passage":"If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-1-may-proceed-with-safeguards","support":"supports","locator":"PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, first paragraph, first sentence","passage":"If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-2-may-proceed-with-safeguards","support":"supports","locator":"PDF p. 14 (printed p. 10), §4.3 Safeguards Decision, first paragraph, first sentence","passage":"If, after the evaluations above, we determine that we have met the ASL-3 Required Safeguards, then we may proceed with deploying and training models above the Capability Threshold, provided we have also conducted a follow-up capability assessment.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-security-alone-continue-training","support":"supports","locator":"PDF p. 15 (printed p. 11), footnote 14 (attached to the §6.2 'Monitoring pretraining' bullet), first sentence","passage":"We consider implementation of the ASL-3 Security Standard alone sufficient to continue training, regardless of whether the ASL-3 Deployment Standard is satisfied.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-0-policy-change-approval","support":"supports","locator":"PDF p. 16 (printed p. 12), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentence","passage":"Changes to this policy will be proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors, in consultation with the Long-Term Benefit Trust.","passageType":"quote"},{"id":"evidence-prov-rsp-v2-1-policy-change-approval","support":"supports","locator":"PDF p. 17 (printed p. 13), §7.1 Internal Governance, numbered item 7 ('Policy changes'), first sentence","passage":"Changes to this policy will be proposed by the CEO and the Responsible Scaling Officer and approved by the Board of Directors, in consultation with the Long-Term Benefit Trust.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-0-industry-commitment-limit","support":"supports","locator":"PDF p. 4 (printed p. 4), §1 Our Recommendations for Industry-Wide Safety, second paragraph, second sentence","passage":"In particular, we cannot unilaterally and unconditionally commit to staying in line with the industry-wide recommendations in the right column.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-0-competitor-parity","support":"supports","locator":"PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'Competitors have strong safety measures', Commitment column, first sentence","passage":"For our highly capable frontier models, we will meet or exceed the overall risk reduction posture of these competitors, as far as we can tell based on our best efforts to assess that posture.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-0-competitor-upleveling","support":"supports","locator":"PDF p. 16 (printed p. 16), Appendix A: Commitments Related to Competitors, table row 'General upleveling', Commitment column","passage":"We will make a significant effort to meet or exceed that performance standard. However, we will not necessarily delay AI development and deployment in this scenario.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-0-marginal-risk-board-ltbt-approval","support":"supports","locator":"PDF p. 12 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')","passage":"In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-2-marginal-risk-board-ltbt-approval","support":"supports","locator":"PDF p. 13 (printed p. 12), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')","passage":"In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-4-marginal-risk-board-ltbt-approval","support":"supports","locator":"PDF p. 14 (printed p. 14), §3.4 Procedures, item 5 ('Modified process when marginal risk analysis is important to our case')","passage":"In the event that marginal risk analysis (see previous section) plays a major role in a decision to move forward, explicit approval of the Risk Report by the Board and LTBT (rather than just the CEO and RSO) will be required.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-2-ltbt-review-request","support":"supports","locator":"PDF p. 14 (printed p. 13), §3.6 External Review, final paragraph before §3.6.1","passage":"In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-3-ltbt-review-request","support":"supports","locator":"PDF p. 14 (printed p. 13), §3.6 External Review, final paragraph before §3.6.1","passage":"In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-4-ltbt-review-request","support":"supports","locator":"PDF p. 14 (printed p. 14), §3.6 External Review, final paragraph before §3.6.1","passage":"In addition, upon the LTBT’s request, we will conduct a public or private external review of our Risk Report or sections thereof, subject to the procedures outlined below.","passageType":"quote"},{"id":"evidence-prov-rsp-v3-2-ltbt-regular-briefing","support":"supports","locator":"PDF p. 16 (printed p. 15), §4 Governance, numbered item 2 ('Long Term Benefit Trust')","passage":"We will regularly brief the LTBT on plans and developments related to our Risk Reports, including model training, capability evals, mitigations, and risk analyses.","passageType":"quote"},{"id":"evidence-prov-fsf-v2-0-response-plan","support":"supports","locator":"PDF p. 3 (printed p. 3), component “3 - Applying Mitigations”, first paragraph, first two sentences","passage":"When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-response-plan","support":"supports","locator":"PDF p. 6 (printed p. 6), §1.4 Response Plans and Mitigations, second paragraph, first two sentences","passage":"When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-1-response-plan","support":"supports","locator":"PDF p. 6 (printed p. 6), §1.3.3 Risk Mitigation, second paragraph, first two sentences","passage":"When a model reaches an alert threshold for a CCL, we will assess the proximity of the model to the CCL and analyze the risk posed, involving internal and external experts as needed. This will inform the formulation and application of a response plan.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-response-plan-distant-from-ccl","support":"supports","locator":"PDF p. 6 (printed p. 6), §1.4 Response Plans and Mitigations, second paragraph, third sentence","passage":"Where model capabilities remain quite distant from a CCL, a response plan may involve the adoption of additional capability assessment processes to flag when heightened mitigations are required.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-1-response-plan-distant-from-ccl","support":"supports","locator":"PDF p. 6 (printed p. 6), §1.3.3 Risk Mitigation, second paragraph, fourth sentence","passage":"However, if we assess that risks stemming from the model remain acceptable and model capabilities remain distant from a CCL, the response plan may include updating the alert threshold to ensure the safety buffer remains appropriate.","passageType":"quote"},{"id":"evidence-prov-fsf-v2-0-security-level-adjustment","support":"supports","locator":"PDF p. 5 (printed p. 5), Misuse, Misuse Critical Capability Levels, paragraph beginning “These recommended security levels”, second sentence","passage":"This may occur if, for example, a model does not possess capabilities meaningfully different from other widely available models that have not demonstrably caused or contributed to severe risks,","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-security-level-adjustment","support":"supports","locator":"PDF p. 9 (printed p. 9), §2.2 Misuse Critical Capability Levels, second paragraph, second sentence","passage":"This may occur if, for example, a model does not possess capabilities meaningfully different from other publicly available models that have weaker security applied (in which case the marginal benefit of higher security is limited),","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-deployment-mitigation-scope","support":"supports","locator":"PDF p. 7 (printed p. 7), §1.6 Summary of Risk Acceptance Criteria, misuse CCL bullet, first sub-bullet, final sentence","passage":"This is required only for external deployment, not further development.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-1-deployment-mitigation-scope","support":"supports","locator":"PDF p. 7 (printed p. 7), §1.3.5 Risk Acceptance Determination, misuse T/CCL bullet, first sub-bullet, final sentence","passage":"This is required only for external deployment, not internal deployment or further development.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-1-government-disclosure","support":"supports","locator":"PDF p. 17 (printed p. 17), §5.2 Disclosures, first sentence","passage":"If we assess that a model has reached a CCL that poses an unmitigated and material risk to overall public safety, we aim to share relevant information with appropriate government authorities where it will facilitate safety of frontier AI.","passageType":"quote"},{"id":"evidence-prov-fsf-v3-0-framework-update-review","support":"supports","locator":"PDF p. 16 (printed p. 16), §5.1 Updates, first sentence","passage":"The Frontier Safety Framework will be updated at least once a year","passageType":"quote"},{"id":"evidence-prov-fsf-v3-1-framework-update-review","support":"supports","locator":"PDF p. 17 (printed p. 17), §5.1 Updates, first sentence","passage":"The Frontier Safety Framework will be reviewed at least once a year","passageType":"quote"},{"id":"evidence-prov-preparedness-beta-2023-leadership-without-sag","support":"supports","locator":"PDF p. 24 (printed p. 24), Governance › Operations › “Decision process”, fourth item","passage":"For the avoidance of doubt, Leadership can also make decisions without the SAG’s participation, i.e., the SAG does not have the ability to “filibuster”","passageType":"quote"},{"id":"evidence-prov-preparedness-beta-2023-capabilities-development-condition","support":"supports","locator":"PDF p. 21 (printed p. 21), Governance › Safety baselines, “Restricting development”, fourth sentence","passage":"We would also focus our efforts as a company towards solving these safety challenges and only continue with capabilities-enhancing development if we can reasonably assure ourselves (via the operationalization processes) that it is safe to do so.","passageType":"quote"},{"id":"evidence-prov-preparedness-v2-final-decision-authority","support":"supports","locator":"PDF p. 4 (printed p. 3), §1 Introduction, final paragraph, second sentence","passage":"OpenAI Leadership can approve or reject these recommendations, and our Board’s Safety and Security Committee provides oversight of these decisions.","passageType":"quote"},{"id":"evidence-prov-preparedness-v2-critical-development-restriction","support":"supports","locator":"PDF p. 4 (printed p. 3), §1 Introduction, third bullet (“Safeguard against severe harms”), third sentence","passage":"If a model under development reaches a Critical capability threshold, we also require safeguards to sufficiently minimize the associated risks during development, irrespective of deployment plans.","passageType":"quote"},{"id":"evidence-prov-preparedness-v2-marginal-risk-adjustment","support":"supports","locator":"PDF p. 13 (printed p. 12), §4.3 Marginal risk, first paragraph, third sentence (up to the colon introducing three bullets)","passage":"If we are able to rigorously confirm that such a scenario has occurred, then we could adjust accordingly the level of safeguards that we require in that capability area, but only if:","passageType":"quote"},{"id":"evidence-prov-preparedness-v2-sag-determinations","support":"supports","locator":"PDF p. 10 (printed p. 9), §3.2 Testing scope, final paragraph","passage":"In cases of ambiguity about whether a model is covered by the Preparedness Framework, the SAG is responsible for making the final determination.","passageType":"quote"},{"id":"evidence-prov-frontier-governance-2026-update-proposal-process","support":"supports","locator":"PDF p. 21 (printed p. 19), §7.1 Update and approval process, first sentence","passage":"Updates to this FGF may be proposed by Open AI’s Safety Advisory Group, Head of Safety Systems, Head of Preparedness, Chief Information Security Officer, Chief Compliance Officer, General Counsel, or executive leadership.","passageType":"quote"},{"id":"evidence-prov-frontier-governance-2026-update-legal-oversight","support":"supports","locator":"PDF p. 21 (printed p. 19), §7.1 Update and approval process, second sentence, up to “required”","passage":"OpenAI’s Legal function, in collaboration with relevant internal stakeholders, will oversee the process for FGF updates, including determining which updates are required","passageType":"quote"},{"id":"evidence-prov-frontier-governance-2026-precautionary-threshold-treatment","support":"supports","locator":"PDF p. 8 (printed p. 06), §2.3 Systemic risk acceptance determination, first paragraph, final sentence","passage":"For example, out of an abundance of caution we have treated models as crossing a capability threshold in circumstances where we are unable to rule out that a new threshold had been reached, even in the absence of direct evidence that it has occurred.","passageType":"quote"},{"id":"evidence-prov-faif-2025-trusted-user-exception","support":"supports","locator":"PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, third paragraph, single sentence, up to “purposes”","passage":"However, we may selectively allow xAI’s models to respond to such requests from some vetted, highly trusted users (such as trusted third-party safety auditors or large enterprise customers under contract) whom we know to be using those capabilities for benign or beneficial purposes","passageType":"quote"},{"id":"evidence-prov-meta-faf-v1-1-critical-pause-investigation","support":"supports","locator":"PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Critical row, Measures column, first bullet, second sentence","passage":"If a model appears to uniquely enable the execution of a threat scenario we will pause development while we investigate whether barriers to realizing the catastrophic outcome remain.","passageType":"quote"},{"id":"evidence-prov-meta-faf-v1-1-uplift-assessment-approval","support":"supports","locator":"PDF p. 13 (printed p. 13), §3.3 Risk thresholds, footnote 7 (attached to Table 1, High row, Risk Threshold column), third and final sentence","passage":"A final assessment of uplift is approved by senior-level decision-makers through our AI Risk process (see Section 2.1).","passageType":"quote"},{"id":"evidence-prov-meta-faf-v1-1-moderate-threshold","support":"supports","locator":"PDF p. 13 (printed p. 13), §3.3 Risk thresholds, Table 1: Risk thresholds for frontier AI, Moderate row, Risk Threshold column (text below the measure label 'Release')","passage":"The model would not provide significant uplift towards execution of a threat scenario.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-moderate-threshold","support":"supports","locator":"PDF p. 15 (printed p. 15), §3.3 Risk Thresholds, Table 1: Risk Thresholds for Frontier AI, 'Moderate or lower' row, Risk Threshold column","passage":"The Frontier AI shows relevant capabilities, but could not substantially contribute to any threat scenario associated with a catastrophic outcome, across plausible deployment and development scenarios.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-threshold-assignment-authority","support":"supports","locator":"PDF p. 6 (printed p. 6), §2.1.2 Evaluate and Mitigate, 'Evaluate for performance and safety', paragraph beginning 'These assessments typically use a version of the Frontier AI', second sentence","passage":"Based on this pre-mitigation risk assessment, the Chief AI Officer and Director of Alignment and Risk2 will assign a risk threshold.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-accountability-oversight","support":"supports","locator":"PDF p. 10 (printed p. 10), §2.3 Accountability, second paragraph, second sentence (closing clause)","passage":"with model deployment following appropriate consultation with relevant teams and with the approval of the Chief AI Officer.","passageType":"quote"},{"id":"evidence-prov-meta-aasf-v2-0-cb-high-external-deployment-exception","support":"supports","locator":"PDF p. 32 (printed p. 32), §4.2.2 Chemical and Biological Risks, 'Mitigation strategies', third paragraph","passage":"In the case where pre-mitigation testing suggests that a model has crossed the high risk threshold, we will not deploy the model externally unless we have strong additional evidence that mitigations are sufficiently robust to adversarial attacks that the fully mitigated model is reduced to moderate or lower levels.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2025-framework-update-review","support":"supports","locator":"PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentence","passage":"Any updates to our practices will be reviewed by Microsoft’s Chief Responsible AI Officer prior to their adoption.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-framework-update-review","support":"supports","locator":"PDF p. 10 (printed p. 9), §5 Governance, 'Updates to this framework', fourth sentence","passage":"Any updates to our practices will be reviewed by Microsoft’s Chief Responsible AI Officer prior to their adoption.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2025-high-risk-security","support":"supports","locator":"PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph (section begins on PDF p. 7), first sentence","passage":"Models posing high-risk on one or more tracked capability will be subject to security measures protective against most cybercrime groups and insider threats.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-high-risk-security","support":"supports","locator":"PDF p. 8 (printed p. 7), §4 Mitigations, Security measures, fourth paragraph, first sentence","passage":"Models posing high-risk on one or more tracked high-risk capability will be subject to security measures protective against most cybercrime groups and insider threats.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-external-evaluator-decision","support":"supports","locator":"PDF p. 7 (printed p. 6), §3 Evaluation and assessment, Deeper capability assessment, 'Capability evaluation' bullet, fifth sentence","passage":"The decision to involve qualified and expert external actors that meet relevant security standards, including those with domain-specific expertise, is made by internal experts who are independent from the model development team.","passageType":"quote"},{"id":"evidence-prov-ms-fgf-2026-incident-reporting","support":"supports","locator":"PDF p. 9 (printed p. 8), §4 Mitigations, Safety mitigations, 'Monitoring, response, and remediation' bullet, fourth sentence (first part)","passage":"Where we or others identify serious or critical incidents that may pose public safety or national security risks, we operationalize incident response policies and processes, conduct investigations, provide reports to regulatory authorities and impacted customers as appropriate","passageType":"quote"},{"id":"evidence-absent-rsp-v2-0-weights-deletion-decision","support":"supports","locator":"RSP v2.0 (effective October 15, 2024), whole text layer, PDF pp. 1–22: cover, summary and contents (pp. 1–4); Introduction and §§1–7 (pp. 5–17); Appendices A–C (pp. 18–20); Changelog (pp. 21–22)."},{"id":"evidence-absent-rsp-v3-0-pause-training","support":"supports","locator":"RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19)."},{"id":"evidence-absent-rsp-v3-0-restrict-and-pause","support":"supports","locator":"RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19)."},{"id":"evidence-absent-rsp-v3-0-may-proceed-with-safeguards","support":"supports","locator":"RSP v3.0 (effective February 24, 2026), whole text layer, PDF pp. 1–19: Introduction (pp. 3–4); §1 Our Recommendations for Industry-Wide Safety with the threshold table (pp. 4–9); §2 Frontier Safety Roadmap and §3 Risk Reports (pp. 10–15); §4 Governance (p. 15); Appendices A and B (p. 16); Changelog (pp. 17–19)."},{"id":"evidence-absent-meta-aasf-v2-0-critical-pause-investigation","support":"supports","locator":"PDF pp. 1–44, all sections, including Table 1 (PDF p. 15), §3.3 Risk Thresholds (PDF pp. 15–17), §4.2 Evaluation and mitigation (PDF pp. 25–38) and Appendix II – Change log (PDF p. 44)"},{"id":"evidence-absent-meta-aasf-v2-0-uplift-assessment-approval","support":"supports","locator":"PDF pp. 1–44, all sections, footnotes and Appendix II – Change log"},{"id":"evidence-provchange-fsf-v3-0-government-disclosure-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-0-government-disclosure-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-4-automated-rd-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-4-automated-rd-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v3-4-automated-rd-threshold-changelog","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v2-0-pause-training-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v2-0-pause-training-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v2-0-policy-change-approval-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-rsp-v2-0-policy-change-approval-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v2-0-response-plan-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v2-0-response-plan-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-response-plan-distant-from-ccl-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-response-plan-distant-from-ccl-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-0-security-level-adjustment-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-0-security-level-adjustment-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-deployment-mitigation-scope-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-deployment-mitigation-scope-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-framework-update-review-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-fsf-v3-1-framework-update-review-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-preparedness-v2-critical-development-restriction-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-preparedness-v2-critical-development-restriction-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-preparedness-v2-final-decision-authority-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-preparedness-v2-final-decision-authority-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-moderate-threshold-later","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-provchange-meta-aasf-v2-0-moderate-threshold-earlier","support":"supports","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-kaplan-unilateral","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-karnofsky-forcing","support":"context","verification":"machine_checked"},{"id":"evidence-rsp-v3-0-assessed-weakening-karnofsky-unilateral","support":"context","verification":"machine_checked"},{"id":"evidence-assessed-preparedness-v2-high-deployment-mitigation-agent-card","support":"contradicts"},{"id":"evidence-assessed-preparedness-v2-high-deployment-mitigation-openai-high","support":"contradicts"},{"id":"evidence-sb-link-openai-fgf-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-sb-link-openai-fgf-2","support":"context","verification":"machine_checked"},{"id":"evidence-sb-link-rsp-v3-0-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-sb-link-rsp-v3-0-2","support":"supports","verification":"machine_checked"},{"id":"evidence-sb-link-rsp-v3-0-3","support":"context","verification":"machine_checked"},{"id":"evidence-sb-link-faif-2025-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-sb-link-ms-fgf-2026-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-sb-link-ms-fgf-2026-2","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-rsp-2023-wh-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-rsp-v2-0-wh-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-rsp-v2-1-wh-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-rsp-v2-2-wh-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-rsp-v2-0-seoul-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-rsp-v2-1-seoul-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-rsp-v2-2-seoul-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-ms-fgf-2025-seoul-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-ms-fgf-2026-seoul-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-meta-faf-v1-1-seoul-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-frontier-governance-2026-eu-code-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-ms-fgf-2026-eu-code-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-cm-link-faif-2026-eu-code-1","sourceRole":"primary","support":"supports","verification":"machine_checked"},{"id":"evidence-fl-link-preparedness-beta-wh-2023-07-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-ms-fgf-2026-eu-ai-act-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-ms-fgf-2026-ny-raise-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-ms-fgf-2026-ny-raise-2","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-rsp-v3-1-sb53-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-rsp-v3-2-sb53-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-rsp-v3-3-sb53-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-fgf-2026-eu-ai-act-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-fgf-2026-eu-ai-act-2","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-fgf-2026-eu-ai-act-3","support":"context","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-fgf-2026-eu-ai-act-4","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-fl-link-rsp-v3-4-sb53-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-cm-link-frontier-governance-2026-eu-code-2","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-rsp-2023-asl2-bio-information-level-1","support":"supports","locator":"PDF p. 4 (printed p. 4), AI Safety Level table, ASL-2 row, “Dangerous Capabilities” column","passage":"an AI system that can provide bioweapon-related information that couldn’t be found via a search engine, but does so too unreliably to be useful in practice","passageType":"quote"},{"id":"evidence-ab-fw-rsp-2023-asl3-redteam-cbrn-domains-1","support":"supports","locator":"PDF p. 8 (printed p. 8), “ASL-3 Deployment Measures”, bullet “Successfully pass red-teaming”, second sentence","passage":"Misuse domains should at a minimum include causes of extreme CBRN risks, and cybersecurity.","passageType":"quote"},{"id":"evidence-ab-fw-rsp-2023-asl4-anticipated-misuse-level-1","support":"supports","locator":"PDF p. 14 (printed p. 14), “Early Thoughts on ASL-4 and Higher”, bullet “Critical catastrophic misuse risk”, first sentence","passage":"AI models have become the primary source of national security risk in a major area (such as cyberattacks or biological weapons)","passageType":"quote"},{"id":"evidence-ab-fw-rsp-2023-bio-evaluation-first-area-1","support":"supports","locator":"PDF p. 7 (printed p. 7), section “ASL-3 Capabilities and Threat Models”, item 1, paragraph following the misuse threshold","passage":"Our first area of effort is in evaluating bioweapons risks where we will determine threat models and capabilities in consultation with a number of world-class biosecurity experts.","passageType":"quote"},{"id":"evidence-ab-fw-pf-beta-cbrn-category-definition-1","support":"supports","locator":"PDF p. 9 (printed p. 9), Tracked Risk Categories, “CBRN (chemical, biological, radiological, nuclear)”, opening sentence","passage":"CBRN is focused on risks related to model-assisted creation of chemical, biological, radiological, and/or nuclear threats.","passageType":"quote"},{"id":"evidence-ab-fw-fsf-2024-bio-amateur-enablement-level-1-1","support":"supports","locator":"PDF p. 5 (printed p. 5), Critical Capability Levels table, Biosecurity row, “Critical capability level” column, first entry","passage":"Bio amateur enablement level 1: Capable of significantly enabling a non-expert to develop known biothreats that could increase their ability to cause severe harm compared to other means.","passageType":"quote"},{"id":"evidence-ab-fw-fsf-2024-bio-expert-enablement-level-1-1","support":"supports","locator":"PDF p. 5 (printed p. 5), Critical Capability Levels table, Biosecurity row, “Critical capability level” column, second entry","passage":"Bio expert enablement level 1: Capable of significantly enabling an expert (i.e. PhD or above) to develop novel biothreats that could result in an incident of high severity.","passageType":"quote"},{"id":"evidence-ab-fw-fsf-2024-biosecurity-domain-definition-1","support":"supports","locator":"PDF p. 5 (printed p. 5), Critical Capability Levels table, “Risk domain” column, Biosecurity row","passage":"Biosecurity: Risks of models assisting in the development, preparation and/or execution of a biological attack.","passageType":"quote"},{"id":"evidence-ab-fw-rsp-v2-0-cbrn-assessment-baseline-1","support":"supports","locator":"PDF p. 20 (printed p. 16), Appendix C: Detailed Capability Thresholds, paragraph “Chemical, Biological, Radiological, and Nuclear (CBRN) weapons”, second sentence","passage":"comparing what potential attackers could achieve with full model access versus 2023-level online resources, assuming they have funding and up to one year of time to invest, but no initial specialized expertise","passageType":"quote"},{"id":"evidence-ab-fw-rsp-v2-0-cbrn-capabilities-list-sharing-1","support":"supports","locator":"PDF p. 20 (printed p. 16), Appendix C, footnote 21","passage":"we maintain a current list of specific CBRN capabilities of concern … we plan to share them with organizations such as AI Safety Institutes and the Frontier Model Forum","passageType":"quote"},{"id":"evidence-ab-fw-rsp-v2-0-cbrn-required-safeguards-1","support":"supports","locator":"PDF p. 7 (printed p. 3), §2 Capability Thresholds and Required Safeguards, table row “Chemical, Biological, Radiological, and Nuclear (CBRN) weapons”, Required Safeguards column, second sentence","passage":"The ASL-3 Deployment Standard and the ASL-3 Security Standard, which protect against misuse and model-weight theft by non-state adversaries, are required.","passageType":"quote"},{"id":"evidence-ab-fw-fsf-v2-0-cbrn-domain-definition-1","support":"supports","locator":"PDF p. 2 (printed p. 2), list of misuse risk domains, first bullet","passage":"CBRN: Risks of models assisting in the development, preparation, and/or execution of a chemical, biological, radiological, or nuclear (“CBRN”) attack.","passageType":"quote"},{"id":"evidence-ab-fw-fsf-v2-0-cbrn-uplift-1-security-level-1","support":"supports","locator":"PDF p. 5 (printed p. 5), Table 1, CBRN row, “Recommended security level and rationale” column, first line","passage":"Security controls and detections at a level generally aligned with RAND SL 2","passageType":"quote"},{"id":"evidence-ab-fw-fsf-v2-0-cbrn-uplift-1-threshold-1","support":"supports","locator":"PDF p. 5 (printed p. 5), Table 1: Misuse CCLs and Security Mitigations, CBRN row, “Critical capability level” column","passage":"CBRN uplift 1: Can be used to significantly assist a low-resourced actor with dual-use scientific protocols, resulting in a substantial increase in ability to cause a mass casualty event.","passageType":"quote"},{"id":"evidence-ab-fw-fsf-v2-0-replaces-biosecurity-levels-with-cbrn-uplift-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-fsf-v2-0-replaces-biosecurity-levels-with-cbrn-uplift-2","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-ms-fgf-2025-cbrn-critical-threshold-1","support":"supports","locator":"PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, Critical row, Capability threshold column","passage":"The model provides a meaningful uplift to an expert’s ability to develop a highly dangerous novel threat or significantly lowers the barriers to a low-skilled actor developing and delivering a known CBRN threat.","passageType":"quote"},{"id":"evidence-ab-fw-ms-fgf-2025-cbrn-medium-threshold-1","support":"supports","locator":"PDF p. 12 (printed p. 11), Appendix I – Capability thresholds, CBRN weapons table, Medium row, Capability threshold column","passage":"The model provides some assistance increasing the ability of an existing expert (PhD level education in related fields) to develop a known CBRN threat.","passageType":"quote"},{"id":"evidence-ab-fw-ms-fgf-2025-leading-indicator-direction-1","support":"supports","locator":"PDF p. 6 (printed p. 5), §3 Capability assessment, paragraph on leading indicator assessments, second sentence","passage":"we intend to move this leading indicator screening toward a more direct assessment of tracked capabilities such as CBRN weapon development, offensive cyberoperations, and advanced autonomy","passageType":"quote"},{"id":"evidence-ab-fw-rsp-v2-1-adds-cbrn-development-threshold-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-rsp-v2-1-cbrn-4-expected-safeguards-1","support":"supports","locator":"PDF p. 8 (printed p. 4), §2, table row “CBRN weapons”, entry “CBRN-4”, Required Safeguards column","passage":"We expect this threshold will require the ASL-4 Deployment and Security Standards. We plan to add more information about what those entail in a future update.","passageType":"quote"},{"id":"evidence-ab-fw-rsp-v2-1-cbrn-4-threshold-1","support":"supports","locator":"PDF p. 8 (printed p. 4), §2 Capability Thresholds and Required Safeguards, table row “Chemical, Biological, Radiological, and Nuclear (CBRN) weapons”, entry “CBRN-4”, Capability Thresholds column","passage":"The ability to substantially uplift CBRN development capabilities of moderately resourced state programs (with relevant expert teams), such as by novel weapons design, substantially accelerating existing processes, or dramatic reduction in technical barriers.","passageType":"quote"},{"id":"evidence-ab-fw-pf-2-bio-chem-category-definition-1","support":"supports","locator":"PDF p. 2 (printed p. 1), opening page, first bullet of the Tracked Categories list","passage":"Biological and Chemical capabilities that, in addition to unlocking discoveries and cures, can also reduce barriers to creating and using biological or chemical weapons.","passageType":"quote"},{"id":"evidence-ab-fw-pf-2-bio-evaluation-object-1","support":"supports","locator":"PDF p. 10 (printed p. 9), §3.1 box “An example of a Tracked Category capability evaluation”, first sentence","passage":"To assess the degree to which a covered system can reduce the barriers to creating a biological weapon, our current evaluations test both how capable the system is at providing useful information to someone creating a weapon and how capable it is of directly integrating with relevant tools","passageType":"quote"},{"id":"evidence-ab-fw-pf-2-bio-evaluation-priority-1","support":"supports","locator":"PDF p. 6 (printed p. 5), footnote 5 to the Biological and Chemical row of Table 1","passage":"We will build safeguards against both biological and chemical threats. Given the higher potential severity of biological threats relative to chemical ones, we will prioritize Biological capability evaluations and these will be used as indicators for High and Critical capabilities for the category.","passageType":"quote"},{"id":"evidence-ab-fw-pf-2-independent-biological-risk-expertise-1","support":"supports","locator":"PDF p. 14 (printed p. 13), §4 Governance, item “Independent expert opinion on the evidence being produced to SAG”, second sentence","passage":"The purpose of this input is to add independent analysis from individuals or organizations with deep expertise in domains of relevant risks (e.g., biological risk).","passageType":"quote"},{"id":"evidence-ab-fw-rsp-v2-2-cbrn-3-threat-model-rationale-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-rsp-v2-2-cbrn-3-threat-model-rationale-2","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-fsf-v3-0-cbrn-domain-attack-to-threat-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-fsf-v3-0-cbrn-domain-attack-to-threat-2","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-faif-2025-bio-chem-critical-steps-1","support":"supports","locator":"PDF p. 5 (no printed page numbers), “Addressing Risks of Malicious Use” › “2. Risk Assessment”, paragraph introducing the restricted critical steps","passage":"In the setting of biological and chemical weapons, xAI considers critical steps where we restrict xAI models from providing detailed information or substantial assistance","passageType":"quote"},{"id":"evidence-ab-fw-faif-2025-cbrn-barrier-recognition-1","support":"supports","locator":"PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, first paragraph, second sentence","passage":"advanced AI models could lower the barrier to entry for bad actors seeking to develop chemical, biological, radiological, or nuclear (“CBRN”) or cyber weapons, and could help automate knowledge compilation to swiftly overcome bottlenecks to weapons development","passageType":"quote"},{"id":"evidence-ab-fw-faif-2025-heightened-safeguards-1","support":"supports","locator":"PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, second paragraph, first sentence","passage":"Under this FAIF, xAI’s models apply heightened safeguards if they receive user prompts that pose a foreseeable and non-trivial risk of resulting in large-scale violence, terrorism, or the use, development, or proliferation of weapons of mass destruction, including CBRN weapons, and major cyber attacks on critical infrastructure.","passageType":"quote"},{"id":"evidence-ab-fw-faif-2025-vetted-user-exception-1","support":"supports","locator":"PDF p. 3 (no printed page numbers), “Addressing Risks of Malicious Use”, third paragraph, first sentence","passage":"we may selectively allow xAI’s models to respond to such requests from some vetted, highly trusted users (such as trusted third-party safety auditors or large enterprise customers under contract) whom we know to be using those capabilities for benign or beneficial purposes","passageType":"quote"},{"id":"evidence-ab-fw-rsp-v3-0-novel-cb-threat-pathway-sharing-1","support":"supports","locator":"PDF p. 7 (printed p. 7), §1 Our Recommendations for Industry-Wide Safety, threshold table, row “Novel chemical/biological weapons production”, middle column (“Mitigations—our plan as a company”), second paragraph","passage":"we will identify the most concerning specific threat pathways, create policy recommendations for early detection and response for such threats, and share this content with policymakers","passageType":"quote"},{"id":"evidence-ab-fw-ms-fgf-2026-changelog-no-cbrn-entry-1","support":"supports","locator":"PDF p. 16 (printed p. 15), Appendix II – Change log, entry “February 2026”, all six bullets"},{"id":"evidence-ab-fw-fsf-v3-1-cbrn-security-level-2-plus-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-fsf-v3-1-cbrn-security-level-2-plus-2","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-fsf-v3-1-cbrn-uplift-tcl-1","support":"supports","locator":"PDF p. 11 (printed p. 11), §2.2.1 Chemical, Biological, Radiological or Nuclear, paragraph “CBRN Tracked Capability Level”","passage":"CBRN uplift TCL: Provides low to medium resourced actors uplift in reference scenarios, resulting in material risk of CBRN attacks that could result in significant but not severe harm.","passageType":"quote"},{"id":"evidence-ab-fw-rsp-v3-3-revises-novel-cb-threshold-and-off-cycle-1","sourceRole":"primary","support":"supports","verification":"machine_checked","retrievalRoute":"direct"},{"id":"evidence-ab-fw-meta-faf-v1-1-cb-risk-process-1","support":"supports","locator":"PDF pp. 3, 8, 13 and 16–18; §2.1.2 and Table 1","passageType":"paraphrase"},{"id":"evidence-ab-fw-meta-aasf-v2-0-cb-assessment-methods-1","support":"supports","locator":"PDF pp. 1 and 31–32; §4.2.2","passageType":"paraphrase"},{"id":"evidence-ab-fw-faif-2026-cbrn-safeguard-assessment-1","support":"supports","locator":"PDF pp. 2–4; §2.1(a)","passageType":"paraphrase"}],"at":{"entities":[0,1,2,3,4,21,22,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,157,199,200,201,202],"claims":[16,17,18,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,259,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,621,622,623,624,695,696,697,698,725,726,727,728,729,730,752,753,754,2042,2043,2044,2045,2046,2047,2048,2049,2050,2051,2052,2053,2054,2055,2056,2057,2058,2059,2060,2061,2062,2063,2064,2065,2066,2067,2068,2069,2070,2071,2072,2073,2074,2075,2076,2077,2078,2079,2080,2081,2082,2083,2084,2085,2086,2087,2088,2089,2090,2091,2092,2093,2094,2095,2096,2097,2098,2099,2100,2101,2102,2103,2104,2105,2106,2107,2108,2109,2110,2111,2112,2113,2114,2115,2116,2117,2118,2119,2120,2121,2122,2123,2124,2125,2126,2127,2128,2129,2130,2131,2132,2133,2134,2135,2136,2137,2138,2139,2140,2141,2142,2143,2144,2145,2146,2147,2148,2149,2150,2151,2152,2153,2154,2155,2156,2157,2158,2159,2160,2161,2162,2163,2164,2165,2166,2167,2168,2169,2482,2483,2484,2485,2486,2487,2488,2489,2490,2491,2492,2493,2494,2495,2496,2497,2498,2499,2500,2501,2502,2503,2504,2505,2506,2507,2508,2509,2510,2511,2512,2513,2514,2515,2516,2517,2518,2519,2520,2521,2522,2523,2524,2525,2526,2527,2528,2529,2530,2531,2532,2533,2534,2535,2536,2537,2538,2539,2540,2541,2542,2543,2544,2545,2546,2547,2548,2549,2550,2551,2552,2553,2554,2555,2556,2557,2558,2559,2560,2561,2562,2563,2564,2565,2566,2567,2568,2569,2570,2571,2572,2573,2574,2575,2576,2577,2578,2579,2580,2581,2582,2583,2584,2585,2586,2587,2588,2589,2590,2591,2592,2593,2594,2595,2596,2597,2598,2599,2600,2601,2602,2603,2604,2605,2606,2607,2608,2609,2610,2611,2612,2613,2614,2615,2616,2617,2618,2619,2620,2621,2622,2623,2624,2625,2626,2627,2628,2629,2630,2631,2632,2633,2634,2635,2636,2637,2638,2639,2640,2641,2642,2643,2644,2645,2646,2647,2648,2649,2650,2651,2652,2653,2654,2655,2656,2657,2658,2659,2660,2661,2662,2663,2664,2665,2666,2667,2668,2669,2670,2671,2672,2673,2674,2675,2676,2677,2678,2679,2680,2681,2682,2683,2684,2685,2686,2687,2688,2689,2690,2691,2692,2693,2694,2695,2696,2697,2698,2699,2700,2701,2702,2703,2704,2705,2706,2707,2708,2709,2710,2711,2712,2713,2714,2715,2716,2717,2718,2719,2720,2721,2722,2723,2724,2725,2726,2727,2728,2729,2848,2849,2850,2851,2852,2853,2854,2855,2856,2857,2858,2859,2860,2921,2922,2923,2924,2925,2926,2927,2928,3246,3247,3248,3249,3250,3251,3252,3253,3254,3255,3256,3257,3258,3259,3260,3261,3262,3263,3264,3265,3266,3267,3268,3269,3270,3271,3272,3273,3274,3275,3276,3277,3278,3279,3280,3281,3358,3359,3360],"sources":[33,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,178,179,180,183,184,188,190],"evidence":[17,18,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,121,280,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,580,582,584,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,733,734,735,736,737,738,739,740,873,874,875,876,908,909,910,911,912,913,954,955,956,3774,3775,3776,3777,3778,3779,3780,3781,3782,3783,3784,3785,3786,4458,4459,4460,4461,4462,4463,4464,4465,4466,4467,4468,4469,4470,4471,4472,4473,4474,4476,4477,4478,4479,4480,4481,4482,4483,4484,4485,4486,4487,4488,4489,4490,4491,4492,4493,4494,4495,4496,4497,4498,4608,4609,4610]},"version":"1lg47t7"}