Frontier AI safety frameworks compared: what Anthropic, OpenAI and DeepMind commit to

A frontier AI safety framework is a published document in which a lab names capability levels it considers dangerous, states how it will test for them, and pre-commits to specific safeguards if a model reaches one. Three labs maintain one: Anthropic, OpenAI and Google DeepMind. The documents now share a common shape, which makes the places they diverge more informative than the places they agree.

What is the shared structure?

Four parts, in every one of them.

A threshold, stated in terms of capability rather than model size. A testing regime that is supposed to detect when a model is approaching it. A set of safeguards that attach when it does, covering both deployment restrictions and internal security. And a governance process naming who decides.

That shape is a real convergence. It did not exist in 2022, and it is the main structural legacy of the Seoul Frontier AI Safety Commitments, under which signatories agreed to publish exactly this.

Anthropic: AI Safety Levels

Anthropic's Responsible Scaling Policy was at version 3.4, effective 8 July 2026. It is the oldest of the three and the most frequently revised.

It uses AI Safety Level standards, borrowed in spirit from biosafety levels. ASL-2 is the baseline. ASL-3 is a higher standard with two halves: a Security Standard aimed at making model weights harder to steal, and a Deployment Standard aimed at a narrowly defined set of misuse risks, specifically the development or acquisition of chemical, biological, radiological and nuclear weapons.

The interesting part is how it has been applied. Anthropic released Claude Opus 4 under ASL-3 protections while stating it had not determined whether the model had definitively passed the capability threshold requiring them, describing the move as precautionary and provisional. Later models, including Claude Sonnet 4.5, Opus 4.5 and Opus 4.6, were also released under the ASL-3 standard.

That is a framework being used as a ratchet rather than a gate: the lab applied the stronger protections without first proving they were required.

OpenAI: High and Critical

OpenAI's Preparedness Framework reached version 2 on 15 April 2025.

It uses two thresholds. A High capability threshold requires sufficient safeguards to be in place before the model is deployed. A Critical threshold requires safeguards during development, not merely before release, which is the stricter idea of the two because it constrains the training process rather than the product.

The tracked categories in version 2 include biological and chemical capability, cybersecurity, and AI self-improvement. That last category is the one worth noting: a model that can meaningfully accelerate AI research is treated as a risk in its own right, independent of any misuse, which is the same concern behind work on recursive self-improvement.

Google DeepMind: Critical Capability Levels

Google DeepMind published the third iteration of its Frontier Safety Framework on 22 September 2025, then updated it to version 3.1 in April 2026.

Its unit is the Critical Capability Level. Version 3 added one for harmful manipulation, covering models that could be used to shift beliefs and behavior at severe scale, which no other framework had named. It also extended coverage of misalignment with protocols for machine learning research and development capability levels, and warning levels for deceptive instrumental reasoning, where a model begins reasoning in a way that conceals its objectives.

Version 3.1 added Tracked Capability Levels, which are designed to trigger assessment before a Critical Capability Level is reached, and raised the security bar for misuse risks. We have gone through its levels and alert thresholds in detail.

Where did these documents come from?

Anthropic published the first one in September 2023, and the idea spread from there.

The design borrows from fields that already had to decide how dangerous work may proceed. Biosafety levels are the obvious reference, and the AI Safety Level naming is explicit about it. The underlying logic is the same: you cannot assess every experiment individually, so you define tiers, assign containment measures to each, and classify the work into a tier.

The spread was accelerated by the Seoul Frontier AI Safety Commitments in May 2024, under which sixteen companies agreed to publish exactly this sort of document: a framework describing how they measure and manage severe risk, with an undertaking not to develop or deploy models whose identified risks cannot be sufficiently mitigated.

That is why three different companies arrived at four-part documents with the same architecture within about eighteen months. It was not coincidence, and it was not regulation either.

What is actually inside a capability threshold?

This is where the documents get vague, and the vagueness is structural rather than evasive.

A threshold has to be specific enough to test and general enough to survive a capability nobody anticipated. The frameworks resolve that tension by naming a domain and a severity, such as meaningfully uplifting a non-expert's ability to create a biological weapon, and then leaving the evaluation design to be built against it.

The consequence is that the hard work is not in the framework. It is in the evaluation suite that decides whether a threshold was reached, and those suites are mostly unpublished. A reader can check what a lab promised to do when a threshold is crossed. A reader usually cannot check how the lab decided it had not been.

That asymmetry is the main reason external evaluation access keeps coming up in this debate, and the reason work on what safety evaluations test and miss matters more than the framework text.

Where do they actually differ?

Four places, and these are the ones to read for.

What triggers. Anthropic's ASL-3 deployment standard is narrowly scoped to CBRN misuse. DeepMind's levels include manipulation and deceptive reasoning. OpenAI's include AI self-improvement. The frameworks are not measuring the same risks.

When it triggers. OpenAI's Critical threshold bites during development. Most of the rest attach at deployment, which is later.

Who decides. In all three, the lab does. There is no external approval step and no independent audit requirement written into any of them.

What happens on failure. This is the weakest part across all three. The documents describe what safeguards attach, not what consequence follows if a lab ships without them.

Are these commitments binding?

Not on the labs, by anyone outside them. Each document is written and revised by the company it governs, which is why version numbers matter and why the version you read may not be the one that applied when a model shipped.

They are, however, becoming legally relevant in an indirect way. California's frontier statute requires a large frontier developer to publish a framework describing how it manages catastrophic risk, without specifying the contents. That converts a voluntary document into a disclosure obligation: the state does not tell you what to commit to, but it does require you to say what you committed to, which makes a later deviation checkable.

What would make them stronger?

Three things that none of them currently has.

An external trigger check, so that whether a threshold has been crossed is not solely the lab's determination. A published consequence for shipping without the required safeguards. And version control with effect: a statement of which version governed which model release, so a commitment cannot be quietly revised after the fact.

The third is the cheapest and the most useful. Anthropic's transparency hub is the closest thing to it in practice, recording which standard each model was released under.

How to read a framework

Five questions, in order.

• Which version, effective from when, and which models did it govern?
• What capability triggers the higher standard, stated specifically enough to be tested?
• Does the trigger attach at deployment or during development?
• Who determines that the trigger has been met?
• What is the stated consequence of proceeding without the safeguards?

Question five usually has no answer, in any of the three documents. That is the honest summary of where this practice has reached.