A responsible scaling policy specifies what level of AI capabilities an AI developer is prepared to handle safely with their current protective measures, and the conditions under which it would be too dangerous to continue deploying AI systems or scaling up AI capabilities until protective measures improve. Anthropic’s Responsible Scaling Policy, a series of technical and organizational protocols defining a framework called AI Safety Levels (ASL), took effect as version 1.0 on September 19, 2023.
AI capability governance is the subject here, not corporate-responsibility language and not infrastructure capacity planning. The document makes a promise about a machine that does not exist yet, which is what makes the exact wording of one worth reading closely.
Key Takeaways
- The artifact states what level of AI capabilities a developer is prepared to handle safely with their current protective measures. It also states when it would be too dangerous to keep scaling up AI capabilities until protective measures improve.
- The commitments take a conditional form: If an AI model has capability X, risk mitigations Y must be in place. If needed, the developer will delay AI deployment and/or development to ensure the mitigations can be present in time.
- Anthropic describes the policy as the voluntary framework it uses to mitigate catastrophic risks from AI systems. That wording comes from the third version of the document, effective February 24, 2026.
- Anthropic activated the AI Safety Level 3 (ASL-3) Deployment and Security Standards alongside the launch of Claude Opus 4, calling the step a precautionary and provisional action. The company dates that activation for relevant models to May 2025.
- The policy is a living document with 9 dated versions on its public updates page. That list runs from version 1.0, effective September 19, 2023, through version 3.4, effective July 8, 2026.
How Does a Responsible Scaling Policy Work?
A responsible scaling policy works in three moves, and every one of them is written down before the capability it governs arrives.
1. The Developer Names a Capability It Cannot Yet Handle
METR, the research nonprofit that publishes the framework page for this class of policy, puts Limits at the head of its component list. The page asks which specific observations about dangerous capabilities would indicate that it is, or strongly might be, unsafe to continue scaling.
Naming the observation is the hard part. It converts a general worry into something an evaluation can go looking for. A fire door held open by a magnet wired to the alarm works on the same principle. Nobody decides to close it in the moment, because that decision belongs to the day the building was fitted out.
2. The Policy Attaches Safeguards to That Capability in Advance
Researchers at the Carnegie Endowment for International Peace set out the general form as an if-then commitment. If an AI model has capability X, risk mitigations Y must be in place. If needed, the developer will delay AI deployment and/or development to ensure the mitigations can be present in time.
Anthropic built its own policy on that shape. The company focused the document on the principle of conditional, or if-then, commitments. If a model exceeded certain capability levels, the policy stated that a new and stricter set of safeguards should be introduced. Each set of safeguards corresponded to an AI Safety Level (ASL).
ASL-2 referred to one set of required safeguards, whereas ASL-3 referred to a more stringent set of safeguards needed for more capable AI models. That account appears in the version 3.0 announcement, and version 3.0 took effect on February 24, 2026.
A covenant in a loan agreement does the same job in a different industry. The borrower writes down, before any trouble arrives, what happens if a ratio breaches a level, precisely because judgment under pressure is unreliable.
3. Evaluation Decides Whether the Trigger Has Fired
Anthropic’s policy includes Capability Thresholds for models. If models reach those thresholds, or if the company has not yet determined that they are sufficiently far below them, a higher level of AI Safety Level Standards is required.
That uncertainty limb is the part worth reading twice. The trigger fires on the absence of reassurance rather than on the arrival of proof. A commitment written that way can cost the developer something while the evidence is still contested. Most summaries of the term describe a clean measurement and skip the clause.
The framework page names 5 components a policy of this kind has to answer for.
| Component | The question the policy must answer | Why a reader checks it |
|---|---|---|
| Limits | Which observations about dangerous capabilities would indicate that it is, or strongly might be, unsafe to continue scaling? | Whether the trigger is observable or rhetorical |
| Protections | What aspects of current protective measures are necessary to contain catastrophic risks? | What the developer relies on today |
| Evaluation | What are the procedures for promptly catching early warning signs of dangerous capability limits? | Whether anyone would notice in time |
| Response | Is the developer prepared to pause further capability improvements until protective measures are sufficiently improved? | What the commitment actually costs |
| Accountability | How does the developer ensure commitments are executed as intended, and that changes are not made in a rushed or opaque way? | Whether the document can be quietly rewritten |
Source: METR responsible scaling policies framework page, September 2023
Why Does a Responsible Scaling Policy Matter?
Anthropic states that the policy is its attempt to solve one problem. The risks it addresses are not present at the time the policy is written, but could emerge rapidly as a result of an exponentially advancing technology. Timing is the whole difficulty. A rule written after the capability arrives is a reaction; a rule written before it is a constraint.
When the original document was written in September 2023, large language models were essentially chat interfaces. They can now browse the web, write and run code, use computers, and take autonomous, multi-step actions. Our AI benchmark coverage keeps showing capability rankings turn over every few release cycles, which is why a dated commitment beats an undated one. Release dates and version histories sit in our AI model release and version tracker.
Anthropic wrote that the ASL system implicitly requires it to temporarily pause training of more powerful models. That pause applies if its AI scaling outstrips its ability to comply with the necessary safety procedures. The company hoped this might create a race to the top dynamic if the approach were adopted as a standard across frontier labs. The version 1.0 announcement carried that reasoning as a hope rather than as a result.
A responsible scaling policy is a rare public artifact: a developer writing down, in advance, the conditions under which it would stop building. How specific those conditions are decides whether the commitment can be checked by anyone outside the company.
Pros, Cons, and Risks
Advantages
- The component list forces a policy to state what aspects of current protective measures are necessary to contain catastrophic risks. It also asks what the procedures are for promptly catching early warning signs of dangerous capability limits. Evaluation work gets a target instead of a mood.
- The framework page argues that widespread adoption of high-quality responsible scaling policies would significantly reduce risks of an AI catastrophe relative to business as usual. High-quality means those that include all the key components it details.
- Adopting such commitments does not require agreement on whether major AI risks are imminent, only that certain situations would require certain risk mitigations if they came to pass. Researchers at the Carnegie Endowment for International Peace make that case, and agreement on timelines is the argument that never ends.
- Organizations signing the Frontier AI Safety Commitments undertook, in accordance with voluntary commitments, to demonstrate responsible development and deployment by publishing a safety framework focused on severe risks. Publication leaves a record a reader can return to.
Trade-offs and Risks
- Anthropic found pre-set capability levels to be far more ambiguous than it anticipated. In some cases model capabilities have clearly approached the thresholds, but the company has had substantial uncertainty about whether they have definitively passed them. The weakest joint in the instrument is measurement, and no amount of drafting fixes that.
- The framework page states that it expects voluntary commitments will be insufficient to adequately contain risks from AI. These policies were designed as a first step safety-concerned labs could take themselves, not as a substitute for regulation, now or in the future.
- Anthropic’s updates page listed 9 dated versions of the policy at its July 2026 snapshot. A commitment a reader relied on a year ago may not be the commitment in force today. Every claim about a threshold needs a version stamp attached.
- Documentation is not mitigation. A written safeguard and a safeguard that holds under adversarial pressure are different objects, and the distance between them shows up in AI jailbreaking statistics.
What the commitment does not do: A responsible scaling policy commits; it does not certify, guarantee, or remove risk. Anthropic described the ASL-3 Deployment Standard as covering a narrowly targeted set of deployment measures designed to limit the risk of Claude being misused specifically for the development or acquisition of chemical, biological, radiological, and nuclear (CBRN) weapons. Designed to limit is the register the source uses, and it is the register to carry.
Types of Responsible Scaling Commitment
Three shapes of commitment share the same phrase, and they differ in who is bound and who could ever enforce anything.
The single-developer form is a policy one company publishes about its own models. Anthropic released the first version of its Responsible Scaling Policy in September 2023 and has continued to refine it over time. The company says risk governance in this domain should be proportional, iterative, and exportable.
The industry-undertaking form appeared in the Frontier AI Safety Commitments. The signing organizations undertook to develop and deploy their frontier AI models and systems responsibly, in accordance with voluntary commitments. Those commitments date from the AI Seoul Summit.
The remaining shape treats the conditional commitment as a policy instrument in its own right. Adoption could help reduce risks by prototyping, battle-testing and building consensus around a potential framework for regulation. It could also help AI developers and others build roadmaps of what risk mitigations need to be in place by when.
| Type | What it commits to | Who it binds | Enforceable by |
|---|---|---|---|
| Single-developer policy | Named capability levels and the safeguards attached to each one | The publishing company only | The company itself, through its own governance |
| Industry undertaking | Publishing a safety framework focused on severe risks, plus explicit processes for models that meet or exceed pre-defined thresholds | The organizations that signed | Voluntary undertaking; publication is the commitment |
| Conditional commitment as policy instrument | A rule pairing capability X with mitigations Y, and a delay limb when the mitigations are not ready | Whoever adopts it | Voluntarily adopted, and potentially enforceable by regulators |
Sources: Anthropic, Frontier AI Safety Commitments, Carnegie Endowment for International Peace
Anthropic credited ARC Evals with leadership in originating and spearheading the development of their broader ARC Responsible Scaling Policy framework, which inspired its approach. That acknowledgement is the sentence most summaries of the term leave out.
Two neighboring artifacts get mixed in constantly. A system card documents a deployed system and a model card documents a trained model. A responsible scaling policy commits to future conduct instead of reporting on something already built.
Version stamping matters because the document moves: the updates page records each release with an effective date, from version 1.0 through version 3.4.
| Version | Effective date |
|---|---|
| 3.4 | July 8, 2026 |
| 3.3 | May 26, 2026 |
| 3.2 | April 29, 2026 |
| 3.1 | April 2, 2026 |
| 3.0 | February 24, 2026 |
| 2.2 | May 14, 2025 |
| 2.1 | March 31, 2025 |
| 2.0 | October 15, 2024 |
| 1.0 | September 19, 2023 |
Source: Anthropic responsible scaling policy updates page, snapshot of July 8, 2026
Who Publishes a Responsible Scaling Policy?
Anthropic publishes one and maintains a dated version index for it. The company reported that within a few months of announcing its policy, both OpenAI and Google DeepMind adopted broadly similar frameworks. Company figures for two of those developers sit in our frontier developer comparison data.
Real-World Applications
Published cases show the commitment in operation, and one of them shows where it strained:
- A single developer applying its own thresholds at a model launch.
- A group of organizations undertaking to publish a framework and the processes attached to it.
- The same developer reporting, later, where those thresholds proved hard to apply.
Anthropic: ASL-3 Activated Alongside Claude Opus 4
Anthropic activated the AI Safety Level 3 (ASL-3) Deployment and Security Standards described in its Responsible Scaling Policy in conjunction with launching Claude Opus 4. The ASL-3 Security Standard involves increased internal security measures that make it harder to steal model weights.
The company deployed Claude Opus 4 with the ASL-3 measures as a precautionary and provisional action. It stated that it had not yet determined whether the model had definitively passed the Capabilities Threshold that requires ASL-3 protections. The safeguards arrived ahead of any finding that the threshold had been crossed.
Anthropic dates the activation of ASL-3 safeguards for relevant models to May 2025. Version 2.2 of the policy took effect on May 14, 2025. The activation therefore sits under that version of the ladder rather than under the architecture the later revisions describe. Readers new to the underlying technology can start with our explainer on how large language models are built and trained.
The Seoul Signatories: Publication as the Commitment
Commitment IV asks signatories to set out explicit processes they intend to follow if their model or system poses risks that meet or exceed the pre-defined thresholds. In the extreme, organizations commit not to develop or deploy a model or system at all if mitigations cannot be applied to keep risks below the thresholds.
Nothing in the Frontier AI Safety Commitments is a statute. The text is a promise to publish and to follow a stated process, which is a different instrument from a rule a regulator can apply to a company that never signed.
Where the Mechanism Strained
Anthropic wrote that the science of model evaluation is not well-developed enough to provide dispositive answers. Its internal uncertainty, the company added, translated into a weak external case for taking multilateral action across the AI industry.
In the dated case above, the mechanism fired on an unresolved question rather than on a settled finding. One property is worth testing in any responsible scaling policy: whether it says what happens while the evidence is still unclear. That is the only moment a pre-commitment does work that a judgment call would not.
Is a Responsible Scaling Policy Legally Binding?
No. A responsible scaling policy is a commitment a developer adopts by choice. Such commitments can be voluntarily adopted by AI developers, and they also, potentially, can be enforced by regulators. That reading comes from the Carnegie Endowment for International Peace.
Anthropic describes its own policy as the voluntary framework it uses to mitigate catastrophic risks from AI systems. Potential enforcement is a separate question from enforcement in force today, and the published record supports only the weaker reading. Governance readers tracking where statutory requirements actually sit can follow our AI regulation timeline.
Has an AI Developer Ever Acted on One?
Yes, and the clearest dated instance is the ASL-3 activation. Anthropic activated ASL-3 safeguards for relevant models in May 2025. It called the step a precautionary and provisional action. Clearly ruling out ASL-3 risks was not possible for Claude Opus 4 in the way it had been for every previous model, and a more detailed study was required to conclusively assess the model’s level of risk.
The published record shows safeguards added at launch rather than a halt to training. A halt of that kind sits in the ASL system as well. Anthropic said the system implicitly requires it to temporarily pause training of more powerful models if its AI scaling outstrips its ability to comply with the necessary safety procedures. That limb covers a different situation from the one the activation describes.
Conclusion
Anthropic’s policy has moved from version 1.0, effective September 19, 2023, through version 3.4, effective July 8, 2026. The idea has held its shape across those revisions: name a capability, attach a safeguard, and say in advance what happens when the two meet. What has not held is the assumption that the meeting point is easy to observe.
Specificity is the test a reader can apply without any inside knowledge. A commitment naming an observable capability and its attached safeguard can be checked against what a developer actually ships. A commitment to act responsibly gives a reader nothing to hold, and that distance separates a governance document from a statement of intent.
