Three of the largest AI developers each publish a voluntary document that says, in effect, when a model is capable enough that it should not ship without stronger safeguards. Reading frontier AI safety frameworks side by side shows they share a skeleton but differ on who decides, what counts as evidence and what happens if competitors do not follow. This article compares Anthropic's Responsible Scaling Policy (RSP), OpenAI's Preparedness Framework and Google DeepMind's Frontier Safety Framework (FSF), using the documents themselves.
What we read, and what we did not
We read Anthropic's RSP version 3.3 in full as a PDF and its current-version page, which lists version 3.4 (effective 8 July 2026).[1][2] We read OpenAI's Preparedness Framework Version 2, last updated 15 April 2025, in full, and did not confirm whether OpenAI has published a newer version.[3] For Google DeepMind we read the announcement post for the third iteration of the FSF (22 September 2025, with an April 2026 update describing FSF 3.1), not the full framework PDF, so our DeepMind column is thinner than the other two.[4] Treat that as a limit on this comparison, not a finding about DeepMind.
The shared skeleton
Each framework follows roughly the same logic: define capability thresholds in dangerous domains, test models against them, and apply stronger safeguards when a threshold is reached. The differences are in the details.
OpenAI describes four steps: decide where to focus, measure capabilities, safeguard against severe harms, and build trust. It says it will not deploy a model that reaches a High capability threshold until the associated risks are sufficiently minimised.[3] DeepMind's post describes Critical Capability Levels (CCLs) as capability levels at which, absent mitigation, a model may pose heightened risk of severe harm, and says it applies safety and security mitigations before specific CCL thresholds are reached.[4] Anthropic maps capability thresholds to mitigations in a three-column table: the threshold, Anthropic's own planned mitigations, and what it recommends industry-wide.[1]
Side-by-side comparison
| Dimension | Anthropic RSP | OpenAI Preparedness Framework | Google DeepMind FSF |
|---|---|---|---|
| Version read | 3.3 PDF; page lists 3.4 | Version 2, 15 April 2025 | Third iteration (post of 22 Sept 2025); FSF 3.1 in April 2026 |
| Threshold vocabulary | Capability or usage thresholds in a table | Tracked Categories with High and Critical thresholds | Critical Capability Levels; Tracked Capability Levels added in 3.1 |
| Named domains in the text we read | Chemical and biological weapons, automated AI R&D | Biological and Chemical, Cybersecurity, AI Self-improvement | Harmful manipulation, misalignment, machine learning R&D (post only) |
| Key artefacts | Frontier Safety Roadmaps, Risk Reports | Capabilities Reports, Safeguards Reports | Safety case reviews |
| Who decides | Governance section; Board and Long-Term Benefit Trust receive reports | Safety Advisory Group recommends; OpenAI Leadership decides; Board committee oversees | Not stated in the post we read |
| External review | Sought for Risk Reports; required for some | Third-party evaluations may feature in deep dives | Not described in the post we read |
Anthropic: from fixed levels to published reports
Anthropic calls its RSP a voluntary framework for managing catastrophic risks and says version 3.0 was a rewrite.[1][2] The headline change is a distinction between what Anthropic expects to do regardless of competitors and ambitious industry-wide recommendations it says it "cannot commit to following unilaterally". Its stated reason is a collective action problem: if one developer paused while others proceeded without strong mitigations, "the developers with the weakest protections would set the pace".[1]
Two new artefacts carry most of the weight. Frontier Safety Roadmaps describe plans across Security, Alignment, Safeguards and Policy, and Anthropic says these are "not hard commitments but rather public goals" it will grade itself against.[1] Risk Reports give a detailed view of the safety profile of its models, published online with redactions. Version 3.3 says Anthropic will publish a Risk Report every three to six months, and that they are not published with each model release the way system cards are.[1]
On accountability, Anthropic says it will work toward public external review of Risk Reports, and calls this "an experiment" because no well-established organisations or procedures exist for it. It commits to a full external review with at least one reviewer when a report covers highly capable models and is significantly redacted.[1] The current page describes later changes, including a version 3.2 provision letting the Long-Term Benefit Trust request external review and a version 3.4 provision requiring unredacted reports to be shared with at least 200 employees.[2]
A practical point from the same page: Anthropic's own account of earlier practice lists gaps it found, such as a late evaluation and under-elicitation, which is unusual candour for a policy document and a useful reminder that evaluations are imperfect.[2]
OpenAI: the most explicit about decision-making
OpenAI's Version 2 narrows what it tracks. A capability becomes a Tracked Category only if it meets five criteria: plausible, measurable, severe, net new, and instantaneous or irremediable. The three Tracked Categories are Biological and Chemical, Cybersecurity and AI Self-improvement. Capabilities that do not yet meet the criteria become Research Categories.[3]
Thresholds are two-level. High capability means capabilities that significantly increase existing risk vectors for severe harm, and covered systems crossing it need robust safeguards before deployment. Critical capability means a meaningful risk of a qualitatively new threat vector, and requires safeguards even during development, irrespective of deployment plans.[3]
The evaluation design is spelled out. Scalable Evaluations are automated proxies with pre-determined "indicative thresholds"; Deep Dives validate them with evidence such as human expert red-teaming and third-party assessments. The text also treats a one-time capability elicitation as "a lower bound, rather than a ceiling".[3] Results go into a Capabilities Report for the Safety Advisory Group (SAG), whose determination "also reflects holistic judgment", not just scores.[3]
The governance chain is the clearest of the three: the SAG makes recommendations, OpenAI Leadership can approve or reject them, and the Board's Safety and Security Committee provides oversight. The text also says Leadership can decide without the SAG, so the SAG cannot "filibuster".[3]
Google DeepMind: CCLs, manipulation and misalignment
The post announces a new CCL for harmful manipulation, aimed at models with powerful manipulative capabilities that could systematically change beliefs and behaviours in high-stakes contexts. It also extends the framework to scenarios where misaligned models might interfere with operators' ability to direct, modify or shut down their operations, and adds protocols for machine learning R&D CCLs.[4]
For process, it describes safety case reviews before external launches when relevant CCLs are reached, extended to large-scale internal deployments for advanced ML R&D CCLs, and holistic assessments ending in "explicit determinations of risk acceptability". The April 2026 update, FSF 3.1, adds Tracked Capability Levels to flag less extreme risks earlier.[4]
The escape clauses
The most revealing sections are the ones about competitors. OpenAI's text says that if another developer releases a High or Critical system without comparable safeguards, OpenAI could adjust its required safeguards, but only if it assesses that this does not meaningfully increase overall risk, publicly acknowledges the change, and keeps safeguards more protective than the other developer's.[3] Anthropic's version 3 makes the competitor question structural: it separates unilateral plans from industry-wide recommendations and adds competitor-contingent commitments in an appendix.[1] We did not find an equivalent clause in the DeepMind post, which does not mean one is absent from the full framework.
What the documents cannot tell you
- Whether thresholds were crossed. The frameworks define how a company decides; the outcome appears in system cards and reports, which are written by the same company.
- How good the evaluations are. Anthropic's page admits past gaps in elicitation; OpenAI says one-time elicitation is a lower bound. Both are signals to read results as floors.[2][3]
- Whether they will be followed or revised. Anthropic calls its RSP a living document and has issued several versions since February 2026, and DeepMind's post describes a third iteration followed by FSF 3.1 in April 2026; OpenAI's text says it expects to update the framework again before any model reaches Critical capability.[1][2][3][4]
- How they relate to law. Anthropic says its RSP "may serve some regulatory requirements" but is not designed to be comprehensive.[1]
How to use this when reading a launch
- Find which framework version the system card cites and its date.
- Look for the threshold statement: which domains were evaluated, and was a threshold judged crossed or not?
- Check whether outside parties were involved and what they could see.
- Note whether the claim is a measured result or a judgement ("holistic").
- For related reading, see how to read an AI benchmark claim and the NIST AI Risk Management Framework explained. Browse more in safety and policy.
Our interpretation: the frameworks converge on structure and diverge on accountability. Where a document names the decider and the evidence, you can check a launch against it. Where it relies on judgement, you are trusting the process, which is a different thing from verifying the result.
