⚡ Quick Summary
Published by Anthropic, this document sets out version 1.0 of the company's Responsible Scaling Policy, effective 19 September 2023. It commits Anthropic to a framework of AI Safety Levels (ASL), modelled loosely on the US government's biosafety level standards, in which each successive capability threshold brings stricter safety, security and operational measures. The framework separates deployment risks, arising from active use of a model, from containment risks, arising from merely possessing its weights, and names misuse and autonomy/replication as the two sources of catastrophic risk it targets.
The initial commitments cover ASL-2, the current level, at which Claude 2 and similar frontier models are placed, and ASL-3, described as the next level of risk and defined by misuse potential or early signs of autonomous self-replication. Anthropic commits to pause training before a model outgrows its containment measures, to evaluate after every 4x increase in effective compute while holding a 6x safety buffer, and to procedural commitments including an Update Process with board approval and a designated Responsible Scaling Officer. Appendices give the ASL-3 autonomy evaluation tasks, the misuse evaluation methodology and ASL-2 and ASL-3 security themes. ASL-4 is discussed only as speculation.
🧩 What’s Covered
- Framework: defines AI Safety Levels (ASL-1 through ASL-5 and beyond) modelled loosely on biosafety levels, splitting risk into deployment risks from active use and containment risks from possessing weights, and committing Anthropic to pause scaling or delay deployment when compliance lags capability.
- Sources of catastrophic risk: identifies misuse (CBRN and cyber threats) and autonomy and replication as the risk sources shaping its evaluations, with catastrophe defined as thousands of deaths or hundreds of billions of dollars in damage.
- Initial commitments: five elements — ASL-2 measures, ASL-3 measures, an iterative commitment to define ASL-4 before training ASL-3 models, an evaluation protocol, and procedural commitments.
- ASL-2 commitments: capabilities and threat model, containment measures treating model weights as core intellectual property, and deployment measures including model cards, an acceptable use policy, vulnerability reporting, harm refusal techniques and trust and safety classifiers.
- ASL-3 commitments: capability thresholds set by misuse risk or a 50% aggregate success rate on autonomy tasks; security against non-state and state attackers; internal compartmentalization; and deployment measures such as expert red-teaming of every modality, automated detection, 30-day retention of inputs and outputs, tiered access and rapid patching of vulnerabilities.
- Evaluation protocol: evaluation after every 4x jump in effective compute and every three months, a 6x safety buffer, mid-training evaluations, and a response policy covering pausing, weight lockdown, possible deletion and de-deployment.
- Procedural commitments: eight measures including the Update Process with board and Long-Term Benefit Trust approval, distribution partner safety evaluation, planning for a pause in scaling, a Responsible Scaling Officer and a non-compliance reporting policy.
- Appendices: version history, five ASL-3 autonomy evaluation tasks with prompts and resolution criteria, the three-step misuse evaluation method (threat models, capabilities, evaluations), and ASL-2 and ASL-3 security themes based on a forthcoming RAND report.
💡 Why it matters?
For labs, safety teams and auditors, this is a worked example of tying capability thresholds to binding internal safeguards rather than to fixed model versions: each level states what must be true before training continues or a model is deployed, and the response policy states what happens when an evaluation triggers. Its pause commitment, distribution-partner clause and quarterly reporting to the board give governance and compliance functions concrete hooks to test. The document positions itself alongside emerging UK, EU and US policy proposals, the White House voluntary commitments and the RSP framework of Paul Christiano and ARC Evals.
❓ What’s Missing
ASL-4 measures, thresholds and evaluations are explicitly described as speculation, so anything beyond ASL-3 is undefined; Anthropic commits only to define ASL-4 before training ASL-3 models. The misuse evaluation work is not yet published, and the security appendices summarise themes while pointing to a forthcoming RAND report for the full set of implemented measures. The document acknowledges that dangerous-capability evaluations are a nascent area, that generative model capabilities cannot be upper-bounded, that threat models are disputed, and that harms such as misinformation, bias and toxicity are outside its scope. Verification rests on internal processes; external audits appear only as a possible ASL-4 element.
👥 Best For
Frontier-lab policy and safety leads drafting or benchmarking scaling policies; governance and risk committees that need to see how capability thresholds, evaluation triggers and pause commitments are specified; auditors and researchers assessing whether voluntary commitments are binding and verifiable; and enterprise AI teams seeking a reference model for linking model capability to internal controls.
📄 Source Details
Anthropic's Responsible Scaling Policy, Version 1.0, published by Anthropic, effective 19 September 2023; the version history records "v1.0 (Sep 19, 2023): Initial version". The document runs to 22 pages in English and carries no series or reference number. It states that the most recent version can be found at http://anthropic.com/responsible-scaling-policy. The analysis covers the full text extracted from all 22 pages. No individual authors are named.
