Frontier safety frameworks read as a version diff

What the frameworks are, and what moved

Anthropic, OpenAI, Google DeepMind, Meta, and xAI each publish a voluntary document that sets capability thresholds, evaluation commitments, and conditions for deployment. These are among the more developed self-governance instruments in any industry. They are also the operative constraint on frontier model release, since binding regulation is only now arriving.

Every one of these documents has been revised. Anthropic has published nine versions of its Responsible Scaling Policy since September 2023, four of them between February and July 2026. Google DeepMind is on version 3.1. Meta rewrote and renamed its framework in April 2026. The revisions carry information that the first drafts do not: what a company changed while operating under competitive and regulatory pressure describes its posture more precisely than what it wrote before shipping anything.

Four movements show up across the set.

• Pause language became conditional. Anthropic's version 3.0 dropped the general pause commitment and separated what it will do alone from what it recommends the industry adopt. Meta's Critical tier action changed from stop development to develop with mitigations.
• Competitor-conditional clauses spread. Anthropic, OpenAI, and Google DeepMind each hold a provision permitting relaxed safeguards if another developer proceeds without comparable ones. Meta holds no such clause in either version.
• Manipulation moved in three directions at once. OpenAI removed persuasion as a tracked category in April 2025. DeepMind added a harmful manipulation threshold in September 2025. Anthropic and Meta have never tracked it.
• Transparency machinery grew as commitments loosened. Named risk reports, external review rights, and board oversight all expanded in the same versions that softened the hard tripwires.

How the comparison was built

Primary documents were retrieved from company domains and content delivery networks, and cross-checked against the METR Frontier AI Safety Policies index for version numbers and dates. Secondary sources establish that a version exists or attribute named commentary. They are never presented as document text.

Each version is compared against its predecessor on the same nine dimensions, so the cross-company read is possible. Quotations are held under 15 words and attributed to document and version. Claims that could not be confirmed against a primary document were moved to the anomalies section rather than left asserted.

Twenty-eight versions, three years

The set below covers every published version located as of 18 July 2026. Retrieval status records whether the document itself was read, whether an archive capture stood in, or whether existence rests on an index entry.

Corpus table

A page-count column was omitted. Counts could be confirmed for only 6 of the 30 entries, and a column that is mostly empty asserts less than it implies. The unresolved counts are recorded in the anomalies section. Amazon's document states 9 February 2025; the METR index labels it 10 February 2025.

Responsible Scaling Policy

The RSP was the first document of its kind, published September 2023. It sets AI Safety Levels, assessment procedures, and required safeguards, and governs decisions on training and deployment. Anthropic maintains a public changelog and publishes redline comparisons for point releases, a practice no other developer in the set matches.

Version history

Nine versions: v1.0 (19 September 2023), v2.0 (effective 15 October 2024), v2.1 (31 March 2025), v2.2 (14 May 2025), v3.0 (24 February 2026), v3.1 (2 April 2026), v3.2 (29 April 2026), v3.3 (26 May 2026), v3.4 (8 July 2026). Four revisions landed in roughly four months in 2026.

Diff by dimension

D3 · Commitment modality

Version 3.0 is the substantive shift in the entire corpus. Anthropic separates what it commits to unilaterally from what it recommends the industry adopt, and names the reason.

The most demanding measures now sit in a recommendations tier that Anthropic will strive to advance but cannot commit to following ... unilaterally. Frontier Safety Roadmap goals are described as nonbinding but publicly-declared targets.

D5 · Response and mitigation commitments

The general pause commitment was dropped in v3.0. Version 3.1 then clarified that the option remains available without the obligation.

D4 · Triggering and timing

Version 3.0 extended the routine evaluation interval from three months to six. Anthropic acknowledges in the same document that its most recent evaluations were completed 3 days later than the three-month interval, and that it identified instances where it fell short of meeting the full letter of its requirements.

D8 · Security commitments

Anthropic continues to commit unilaterally to the ASL-3 security standard. The more demanding RAND Security Level 4, which addresses state-level weight theft, moved into the industry-wide recommendations tier. The v3.0 announcement describes RAND's SL5 as currently not possible.

D6 · Governance and accountability

Governance expanded while substantive commitments loosened. Version 3.2 authorises the Long-Term Benefit Trust to request external review of Risk Reports, approve external reviewers, and receive regular briefings. Version 3.4 changed the internal disclosure requirement.

D1, D2, D7, D9 · In brief

• D1 thresholds. Version 3.0 reframes the AI research and development threshold around compressing two years of 2018 - 2024 AI progress into a single year. Version 3.1 clarified this means rate of progress, not researcher productivity. Versions 3.3 and 3.4 each revised a threshold to better track the threat model of concern.
• D2 categories. Centred on CBRN and autonomous AI research and development. Cyber operations sits under ongoing assessment in v2.0 rather than as a committed threshold. No persuasion or manipulation category has appeared in any version.
• D7 conditional withdrawal. Version 3 relocates competitor provisions into an appendix titled Commitments Related to Competitors.
• D9 scope. Risk Reports cover all publicly deployed models and, where risk warrants, internal models.

Reading

The RSP moved from a document of pre-committed unilateral tripwires to one that distinguishes unilateral action from industry recommendation, paired with new transparency instruments and expanded trust oversight. Anthropic names the collective action problem as the driver and acknowledges past shortfalls against the letter of prior requirements. Whether the trade is favourable depends on whether the reporting and external review provisions bind as firmly in practice as the pause commitment they partly replaced.

Preparedness Framework

Published in beta on 18 December 2023 and revised once, on 15 April 2025. A separate Frontier Governance Framework followed on 28 May 2026, which OpenAI states does not replace the Preparedness Framework. Two full versions makes this the least-revised framework among the four primary subjects.

Diff by dimension

D1, D2 · Thresholds and categories

The beta used four tracked categories on a four-level scale, gating deployment at medium or below post-mitigation and halting development at critical. Version 2 collapsed the scale to two operative thresholds and reduced the tracked set to three categories.

Version 2 defines High capability as capability that could amplify existing pathways to severe harm and Critical as capability that could introduce unprecedented new pathways to severe harm. The biological and chemical High threshold is tied to meaningful counterfactual assistance to novice actors.

D7 · Conditional withdrawal

Absent in the beta. Version 2 introduced a marginal-risk clause under which OpenAI may adjust our requirements if another developer releases a high-risk system without comparable safeguards, provided it confirms the change does not net increase severe-harm risk, acknowledges the adjustment publicly, and keeps safeguards more protective.

D3, D4, D5 · Modality, triggering, mitigation

Version 2 applies a five-part test to what qualifies as a tracked risk: risks must be plausible, measurable, severe, net new and instantaneous or irremediable. It formalises Capabilities Reports and Safeguards Reports reviewed by the Safety Advisory Group, and states that reducing risk generally does not require reducing capability. The beta's commitment to test fine-tuned versions of models was removed.

D6 · Governance

The beta gave the board the right to reverse leadership safety decisions, and version 2 preserves it: the Board may reverse a decision and mandate a revised course of action. The Safety Advisory Group recommends to leadership, with the chief executive or a designee holding final authority.

Reading

Version 2 narrowed the tracked set from four categories to three, simplified four risk levels to two operative thresholds, and added an explicit conditional relaxation clause. OpenAI frames these as sharper focus and better measurability. The May 2026 Frontier Governance Framework is a compliance mapping layer to California SB 53 and the EU code of practice rather than a tightening of the underlying thresholds.

Frontier Safety Framework

Four versions since May 2024. The framework is built on Critical Capability Levels, thresholds at which a model could cause severe harm without mitigation, matched to recommended security levels and deployment mitigations. It is the most process-oriented document in the set, specifying what will be measured and reviewed more than what action follows.

Version history

v1.0 (17 May 2024), v2.0 (4 February 2025), v3.0 (22 September 2025), v3.1 (17 April 2026). The current document states Version 3.1 (April 17, 2026).

D2 · Evaluation categories

Version 3.0 added a Critical Capability Level for harmful manipulation, covering models with capabilities that could be misused to systematically and substantially change beliefs and behaviors in identified high-stakes contexts. The 22 September 2025 announcement was authored by John Flynn, Helen King, and Anca Dragan.

D4, D6 · Triggering and governance

Evaluations run at a regular cadence and after a significant capability jump. Version 3.0 extended safety case review to large-scale internal deployments, stating that for advanced machine learning research and development levels, large-scale internal deployments can also pose risk. The framework commits to sharing model information, evaluation results, and mitigation plans with governments where a model reaches a level posing material risk. Review runs through internal bodies including the AGI Safety Council. As an Alphabet division, DeepMind has no independent board structure of its own.

D7 · Conditional withdrawal

Version 3.1 states that the social value of certain mitigations is significantly reduced if not broadly applied, and that recommended security levels may be adjusted if our understanding of the risks changes, for example where a model does not possess capabilities meaningfully different from other publicly available models. DeepMind judges when the condition is met.

D3 · Commitment modality

Manipulation and misalignment research is described as nascent, and the associated level and risk assessment as exploratory and subject to further research. These qualifiers carry across versions and are the framework's principal source of flexibility.

Reading

DeepMind's framework expanded across 2025 and 2026, adding a manipulation threshold, an early warning tier, and internal deployment safety cases. It buys flexibility through process language and exploratory qualifiers rather than through weakened commitments, and it couples this with an explicit statement that the value of some mitigations depends on industry-wide adoption.

Frontier AI Framework, now Advanced AI Scaling Framework

Meta published the Frontier AI Framework on 3 February 2025, ahead of the Paris AI Action Summit, and replaced it in April 2026 with a renamed second iteration. The framework operates in the context of open-weight release, which makes its adversary modelling and its trigger language the load-bearing choices.

Version history

v1.0 (3 February 2025) and v2.0 (8 April 2026 per the announcement, 7 April 2026 per the document change log). The framework describes itself as the second iteration, previously titled the Frontier AI Framework.

D1, D3 · Threshold language and modality

The primary standard changed, and so did the consequence attached to the highest tier. These two changes run in opposite directions.

D2 · Evaluation categories

Version 1 covered cybersecurity and chemical and biological risk. Version 2 adds Loss of Control as a third domain, decomposed into autonomous AI research and development, evaluation awareness (whether a model can identify when it is being evaluated and selectively adapt its outputs), monitor interference, and autonomous replication as an emerging concern. No persuasion or manipulation domain appears in either version.

D6 · Governance

Version 1 located the release decision with an unnamed leadership team. Version 2 names the Chief AI Officer and the Director of Alignment and Risk as the decision-makers who assign risk thresholds and approve deployment, and adds a published Model Spec listing intended propensities including acquiescence to shutdown and lack of coercive power-seeking behavior.

D7 · Conditional withdrawal

Neither version contains a competitor-conditional relaxation clause. This is a confirmed absence against the retrieved version 2 text and the archived version 1, and it distinguishes Meta from the other three primary subjects.

D9 · Definitional scope

Version 2 expands the deployment taxonomy to internal deployment, limited deployment, controlled deployment, closed release, or open release, and states that Loss of Control risks may occur with similar probability with any type of deployment, including internal deployment. The four-part inclusion test is plausible, catastrophic, net new, and instantaneous or irremediable.

Reading

Version 2 broadens scope and lowers the trigger while converting the top-tier consequence from a halt to a mitigation pathway, and it names individual officers as accountable decision-makers. The governance additions are specific and auditable. Meta remains the only primary subject with no competitor-conditional clause.

xAI, Microsoft, Amazon, and the rest of the signatory set

xAI

xAI published a draft Risk Management Framework watermarked DRAFT on 20 February 2025, the Seoul commitment deadline, promising an updated version within three months. Version 1.0 followed on 20 August 2025, roughly six months past that deadline. It states a quantitative deployment criterion: maintaining a dishonesty rate of less than 1 out of 2 on MASK.

xAI released Grok Code Fast 1 on 28 August 2025, eight days later. The model card reported a 71.9 percent dishonesty rate on the same benchmark. AI Lab Watch's Zach Stein-Perlman described the framework as dreadful and profoundly unserious. This is named external commentary, cited to establish the criticism rather than as document text.

A renamed Frontier Artificial Intelligence Framework version 2.0 followed on 30 December 2025, two days before California's Transparency in Frontier Artificial Intelligence Act came into force. A further revision dated 30 June 2026 is a distinct document at a separate address, resolving the question of whether these are two revisions or a relabelling. The Midas Project reports that the June 2026 revision removed both quantitative risk acceptance criteria and whistleblower protection language; this is secondary reporting.

Microsoft

Microsoft published its Frontier Governance Framework in February 2025. It sets qualitative capability thresholds, scales security safeguards to pre-mitigation risk levels across four bands, and integrates with Microsoft's wider AI governance programme. A February 2026 update exists as a distinct primary document. What changed between the two could not be established from a primary comparison in this pass and is carried as an open item.

Amazon

Amazon published its Frontier Model Safety Framework on 9 February 2025, tied to the Paris summit and its endorsement of the Korea Frontier AI Safety Commitments. It defines Critical Capability Thresholds across CBRN, offensive cyber operations, and automated AI research and development, and commits not to deploy models exceeding thresholds without safeguards. The document commits to review at least annually. No second version appears as of 18 July 2026. Amazon has instead published model-specific evaluations under the framework, including for Nova Premier and Nova 2.0 Lite.

The remainder of the signatory set

Cohere, G42, NAVER, Nvidia, and Magic remain at their first published versions with no second version indexed. Nvidia's and Cohere's documents emphasise domain-specific rather than catastrophic risk. No published second version was found for Zhipu or Samsung, neither of which appears on METR's published-policy list.

METR's December 2025 update records that sixteen companies agreed to the Seoul commitments with an additional four companies joining since then, and that twelve companies have published frontier AI safety policies. As of 18 July 2026 the public index still reflects that count.

Where the documents converge and where they part

Convergent movement

All five major developers now use a capability threshold structure paired with pre-committed responses. Loss of control and misalignment has become a shared domain: DeepMind through misalignment levels, Meta through Loss of Control as a third domain, OpenAI through the Frontier Governance Framework, and Anthropic through an affirmative misalignment case at its research and development thresholds. Named risk-reporting artefacts now exist at all four primary subjects.

Competitor-conditional clauses are the second convergence. Three of the four primary subjects hold one. Anthropic elevated the concept from an emergency provision to the organising logic of version 3.

Divergent movement

The clearest divergence is manipulation. Within roughly fourteen months the four primary frameworks moved in three different directions on the same capability.

Modality diverges as well. Anthropic separated unilateral commitments from industry recommendations and dropped its pause commitment. OpenAI added a conditional relaxation clause. Meta lowered its trigger but holds no competitor clause. DeepMind expanded scope at every revision. xAI relies on quantitative benchmark thresholds that no other developer uses.

Terminology drift

The four now describe similar constructs in language that no longer maps cleanly. Cross-company comparison on any single capability requires translation, which is itself a finding.

Revision timing against external events

Revision dates cluster around summit and regulatory milestones. The pattern is correlation and is stated as such; companies give multiple reasons for revisions, including learning from implementation.

• February 2025. Meta v1.0, DeepMind v2.0, Microsoft v1.0, Amazon, G42, Cohere, Nvidia, and the xAI draft all land in the weeks around the Paris AI Action Summit.
• 30 December 2025. xAI publishes version 2.0 two days before California's Transparency in Frontier Artificial Intelligence Act takes effect.
• February 2026. The India AI Impact Summit produces the New Delhi Frontier AI Impact Commitments, signed by thirteen developers, and a declaration endorsed by 92 countries and international organisations. These address usage insights and multilingual evaluation rather than catastrophic-risk thresholds.
• May and June 2026. OpenAI's Frontier Governance Framework and Microsoft's update map to SB 53 and the EU code of practice. A US executive order of 2 June 2026 creates a voluntary pre-release government access framework for covered frontier models, with an access window of up to 30 days, and expressly prohibits mandatory licensing or preclearance.
• 2 August 2026. EU AI Act systemic-risk obligations for general purpose AI take effect, ahead of which the 2026 revision wave sits.

What did not resolve cleanly

Items below did not confirm against a primary document in this pass, or produced conflicting evidence. They are recorded rather than resolved.

Corpus close

No framework activity was found later than 8 July 2026. Anthropic's policy page states last updated 8 July 2026. No OpenAI Preparedness Framework version 3 exists. DeepMind's current version remains 3.1. Meta has published no revision after version 2.0.