Responsible Scaling Policies Explained

A Responsible Scaling Policy (RSP) is a frontier lab's public commitment to pause or add safeguards when models cross defined capability thresholds. Anthropic introduced the concept in September 2023. OpenAI published its analog (Preparedness Framework) in December 2023. Google DeepMind followed with its Frontier Safety Framework in May 2024. Meta, xAI, and Cohere all have some version now.

The Anthropic RSP architecture (v2.2, 2025)

Anthropic's RSP defines AI Safety Levels (ASL) modeled on biosafety levels (BSL) for pathogens. Each level specifies capabilities and required safeguards.

• ASL-1: No meaningful catastrophic risk (2018-era models, narrow chess AIs)
• ASL-2: Early signs of dangerous capability but unreliable (most current LLMs)
• ASL-3: Substantial uplift on CBRN misuse or meaningful autonomous AI R&D. Triggered May 2025 for Anthropic's frontier models. Requires stronger weight security and deployment restrictions.
• ASL-4: Not yet defined concretely; associated with qualitative escalations in autonomy and misuse potential
• ASL-5: Placeholder for far-future concerns

What capabilities actually trigger the next level?

1. 1CBRN uplift: can the model meaningfully help a novice with a bioweapon?
2. 2Cyber uplift: does it enable attacks that were previously infeasible?
3. 3Autonomous replication: can it copy itself across machines without human help?
4. 4AI R&D acceleration: can it fully automate junior-researcher AI work?
5. 5Persuasion: does it meaningfully exceed human baselines in influence operations?

OpenAI's Preparedness Framework

OpenAI rates models across four risk categories (cybersecurity, CBRN, persuasion, model autonomy) on a low/medium/high/critical scale. Models scoring high can be deployed only with mitigations; models scoring critical cannot be trained further until mitigations work. Pre-mitigation score matters — mitigating a critical model back to medium does not let you train the next one without reviewing.

Compare: the three big-lab frameworks

What RSPs get right

• Specificity: concrete capability thresholds, not vague commitments
• Pre-commitment: easier to honor restrictions announced before a race
• Safeguard ladders: security and deployment measures scale with capability
• Publicness: the document can be evaluated and critiqued by outsiders
• Interoperability: Seoul Summit Commitments use RSP-style language

What critics hammer

• Self-imposed: no external enforcement, can be amended by the company at will
• Revisable mid-race: Anthropic moved some thresholds between RSP versions
• No peer consistency: what triggers ASL-3 at Anthropic is not what triggers high at OpenAI
• Eval quality: thresholds are only as good as the evaluations probing them — and evals are still immature
• Incentive problem: the company running the evals has a business interest in passing

The relationship to law

The EU AI Act refers to GPAI Code of Practice signatories and treats RSP-style commitments as presumption-of-compliance for some systemic-risk obligations. The UK AISI MOUs with labs include pre-release evaluation rights that rely on the labs' own classifications. US Executive Order 14110 (2023) required dual-use foundation model reporting, modified by Trump administration EOs in early 2025 but with some evaluation requirements preserved. Soft commitments and hard law are converging, slowly.

“A commitment is not a guarantee. It is a promise plus a mechanism for catching yourself when you are about to break it.”

The big idea: RSPs are the frontier labs' admission that some capabilities should change how a model is handled. They are imperfect, self-enforced, and strictly better than nothing. Knowing their architecture lets you read any new safety announcement against the actual document it cites.