Every Major Lab's AI Safety Framework, Compared

Every major AI lab now publishes a safety framework, and every framework promises roughly the same thing: test the model, set a threshold, and stop or restrict the release if the risk crosses it. Read side by side, the documents differ in exactly the places that decide whether the promise binds. Anthropic's Responsible Scaling Policy, first published in September 2023, was the first such framework and the most explicit about pausing, until version 3.0 in February 2026 removed that hard pause language. OpenAI's Preparedness Framework version 2, effective April 2025, gates deployment by risk category. Google DeepMind's Frontier Safety Framework version 3, from September 2025 and updated in April 2026, requires a safety case before deployment. Meta's Frontier AI Framework uses outcome based thresholds. This comparison puts those four, plus Mistral and xAI, on the same table, with version dates, so a reader can see what each lab actually commits to, what it only recommends, and what an outside assessor thought of the paper trail.

The shared skeleton, and why it is not enough

All three leading frameworks share the same skeleton, as METR's comparison of frontier safety policies shows. First, a short list of risk domains severe enough to justify gating a release: biological and chemical weapons uplift, offensive cyber capability, and AI systems that accelerate AI research itself appear in all three, with DeepMind adding harmful manipulation as its own critical capability level. Second, a capability threshold per domain, the point at which the risk changes character. Third, evaluations run on checkpoints during and after training to decide whether a threshold has been crossed or cannot be ruled out. Fourth, safeguards that must be in place before a model at a given level can be deployed, or in some cases trained further. Fifth, governance and disclosure: who makes the call, and what gets published afterwards. The skeleton is reassuring until you ask the questions that separate a commitment from a description. Who decides that a threshold is crossed, and can they be overruled by product leadership? What happens, in writing, if the mitigations are not ready on launch day? And what does the public get to see, a summary, a report, or the evaluation results? The labs answer those questions differently, and the differences are the comparison.

Anthropic: the framework that changed its own mind

Anthropic's version 3.0 is the most important revision in this comparison, because it rewrote the commitment that made the original policy famous. The 2023 policy committed Anthropic not to train or deploy models capable of causing catastrophic harm unless safety measures kept risks below acceptable levels, which readers reasonably took as a pause promise. Version 3.0, effective February 24, 2026, replaced that unconditional pause with a more conditional approach, and split the document into two parts: what Anthropic commits to on its own, and a capabilities to mitigations map it recommends for the whole industry, on the grounds that some protections at higher levels cannot be achieved by one company alone. In exchange it added transparency machinery the earlier versions lacked: a public Frontier Safety Roadmap with goals Anthropic grades itself against, and Risk Reports every three to six months covering capabilities, threat models, and active mitigations, with external reviewers given largely unredacted access where required. Anthropic's chief science officer, Jared Kaplan, told TIME that a unilateral pause would not help anyone if competitors kept advancing, which is a coherent argument about collective action and also a weaker commitment than the one it replaced. A buyer should read version 3.0 as two documents in one: a real transparency program, and a pause promise that now depends on competitive conditions. The practical sign that the framework bites is product tiering: the cyber and life science capable Claude Mythos 5.1 is available only through trusted access programs, while Claude Fable 5.1 is generally available. Satya Nadella Wants an Emergency Brake on Every AI Model made the same point from the other side: a brake that only works when everyone agrees to use it is a coordination problem, not a technical feature.

OpenAI and DeepMind: gates, cases, and who decides

OpenAI's Preparedness Framework version 2 keeps deployment gates for three tracked categories, biological and chemical risk, cybersecurity, and AI self improvement, and lists other areas, such as sandbagging and autonomous replication, as research categories outside those gates. Models rated High risk are not deployed without safeguards, and a Safety Advisory Group advises while leadership decides, which means the gate is real but the final decision sits with the same executives who own the launch date. DeepMind's Frontier Safety Framework version 3 takes a different approach to the same problem: it defines Critical Capability Levels, including one for harmful manipulation that the other frameworks do not separate out, and it requires a safety case, an argued claim that the model is safe to deploy in a specific context, before release, with security mapped to RAND levels. A safety case is stronger than a checklist because it forces the lab to argue, in writing, why the mitigations fit the deployment, but it is also only as strong as the reviewer who can reject it, and DeepMind's governance sign off sits inside its corporate structure. The contrast worth remembering is simple: OpenAI gates by category score, DeepMind gates by argued case, Anthropic gates by safety level plus transparency reports. None of the three publishes its full evaluation results, so all three require the reader to trust the summary of tests they cannot rerun. Anthropic Warns of Self-Replicating AI Worms. The Evidence showed why that trust is hard to grant: the same lab warning about a risk category is also the lab grading its own mitigations for it.

Meta, Mistral, and xAI: where the paper trail thins out

The Future of Life Institute's 2026 grades, which assess published frameworks across six domains, put the gap in numbers: Anthropic C+, OpenAI C, Google DeepMind C, Meta D+, Mistral F, xAI F. Those grades are one assessor's judgment, not a regulatory verdict, and they measure the published paper trail, not the lab's actual behaviour, but they track the same pattern this comparison finds in the documents. Meta's Frontier AI Framework describes outcome based thresholds, Moderate, High, and Critical, and says development pauses if Critical risk is unmitigated, yet it publishes less about dangerous capability testing, thresholds, and decision rights than the three leaders, and it did not sign the EU General Purpose AI Code of Practice. Mistral signed the full Code and offers EU hosting and open weight models a buyer can run and audit, which is valuable for data sovereignty, yet it scored F in five of six FLI domains because it publishes little about testing and thresholds, and with open weights the safeguards move to whoever deploys the model. xAI signed only the Code's safety and security chapter and received an F. The lesson is not that open weights are unsafe or that signing a code is meaningless. It is that a framework's value is the product of two things, what it promises and what a buyer can verify, and the labs at the bottom of this table are thin on the second factor even where their products are useful.

The buyer checklist: five checks before you trust a framework

First, check the version date and the change log. A framework cited without a version is already suspect, because Anthropic revised its policy three more times in the three months after version 3.0, and DeepMind updated its framework in April 2026. Second, ask who can say no, and whether that person has ever done so in public. A gate with no recorded refusal is a process description, not a control. Third, ask what is published after a release: a Risk Report on a schedule, a safeguards report, or a summary with no date. Fourth, ask whether the framework covers the risk you actually face. A lab strong on bioweapons and silent on manipulation is not strong for a deployment built around persuasion. Fifth, ask what happens when the mitigations are not ready: delay, restricted release, or launch with a note. Anthropic's trusted access tiering, DeepMind's safety case, and OpenAI's category gates are three different answers, and a buyer should pick the vendor whose answer matches their own risk tolerance, then write it into the contract, because a voluntary framework is not enforceable unless the contract makes it so. How AI Watermarking Actually Works, and Where It Breaks is the cautionary companion to this checklist: a safeguard that exists on paper and fails in practice, like a watermark that degrades under paraphrase, is worse than no safeguard, because it invites reliance it cannot support.

What to watch next

Three developments would change this table. Anthropic's next Risk Report will show whether the transparency machinery of version 3.0 survives contact with a competitive launch window, or whether reporting slips when a release is at stake. OpenAI's next Preparedness revision will show whether its research categories, sandbagging and autonomous replication, graduate into deployment gates, or stay as observations. And the EU Code of Practice will show whether voluntary signing hardens into procurement requirements, because buyers in regulated industries are already treating a missing framework, or an F grade, as a procurement risk on its own. Until then, the fair verdict is that the frontier labs have built a shared language for talking about catastrophic risk, and only a partial system for stopping it. The language is genuinely useful: it lets a buyer compare thresholds, demand a safety case, and ask for a dated report. The system is partial because every gate still ends with the lab deciding about its own product, and the strongest pause promise in the set has already been rewritten into a conditional one. Treat these frameworks as evidence about a lab's seriousness, not as proof of its safety, and recheck the version date every time you cite one.

By ByteHerald Staff. METR, Common Elements of Frontier AI Safety Policies, compared threat model coverage across frontier policies, including Anthropic's Responsible Scaling Policy version 2.2, OpenAI's Preparedness Framework version 2, Google DeepMind's Frontier Safety Framework version 3.0, and Meta's Frontier AI Framework. AI Workshop, October 2026, compared Anthropic Responsible Scaling Policy version 3, OpenAI Preparedness Framework version 2, Google DeepMind Frontier Safety Framework, Meta, Mistral, and xAI, reporting Anthropic ASL-3 active since May 2025, version 3.0 effective February 24, 2026, and Future of Life Institute 2026 grades of C+ for Anthropic, C for OpenAI, C for DeepMind, D+ for Meta, and F for Mistral and xAI, plus EU General Purpose AI Code of Practice signing status. AI Cassindra, frontier labs in depth, reported that Responsible Scaling Policy version 3.0 separates Anthropic's own commitments from industry recommendations, removed the earlier pause implication, and added periodic Risk Reports and a Frontier Safety Roadmap. ET Enterprise AI, February 25, 2026, reported the three key version 3.0 updates: separation of commitments and recommendations, the Frontier Safety Roadmap, and Risk Reports every three to six months with external review.