Responsible Scaling, if-then commitments and their erosion

A Responsible Scaling Policy is one commitment stated as an if-then: if a model crosses a defined capability threshold, then a matching set of safeguards must be in place before it can be trained further or deployed. The threshold is the trigger; the safeguard is the response. Nothing about the model's power is capped directly; what is capped is how far capability may run ahead of controls.

Read as a governance artifact, the structure is familiar. The capability thresholds are risk tiers; the mandated safeguards are control baselines that step up as the tier rises. What is unusual is the enforcement: the assessment is self-administered, the commitment is voluntary, and the only real penalty for backsliding is reputational. There is no regulator, no external auditor with stop authority, no certification body. It is a control framework a company points at itself and promises to obey.

That makes it exactly the kind of thing worth reading closely. The document below is Anthropic's (currently RSP v3.3), but the questions it raises are the questions any GRC function should ask of a vendor's "we follow a responsible scaling policy" claim: what trips the tier, who checks, and what has quietly changed between versions.

AI Safety Levels

The tiering scheme is modelled on the Biosafety Levels (BSL-1 through BSL-4) used in labs handling dangerous pathogens: a deliberate borrowing, because the reference class is catastrophic, low-frequency, high-consequence risk rather than everyday product harm. Anthropic calls its tiers AI Safety Levels (ASL).

Each level carries two distinct standards, and the split matters. A Deployment Standard governs what users can do with the model in the world: refusals, classifiers, misuse controls. A Security Standard governs whether the model's own weights can be stolen, the assumption being that a sufficiently capable model is itself the hazardous material. A model can meet one and fail the other, so the two ladders are tracked separately.

ASL-1 is the floor: systems with no meaningful catastrophic risk, the 2018-era language models, requiring nothing beyond baseline practice. ASL-2 covers early dangerous capability: a model that gives, at most, what a determined searcher could already find. ASL-3 marks a substantial increase in catastrophic-misuse risk measured against non-AI baselines, and pulls in a heavier control set. ASL-4 was left deliberately undefined in v1.0, a placeholder for a class of risk the authors did not yet feel able to specify, and in v3.0 its state-actor-grade security expectation was downgraded from a firm commitment to a recommendation. Drag the capability marker below through the gates and watch which standards each level activates.

What trips the wire

Two capability domains are tracked as the live triggers. The first is CBRN uplift: whether a model materially helps a bad actor with chemical, biological, radiological or nuclear weapons beyond what existing tools already offer. The second is autonomous AI R&D: whether a model can meaningfully accelerate frontier AI development itself, the feedback loop that makes every other risk faster.

v3.0 restructured how that second domain is framed. It collapsed the AI R&D threshold to a single vivid criterion (the ability to "compress two years of 2018–2024-rate progress into one year") and added high-stakes sabotage as a newly tracked risk. Sharper as a headline; but the restructuring also moved several of the surrounding commitments from firm to conditional, which is the pattern the drift artefact makes visible.

Opus 4, the precautionary activation

On 22 May 2025, Claude Opus 4 became the first model deployed under the ASL-3 Standard. The framing was explicitly precautionary: Anthropic did not claim Opus 4 had crossed the CBRN threshold; it said it could not rule out that it had, and so applied ASL-3 anyway rather than wait for certainty. That is the hatched band in Figure 01 made real: inside the uncertainty zone, the higher tier applies.

The ASL-3 control set that came with it is a concrete GRC baseline. On the deployment side: Constitutional Classifiers screening inputs and outputs (the subject of R·020, where those classifiers became a required control) and a universal-jailbreak bounty paying researchers to break them. On the security side: 100+ security controls, two-party authorization for sensitive actions, and egress bandwidth throttling to make weight exfiltration slow enough to catch.

The tell that this was genuine per-model risk-tiering, not a blanket policy: Sonnet 4 shipped the same day at ASL-2. Two models, one launch, two different tiers: the ladder is applied live, per system, not to the company as a whole.

It cuts both ways. Read charitably, precautionary activation is conservatism working exactly as designed: act on suspicion, not proof. Read critically, it is an admission: if the evaluations could produce a definitive answer, you would not need to hedge. And behaviour-only evaluations may not produce definitive answers at all, because a capable model can be aware it is being evaluated, the eval-awareness problem examined in R·021.

The machinery

Behind the ladder sits an accountability structure that maps cleanly onto a three-lines-of-defense model. The first line is the capability and safety teams building and evaluating the models. The second line is a dedicated Responsible Scaling Officer (RSO), an independent risk function, supported by Capability Reports and Risk Reports that go to both the CEO and the RSO. The third line is the Board of Directors and the Long-Term Benefit Trust (LTBT), providing oversight above management.

Two features are worth flagging for a controls reviewer. First, noncompliance reporting with anti-retaliation protection: a whistleblower channel written into the policy, so staff can escalate a broken commitment without career risk. Second, in v3.2 the LTBT was given the power to request external review of Risk Reports, a small but real crack of independent assurance into an otherwise self-assessed system. It is the closest the framework comes to a genuine second opinion, and it arrived late.

Eight versions of one promise

A policy is a living document, and the interesting story is in the diff. Across eight versions the RSP added real transparency and oversight (public roadmaps, regular risk reporting, an empowered trust) while, in the same revisions, softening or removing several of its hardest commitments. The timeline below lays out every version; violet chips are strengthenings, amber chips are weakenings.

The load-bearing changes: v2.0 dropped the quantitative triggers (a concrete example being "50% aggregate success on listed tasks") in favour of qualitative descriptions (SaferAI called this "a step backwards") and softened mandated external reviews to mere expectations. v2.2, landing nine days before Opus 4's ASL-3 launch, narrowed the ASL-3 Security Standard to exclude sophisticated insiders from its threat model. And v3.0 removed the categorical pause commitment: the promise to stop if safeguards ever fell behind capabilities. GovAI's verdict was blunt: this eliminated "arguably the strongest accountability mechanism" the policy contained.

Best of a weak field

None of this happens in isolation. In May 2024, 16 companies signed the Seoul Frontier AI Safety Commitments, promising to publish exactly this kind of policy. Adoption is broad; depth is not. The Future of Life Institute's Summer 2025 safety index graded the field: Anthropic C+, OpenAI C, Google DeepMind C−, xAI D, Meta D, Zhipu F, DeepSeek F, and, tellingly, no lab scored above D on existential-safety planning. Anthropic's C+ is best-in-class in a class that clears a low bar.

The competitive pressure is written into the rival frameworks too. OpenAI's Preparedness Framework contains an explicit clause allowing it to lower its own safety standards if a competitor ships a High- or Critical-risk system without comparable safeguards (a race-to-the-bottom trigger stated in the open), and in April 2025 it removed a third-party audit provision. This is the structural problem: the same investors, governments and customers that fund frontier labs all push in the direction of speed, and a voluntary, self-enforced policy is a thin membrane against that pressure. The version drift in Figure 02 is what that pressure looks like in a changelog.

Open questions

• QCan if-then commitments be made binding? What would it take (audit rights, accredited external assessors, a certification regime) to turn a voluntary RSP into something with teeth, and what exactly is the delta between an RSP and a standard like ISO 42001 that a customer could actually require?
• QDoes eval-awareness hollow out the trigger layer? The entire structure rests on evaluations detecting when a threshold is crossed. If capable models can behave differently under test, the triggers may be unreliable precisely when they matter most.
• QIs precautionary activation a feature or an admission? Applying ASL-3 to Opus 4 despite being unable to confirm the threshold was crossed reads as conservatism, or as a confession that the evaluations cannot give a clean answer. Which one it is changes how much comfort the activation should give.
• QWhat does version-drift due diligence look like? For a GRC function assessing a vendor's "we follow a responsible scaling policy" claim, the current version is not enough. What has been quietly removed across revisions may matter more than what remains.