Responsible Scaling Policy
A responsible scaling policy is a published commitment by an AI developer to tie the safeguards it applies to its models to the measured dangerous capabilities of those models, so that stronger systems trigger stricter security and deployment requirements before they are trained further or released. The idea is conditional by design: instead of asserting that a model is safe or unsafe in the abstract, the policy defines capability thresholds, specifies the evaluations that check for them, and states in advance what the developer will do if a threshold is crossed, including pausing scaling or deployment if the required safeguards are not ready. The approach is voluntary self-regulation that emerged in 2023, and it is often described as a template that later laws and international agreements could formalize.
The pattern is best understood as a set of if-then commitments. If a model shows the ability to provide meaningful uplift to someone seeking to build a biological or chemical weapon, or to carry out sophisticated autonomous cyber operations, then specific safeguards must be in place before the model is deployed or further scaled. The appeal is that it commits to action under uncertainty without requiring agreement today on how dangerous future systems will be; the cost of the safeguards is only paid if the evidence says it is warranted. The term responsible scaling policy was popularized in September 2023 by the evaluation group then called ARC Evals (now METR), which argued for such policies as a middle path between doing nothing and imposing blanket pauses.
Anthropic published the first widely cited example, its Responsible Scaling Policy, in September 2023. It defines AI Safety Levels, abbreviated ASL, modeled on the biosafety levels used for handling dangerous pathogens. ASL-1 covers systems that pose no meaningful catastrophic risk, ASL-2 covers the stage of models at the time of publication, which show early signs of dangerous capabilities but whose information is not yet reliably more useful than what a search engine provides, and ASL-3 begins where a model substantially increases the risk of catastrophic misuse or shows low-level autonomous capabilities. Higher levels were left to be defined later. Each level pairs required security measures protecting model weights with deployment measures such as misuse filtering and red-teaming, and the policy has been revised since its first version.
Other developers published parallel frameworks within months, using different vocabulary for the same structure. OpenAI released the beta of its Preparedness Framework in December 2023, tracking categories such as cybersecurity, chemical, biological, radiological and nuclear threats, persuasion, and model autonomy, scoring each from low through medium and high to critical, and committing to deploy only models whose post-mitigation risk is at most medium and to continue development only for those at most high. Google DeepMind published its Frontier Safety Framework in May 2024, built around Critical Capability Levels at which a model would pose heightened risk absent mitigations. At the May 2024 AI Seoul Summit, a group of companies signed the Frontier AI Safety Commitments, pledging to publish safety frameworks with thresholds, and the convergence of these documents is why the policy form is now treated as a category.
The central criticisms are that the policies are voluntary, self-assessed, and revisable. A company writes its own thresholds, runs its own evaluations, and can amend the document, so critics argue the commitments are only as binding as reputational pressure makes them. Measurement is also hard: capability evaluations must be elicited well enough that a negative result means something, as noted in the discussion of AI evaluation suites, and thresholds expressed in qualitative terms such as meaningful uplift leave room for judgment. Supporters answer that explicit triggers make decisions auditable, create a shared vocabulary for regulators, and force internal preparation before pressure to ship peaks. A frequent misconception is that these policies prove models are dangerous today; they are better read as preparation for the possibility, with most current models falling under the lower tiers. They also differ from legislation such as the EU AI Act, which attaches legal duties to general-purpose models with systemic risk, though the two increasingly reference similar evaluation practices.
Read a responsible scaling policy as a pre-commitment device: a company binds its future self to match safeguards to measured capability, so that the decision to slow down or add protections is made by an agreed rule in advance, not negotiated under commercial pressure at the moment a model becomes powerful.