Anthropic published the third version of its Responsible Scaling Policy (RSP) on February 24, 2026. The RSP is the company’s voluntary framework for mitigating potentially catastrophic risks from advanced artificial intelligence. This update aims to reinforce what worked, address shortcomings identified over the past two-plus years, and increase transparency and accountability in decision‑making.
Background: the original RSP and the theory of change
Anthropic first released the RSP in September 2023. At that time, large language models were primarily conversational interfaces; since then models have gained capabilities such as web browsing, writing and executing code, using external computers, and taking autonomous multi‑step actions—each bringing new risks. The original RSP used conditional (if–then) commitments: if a model crossed a defined capability threshold (for example, biological capabilities that could support weapon creation), then Anthropic would implement stronger safeguards.
Safeguards were organized into AI Safety Levels (ASLs). Early ASLs (ASL‑2 and ASL‑3) were specified in detail, while later levels (ASL‑4 and above) were left largely undefined, with the intent to develop them once higher‑capability models made clearer what would be required.
Anthropic’s stated theory of change rested on several mechanisms:
- An internal forcing function: the RSP would make safeguards internal requirements for launching or training models, motivating organization‑wide progress.
- A race to the top: publishing the RSP was intended to encourage other AI developers to adopt similar practices, improving industry norms rather than degrading them.
- Building consensus about risks: capability thresholds would serve as moments to move from unilateral measures (Anthropic applying safeguards to its own models) to advocating multilateral action by other companies and governments.
Anthropic also recognized that many measures required at higher ASLs would be difficult or impossible to achieve unilaterally and would likely need coordinated, government‑level action.
What worked — and what didn’t
After roughly two and a half years, Anthropic judges that some parts of the theory of change worked as hoped, while others did not. Successes include:
- The RSP incentivized stronger safeguards internally. To meet ASL‑3 deployment standards, which focus on risks such as chemical and biological misuse by actors with modest resources, Anthropic developed increasingly sophisticated input and output classifiers and activated ASL‑3 safeguards for relevant models in May 2025.
- The RSP encouraged similar standards elsewhere: within months of Anthropic’s announcement, OpenAI and Google DeepMind adopted broadly similar frameworks. Some firms implemented bioweapon‑related classifiers similar to Anthropic’s ASL‑3 defenses. RSP‑style principles have also informed early AI policy, with governments moving toward requirements for frontier AI developers to publish frameworks for catastrophic‑risk assessment (Anthropic points to California’s SB 53, New York’s RAISE Act, and the EU AI Act’s Codes of Practice). Anthropic’s Frontier Compliance Framework and public documentation have been part of this transparency push.
However, notable challenges emerged:
- Ambiguous thresholds: pre‑set capability levels proved more ambiguous than expected. In many cases models have approached thresholds, but it has been hard to be confident they definitively passed them. Model evaluation science is not yet mature enough to provide decisive answers, which weakens the external case for multilateral action even when Anthropic has taken precautionary unilateral steps.
- Biological risk evaluation: models now show enough biological knowledge to make it difficult to claim risks are low, yet simple tests do not conclusively demonstrate high risk either. Anthropic has supported longer wet‑lab trials for additional evidence, but those studies take time and can be overtaken by newer, more capable models.
- Slow government action and political headwinds: despite rapid advances in capabilities, national policy has moved slowly and often emphasizes competitiveness and economic growth over stringent safety measures.
- Need for collective action at high ASLs: some robust mitigations proposed earlier may be infeasible without coordinated assistance. Anthropic cites a RAND report saying an “SL5” security standard for protecting model weights from top‑priority adversaries is “currently not possible” and would likely require national security community assistance.
The combination of ambiguous thresholds, anti‑regulatory political climates, and high unilateral costs for some proposed mitigations creates a structural challenge for the current RSP. Anthropic rejects the option of weakening higher ASL definitions to make compliance easier; instead it chooses to restructure the RSP transparently before higher capability levels arrive, focusing on realistic unilateral commitments while continuing to map the measures the whole industry would need multilaterally.
Key changes in RSP 3.0
The new RSP has three main elements:
- Separating company plans from industry recommendations
The RSP now distinguishes two sets of mitigations: those Anthropic intends to pursue regardless of others’ actions, and an ambitious capabilities‑to‑mitigations map that the company believes would be necessary if implemented across the AI industry to adequately manage advanced AI risks.
- Frontier Safety Roadmap
Anthropic will develop and publish a Frontier Safety Roadmap describing concrete plans for risk mitigations across Security, Alignment, Safeguards, and Policy. These Roadmap goals are intended to be ambitious yet achievable and act as a public, nonbinding forcing function—goals Anthropic will grade publicly over time.
Example goals included in the current Frontier Safety Roadmap:
- Launch “moonshot R&D” projects to explore ambitious or unconventional approaches to unprecedented levels of information security;
- Develop an automated, large‑scale red‑teaming method that goes beyond the contributions of hundreds of bug bounty participants;
- Implement systematic measures to ensure Claude behaves according to Anthropic’s constitution;
- Create comprehensive, centralized records of critical AI development activities and use AI to analyze these records for insider‑threat behaviors (human and AI) and security issues;
- Publish a policy roadmap proposing a “regulatory ladder” of measures that scale with increasing risk and could guide government AI policy.
- Risk Reports and external review
Anthropic will produce Risk Reports—regular, detailed documents describing a model’s safety profile at the time of publication, connecting capabilities, threat models, and active mitigations, and offering an overall risk assessment. These reports will be published online every 3–6 months with limited redactions for legal compliance, IP protection, public safety, or privacy.
Under RSP 3.0, certain Risk Reports will be subject to external review by appointed third‑party experts knowledgeable in AI safety research, incentivized to be candid, and free of major conflicts of interest. External reviewers will have unredacted or minimally redacted access in those cases and will publicly examine Anthropic’s reasoning, analysis, and decisions. Although current models do not yet require external review, Anthropic is running pilots toward that goal.
Risk Reports will also explicitly document gaps between Anthropic’s current safety and security measures and the more ambitious industry‑wide mitigations it recommends, with the hope that publishing such gaps will raise public awareness and inform future policy.
Conclusion
Anthropic frames the RSP as a living document that must evolve as AI capabilities change. Version 3.0 doubles down on successful elements of the earlier policy, commits to greater transparency about company plans and risk judgments, and separates actions the company can take unilaterally from those it recommends for the industry. Anthropic intends to continue revising the RSP and its risk‑evaluation and mitigation practices as the technology and the policy environment evolve.
