Anthropic, the company behind Claude, says in Claude's constitution that AI "might be one of the most world-altering and potentially dangerous technologies in human history," yet it builds that technology itself. One way it addresses that tension is a document called the Responsible Scaling Policy, or RSP. The RSP is where terms like "ASL-3" come from, a label you may have seen in Claude launch coverage.
This guide explains what the RSP is, what AI Safety Levels (ASLs) mean, how the policy has changed, and what it does and does not promise.
The short version
- The RSP is Anthropic's voluntary framework for managing catastrophic risks from its AI models.
- It is built on "if-then" commitments: if a model reaches a certain capability, then stronger safeguards must be in place.
- AI Safety Levels (ASLs) are the tiers of safeguards, loosely modeled on the biosafety levels used for dangerous lab materials.
- A later rewrite split the policy into what Anthropic will do on its own and what it recommends for the whole industry, and added public Frontier Safety Roadmaps and Risk Reports.
- The policy is self-imposed and Anthropic calls it a living document, so it changes over time.
What the RSP is
Anthropic describes the RSP on its policy page as a way of "anticipating and securing against emerging threats that accompany increasingly powerful models." In the post announcing its latest rewrite, Responsible Scaling Policy v3, Anthropic calls it "the voluntary framework we use to mitigate catastrophic risks from AI systems."
"Voluntary" matters. No law requires the RSP. Anthropic wrote it, applies it to itself, and changes it.
"Catastrophic" matters too. The RSP is not about everyday problems such as a chatbot getting a fact wrong. When Anthropic first published the policy, its announcement, Anthropic's Responsible Scaling Policy, said the RSP "focuses on catastrophic risks," which it defined as those "where an AI model directly causes large scale devastation." It named two sources of such risk:
- Deliberate misuse, "for example use by terrorists or state actors to create bioweapons."
- Models acting on their own "in ways contrary to the intent of their designers."
The core idea: if-then commitments
The v3 post explains the basic design. Anthropic "focused the RSP on the principle of conditional, or if-then, commitments." It gives an example: if a model exceeded certain capability levels, "for example, biological science capabilities that could assist in the creation of dangerous weapons," then Anthropic "should introduce a new and stricter set of safeguards," such as protections "against model misuse and the theft of model weights."
Model weights are the trained numbers that make up a model. Because the policy names weight theft, security, and not only model behavior, is part of the RSP.
The original announcement adds an incentive. The ASL system "implicitly requires us to temporarily pause training of more powerful models if our AI scaling outstrips our ability to comply with the necessary safety procedures." In the same breath, it says this "directly incentivizes us to solve the necessary safety issues as a way to unlock further scaling."
What AI Safety Levels mean
The original announcement says the RSP "defines a framework called AI Safety Levels (ASL)," which is "modeled loosely after the US government's biosafety level (BSL) standards for handling of dangerous biological materials." The idea is to require "safety, security, and operational standards appropriate to a model's potential for catastrophic risk, with higher ASL levels requiring increasingly strict demonstrations of safety."
That announcement gave "a very abbreviated summary" of the levels:
- ASL-1: "systems which pose no meaningful catastrophic risk," such as "an AI system that only plays chess."
- ASL-2: systems that "show early signs of dangerous capabilities," but where the information "is not yet useful due to insufficient reliability or not providing information that e.g. a search engine couldn't." At the time, Anthropic wrote that "current LLMs, including Claude, appear to be ASL-2."
- ASL-3: systems that "substantially increase the risk of catastrophic misuse compared to non-AI baselines (e.g. search engines or textbooks) OR that show low-level autonomous capabilities."
- ASL-4 and higher: "not yet defined as it is too far from present systems."
The v3 post adds a useful clarification. Each ASL "corresponded to" a set of safeguards: "ASL-2 referred to one set of required safeguards, whereas ASL-3 referred to a more stringent set of safeguards needed for more capable AI models." It says the early levels "were defined in significant detail," while Anthropic "intentionally left the later ASLs (ASL-4 and beyond) largely undefined."
So "ASL-3" describes two linked things: a level of model capability that raises concern, and the stricter safeguards that must come with it.
What ASL-3 safeguards look like
Anthropic has said the ASL-3 standard has been put to use. The v3 post says: "We activated ASL-3 safeguards for relevant models in May 2025." It describes the ASL-3 deployment standard as "primarily about risks from chemical and biological weapons from threat actors with relatively modest resources and expertise." To meet it, Anthropic says it "developed increasingly sophisticated and accurate methods (specifically, input and output classifiers) to block content of concern."
A classifier is a separate AI model that checks text and flags problems. Anthropic's policy page gives "non-binding descriptions" of these safeguard plans. The plan had four layers:
- Access controls "to tailor safeguards to the deployment context and group of expected users."
- Real-time prompt and completion classifiers that check what users type and what the model writes as it is produced.
- Asynchronous monitoring classifiers for "a more detailed analysis" after the fact.
- Post-hoc jailbreak detection "with rapid response procedures to quickly address any threats."
A jailbreak is a trick prompt designed to get a model past its safety rules.
What Anthropic says worked, and what did not
The v3 post lists successes and shortcomings. Anthropic lists what it thinks the RSP achieved:
- It pushed the company to "develop stronger safeguards."
- It encouraged other labs: "within a few months of announcing our RSP, both OpenAI and Google DeepMind adopted broadly similar frameworks."
- It helped inform early AI policy. The post points to California's SB 53, New York's RAISE Act and the EU AI Act's Codes of Practice as rules that "start to require frontier AI developers to create and publish frameworks for assessing and managing catastrophic risks."
It also lists what did not go as planned:
- Thresholds were blurrier than expected. "We found pre-set capability levels to be far more ambiguous than we anticipated." Anthropic says that when models came close to a threshold, it "implemented the relevant safeguards" as a precaution, but the uncertainty made "a weak external case" for industry-wide action.
- Biology is a "zone of ambiguity." Models "pass most tests we can run quickly and easily," so Anthropic "can no longer make a strong argument that risks are low," but the tests are not enough to show risks "are high, either."
- Government action was slow. The post says "government action on AI safety has moved slowly."
- Higher levels may be too hard for one company. Safeguards at higher ASLs "might prove outright impossible to implement without collective action."
How the rewrite changed the policy
Rather than defining easy-to-meet higher levels, the v3 post says Anthropic chose to "restructure the RSP before we reach these higher levels." The rewrite has three key elements.
1. Two sets of plans. The RSP now separates "the mitigations that we plan to pursue regardless of what others do" from "an ambitious capabilities-to-mitigations map" that Anthropic believes would manage the risks "if implemented across the AI industry."
2. A Frontier Safety Roadmap. Anthropic must publish concrete plans "across the areas of Security, Alignment, Safeguards, and Policy." These are "public goals that we will openly grade our progress towards," not "hard commitments." One example goal from the post is to "implement a number of systematic measures to ensure Claude behaves according to its constitution."
3. Risk Reports and external review. Risk Reports explain "how capabilities, threat models (the specific ways that models might pose threats), and active risk mitigations fit together," with "an assessment of the overall level of risk." The post says they will be published online, with some redactions, "every 3-6 months." In certain cases, outside experts "free of major conflicts of interest" will review them with "unredacted or minimally-redacted access."
The policy page logs later updates. One gives Anthropic's Long-Term Benefit Trust the power "to request external review of Risk Reports" and "to approve our selection of external reviewers." For more on that body, see our Long-Term Benefit Trust explainer. The policy page also says Anthropic remains "free to take measures such as pausing the development of our AI systems in any circumstances in which we deem them appropriate," even when the RSP does not require it.
What the RSP does not do
- It is not law. Anthropic calls it voluntary. Outside rules such as California's SB 53 require published frameworks, but the content of the RSP is Anthropic's.
- It is not fixed. The policy page lists a series of versions and says Anthropic "will use this page to inform the public of any developments." The v3 post calls the RSP "a living document."
- Not every goal is binding. The Frontier Safety Roadmap goals are, in the v3 post's words, "nonbinding but publicly-declared."
- It targets catastrophic risk. The original announcement defines its focus as large-scale devastation from misuse or from models acting against their designers' intent, not everyday chatbot errors.
Why it matters
For anyone using Claude, the RSP is the public explanation of how Anthropic decides when a model is safe enough to release and what protections come with it. For the wider field, it is a test of whether a company can hold itself to written safety rules while competing to build more capable systems. Anthropic's own assessment in the v3 post is mixed: "some parts of this theory of change have played out as we hoped, but others have not."
Outside checks are part of the picture. Our coverage of METR evaluators embedded at Anthropic and of how labs disclose misalignment incidents shows how that kind of review works in practice.
