Responsible Scaling Policy

18:35 The Responsible Scaling Policy (RSP) is the rulebook Anthropic says it follows before training and releasing more capable Claude models; the current version is 3.4, effective Jul 8, 2026 (as of Nov 6, 2026). Anthropic calls it "the voluntary framework we use to mitigate catastrophic risks from AI systems" (RSP v3.0, Feb 24, 2026). It is not a law and no outside body enforces it: Anthropic writes it, changes it, and reports on itself under it, with the Long-Term Benefit Trust able to call in outside reviewers since version 3.2. The policy is best known for its AI Safety Levels (ASLs), and for Anthropic's decision to launch Claude Opus 4 under ASL-3 protections on May 22, 2025.

Quick facts

Version dates are from the RSP page, read Nov 6, 2026.

What are AI Safety Levels?

AI Safety Levels are tiers of protection tied to how dangerous a model's capabilities could be. ASL-2 is the standard set of safeguards (Anthropic released Claude Haiku 4.5 under it in Oct 2025). ASL-3 adds stronger safeguards for models that could give meaningful help to someone trying to build biological or chemical weapons, or that could start to automate AI research. ASL-4 and above were meant for still more capable systems. Anthropic itself admits that earlier editions defined ASL-2 and ASL-3 in detail but left ASL-4 and beyond "largely undefined" (RSP v3.0).

A model's level is decided by capability thresholds: tests of whether it could, for example, give serious uplift on chemical and biological weapons or "compress two years" of AI progress into one. Version 3.1 clarified that "doubling the rate of progress" means overall capabilities, and that Anthropic stays free to pause development (RSP).

ASL-3 activation in May 2025

On May 22, 2025 Anthropic launched Claude Opus 4 under its ASL-3 Deployment and Security Standards, calling it a "precautionary and provisional action": it had not concluded that Opus 4 crossed the threshold, only that it could not rule it out. It ruled out ASL-4 for Opus 4 and ASL-3 for Claude Sonnet 4 (Activating ASL-3 Protections, May 22, 2025). See Claude 4 Models.

The deployment measures aim mainly at biological weapons: Constitutional Classifiers that screen inputs and outputs, a bug bounty for jailbreaks, offline classification, threat intelligence, and exemptions for vetted researchers doing dual-use work. The security side added "more than 100 different security controls" around the model weights, including two-party authorization for access and limits on how fast data can leave the network. Anthropic stated that nation-state attackers and sophisticated insiders are outside ASL-3's scope (same post).

The classifiers came from earlier research: in Anthropic's Feb 2025 tests, they cut jailbreak success on 10,000 synthetic jailbreaks from 86% to 4.4%, at the cost of 23.7% more compute and slightly more refusals of harmless requests. They are why Claude sometimes refuses chemistry or biology questions that look harmless; see Anthropic Usage Policy.

Version history

Dates and changes are from the RSP page, read Nov 6, 2026.

What changed in version 3.0

Version 3.0 rebuilt the policy around three ideas, by Anthropic's account (RSP v3.0, Feb 24, 2026). First, it splits what Anthropic will do whatever its competitors do from a map of capabilities to safeguards that it recommends for the whole industry. Anthropic gave its reasons plainly: thresholds turned out to have a "zone of ambiguity", governments were slow to act, and the highest-level safeguards of the old policy "might prove outright impossible" to build without collective action.

Second, it added Risk Reports every three to six months, partly redacted and sometimes reviewed by outsiders. Third, it added a public Frontier Safety Roadmap of goals in security, alignment, safeguards and policy, which Anthropic describes as goals it will grade itself against rather than hard commitments (same post).

The Risk Reports

The second Risk Report, published in Aug 2026 with a coverage date of Jul 15, 2026, rates four threats. Misalignment in high-stakes settings is "Low", raised from "very low" after the cybersecurity test incidents described on Anthropic Safety Research. Automated AI research is Low but less certain, because the tests have "saturated" and AI speeds internal research "but not yet by a factor of 2". For chemical and biological weapons, Anthropic acts as though its models meet the first threshold (CB-1) and says they do not yet meet the second, for novel weapons (CB-2) (Risk Report: August 2026).

The report includes a section in which Claude reviews the assessment, and a list of "safety process failures", such as training directly on misaligned behavior during a production run. It also notes that Claude Fable 5 is the same model as the restricted Claude Mythos 5 with extra safeguards (see Claude Mythos), and that a since-fixed gap in access controls raised its chemical and biological risk estimate (same).

Criticism and limits

19:44 The plainest limit is the one Anthropic states: the RSP is voluntary, and Anthropic can and does rewrite it. It has gone through nine versions in three years, and version 3.0 put much of its forward plan in a roadmap of "public goals" that Anthropic grades itself, not hard commitments (RSP v3.0). Readers who want binding rules should look at laws such as California's SB 53, which Anthropic endorsed on Sep 8, 2025.

Anthropic's own disclosures show the safeguards are imperfect. Its Feb 2025 public jailbreak challenge ended with one participant finding a universal jailbreak (Constitutional Classifiers); its 2026 Risk Report lists process failures; and its IPO filing, as Fortune read it, calls its safeguards "incomplete" and says they have been "circumvented" (Fortune, Oct 26, 2026). Fortune and CNBC also report that the filing does not describe how the Long-Term Benefit Trust, which oversees the RSP, fits a share structure giving the founders 50.1% of the vote (CNBC, Oct 26, 2026).

Critiques of version 3.0 by independent researchers were not among the sources read for this page on Nov 6, 2026.

Frequently asked questions

What is ASL-3? ASL-3 is the third of Anthropic's AI Safety Levels: stronger deployment and security safeguards for Claude models that might give serious help with biological or chemical weapons. Anthropic first applied it to Claude Opus 4 on May 22, 2025.

What is the current version of Anthropic's Responsible Scaling Policy? Version 3.4, effective Jul 8, 2026, is the current Responsible Scaling Policy as of Nov 6, 2026. Version 3.0 of Feb 24, 2026 was the last full rewrite.

Is the Responsible Scaling Policy legally binding? No. Anthropic describes the RSP as a voluntary framework; it governs how Anthropic trains and releases Claude but no regulator enforces it, and Anthropic can revise it.

Is Claude Mythos held back because of the RSP? Anthropic ships Claude Mythos 5 only to vetted partners and offers the same model to everyone as Claude Fable 5 with added safeguards, and its Aug 2026 Risk Report covers both; see the Claude Mythos page for the programs that grant access.

Why does Claude refuse some science questions? Claude's classifiers, added under ASL-3, block requests that look like help with chemical or biological weapons, and they sometimes catch harmless questions too. Anthropic's Feb 2025 tests measured a small rise in such refusals.

Sources

• Building Anthropic | A conversation with our co-founders, Anthropic, Dec 20, 2024 (video)
• Anthropic's Responsible Scaling Policy, Anthropic, read Nov 6, 2026
• Anthropic's Responsible Scaling Policy: Version 3.0, Anthropic, Feb 24, 2026
• Activating AI Safety Level 3 Protections, Anthropic, May 22, 2025
• Constitutional Classifiers, Anthropic, Feb 3, 2025
• Risk Report: August 2026, Anthropic, Aug 2026
• Anthropic is endorsing SB 53, Anthropic, Sep 8, 2025
• Anthropic's IPO prospectus shows $16.3 billion in revenue, Fortune, Oct 26, 2026
• Anthropic IPO live updates, CNBC, Oct 26, 2026