Anthropic Responsible Scaling Policy drops pause pledge by v3.4

From one bright line to a policy that keeps changing

In October 2024, Anthropic called its updated Responsible Scaling Policy (RSP) a significant revision. The company said it was keeping one core promise while adding flexibility: it would not train or deploy models unless safety and security measures kept risks at acceptable levels.16 Two years later, that promise is gone. The policy has been rewritten from the ground up and then revised four more times in five months. Taken together, these changes show how the first and most influential framework for frontier AI risk has evolved. The record suggests that Anthropic's own commitments have narrowed while its transparency commitments have grown.

What the 2024 update established

The October 2024 version, RSP v2.0, introduced two linked ideas. "Capability Thresholds" were specific abilities that would require stronger protections, and "Required Safeguards" were the AI Safety Level (ASL) standards needed once a threshold was crossed.16 It also changed what "ASL" means. The term now referred only to groups of technical and operational safeguards, not to models.15 Anthropic said this would let it target protections at specific capabilities rather than broad model categories.15

The update also changed how models were tested. Instead of relying on fixed evaluations, Anthropic now had to make an affirmative case that a model was far enough from a threshold. Its reasoning was that predefined tests could miss new risks or be too conservative.15 The update added an AI R&D threshold for systems that could significantly speed up AI development. Anthropic warned that such capabilities could produce advances faster than its ability to evaluate them.15

The company also published a self-assessment, which was unusual. It admitted that a recent evaluation round had finished three days past the required three-month interval. In response, it clarified the rule and extended the interval to six months, arguing that rushed testing produces worse results.11 It also said it had replaced placeholder autonomy tasks with better evaluations without formally updating the policy. It promised to clarify ambiguous points proactively in the future.11 Taken alone, these were minor lapses. Looking back, they were an early sign of a recurring problem: the people writing the rules kept finding that their own lines were hard to apply.

The quieter revisions of 2025

Version 2.1, from March 2025, added a CBRN threshold covering uplift to moderately resourced state weapons programs. It also split AI R&D into two levels: fully automating entry-level research work, and dramatically accelerating the rate of effective scaling.11 Version 2.2 followed in May 2025 with a narrower change. It removed both sophisticated insiders and state-compromised insiders from the scope of the ASL-3 Security Standard.11 The policy document justified this by saying the relevant threat models centered on large numbers of users reaching unguarded models, which it considered more likely through a universal jailbreak than through weight theft.4

That same month, the framework was tested for real. Anthropic activated ASL-3 safeguards when it launched Claude Opus 4 on May 22, 2025. One explainer describes this as a precautionary move, not a confirmed threshold crossing. An Anthropic-affiliated author made the same point more bluntly. The company turned on ASL-3 because it could no longer argue convincingly that the risk was low, not because it had proven the risk was high.5

The 2026 rewrite: the pause pledge goes

RSP v3.0 took effect on February 24, 2026. Anthropic called it a comprehensive rewrite built around published Frontier Safety Roadmaps and Risk Reports that quantify risk across its deployed models.11 The company's own assessment was mixed. It said the RSP had pushed it to build stronger safeguards, such as input and output classifiers for chemical and biological content, and that OpenAI and Google DeepMind adopted similar frameworks within months.12 It also said one central idea had failed. Capability thresholds did not create the expected consensus about risk, because models approached thresholds without clearly passing them, and evaluation science could not settle the question.1

The Centre for the Governance of AI (GovAI) gave what is probably the most careful outside account of the change. Its analysts said Anthropic no longer implies it will pause if it cannot keep risks below acceptable levels. They noted that the escalating ASL tiers were gone and that the undefined ASL-4 standards no longer appeared.3 Mitigations such as RAND Security Level 4 were recast as "industry-wide recommendations" rather than unilateral commitments. GovAI stressed that Anthropic did not lower any existing mitigations.14 It also flagged that radiological and nuclear risks had been removed, along with references to cyber operations, without any stated reason.14 Anthropic's own reasoning is a collective-action problem. If a careful developer paused alone, it argues, the developers with the weakest protections would set the pace.13

The structural shift matters more than the wording. In GovAI's reading, the old policy started from strong mitigations and allowed them to drop only if competitors fell short. The new one starts lower and adds stronger measures only if others do the same or if Anthropic holds a clear lead.14

Where the reporting diverges

The coverage disagrees on some basic facts about v3. One security-industry explainer says v3.0 was published in November 2025, split AI R&D into two thresholds, and kept ASL-4 as a defined escalation tier.9 That account conflicts with Anthropic's own changelog, which places the AI R&D split in v2.1 in March 2025.11 It also conflicts with GovAI, which says v3.0 merged the two levels into one threshold: compressing two years of 2018–2024 AI progress into a single year.3 Some explainers also still describe ASL-4 as triggered by the old AI R&D-4 "entry-level researcher" test.8 The primary documents and GovAI's analysis agree with each other, so the more reliable reading is that v3 consolidated thresholds rather than adding them. Secondary summaries, which many readers depend on, have not kept pace with the edits.

Commentators also split on what the rewrite means. Holden Karnofsky argued on the EA Forum that v3 is a principled improvement. In his view, the implied unilateral pause commitments distorted incentives, because they pushed risk assessments toward playing down how close models were to thresholds.5 Zvi Mowshowitz disagreed sharply. He contrasted v2's narrow "escape clause", which allowed weaker safeguards only when a competitor was already creating serious risk, with v3's willingness to reach thresholds first unless others explicitly commit not to.10 He rejected the idea that this was just the natural evolution of a living document.10 Even inside Anthropic, researcher Drake Thomas described feeling something like grief for the original policy's idea of crisp thresholds tied to concrete safeguards or a halt.10 Reporting by Billy Perrigo quoted concerns about a "frog-boiling" effect, where danger rises gradually without any single tripwire going off.10

Four more edits in five months

The revisions continued after the rewrite. Version 3.1 (April 2026) clarified that the AI R&D threshold means doubling the rate of aggregate capability progress, not doubling researcher productivity. It also restated that Anthropic may still choose to pause even when the policy does not require it.11 Version 3.2 let the Long-Term Benefit Trust request external review of Risk Reports and approve the choice of reviewers.11 Version 3.3 revised the threshold for novel chemical and biological weapons.11 Version 3.4, effective July 8, 2026, narrowed the automated R&D threshold. It also reduced internal access to unredacted Risk Reports from all regular-clearance staff to at least 200 employees, while requiring public reports to show where material was removed.2

The changes go in both directions. External review, LTBT oversight and redaction labels all increase accountability. Narrower thresholds and smaller internal readerships reduce it. Before v3, Anthropic also determined that Claude Opus 4.6 did not cross the AI R&D-4 line that would have required an affirmative misalignment case.11

Why it matters

The RSP now presents itself as a voluntary framework for catastrophic risk, not a compliance document. Statutory requirements such as California's SB 53 are handled in separate frameworks.13 It covers four areas: non-novel and novel chemical and biological weapons, misaligned AI in high-stakes settings, and automated R&D, each paired with a more demanding industry recommendation.13 Anthropic's preferred model is third-party governance of all frontier developers, coordinated across countries.13

The overall direction is clear. The 2024 update promised flexibility within a firm commitment. The 2026 versions keep the flexibility and drop the firm commitment, offering detailed disclosure and outside review in its place. Supporters can reasonably say this is more honest about what evaluations can actually show. Critics can reasonably say a framework that is renegotiated every few weeks no longer works as a constraint. Both positions hold up on the evidence. What decides between them is whether the Risk Reports and external reviews produce findings that lead Anthropic to do something it otherwise would not. Until that happens, the RSP is better understood as a running public explanation of how Anthropic weighs risk than as a policy that binds it.