Anthropic RSP 3.0 Trades Pause Pledge for Public Risk Reports

What Anthropic changed

Version 3.0 of Anthropic's Responsible Scaling Policy took effect on February 24, 2026. The company calls it a comprehensive rewrite of the framework, and it adds two new kinds of public document: Frontier Safety Roadmaps that set out detailed safety goals, and Risk Reports that estimate risk across every model Anthropic has deployed.11 It is the largest overhaul since the policy first appeared in September 2023.13 Eight months on, it is clear the release changed what the policy is for. It used to be a set of tripwires Anthropic placed on itself. Now it mainly commits the company to disclosure.

The core change is a split between two kinds of promise. One list covers what Anthropic says it will do no matter what competitors do. The other is a set of "industry-wide recommendations" that it thinks every frontier developer would need to adopt to keep catastrophic risk reliably low.12 Anthropic says it will "strive to advance" those recommendations but does not commit to meeting them alone or without conditions.12 Some protections are now on the recommendation list instead of the commitment list. One example is RAND Security Level 4, which is meant to defend model weights against theft by state-level attackers.1

The best-known clause of the old policy is gone. Anthropic used to describe its RSP as a public commitment not to train or deploy models capable of catastrophic harm unless safeguards kept risk at acceptable levels, which implied it would pause otherwise. Version 3.0 removes that language.12 Under the new policy, according to one account, Anthropic would delay development only if two conditions hold together: it believes it has a significant lead over competitors, and it identifies catastrophic risk.7

The company's case: a collective action problem

Anthropic's main argument is about collective action. How much catastrophic risk exists depends on what all frontier labs do, so a single company that slows down to build safeguards may simply hand the lead to less careful rivals.12 The company's announcement points to real successes. It turned on ASL-3 safeguards for relevant models in May 2025, and OpenAI and Google DeepMind adopted broadly similar frameworks within months of the first RSP.18 It also says it would sooner admit the difficulties and restructure the policy now than reach higher capability levels with commitments it cannot keep.18

Holden Karnofsky, who led the rewrite, makes the most detailed version of this argument.9 He says the jailbreak-robustness work required by the ASL-3 deployment standard, including Constitutional Classifiers, shows that binding commitments can force progress. He also argues that the old ASL-4 and ASL-5 targets created bad incentives. If meeting a standard against state-backed attackers would take a years-long slowdown, there is pressure to judge that a model has not reached the capability threshold that triggers it.3 Analysts at the Centre for the Governance of AI make a related point about the old structure: when crossing a threshold means costly measures or a pause, the company has a reason not to declare that it has crossed one.9

Where the coverage splits

Coverage divides less over the facts than over how to read them. Mainstream outlets mostly treated the change as a retreat. The Wall Street Journal's headline said Anthropic had dialed back its safety commitments, and TIME reported that the company was dropping the central pledge of its flagship policy.4 Zvi Mowshowitz, a frequent critic, said this framing leaves out a lot but is not wrong.4 Chris Painter, director of policy at METR, reviewed an early draft and called the update "a bearish signal." In his reading, Anthropic thinks its safety plans need to go into triage mode because methods for assessing and reducing risk are not keeping up with capabilities.10

Other observers looked for a middle reading. GovAI's analysis points out that the old policy already had an escape clause in a footnote that let Anthropic lower its safeguards if competitors fell short. In principle, every commitment was always conditional.1 By that account, version 3.0 mostly says out loud what was already there, though it also lowers the starting point. Before, Anthropic began from strong safeguards and would only weaken them if rivals lagged. Now it begins lower and will only add stronger measures if others do, or if it has a clear lead.12

One objection on LessWrong stands out. California's SB 53 and New York's RAISE Act require developers to have safety frameworks and follow them, and Anthropic is the first company to rewrite its framework so that following it no longer means binding itself to anything.5 Another commenter compared the logic to a Cold War power that decides not to retaliate after a first strike. The point was that a commitment only deters if it is credible before the bad outcome happens.5 Some outlets tied the timing to outside pressure, including a reported Pentagon ultimatum over military use of Claude. They describe this as critics' speculation, not something Anthropic has confirmed.610

The ratings data is harder for Anthropic to dismiss. SaferAI cut its score for Anthropic from 2.2 to 1.9, which puts the company in its "weak" tier alongside OpenAI and DeepMind.19 The group that once set the bar for voluntary safety frameworks is now graded the same as its competitors.

What happened to thresholds and threat models

Version 3.0 also changes which threats the policy tracks. It no longer defines escalating safety tiers two levels ahead and specifies safeguards only for the next capability level. Anthropic calls detailed planning for capabilities further out "overly rigid."12 Chemical and biological risks are now split into "novel" and "non-novel" weapons. Radiological and nuclear risks have been dropped, along with references to cyber operations, and the policy does not explain why.12 Mowshowitz notes that OpenAI and Google still treat cyber as a key threat category. He says Anthropic owes a clearer explanation of why it does not, or of how its sabotage analysis covers it.8

Accounts disagree on the automated AI R&D threshold. GovAI says the policy merges the previous two R&D tiers into a single threshold: a model able to compress two years of 2018–2024-era AI progress into one year.12 A vendor-focused analysis says the opposite, that version 3.0 separates the AI R&D threshold into two levels, and it dates publication to November 2025.16 That account conflicts with Anthropic's own timeline and with GovAI's reading of the document, so the merged threshold is the more reliable description. One summary quotes Anthropic as saying that confidently ruling out the R&D threshold for Claude Opus 4.6 "is becoming difficult."19 That suggests the threshold could matter in practice soon.

Another change is quieter. Under v3.0, the term "AI Safety Level" no longer names a capability threshold. It now refers to a bundle of required protections, such as the "ASL-3 Security Standard."20 Instead of fixed checklists, labs are asked for a "strong argument for safety," and Anthropic admits people will disagree about what that standard requires.8

The new accountability tools in practice

The fairest test is whether the replacement mechanisms do real work, and the record so far is mixed. Risk Reports are due every three to six months. They cover all publicly deployed models, plus internal models if those could pose risks well beyond the public ones.12 Within the company, the CEO and the Responsible Scaling Officer make the final decision on whether a risk assessment is adequate and on what development or deployment follows.25

The policy has been revised often since February. By April 29, version 3.2 let Anthropic's Long-Term Benefit Trust request external reviews of Risk Reports and approve the choice of reviewers. Version 3.4, effective July 8, allows a review to be split across several reviewers, as long as every unredacted section is covered by at least one.22 Anthropic also published an update to its internal noncompliance-reporting and anti-retaliation policy in March, which widens the channels employees can use to raise possible violations.11

The first Risk Report, dated February 2026, was later revised after a pilot external review by METR flagged a weakness in how it described an internal survey on whether a model could replace an entry-level researcher. That shows outside review changing the content of a report. Mandatory external review, however, applies only when a report covers a "highly capable" model, meaning one past the automated R&D threshold, and is also "significantly redacted."22 The August 2026 Risk Report says the Trust has not requested an external review and the policy has not required one, though pilot reviews have continued.21 The same report says Anthropic has not yet met its Frontier Safety Roadmap goals, while claiming significant progress on each.21

The verdict

Version 3.0 is not a cut to existing safeguards. ASL-3 protections remain in place, and Anthropic has committed to try to match any competitor's stronger mitigations if it can do so at comparable cost.9 What it weakens is the promise about the future, and that promise was the point of a responsible scaling policy. Risk Reports and roadmaps report what has already happened. As one critique put it, they are disclosures, not constraints.10 The disclosures are detailed and appear to be improving, and METR's correction of the first Risk Report shows that review can change what a report says. But the trigger for mandatory review is set high enough that it may not apply until AI R&D automation is already here. For now, the main way to hold Anthropic to account is to compare what each Risk Report says with what each roadmap promised.