Responsible Scaling Policies Explained: If-Then Safety Rules

Responsible scaling policies explained in one line: they are written commitments by an AI developer to match its safeguards to what its models can do. The more capable the model, the stronger the protections must be before the developer trains further or releases it. This post covers the parts of such a policy, one worked if-then chain, what three published policies say, and what they leave open.

Responsible scaling policies explained: the basic idea

A responsible scaling policy, often shortened to RSP, is a document an AI developer publishes about itself. It says in advance what the developer will do as its models become more capable.

The commitment is conditional. The policy does not promise "we will be safe." It says "if our model can do this dangerous thing, then these safeguards must be in place, or we stop." That makes the promise specific enough to check.

Anthropic published its policy on 19 September 2023 and described its core idea this way: require safety, security and operational standards that fit a model's potential for catastrophic risk, with stricter demands at higher levels. METR, an evaluation organisation, writes that the concept was introduced by METR in 2023 and that the first such policy was piloted in September of that year. By December 2025 METR counted twelve companies with published policies.

Companies chose to publish these. METR notes that they began doing so voluntarily, and that sixteen companies agreed to publish one at the AI Seoul Summit in May 2024.

The three working parts

The policies differ in vocabulary, but most share the same parts.

Capability thresholds

A threshold is a named level of ability that would call for stronger protection. Anthropic's October 2024 update defines two: a model that can independently do complex AI research work, and a model that can meaningfully help someone with a basic technical background create or deploy chemical, biological, radiological or nuclear weapons. Google DeepMind calls its versions Critical Capability Levels and starts from four domains: autonomy, biosecurity, cybersecurity, and machine learning research and development.

Evaluations

You cannot act on a threshold if you cannot tell whether a model has reached it. So the policies commit to testing. DeepMind describes "early warning evaluations" that should alert it when a model is approaching a threshold, run often enough to give notice before the line is crossed.

Safeguards

Both labs sort protections into two groups: security, which keeps the model's weights from being stolen, and deployment measures, which limit misuse while the model is in use. Anthropic's ASL-3 standard, for example, includes internal access controls and stronger protection of weights on the security side, and real-time and asynchronous monitoring, rapid response and thorough red teaming before deployment on the other.

A worked example: one if-then chain

Here is a generic chain, written as a teaching illustration and not as any lab's actual text:

If an evaluation shows a model can give serious help with a task the policy names as dangerous, then treat the model as having reached that threshold.
If it has reached the threshold, then the matching security and deployment safeguards must be in place before the model is released.
If those safeguards are not ready, then hold the release, or stop training the next, larger model, until they are.

Step three is the part with teeth. Without it, the policy is advice. Anthropic's 2023 post says its system implicitly requires pausing training of more powerful models if scaling outstrips the ability to comply with the safety procedures, and that this gives it a reason to solve the safety problems that unlock further scaling.

The METR survey counts how common this step is: conditions for halting deployment appear in 9 of the 12 policies and conditions for halting development in 8.

What three published sources say

Anthropic. Its October 2024 update says it will not train or deploy models unless it has implemented safety and security measures that keep risks below acceptable levels. It describes capability assessments and safeguard assessments, documented in a style inspired by safety cases, plus internal stress-testing and requests for outside expert feedback.

Google DeepMind. Its May 2024 framework has three parts: identify the capabilities that could cause severe harm, evaluate models periodically to detect when they near those levels, and apply a mitigation plan. It calls itself exploratory and says it expects to change a lot. It also states a cost: higher security and deployment mitigations may slow innovation and reduce broad access to capabilities, so the lab weighs benefits against risks.

METR's comparison. METR reads twelve policies side by side and finds nine common elements: capability thresholds, model weight security, deployment mitigations, conditions for halting deployment, conditions for halting development, full capability elicitation, timing and frequency of evaluations, accountability, and updating policies over time. It also says each policy is unique. Cohere's and NVIDIA's emphasize domain-specific risks rather than only catastrophic ones, and xAI's and Magic's lean heavily on quantitative benchmarks.

What the policies leave open

The sources themselves point to open questions.

Policies change. Anthropic calls its first commitments "our current best guess" and an early iteration, and DeepMind expects its framework to evolve significantly. Both say so openly. A policy that can be revised also needs a rule for how revision happens, which is why METR lists updating as an element.
Tests can underestimate. METR writes that without dedicated efforts to elicit full capabilities, evaluations may significantly underestimate what a model can do, since fine-tuning, prompt engineering or agent scaffolding can raise ability. Only 7 of the 12 policies include a capability elicitation commitment. The post on capability elicitation covers how that works.
Following a policy is a task of its own. Anthropic's first-year review found a small number of cases where it fell short of the full letter of its policy, such as evaluations finished three days late, and some evaluations where standard techniques such as chain-of-thought or best-of-N might have drawn out slightly better performance. It judged the risk minimal and concluded it needed more flexibility and better tracking of compliance.
Who checks the checker. Accountability appears in all 12 policies, but METR describes it as intentions to put internal and external oversight in place. How much outside scrutiny a given policy actually allows is something to read for in each one.

People weigh these points differently. Anthropic hoped that adoption across labs might create a "race to the top" in which competitive pressure goes into solving safety problems. Whether voluntary commitments are enough, or whether outside rules are needed on top, is a question these sources do not settle, and this post does not pick a side.

How to read a scaling policy yourself

Open a developer's current policy and check its date and version first, since these documents get revised. Then ask:

Are the thresholds described precisely enough to be tested?
Who decides a threshold has been reached, and does anyone outside the team review that decision?
What happens if safeguards are not ready? Is a pause required, or only considered?
How does the policy say it will change, and who must approve a change?

Pick one policy and answer all four in a few lines of your own. If you cannot, that is a gap in the policy or in your reading, and either is worth knowing.

How scaling policies connect to evaluations and alignment research

A scaling policy is only as good as the science under it. The tests that detect a threshold come from evaluation and red teaming work, covered in the posts on dangerous capability evaluations and AI red teaming. Two things can break the chain: a model that hides what it can do, covered in AI sandbagging, and a model that behaves differently when it knows it is being tested, covered in evaluation awareness. A test set that leaked into training data is a third, covered in benchmark contamination.

For the policy side, the post on AI alignment for policymakers sets out how rules and lab commitments fit together.

In Learn AI Alignment Theory, the Intermediate courses Evaluations and Red Teaming, Robustness, Security and Safety Engineering and Governing AI sit closest to this topic, and the Advanced course Interpretability asks whether we can check what a model is doing inside rather than only from outside.

Frequently asked questions

What is a responsible scaling policy in simple terms?

It is a published commitment by an AI developer to tie its safety measures to its models' abilities. If tests show a model has reached a defined risk level, stronger safeguards are required, or further scaling waits.

Are responsible scaling policies legally binding?

The sources here describe them as commitments companies chose to publish, so they are company policies. METR's December 2025 page also mentions guidance in the EU's General-Purpose AI Code of Practice and California's Senate Bill 53, which are worth reading if you want the legal side.

What are AI Safety Levels?

They are Anthropic's numbered sets of safety and security measures, modeled loosely on biosafety levels. Each level asks for stricter protection as a model's potential for catastrophic risk grows.

Do these policies solve AI risk?

No. They are a risk management tool that relies on reliable evaluations and effective safeguards, and the labs' own posts say their policies are early and will change.

Get started

If you want to go deeper on the pieces behind these policies, Learn AI Alignment Theory teaches them in short hands-on lessons of about 8 minutes. Every lesson lists its sources, and the 71 debate cards set out each serious position fairly with no verdict. You sign in with Google or an emailed code.

Start Learn AI Alignment Theory: short hands-on lessons from first principles to open research, with every side of every debate and the sources to read next.