AI Safety Level
In plain wordsAnthropic's numbered scale, modeled on laboratory biosafety levels, for matching how dangerous an AI model could be with how strong the protections around it must be.
A tier in Anthropic's responsible scaling policyresponsible scaling policy, n.: A public rulebook in which an AI company promises to test each new model for dangerous abilities and to add stronger safeguards, or slow down, as its models become more capable., modeled on the biosafety levels (BSL-1 to BSL-4) used for handling dangerous pathogens; the term names both a level of risk and the standard of safeguards that must match it. In the 2023 version the ladder ran from ASL-1, for systems with no real catastrophic potential, through ASL-2, for models showing hints of dangerous knowledge that is not yet more useful than a web search, to ASL-3, for models that meaningfully extend what a would-be attacker could do with ordinary resources, or that show the first signs of autonomous capability; levels from ASL-4 up were left undefined. From 2024, the 'ASL-3 Deployment Standard' and 'ASL-3 Security Standard' denoted concrete protections — classifiers blocking help with chemical and biological weapons, hardened weight securitymodel weight security, n.: Protecting the files that make up a trained AI model — its learned numbers — from being stolen or leaked, because whoever holds them can run, copy or alter the model. and egress controls — which Anthropic activated for Claude Opus 4 in May 2025. Version 3.0 of the policy (February 2026) kept ASL-3 protections as a firm commitment but dropped the predefined ladder of higher levels: it no longer sets ASL-4 standards and specifies mitigations only for the next capability level.
The model was released under ASL-3, with the bio classifiers switched on by default.
Origin
Introduced in Anthropic's first Responsible Scaling Policy (September 2023), explicitly adapting the US government's biosafety-level framework for laboratories that handle pathogens.
Usage note
Not an industry or legal standard: other developers use different scales, such as OpenAI's High and Critical capabilities and Google's critical capability levels. Unrelated to the SAE levels of driving automation.
Related
- responsible scaling policyresponsible scaling policy, n.: A public rulebook in which an AI company promises to test each new model for dangerous abilities and to add stronger safeguards, or slow down, as its models become more capable.
- capability thresholdcapability threshold, n.: A level of dangerous ability — such as meaningfully helping someone make a biological weapon — that, once an AI model reaches it, obliges its developer to add stronger safeguards or hold the model back.
- model weight securitymodel weight security, n.: Protecting the files that make up a trained AI model — its learned numbers — from being stolen or leaked, because whoever holds them can run, copy or alter the model.
- CBRN riskCBRN risk, n.: The danger that AI could help someone make or use chemical, biological, radiological or nuclear weapons — for example, by explaining hard technical steps an attacker could not work out alone.
- Frontier Safety FrameworkFrontier Safety Framework, prop. n.: Google DeepMind's published plan for spotting when its AI models approach dangerous abilities and applying stronger security and safeguards before that happens.
- Preparedness FrameworkPreparedness Framework, prop. n.: OpenAI's published process for testing its AI models for catastrophic risks — such as help with biological weapons or cyberattacks — and deciding what safeguards are needed before release.
Sources
- Centre for the Governance of AI (2026). Anthropic's RSP v3.0: How it Works, What's Changed, and Some Reflections. governance.ai/analysis/anthropics-rsp-v3-0-how-it-works-whats-changed-and-some-reflections
Mentioned in
AnthropicAnthropic, prop. n.: An American AI company that makes the Claude chatbot and models. It was founded in 2021 by former OpenAI staff and puts particular emphasis on AI safety research., capability thresholdcapability threshold, n.: A level of dangerous ability — such as meaningfully helping someone make a biological weapon — that, once an AI model reaches it, obliges its developer to add stronger safeguards or hold the model back., CBRN riskCBRN risk, n.: The danger that AI could help someone make or use chemical, biological, radiological or nuclear weapons — for example, by explaining hard technical steps an attacker could not work out alone., model weight securitymodel weight security, n.: Protecting the files that make up a trained AI model — its learned numbers — from being stolen or leaked, because whoever holds them can run, copy or alter the model., responsible scaling policyresponsible scaling policy, n.: A public rulebook in which an AI company promises to test each new model for dangerous abilities and to add stronger safeguards, or slow down, as its models become more capable., constitutional classifiersconstitutional classifiers, n.: Safety filters that watch a chatbot's inputs and outputs for dangerous requests, trained on example conversations that an AI generated from a written list of what is and is not allowed.