Last week Anthropic launched Claude Opus 4 and Sonnet 4, and buried in the announcement was a first: Opus 4 ships under AI Safety Level 3 – the first time a frontier lab has released a model while saying, in effect, this one is capable enough that our standard protections aren't enough.
If you sit anywhere near AI procurement, vendor risk, or board reporting, this is worth ten minutes of your attention – not because ASL-3 is scary, but because safety levels are about to become a normal part of how AI vendors describe their products, and misreading them cuts both ways.
What ASL-3 actually isLink to this section
Anthropic maintains a Responsible Scaling Policy: a public commitment that as models cross defined capability thresholds, specific stronger safeguards switch on. Think of it as biosafety levels for models – which is roughly the analogy the industry has adopted.
For Opus 4, ASL-3 means two concrete things:
- Stronger security around the model itself – hardening against theft of the model weights, on the logic that a stolen frontier model bypasses every downstream safeguard at once.
- Narrower deployment safeguards – additional controls targeting a specific class of catastrophic misuse, principally uplift for chemical, biological, radiological, and nuclear weapons development.
Anthropic describes the designation as precautionary – they haven't concluded the model definitively crosses the threshold, but couldn't rule it out, so the stronger controls apply. Sonnet 4, the smaller sibling, ships under the standard ASL-2.
Anthropic isn't alone in this structure. OpenAI has its Preparedness Framework, Google DeepMind its Frontier Safety Framework. The labels differ; the shape is the same: published thresholds, escalating controls.
What ASL-3 is notLink to this section
Equally important for anyone briefing executives:
- It is not a statement that the model is dangerous to your staff. The threats ASL-3 addresses are national-security-scale misuse by sophisticated actors – not your analyst's contract summary.
- It says nothing about the everyday risks you actually manage. Wrong answers presented confidently, sensitive data in prompts, over-trust in output: those live in your controls – data terms, acceptable use, training – and no safety level replaces them.
- It is not a compliance certification. These are voluntary, self-defined frameworks. Valuable, but a vendor grading its own homework – treat them as disclosure, not assurance.
The failure mode we're already seeing in client conversations runs both directions: "ASL-3 means it's too risky to use" and "the lab handles safety, so we don't need our own guardrails." Both wrong, same root cause – reading a lab-level artefact as if it answered organisation-level questions.
Safety frameworks as procurement artefactsLink to this section
Here's the genuinely useful development. Until now, asking an AI vendor "how do you manage the risk of your own product?" got you marketing. Now there's a document to point at. Published scaling policies give vendor review something concrete to grip:
- Which safety framework does the provider publish, and did the model you're buying trigger any elevated level?
- What changed at that level – security, deployment restrictions, monitoring – and does any of it affect your use case?
- Where does the provider document everyday-risk handling: data retention, training on customer data, regional hosting?
- When capability thresholds are crossed mid-contract, how are customers told?
Five questions, one page of a vendor-review template. If a provider of frontier-model services can't point to anything resembling a scaling policy, that's now a data point too – the leaders have set a disclosure bar, and "we have nothing like that" is an answer worth writing down.
The signal worth briefing upwardLink to this section
Step back from the mechanics and the larger message is the trajectory. A frontier lab has formally moved into the regime where each major release gets checked against catastrophic-misuse thresholds – and expects some releases to trip them. Capabilities are compounding; treat this year's planning assumptions about "what AI can do" as having a short shelf life.
For your board, the one-paragraph version: the tools are getting substantially more capable on a cadence of months; the labs have started publishing graduated safeguards; our own controls – approved tools, data rules, trained people, evidence of all three – remain our responsibility and are unaffected by any vendor's safety level.
That last clause is the durable bit. Safety levels are the labs doing their part of the job. Nobody has offered to do yours.