The Levers

The people who can halt a dangerous model launch all work for the lab shipping it

Anthropic, OpenAI, and Google DeepMind each publish a rule for pausing a dangerous model, and in all three the final call belongs to the CEO or an officer the CEO appoints.

8 min read2026-07-18

Prior Context

A frontier lab's promise to handle a dangerous model responsibly is only worth the shortest chain from a capability line being crossed to a launch being stopped, and that chain is written down. Learning to read it settles what any such promise can and cannot do: a threshold the writer scores itself against, on its own reading of the competition, moves the decision back inside the company however precise the number sounds, so the same words bind hard or not at all depending on who holds the last switch. The named officer, the committee the chief executive appoints, and the one clause where an outside authority can compel publication return each time a new framework is read, because they are where the binding either lives or fails.

Prior The EU sorts frontier AI models by one compute number it calls an imperfect proxy: a lever whose threshold binds by statute, with a regulator outside the firm that can demand documents and fine, the sharp contrast to a self-scored pledge.
Prior Employers decide whether New York City's hiring-bias audit applies to them: the same weakness in another domain, a rule the covered party decides first whether it applies to.

The chain from a capability line to a stopped launch

In Anthropic's Responsible Scaling Policy, a model that crosses a defined line of dangerous capability is not supposed to ship until someone decides its risks are contained, and the policy names who. Internal subject-matter experts run the risk assessment and draft a Risk Report; the report goes to the CEO and a designated officer called the Responsible Scaling Officer, who "make the ultimate determination regarding the adequacy of the risk assessment and any downstream deployment or development plans."¹ That is an if-then commitment: a threshold of dangerous capability, declared in advance, that once crossed is meant to force a specific response: stronger safeguards, or a pause.

If-then commitment A conditional rule a lab writes for itself: if a model reaches a named capability threshold, then a named response follows. The binding lives in who can declare the threshold crossed and who can compel the response.

The shape is shared. OpenAI's Preparedness Framework sorts capability into three tracked categories, each with a High and a Critical line that a model must not cross without matching safeguards.² Google DeepMind's Frontier Safety Framework does the same work with what it calls Critical Capability Levels.³ Sixteen companies signed a collective version at the 2024 Seoul summit, undertaking to act "in accordance with the following voluntary commitments" and pledging "not to develop or deploy a model or system at all, if mitigations cannot be applied to keep risks below the thresholds."⁴

Read any of them the same way. Follow the chain from "threshold crossed" to "training stops," and mark where it ends. Where it ends inside the same company that is racing to ship, the document has written a statement of intent, whatever word sits on the cover. Twelve firms now publish such policies, which one independent survey describes as "conditional protocols that trigger specific responses when AI models and systems reach predefined capability thresholds."⁵

Who runs the evaluation and who signs off

In Anthropic's policy the assessment is internal and the decision is internal. Staff experts write the Risk Report; the CEO and RSO approve it and then "promptly share their decision(s)" with the Board and the Long-Term Benefit Trust, notification after the fact, with Board and Trust approval required only in the narrow case where a marginal-risk analysis "plays a major role in a decision to move forward."¹ Outside review exists, but it produces commentary, not a veto: Anthropic says it seeks "comprehensive, public external review" as "an experiment," triggered as a floor only when a Risk Report on a highly capable model "is significantly redacted," and nothing in the text compels the company to act on what the reviewers publish.¹

OpenAI's chain is the most explicit about its own end. An internal cross-functional group of company leaders, the Safety Advisory Group, reviews the evidence and recommends. But "OpenAI Leadership, i.e., the CEO or a person designated by them" makes "all final decisions, including accepting any residual risks and making deployment go/no-go decisions," and the framework adds, "for the avoidance of doubt," that leadership "can also make decisions without the SAG's participation, i.e., the SAG does not have the ability to 'filibuster'." The group's own members are appointed by that same leadership.²

DeepMind specifies the least of the three. Its entire governance section describes "a well-established and comprehensive internal governance structure" with "legal, compliance, and safety reviews" and escalation procedures, and names no officer, no committee, and no board role; the decider throughout is "the appropriate governance function," which alone judges "the residual risk to be acceptable."³ Three documents, three levels of detail, and one shared property: the chain from a crossed threshold to a stopped launch terminates inside the firm, and no party outside it can pull the brake.

What the process actually binds

None of this makes the process empty, and the anchor case shows why. Anthropic's policy binds a real internal procedure that an outsider can audit: it names an accountable RSO responsible for implementation, routes anonymous noncompliance reports to at least one executive who does not report to the RSO, gives the Board quarterly updates on noncompliance, forbids non-disparagement terms that would gag safety concerns, and commissions a roughly annual third-party review of whether it followed its own procedures.¹ The same clause that establishes that review states its limit: it "will focus on procedural compliance, not substantive outcomes." The document names the officer and publishes the procedure that officer follows, and reserves to the CEO and RSO the judgment of whether a given risk is acceptable at all. Both are true of one lever.

OpenAI holds the one check that rises above the person shipping. Its Board's Safety and Security Committee is "given visibility into processes," can review decisions, and "where necessary, the Board may reverse a decision and/or mandate a revised course of action."² That is a genuine internal appeal, and it is still a board inside the company. What none of the three frameworks contains is a person or body outside the firm who can compel a pause. The process is auditable. It is process, not a brake a regulator, a court, or an evaluator can pull.

A threshold its author can move

The commission for this piece named Anthropic's "AI Safety Level" scheme as the concrete lever. That scheme is no longer the operative one. Earlier editions defined AI Safety Levels with "specific lists of required controls"; the February 2026 rewrite deleted them, calling a fixed list "overly rigid" and preferring that a developer instead make "a strong argument... rather than AI Safety Levels." The same rewrite split what Anthropic will do "as a company" from "more ambitious industry-wide recommendations" it says it "cannot unilaterally and unconditionally commit to" following.¹ The named mechanism was rebuilt, and the policy has churned: six versions shipped in under three years.

6Versions of Anthropic's RSP since Sept 2023

< 3 yrsSpan of those six revisions

4Versions of DeepMind's Frontier Safety Framework since May 2024

At Seoul the same company put its name to a flat pledge to "not... develop or deploy a model or system at all" when risks cannot be mitigated, with thresholds "defined with input from trusted actors, including organisations' respective home governments as appropriate."⁴ Two years on, the unconditional pledge has become a conditional posture. Anthropic's stated reason is collective action: it will not hold itself to a unilateral standard competitors ignore, and it says it will "strive to avoid" revising its goals "in a less ambitious direction simply because we are unable to achieve them."¹ The reason is serious. It does not change the structure it produces. Changes to the policy "will be proposed by the CEO and RSO, and approved by the Board." A threshold its author can revise, on the author's own reading of the race, is a threshold whose fulcrum is the author's judgment.¹

What twelve published policies add up to

Two true things sit here, and they answer different questions. The practice spread. An independent survey counts twelve companies now publishing frontier safety policies that "establish conditions for halting development and deployment if the developer's mitigations are insufficient."⁵ Precommitment and a published protocol are a real template, the kind of document a legislature can later point at and harden. It is a case about whether the practice exists, not whether it constrains.

What holds up

Twelve firms publish if-then policies with explicit halting conditions, a template a regulator can build on.
The anchor policy binds auditable internal process: a named officer, whistleblower channels, and an annual procedural review.

What to be careful about

The final go/no-go, in all three frameworks, is a company officer's, and no outside party can compel a pause.
Independent graders judge existential-safety planning "entirely inadequate," none scoring above a C-minus.

On whether it constrains, the independent record is harsh. An affordance analysis of OpenAI's framework by outside researchers finds it evaluates only a narrow slice of risks and still lets the CEO "deploy even more dangerous capabilities," concluding that effective mitigation "requires more robust governance interventions beyond current industry self-regulation."⁶ The threshold the framework guards is high by construction: OpenAI defines "severe harm" as "the death or grave injury of thousands of people or hundreds of billions of dollars of economic damage."² The Future of Life Institute's Summer 2026 index grades Anthropic C+, OpenAI C, and DeepMind C; on planning for existential safety no company exceeds C-minus, and the review panel called existing efforts "entirely inadequate," with one reviewer noting that companies "have backed away from earlier commitments."⁷

Where the binding turns external

There is one place the last switch leaves the building. California's Transparency in Frontier Artificial Intelligence Act, in force since January 1, 2026, requires the largest developers to publish a safety framework on their websites and to report critical incidents, and it creates a civil penalty for noncompliance "enforceable by the Attorney General's office."⁸ The statute does not decide whether a model is safe. But it moves the power to compel publication, and to punish its absence, to an actor no lab appoints. Anthropic's own policy now cites the law by name where it defines its terms.¹ The binding these voluntary frameworks keep inside the firm is exactly the binding a statute takes out.

For any if-then commitment, the test travels. Read the chain to its end. Where an authority outside the company can force the pause, the commitment binds and the threshold is worth its precision. Where the last hand on the switch belongs to the party racing to ship, revisable on its own reading of the competition, the same words are a statement of intent: internal process, honestly published, resting on a judgment the promising party makes about itself.