Anthropic · 2026
Published June 10, 2026 alongside an Economic Policy Framework under the banner 'Policy on the AI Exponential,' the Advanced AI Framework is Anthropic's statement of what governments should do about the most serious risks from frontier AI. It is the source document for the company's later draft bill, which its federal affairs lead described in October as a translation of the framework into legislative language. Part 1 sets obligations for developers that both train models above 10^25 operations and earn more than $500M in AI revenue or spend more than $1B a year on AI R&D. They must test for four enumerated risks (biological weapons, offensive cyber operations, loss of control, and automated AI R&D that amplifies the others), publish a safety framework, certify compliance annually, publish risk reports every six months that cover substantially riskier internal models, publish system cards for materially more capable or less safeguarded releases, report critical safety incidents within 15 days, maintain a security program with penetration testing, and engage at least one qualified independent evaluator who sees unredacted reports and the most capable models and publishes a review. The framework floats evaluator licensing, government or pooled funding so evaluators are not paid by the labs they assess, ratings, and random assignment of highly rated evaluators to prevent 'evaluator shopping.' For enforcement it offers a menu rather than a design: an agency could find violations, from missing reports or an unqualified or under-resourced evaluator to a significant risk of catastrophic harm that persists after safeguards, and respond with fines, a bar on deploying further covered models until the violation is corrected, or, in extreme cases, restrictions on deployed models. It pairs that with optional safeguards: court enforcement with provisional remedies, discretion confined to listed violations, and expedited judicial review. On preemption it says Congress should not preempt state law unless it enacts a rigorous federal regime that 'meets or exceeds the strongest measures proposed in this framework,' and then only for the specific functions Congress occupies, with no safe harbor and ambiguity resolved for the states. Part 2 is a societal-resilience agenda for biological and cyber threats: gene synthesis screening, pathogen-agnostic biosurveillance, stockpiles and countermeasures, open-source and legacy software security, coordinated vulnerability remediation at scale, and binding patch-deployment schedules for critical-infrastructure operators.
A menu with a bar set high. The framework commits firmly to the information layer — testing, risk reports, system cards, independent evaluators who publish — and to the principle that there must ultimately be a way to block or deter a dangerous model, then deliberately declines to pick a design for that power, offering policymakers a range from lighter-touch to agency-led and suggesting they start light and tighten as capabilities and the evaluator ecosystem mature. Its preemption clause is the most demanding any frontier developer has written: a federal law earns preemption only by meeting or exceeding the framework's strongest measures. That makes the framework the yardstick for Anthropic's own bill, and the bill measures short of it.
This proposal is related to the frontier framework family built on California's SB 53. Compare the family side by side →
Where the burden falls
In contrast
Anthropic's October draft bill is, by its federal affairs lead's account, this framework in legislative form, and on the information layer it tracks closely: the same four enumerated risks, safety frameworks, six-month risk reports reaching internal models, system cards, 15-day incident reports, and evaluators who publish. The bill goes further in places: a 24-hour clock for imminent danger, an audited security standard, and detailed whistleblower remedies. It reaches further down too, putting transparency and incident duties on every developer above 10^25 operations, where the framework covered only those that also passed the revenue-or-spending test. On every point the framework left open, the bill picks the lighter option. Of the framework's four grounds for agency action, it keeps only one, narrowed to imminent risk and decided by a court. It drops the bar on further deployments until a violation is corrected. Evaluators are rated but not licensed, and are paid by the developer. And it preempts disclosure, evaluation, and incident reporting for every AI developer. The framework said Congress should not preempt state law unless the federal regime meets or exceeds its strongest measures; on blocking authority and evaluator independence, the bill does not.
Compare with Anthropic Draft Bill→Derived from the proposal’s own policy documents
From the perspective of political opposition
Verbatim from podcast transcripts; each links to the moment it was said
“Meanwhile, Dario Amodei keeps playing the please regulate us card.”
Enforcement Mechanism vs. Regulatory Scope
Prevention vs. Liability & Regulatory Authority
Innovation Priority vs. Worker Protection
Pre-deployment Obligations vs. Federal Preemption