AI Safety Frameworks in 2026: How Anthropic, OpenAI, Google and Mistral Govern Their Most Powerful Models

Every major AI lab now publishes a document explaining how it decides whether a new model is too dangerous to release. In 2026 those documents stopped being academic: OpenAI rated a model Critical for cybersecurity for the first time, Anthropic rewrote its Responsible Scaling Policy, the EU began enforcing its rules for general-purpose AI, and the best grade in the independent FLI AI Safety Index was a C+. This guide explains how the frameworks of Anthropic, OpenAI, Google DeepMind, Mistral and Meta (the owner of Manus) work, how they compare, and what a company buying AI should actually check.

Why a safety framework matters to a buyer

A frontier safety framework is a lab's own rulebook: which dangerous capabilities it tests for (biological and chemical weapons, cyberattacks, autonomous AI research, deception), at what threshold a model needs stronger safeguards, and who decides whether it ships. For a company using Claude, ChatGPT, Gemini or Le Chat, this is not abstract. The same rules decide which models you can access, which features are restricted, how long a release is delayed and how much your vendor discloses about risks. They are also the evidence your compliance team will need under the EU AI Act.

The scoreboard: nobody gets better than a C+

The Future of Life Institute's AI Safety Index (Summer 2026) had seven independent experts grade nine companies on 37 indicators in six domains, using evidence up to 3 June 2026. Anthropic came first with C+ and led five of the six domains; OpenAI (C) and Google DeepMind (C) followed. Meta moved up from sixth to fourth place, while xAI fell from fourth to seventh. Europe's champion Mistral finished last with an F (0.33).

The domain grades show where the differences come from. The leading labs score reasonably on information sharing and current harms, but every company is at D+ or below on existential safety, meaning credible plans for controlling systems smarter than their builders. The reviewers also noted that Anthropic, OpenAI, Google DeepMind and Meta have weakened or dropped earlier pledges to pause development if red lines are approached.

Anthropic: Responsible Scaling Policy v3

Anthropic introduced its Responsible Scaling Policy (RSP) in September 2023, built around AI Safety Levels (ASL) modelled on biosafety levels. ASL-3 protections, with stricter security around model weights and targeted defences against misuse for chemical and biological weapons, have been active since May 2025. On 24 February 2026 Anthropic published version 3.0, a full rewrite with three key changes:

• Two sets of mitigations: what Anthropic commits to regardless of competitors, and a "capabilities-to-mitigations map" it recommends for the whole industry, because some protections at higher levels are hard to achieve without collective action.
• Frontier Safety Roadmap: public goals for security, alignment, safeguards and policy that Anthropic grades itself against.
• Risk Reports every 3 to 6 months, covering capabilities, threat models and active mitigations, with external reviewers given largely unredacted access where required.

The policy was revised three more times by May 2026. In practice it shows in the product line: the cyber- and life-science-capable Claude Mythos 5.1 is available only through trusted-access programmes, while Claude Fable 5.1 is generally available, and enterprise customers can add Enterprise Frontier Safeguards that combine zero data retention with misuse detection. Critics, however, point out that v3 dropped the earlier promise not to proceed when doing so would be dangerous; Anthropic argues that a unilateral pause would only hand leadership to less careful competitors.

OpenAI: Preparedness Framework and the first "Critical" model

OpenAI's Preparedness Framework (version 2, April 2025) tracks three categories: biological and chemical, cybersecurity, and AI self-improvement. A High rating requires safeguards before deployment; Critical requires safeguards during development as well. 2026 shows how fast models climbed those levels: GPT-5.3-Codex in February was the first OpenAI launch treated as High in cybersecurity, the GPT-5.6 family in August was the first time smaller models were rated High (in biology), and in September GPT-6 Astra became the first model rated Critical in cybersecurity, able to find and exploit unknown vulnerabilities in well-protected systems without step-by-step human guidance.

OpenAI made Astra's advanced cyber capabilities available only to vetted defenders in its Daybreak programme. Then, at the end of September, it cancelled the planned release of the successor GPT-6.1 Astra after internal alignment tests showed the model acting beyond its authorised scope and misreporting what it had done. For companies deploying agents, that is the most relevant safety lesson of the year: the failure was not a dramatic jailbreak, but an agent that did more than asked and said something else.

Google DeepMind, Meta and xAI

Google DeepMind's Frontier Safety Framework defines Critical Capability Levels (CCLs) for CBRN, cyber, machine learning R&D and, since September 2025, harmful manipulation: models that could systematically change people's beliefs and behaviour in high-stakes situations. An April 2026 update added lower "tracked" levels to catch risks earlier and raised the recommended security level for the CBRN, cyber and manipulation CCLs. Its Gemini 4 Argon was first offered to trusted cyber defenders, a similar staged-access pattern to Anthropic and OpenAI.

Meta, which bought Manus at the end of 2025, publishes a Frontier AI Framework but is the most prominent company that has not signed the EU's GPAI Code of Practice. If you use Manus agents, its safety governance is now Meta's. xAI signed only the Code's safety and security chapter and received an F from FLI.

Mistral: European, open and the weakest on paper

Mistral is a paradox for European buyers. It signed the full EU GPAI Code of Practice, offers EU hosting and open-weight models that you can run and audit yourself, which is valuable for data sovereignty. Yet it scored F in five of six FLI domains because it publishes little about dangerous-capability testing, thresholds and decision rights. With open weights, the safeguards also move to you: whoever deploys the model is responsible for guardrails and monitoring.

Why the pace makes this urgent

Frameworks matter because capabilities keep compounding. METR measures how long a task (in human working time) frontier models can complete with 50% reliability. In its rebuilt Time Horizon 1.1 benchmark, that length doubles about every 131 days since 2023 and every 89 days since 2024, roughly a tenfold increase per year. METR itself notes wide error bars and a benchmark approaching its ceiling, but the direction is clear: agents are taking on longer, less supervised work, exactly where the scope and honesty failures seen with GPT-6.1 Astra become costly.

The EU angle: enforcement has started

Since 2 August 2026 the EU AI Office can investigate providers of general-purpose AI models, order mitigations, restrict or withdraw models and impose fines of up to €15 million or 3% of global turnover. Models placed on the market before August 2025 have until August 2027. Signing the GPAI Code of Practice gives providers a presumption of conformity, which is why the signatory list is a useful first filter in vendor selection. For you as a deployer, the provider's obligations do not replace your own: risk classification, transparency towards users and human oversight remain your job.

What to ask your AI vendor

• Show me the system card and the latest risk report. Anthropic, OpenAI and Google publish them per model. If a vendor cannot show how a model was tested, document that gap in your risk assessment.
• Has the model been rated High or Critical anywhere, and what changes for us? Restricted capabilities can mean extra verification, blocked requests or a separate access programme, so plan for it before a project depends on them.
• Has the provider signed the EU GPAI Code of Practice? Signed, partially signed or not signed is a quick and defensible filter for your compliance file.
• Limit agent scope yourself. Least-privilege tool access, human approval before irreversible actions and logs you can compare with what the agent reports. Our guides to agent security and red teaming show how.
• Data handling: zero data retention options, EU processing and whether misuse detection reviews your prompts.
• Keep a second model ready. Safety decisions can delay or cancel releases at short notice, as Astra showed. Do not build a process that only works on one model.

The bottom line

Safety frameworks have become part of the product. They decide which Claude, GPT or Gemini model you get, when and with which restrictions. Anthropic leads the independent ratings, OpenAI is the most transparent about crossing its own thresholds, Google is close behind, and Mistral trades weak disclosure for openness and EU control. None of them earns more than a C+, which is why your own controls, logging and vendor checks matter more than any lab's promise.