Analyzing SSF Requirements in the GPAI Code of Practice: A Case Study using Anthropic’s Frontier Compliance Framework

Below is our list of requirements. We provide the requirement number, the requirement description, our assessment of the requirement’s presence in the FCF, and our reasoning for that assessment. We also provide a rubric for our assessments. A mapping from the requirements to the original CoP text, as well as an explanation of our method, can be found in Appendix A.

Rubric

• Present: Information addressing the requirement is present, and/or no clear gaps appear.
• Mostly present: Information addressing the requirement is mostly present, but minor gaps remain that should be addressed explicitly.
• Mostly absent: Information addressing the requirement is mostly absent, with major gaps remaining that should be addressed explicitly.
• Absent: No information is given that addresses the requirement, or the information given is vague to the degree that it does not provide relevant information.
• Assessment omitted: The assessment was omitted due to difficulty rigorously operationalizing the requirement. 
• Not required: No rating could be assigned due to the requirement not being necessary for this specific framework.

#	Requirement text	Assessment	Reasoning
1	The Signatory has created a Framework.	Present	Framework published
2	The Framework is state-of-the-art.	Assessment omitted	We believe a Framework could be classified as “state-of-the-art” if it matches or exceeds the best practices present across currently or previously available Frameworks of frontier AI companies. A precise evaluation of the FCF’s alignment with this requirement would thus require a thorough assessment of other SSFs, which is beyond the scope of this blog post.
3	The Framework contains a high-level description of implemented processes and measures for systemic risk assessment.	Assessment omitted	We omit our assessment due to the vagueness of the “high-level” term in combination with the broad scope of the requirement.
4	The Framework contains a high-level description of planned processes and measures for systemic risk assessment.	Assessment omitted	We omit our assessment due to the vagueness of the “high-level” term in combination with the broad scope of the requirement.
5	The Framework contains a high-level description of implemented processes and measures for systemic risk mitigation.	Assessment omitted	We omit our assessment due to the vagueness of the “high-level” term in combination with the broad scope of the requirement.
6	The Framework contains a high-level description of planned processes and measures for systemic risk mitigation.	Assessment omitted	We omit our assessment due to the vagueness of the “high-level” term in combination with the broad scope of the requirement.
7	The Framework includes a commitment to conducting lighter-touch model evaluations.	Present	The FCF includes an explicit commitment to conduct lighter-touch model evaluations: “In addition to carrying out full Systemic Risk Assessments as described above, we conduct lighter-touch model evaluations (which may include running our automatic evaluations and  collaborating with external experts to test our models) to consider whether further  systemic risk mitigations may be required or a full Systemic Risk Assessment and Model Report update is required.” (FCF §4)
8	The Framework describes trigger points for lighter-touch model evaluations.	Present	The FCF defines one trigger point in terms of time: “Every nine months, unless an update of the relevant model is planned within a month of the trigger point” (FCF §4) It also provides the baseline condition for starting lighter-touch evaluations:  “A new model is in training and test model snapshots are available and appropriate for early evaluation.” (FCF §4)
9	The Framework describes appropriate trigger points for lighter-touch model evaluations	Assessment omitted	We omit our assessment due to the current lack of clarity on what would make trigger points “appropriate”.
10	The Framework defines trigger points for lighter-touch model evaluations along the entire model lifecycle.	Mostly absent	Trigger points are set in terms of time (“every nine months”, FCF §4), and training-phase milestones (“snapshots”, FCF §4), but no lifecycle stage-dependent triggers are defined for stages after training finishes (e.g., deployment, fine-tuning, affordance changes, user access expansion, etc.)
11	The Framework’s trigger points for lighter-touch model evaluations are justified.	Absent	The FCF includes a description of the purpose of the triggers and what they trigger, but does not justify the chosen trigger points. (FCF §4)
12	The Framework describes the usage of trigger points for lighter-touch model evaluations (i.e., what actions or evaluations are initiated when trigger points are passed).	Mostly present	The FCF includes a brief explanation of what lighter-touch evaluations could look like and what those might result in: “We conduct lighter-touch model evaluations (which may include running our automatic evaluations and collaborating with external experts to test our models) to consider whether further systemic risk mitigations may be required or a full Systemic Risk Assessment and Model Report update is required.” (FCF §4)
13	The Framework justifies the usage of trigger points for lighter-touch model evaluations (i.e., what actions or evaluations are initiated when trigger points are passed).	Absent	The FCF describes the purpose of the trigger points and what they trigger, but does not justify how they are used. (FCF §4)
14	The Framework defines systemic risk tiers for each identified systemic risk.	Present	The FCF defines risk tiers for cyber offense, CBRN, harmful manipulation, and loss of control.
15	The Framework defines systemic risk tiers in terms of model capabilities.	Present	Each tier includes a description of model capabilities at that level.
16	The Framework defines appropriate systemic risk tiers.	Assessment omitted	We omit our assessment due to the current lack of clarity on what makes systemic risk tiers “appropriate”.
17	The Framework defines measurable systemic risk tiers.	Mostly absent	Most risk tiers contain quite ambiguous phrasing, e.g.: “Meaningful technical assistance for active cyber operations using known attack techniques and methodologies.” (FCF §2.4). Some risk tiers show an effort to include more specific thresholds. For example, CBRN Tier 2 applies to models with the ability to “significantly” help creation of chemical or bioweapons “with potential for catastrophic damages far beyond those of past catastrophes in this category such as COVID-19” (FCF §2.4). Similarly, harmful manipulation Tier 1 includes models that can automate “>50% of steps normally requiring multiple sophisticated adversarial actors” (FCF §2.4). However, the combination with vague wording like “significantly” or “sophisticated”  limits their measurability in practice.
18	The Framework includes at least one systemic risk tier that has not yet been reached by the Signatory’s models.	Mostly present	The FCF formally satisfies this requirement by defining two tiers per risk category, where Tier 2 appears unreached for most categories based on evidence from the Opus 4.6 system card and sabotage risk report. However, the FCF does not explicitly map current models to specific tiers, making this requirement difficult to verify for certain. The tier descriptions are also sufficiently vague that boundary cases are hard to assign. For cyber offense specifically, the system card acknowledges that Opus 4.6 “has saturated all of [their] current cyber evaluations” (Claude Opus 4.6 System Card §1.2.4.3), meaning accurate tier placement may no longer be possible with existing benchmarks. This raises the concern that higher tiers may have been reached without adequate measurement to confirm or rule out this possibility.
19	The Framework defines other systemic risk acceptance criteria if risk tiers are not suitable and the systemic risk is not a specified systemic risk.	Not required	Not required if only specified systemic risks are covered, as is the case here.
20	The Framework defines other appropriate systemic risk acceptance criteria if risk tiers are not suitable and the systemic risk is not a specified systemic risk.	Not required	Not required if only specified systemic risks are covered, as is the case here.
21	The Framework describes how risk tiers or other criteria will be used to determine whether each systemic risk is acceptable (i.e., how these tiers/criteria link to the identified systemic risk acceptance criteria).	Mostly absent	The FCF does not describe how risk tiers were used for risk acceptance determination, only including vague statements:  “The acceptability of residual risk depends on the scale and probability of harm and the potential consequences should harm occur” (FCF §2.3).  “We determine acceptability by reviewing our risk tiers” (FCF §2.3). These affirm that risk tiers are used for decision making and acceptability determination, but do not describe how.
22	The Framework describes how risk tiers or other criteria will be used to determine whether overall systemic risk is acceptable (i.e., how these tiers/criteria link to the overall systemic risk acceptance criteria).	Mostly absent	See requirement 21. For overall risk specifically, the FCF states that their “systemic risk tiers guide decisions on whether additional mitigations are required to keep overall systemic risk at an acceptable level prior to model release” (FCF §2.5). However, it does not describe how this is done.
23	The Framework justifies how their risk tiers or other criteria ensure the identified systemic risk is acceptable.	Absent	No justification included.
24	The Framework justifies how their risk tiers or other criteria ensure overall systemic risk is acceptable.	Absent	No justification included.
25	The systemic risk acceptance criterion incorporates a safety margin for each identified systemic risk.	Mostly absent	The FCF states that safety margins are included, but the safety margin is not referenced in the risk acceptance criteria (in this case, risk tiers) themselves:  “We determine acceptability by reviewing our risk tiers for each systemic risk category, which incorporate appropriate safety margins“ (FCF §2.3, emphasis added). “Provided the residual risk falls within acceptable levels, taking into account appropriate safety margins, the model is approved for continued development, internal use (where applicable), and launch (as the case may be)“ (FCF §2.5, emphasis added).   These quotes imply a recognition of the concept, but suggest a more shallow integration.
26	The safety margins are appropriate for the systemic risk.	Assessment omitted	We omit our assessment due to the current lack of clarity on what makes systemic risk tiers “appropriate”.
27	The safety margins take into account potential limitations, changes, and uncertainties of systemic risk sources.	Absent	The FCF provides no details on whether and how safety margins take into account the limitations, changes, and uncertainties of systemic risk sources.
28	The safety margins take into account potential limitations, changes, and uncertainties of systemic risk assessments.	Absent	The FCF provides no details on whether and how safety margins take into account the limitations, changes, and uncertainties of systemic risk assessments.
29	The safety margins take into account the potential limitations, changes, and uncertainties of the effectiveness of safety mitigations.	Absent	The FCF provides no details on whether and how safety margins take into account the limitations, changes, and uncertainties of safety mitigations.
30	The safety margins take into account the potential limitations, changes, and uncertainties of the effectiveness of security mitigations.	Absent	The FCF provides no details on whether and how safety margins take into account the limitations, changes, and uncertainties of security mitigations.
31	The Framework gives a high-level description of what safety mitigations to implement once each systemic risk tier is reached.	Mostly absent	No tier-specific safety mitigations are given. Instead, the FCF states that mitigations have to be “proportionate” to the level of risk. It also provides a list of general safety mitigations: “When a model reaches a particular risk tier, we implement safeguards proportionate to that level of risk. These may include monitoring and filtering the model’s inputs and outputs, modifying model behavior through fine-tuning (such as training the model to refuse certain requests), or staged deployment (gradually expanding access from a limited group of trusted users to broader availability)” (FCF §2.3, emphasis added). Further, it explicitly states that mitigations may be determined when specific risk tiers are reached, deferring this action to a later point in time:  “Because we cannot always anticipate what safety and security measures will be appropriate for models beyond the current frontier, the specific mitigations we implement may be determined when the relevant risk tier is reached, informed by the threat landscape at that  time” (FCF §2.3).
32	The Framework gives a high-level description of what security mitigations to implement once each systemic risk tier is reached.	Mostly absent	See requirement 31. No tier-specific security mitigations are given – just general security mitigations that Anthropic might apply: “For risks related to model security, safeguards may include conducting evaluations in sandboxed environments, anomaly detection systems, access controls, and output rate limiting” (FCF §2.3).
33	For each systemic risk for which risk tiers have been defined, the Framework gives estimates of timelines for when the provider reasonably foresees their models exceeding the highest systemic risk tier currently reached.	Absent	No timeline estimates are given.
34	The Framework gives justifications for the provider’s timeline estimates, including underlying assumptions and uncertainties.	Absent	No justifications for timeline estimates are given.
35	The Framework includes a statement as to whether input from external actors influences development, deployment, or use decisions.	Absent	No statement on whether input from external actors influences decisions is given.
36	The Framework describes how input from external actors influences development, deployment, or use decisions.	Absent	No description of how input from external actors influences decisions is given.
37	The Framework clearly defines the systemic risk oversight responsibility for overseeing systemic risk assessment and mitigation processes and measures.	Mostly absent	The FCF only includes a vague description of oversight over the Framework implementation, but does not specify how this relates to oversight of risk assessment and mitigation processes and measures: “The board of directors of Anthropic Ireland Limited oversees implementation of this Framework for EU purposes” (FCF §6).
38	The Framework clearly defines systemic risk ownership responsibility for managing systemic risks stemming from Signatories’ models, including for the systemic risk assessment and mitigation processes and measures.	Mostly absent	Existence of a risk owner is mentioned with one associated task, but the responsibility is not defined further:  “In each case, the justification for proceeding will be documented by the risk owner” (FCF §2.5).
39	The Framework clearly defines systemic risk ownership responsibility for managing the response to serious incidents.	Present	The FCF describes in detail what the role of “AI Incident Commander” for managing the response to serious incidents entails (§2.6).
40	The Framework clearly defines systemic risk support and monitoring responsibility for supporting and monitoring systemic risk assessment and mitigation processes and measures.	Absent	The systemic risk support and monitoring responsibility is not defined.
41	The Framework clearly defines systemic risk assurance responsibility for providing internal assurance about the adequacy of the Signatories’ systemic risk assessment and mitigation processes and measures to the management body in its supervisory function or another suitable independent body.	Absent	The systemic risk assurance responsibility is not defined.
42	As appropriate, the Framework clearly defines systemic risk assurance responsibility for providing external assurance about the adequacy of the Signatories’ systemic risk assessment and mitigation processes and measures to the management body in its supervisory function or another suitable independent body.	Assessment omitted	The systemic risk assurance responsibility is not defined. However, we omit our assessment of this requirement due to its optional nature implied by the phrase “as appropriate”.
43	The responsibilities for systemic risk oversight, systemic risk ownership, systemic risk support and monitoring, and systemic risk assurance are allocated across the following levels of the organization:  1. The management body in its supervisory function or another suitable independent body (such as a council or board)  2. The management body in its executive function Relevant operational teams 3. If available, internal assurance providers 4. If available, external assurance providers	Mostly absent	Systemic risk oversight: Responsibility for overseeing the implementation of the Framework is explicitly assigned to the board of directors of Anthropic Ireland Limited. However, it is unclear whether this responsibility completely covers the role of overseeing systemic risk assessment and mitigation processes and measures: “The board of directors of Anthropic Ireland Limited oversees implementation of this Framework for EU purposes.” (FCF §6) Systemic risk ownership: The existence of a risk owner for making decisions on proceeding with development, use, or deployment is mentioned, but it is not specified which organizational level they sit at: “In each case, the justification for proceeding will be documented by the risk owner.” (FCF §2.5) Further, the AI incident commander is allocated responsibility for managing the response to serious incidents (see requirement 39). However, this only partly covers systemic risk ownership responsibility.  Systemic risk support and monitoring: The responsibility for systemic risk support and monitoring is not allocated. Systemic risk assurance: The responsibility for systemic risk assurance is not allocated.
44	The Framework includes a description of the process by which the Framework will be updated.	Present	The FCF includes information on:  Who proposes updates: “Anthropic’s Head of Safeguards, Responsible Scaling Officer, General Counsel, Head of Integrity & Compliance, or Chief Information Security Officer“ (FCF §7.1). Who coordinates Framework updates: “Legal and Compliance function” (FCF §7.1). Triggers for updates: “changes in law or regulatory guidance, changes in model capabilities and related technologies, new approaches to mitigations and safeguards, other incidents affecting the industry, and new industry best practices and standards” (FCF §7.1). Timing of updates: “at least once every 12 months from the  Effective Dates of the TFAIA and the EU Code”, or when “relevant factors in the update and approval process are satisfied” (FCF §7.2). Documentation: Changelog with changes and justifications, published within 30 days (FCF §7.1). Board involvement: Material updates presented to the board for oversight (FCF §7.1).
45	The Framework includes a description of the process used to determine that an updated Framework is confirmed.	Mostly absent	The FCF mentions board oversight of updates and references “approved changes” (FCF §7.1), but does not explicitly state that the board approves (vs. merely reviews), and does not describe the process by which an updated Framework is determined to be confirmed: “Material updates will be presented to the board of directors of Anthropic Ireland Limited for oversight, with approved changes and justifications for material updates documented in a changelog and published within 30 days of the update.” (FCF §7.1)
46	The Framework includes a changelog for tracking updates, including how and why the Framework has been updated, along with a version number and date of change.	Mostly present	The FCF includes a changelog that explains how and why the framework was updated:  “Revised risk tiers in Section 2.4 across all four systemic risk categories to better align with our evolving threat models and capability assessments. Introduced nascent risk tiers for Harmful Manipulation”. It uses date-based versioning rather than assigning distinct version numbers alongside dates, as the CoP specifies.

We analyse Measure 1.1 by providing a breakdown of each measure into explicit requirements. If other measures are referenced, we follow these references to understand which aspects of the measure are required. We extracted the list of requirements in an iterative manner internally and verified it by soliciting feedback from an independent external reviewer.

---

Mapping the Code of Practice to explicit requirements

Measure 1.1 Creating the Framework

Signatories will create a state-of-the-art Framework, taking into account the models they are developing, making available on the market, and/or using.

1. Measure 1.1, para. 1: The Signatory has created a Framework.

2. Measure 1.1, para. 1: The Framework is state-of-the-art.

The Framework will contain a high-level description of implemented and planned processes and measures for systemic risk assessment and mitigation to adhere to this Chapter.

3. Measure 1.1, para. 2: The Framework contains a high-level description of implemented processes and measures for systemic risk assessment.

4. Measure 1.1, para. 2: The Framework contains a high-level description of planned processes and measures for systemic risk assessment.

5. Measure 1.1, para. 2: The Framework contains a high-level description of implemented processes and measures for systemic risk mitigation.

6. Measure 1.1, para. 2: The Framework contains a high-level description of planned processes and measures for systemic risk mitigation.

In addition, the Framework will contain:  

(1) a description and justification of the trigger points and their usage, at which the Signatories will conduct additional lighter-touch model evaluations along the entire model lifecycle, as specified in Measure 1.2, second paragraph, point (1)(a);

Measure 1.2 (1)(a): Signatories will implement the processes and measures outlined in their Framework as specified in the following paragraphs.  

Along the entire model lifecycle, Signatories will continuously:  

(1) assess the systemic risks stemming from the model by:

(a) conducting lighter-touch model evaluations that need not adhere to Appendix 3 (e.g. automated evaluations) at appropriate trigger points defined in terms of, e.g. time, training compute, development stages, user access, inference compute, and/or affordances;

---

7. Measure 1.1, para. 3(1) → Measure 1.2, para. 2(1)(a): The Framework includes a commitment to conducting lighter-touch model evaluations.

8. Measure 1.1, para. 3(1) → Measure 1.2, para. 2(1)(a): The Framework describes trigger points for lighter-touch model evaluations.

9. Measure 1.1, para. 3(1) → Measure 1.2, para. 2(1)(a): The Framework describes appropriate trigger points for lighter-touch model evaluations.

10. Measure 1.1, para. 3(1) → Measure 1.2, para. 2(1)(a): The Framework defines trigger points for lighter-touch model evaluations along the entire model lifecycle.

11. Measure 1.1, para. 3(1) → Measure 1.2, para. 2(1)(a): The Framework’s trigger points for lighter-touch model evaluations are justified.

12. Measure 1.1, para. 3(1)  → Measure 1.2, para. 2(1)(a): The Framework describes the usage of trigger points for lighter-touch model evaluations (i.e., what actions or evaluations are initiated when trigger points are passed).

13. Measure 1.1, para. 3(1) → Measure 1.2, para. 2(1)(a): The Framework justifies the usage of trigger points for lighter-touch model evaluations (i.e., what actions or evaluations are initiated when trigger points are passed).

(2) for the Signatories’ determination of whether systemic risk is considered acceptable, as specified in Commitment 4:  

(a) a description and justification of the systemic risk acceptance criteria, including the systemic risk tiers, and their usage as specified in Measure 4.1; 

---

Commitment 4:

Signatories commit to specifying systemic risk acceptance criteria and determining whether the systemic risks stemming from the model are acceptable (as specified in Measure 4.1). 

Signatories commit to deciding whether or not to proceed with the development, the making available on the market, and/or the use of the model based on the systemic risk acceptance determination (as specified in Measure 4.2).  

Measure 4.1 Systemic risk acceptance criteria and acceptance determination  

Signatories will describe and justify (in the Framework pursuant to Measure 1.1, point (2)(a)) how they will determine whether the systemic risks stemming from the model are acceptable. 

To do so, Signatories will: 

(1) for each identified systemic risk (pursuant to Measure 2.1), at least:  

(a) define appropriate systemic risk tiers that: 

14. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(1)(a)(i): The Framework defines systemic risk tiers for each identified systemic risk.

(i) are defined in terms of model capabilities, and may additionally incorporate model propensities, risk estimates, and/or other suitable metrics; 

15. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(1)(a)(i): The Framework defines systemic risk tiers in terms of model capabilities.

16. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(1)(a)(i): The Framework defines appropriate systemic risk tiers.

(ii) are measurable; and 

17. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(1)(a)(ii): The Framework defines measurable systemic risk tiers.

(iii) comprise at least one systemic risk tier that has not been reached by the model;

18. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(1)(a)(iii): The Framework includes at least one systemic risk tier that has not yet been reached by the Signatory’s models.

or (b) define other appropriate systemic risk acceptance criteria, if systemic risk tiers are not suitable for the systemic risk and the systemic risk is not a specified systemic risk (pursuant to Appendix 1.4); 

19. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(1)(B): The Framework defines other systemic risk acceptance criteria if risk tiers are not suitable and the systemic risk is not a specified systemic risk.

20. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(1)(B): The Framework defines other appropriate systemic risk acceptance criteria if risk tiers are not suitable and the systemic risk is not a specified systemic risk.

(2) describe how they will use these tiers and/or other criteria to determine whether each identified systemic risk (pursuant to Measure 2.1) and the overall systemic risk are acceptable; and

21. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(2): The Framework describes how risk tiers or other criteria will be used to determine whether each systemic risk is acceptable (i.e., how these tiers/criteria link to the identified systemic risk acceptance criteria).

22. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(2): The Framework describes how risk tiers or other criteria will be used to determine whether overall systemic risk is acceptable (i.e., how these tiers/criteria link to the overall systemic risk acceptance criteria).

(3) justify how the use of these tiers and/or other criteria pursuant to point (2) ensures that each identified systemic risk (pursuant to Measure 2.1) and the overall systemic risk are acceptable. 

23. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(3): The Framework justifies how their risk tiers or other criteria ensure the identified systemic risk is acceptable.

24. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 1(3): The Framework justifies how their risk tiers or other criteria ensure overall systemic risk is acceptable.

Signatories will apply the systemic risk acceptance criteria to each identified systemic risk (pursuant to Measure 2.1), incorporating a safety margin (as specified in the following paragraph), to determine whether each identified systemic risk (pursuant to Measure 2.1) and the overall systemic risk are acceptable. This acceptance determination will take into account at least the information gathered via systemic risk identification and analysis (pursuant to Commitments 2 and 3). 

25. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 2: The systemic risk acceptance criterion incorporates a safety margin for each identified systemic risk.

The safety margin will:  

(1) be appropriate for the systemic risk; and 

26. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 3(1): The safety margins are appropriate for the systemic risk.

(2) take into account potential limitations, changes, and uncertainties of:  

(a) systemic risk sources (e.g. capability improvements after the time of assessment); 

27. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 3(2)(a): The safety margins take into account potential limitations, changes, and uncertainties of systemic risk sources.

(b) systemic risk assessments (e.g. under-elicitation of model evaluations or historical accuracy of similar assessments); and 

28. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 3(2)(b): The safety margins take into account potential limitations, changes, and uncertainties of systemic risk assessments.

(c) the effectiveness of safety and security mitigations (e.g. mitigations being circumvented, deactivated, or subverted).

For each safety margin given in the Framework:

29. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 3(2)(c): The safety margins take into account the potential limitations, changes, and uncertainties of the effectiveness of safety mitigations.

30. Measure 1.1, para. 3(2)(a) → Measure 4.1, para. 3(2)(c): The safety margins take into account the potential limitations, changes, and uncertainties of the effectiveness of security mitigations.

---

(b) a high-level description of what safety and security mitigations Signatories would need to implement once each systemic risk tier is reached; 

31. Measure 1.1, para. 3(2)(b): The Framework gives a high-level description of what safety mitigations to implement once each systemic risk tier is reached.

32. Measure 1.1, para. 3(2)(b): The Framework gives a high-level description of what security mitigations to implement once each systemic risk tier is reached.

(c) for each systemic risk that Signatories defined systemic risk tiers for as specified in Measure 4.1, estimates of timelines when Signatories reasonably foresee that they will have a model that exceeds the highest systemic risk tier already reached by any of their existing models. Such estimates:

33. Measure 1.1, para. 3(2)(c): For each systemic risk for which risk tiers have been defined, the Framework gives estimates of timelines for when the provider reasonably foresees their models exceeding the highest systemic risk tier currently reached.

(i) may consist of time ranges or probability distributions⁴; and 

(ii) may take into account aggregate forecasts, surveys, and other estimates produced with other providers. Further, such estimates will be supported by justifications, including underlying assumptions and uncertainties; and 

34. Measure 1.1, para. 3(2)(c): The Framework gives justifications for the provider’s timeline estimates, including underlying assumptions and uncertainties.

(d) a description of whether and, if so, by what process input from external actors, including governments, influences proceeding with the development, making available on the market, and/or use of the Signatories’ models as specified in Measure 4.2, other than as the result of independent external evaluations; 

35. Measure 1.1, para. 3(2)(d): The Framework includes a statement as to whether input from external actors influences development, deployment, or use decisions.

36. Measure 1.1, para. 3(2)(d): The Framework describes how input from external actors influences development, deployment, or use decisions.

(3) a description of how systemic risk responsibility is allocated for the processes by which systemic risk is assessed and mitigated as specified in Commitment 8; and 

---

Measure 8.1: Signatories will clearly define⁵ responsibilities for managing the systemic risks stemming from their models across all levels of the organisation. This includes the following responsibilities: 

(1) Systemic risk oversight: Overseeing the Signatories’ systemic risk assessment and mitigation processes and measures. 

37. Measure 1.1, para. 3(3) → Measure 8.1, para. 1(1): The Framework clearly defines the systemic risk oversight responsibility for overseeing systemic risk assessment and mitigation processes and measures.

(2) Systemic risk ownership: Managing systemic risks stemming from Signatories’ models, including the systemic risk assessment and mitigation processes and measures, and managing the response to serious incidents. 

38. Measure 1.1, para. 3(3) → Measure 8.1, para. 1(2): The Framework clearly defines systemic risk ownership responsibility for managing systemic risks stemming from Signatories’ models, including for the systemic risk assessment and mitigation processes and measures.

39. Measure 1.1, para. 3(3) → Measure 8.1, para. 1(2): The Framework clearly defines systemic risk ownership responsibility for managing the response to serious incidents.

(3) Systemic risk support and monitoring: Supporting and monitoring the Signatories’ systemic risk assessment and mitigation processes and measures. 

40. Measure 1.1, para. 3(3) → Measure 8.1, para. 1(3): The Framework clearly defines systemic risk support and monitoring responsibility for supporting and monitoring systemic risk assessment and mitigation processes and measures.

(4) Systemic risk assurance: Providing internal and, as appropriate, external assurance about the adequacy of the Signatories’ systemic risk assessment and mitigation processes and measures to the management body in its supervisory function or another suitable independent body (such as a council or board). 

41. Measure 1.1, para. 3(3) → Measure 8.1, para. 1(4): The Framework clearly defines systemic risk assurance responsibility for providing internal assurance about the adequacy of the Signatories’ systemic risk assessment and mitigation processes and measures to the management body in its supervisory function or another suitable independent body.

42. Measure 1.1, para. 3(3) → Measure 8.1, para. 1(4): As appropriate, the Framework clearly defines systemic risk assurance responsibility for providing external assurance about the adequacy of the Signatories’ systemic risk assessment and mitigation processes and measures to the management body in its supervisory function or another suitable independent body.

Signatories will allocate these responsibilities, as suitable for the Signatories’ governance structure and organisational complexity, across the following levels of their organisation:  

(1) the management body in its supervisory function or another suitable independent body (such as a council or board);  

(2) the management body in its executive function;  

(3) relevant operational teams;  

(4) if available, internal assurance providers (e.g. an internal audit function); and  

(5) if available, external assurance providers (e.g. third-party auditors). 

43. Measure 1.1, para. 3(3) → Measure 8.1, para. 2: The responsibilities for systemic risk oversight, systemic risk ownership, systemic risk support and monitoring, and systemic risk assurance are allocated across the following levels of the organization:

1. The management body in its supervisory function or another suitable independent body (such as a council or board) 
2. The management body in its executive function
3. Relevant operational teams
4. If available, internal assurance providers
5. If available, external assurance providers

This Measure is presumed to be fulfilled, if Signatories, as appropriate for the systemic risks stemming from their models, adhere to all of the following:  

(1) Systemic risk oversight: The responsibility for overseeing the Signatory’s systemic risk management processes and measures has been assigned to a specific committee of the management body in its supervisory function (e.g. a risk committee or audit committee) or one or multiple suitable independent bodies (such as councils or boards). For Signatories that are SMEs or SMCs, this responsibility may be primarily assigned to an individual member of the management body in its supervisory function.  

(2) Systemic risk ownership: The responsibility for managing systemic risks from models has been assigned to suitable members of the management body in its executive function who are also responsible for relevant Signatory core business activities that may give rise to systemic risk, such as research and product development (e.g. Head of Research or Head of Product). The members of the management body in its executive function have assigned lower-level responsibilities to operational managers who oversee parts of the systemic-risk-producing business activities (e.g. specific research domains or specific products). Depending on the organisational complexity, there may be a cascading responsibility structure.  

(3) Systemic risk support and monitoring: The responsibility for supporting and monitoring the Signatory’s systemic risk management processes and measures, including conducting risk assessments, has been assigned to at least one member of the management body in its executive function (e.g. a Chief Risk Officer or a Vice President, Safety & Security Framework). This member(s) must not also be responsible for the Signatory’s core business activities that may produce systemic risk (e.g. research and product development). For Signatories that are SMEs or SMCs, there is at least one individual in the management body in its executive function tasked with supporting and monitoring the Signatory’s systemic risk assessment and mitigation processes and measures.  

(4) Systemic risk assurance: The responsibility for providing assurance about the adequacy of the Signatory’s systemic risk assessment and mitigation processes and measures to the management body in its supervisory function or another suitable independent body (such as a council or board) has been assigned to a relevant party (e.g. a Chief Audit Executive, a Head of Internal Audit, or a relevant sub-committee). This individual is supported by an internal audit function, or equivalent, and external assurance as appropriate. The Signatories’ internal assurance activities are appropriate. For Signatories that are SMEs or SMCs, the management body in its supervisory function periodically assesses the Signatory’s systemic risk assessment and mitigation processes and measures (e.g. by approving the Signatory’s Framework assessment).

---

(4) a description of the process by which Signatories will update the Framework, including how they will determine that an updated Framework is confirmed, as specified in Measure 1.3.

44. Measure 1.1, para. 3(4): The Framework includes a description of the process by which the Framework will be updated.

45. Measure 1.1, para. 3(4): The Framework includes a description of the process used to determine that an updated Framework is confirmed.

---

Measure 1.3: Signatories will update the Framework as appropriate, including without undue delay after a Framework assessment (specified in the following paragraphs), to ensure the information in Measure 1.1 is kept up-to-date and the Framework is at least state-of-the-art. For any update of the Framework, Signatories will include a changelog, describing how and why the Framework has been updated, along with a version number and the date of change.

46. Measure 1.3, para. 1: The Framework includes a changelog for tracking updates, including how and why the Framework has been updated, along with a version number and date of change.

---

Signatories will have confirmed the Framework no later than four weeks after having notified the Commission pursuant to Article 52(1) AI Act and no later than two weeks before placing the model on the market.