Frontier AI-C(B)RN Commitments Observatory

The CBRN Collapse

12 frameworks coded · 10 companies · 2 documented nulls
Dataset v0.7.6 · 25 Sep 2026

Biological hazard specificity in frontier AI safety frameworks: a crosswalk against the EU General-Purpose AI Code of Practice, Safety and Security chapter.

Principal finding

The Code of Practice mentions biological hazard 3 times: once in a recital and twice in Appendix 1. None of its 32 Measures, where the commitments sit, names a hazard domain. CBRN is identified as a single systemic risk.

The frameworks are written the same way. Where they name biological hazard, it is usually the word on its own, inside a CBRN block.

Code of Practice · Safety and Security chapter

Recitals

1 of 9, no obligation

Measures

0 of 32 name a domain

Appendices

2 provisions, both in Appendix 1

Framework findings · hazard differentiation

Of the 67 bio-relevant claims in the 12 frameworks:

52carry no biology beyond the word itself
28name all four hazard domains as one undivided block
3give a reason for treating biological hazard differently

Biological vocabulary across the 12 frameworks

COVID-19 · biodesign tools · a novel biological agent · CDC Class A · BioTIER · one five-stage threat-creation model · DNA and proteins · LAB-Bench · WMDP-Bio · biological design tools · wet-lab experiments · CBRN agents

Correction, 29 September 2026

The Public transparency (Measure 10.2) and External evaluators (Appendix 3.5) columns previously counted only claims specific to biology, which showed no framework addressing either. Following mentor review, both are now read across the whole document, as Measures 8.1 and 1.3 already were: publication and outside evaluation are process commitments that apply to every hazard alike. Measure 10.2 moves from 0 to 10 partial. The printed poster shows the earlier version.

01 · Commitments crosswalk

Twelve published safety frameworks, compared against six provisions of the Code of Practice.

Nine frameworks establish a biological threshold. Ten commit to publishing evaluation results, in general terms.

addressedpartialnot addressed
CompanyFrameworkCode of Practice signatory Bio-relevant claimshazard specificityby-name referentbare bio nounthe word only VersioningM 1.3 · docCapability thresholdsM 4.1 · bioGo / no-go decisionM 4.2 · bioResponsibility allocationM 8.1 · docPublic transparencyM 10.2 · docExternal evaluatorsApp 3.5 · doc
AmazonFrontier Model Safety Framework CoP
2 claimsno specific mention
AnthropicFrontier Compliance Framework regulatoryCoP
5 claims1 bare bio noun
Responsible Scaling Policy voluntaryCoP
3 claims1 by-name referent
CohereSecure AI Frontier Model Framework CoP
2 claimsno specific mention
G42Frontier AI Safety Framework CoP
9 claims3 by-name referents
Google DeepMindFrontier Safety Framework CoP
4 claimsno specific mention
MetaAdvanced AI Scaling Framework CoP
13 claims3 by-name referents
MicrosoftFrontier Governance Framework CoP
4 claimsno specific mention
NVIDIAFrontier AI Risk Assessment CoP
2 claims1 by-name referent
OpenAIFrontier Governance Framework regulatoryCoP
7 claims1 by-name referent
Preparedness Framework voluntaryCoP
5 claims2 by-name referents
xAIFrontier AI Framework CoP
11 claims3 bare bio nouns
Provisions fully addressed4/129/127/121/120/120/12

Reading the circles

Each circle compares one framework against the commitment described in the text of a Code provision.

Whether a Measure is addressed should not be read as a compliance judgment, or as a judgment about the company.

BIO indicates that the column is scoped to bio-relevant claims, and is more specific than the Code requires. DOC indicates that the provision is read across the whole document: Measures 8.1 and 1.3 state their own test, and Measure 10.2 and Appendix 3.5 apply to every hazard alike.

Appendix 3.5 is marked partial only where a framework commits both to outside evaluation and to publishing it.

Paired publications

The regulatory and voluntary chips indicate paired publications and how each document describes its purpose.

Signatories

CoP indicates the company is included in the European Commission's list of Code of Practice signatories, last updated 31 July 2026. Note: xAI is a signatory to the Safety and Security chapter only.

02 · Risk postures

Domain-specific thresholds to a reasoned refusal

The corpus does not divide into frameworks that address biological risk and frameworks that ignore it. Every framework sits in one of five postures, ordered by how specifically the hazard domain is named before anything is committed to it.

Threshold at the biological level

G42 · Meta · OpenAI-FGF · OpenAI-PF

At least one capability threshold is specific to the biological domain. G42: novice uplift to a biological weapon and the design of novel weapons; Meta and OpenAI: narrow to biology inside a broader set of combined chemical and biological tiers.

Threshold on chemical and biological, combined

Anthropic-FCF · Anthropic-RSP

Thresholds name chemical and biological weapons as a pair and never separate the domains. Nothing in the document hinges on biology alone.

Threshold at the CBRN block

Amazon · Google DeepMind · Microsoft

Thresholds are stated for CBRN as one undivided category. Nothing in the document hinges on biology alone.

No threshold, names the domain

xAI · NVIDIA

CBRN is named as one undivided risk category. xAI applies risk tiers to each domain without stating the capability level that would put a model in one; NVIDIA lists CBRN as a hazard with no associated threshold.

Considers thresholds, but declines

Cohere

The capability-threshold approach is established but rejected, on the grounds that biorisk research does not account for risk chains beyond information access.

Samsung Electronics and NAVER publish frameworks that carry no CBRN content at all. These frameworks were fully reviewed but not coded or counted in the overall corpus.

03 · One company, two frameworks

Both companies put the detail in the voluntary document

OpenAI and Anthropic each publish a pair of frameworks: one identified as meeting regulatory obligations and one which is voluntary and internal. Totals are pooled across both companies.

FeatureRegulatoryVoluntary
Bio-relevant claims128
Carries biological substance2 of 12 · 17%3 of 8 · 38%
Names CBRN as one undivided block70
Stated as a rule26
Tied to a go / no-go decision04

All 4 claims tied to a go or no-go decision appear only in the voluntary documents, and all 7 claims that treat CBRN as one undivided block appear only in the regulatory-facing ones. Decision rules may also sit in companion documents this crosswalk does not read, and nothing here shows that grouping CBRN together caused the gaps.

Committed at Seoul, not published

Six frontier-salient companies committed at the AI Seoul Summit (2024) to publish a frontier safety framework and have not: 01.AI, IBM, MiniMax, Mistral AI, Technology Innovation Institute and Z.ai (Zhipu AI). IBM and Mistral AI are also EU GPAI Code of Practice signatories but have no published frameworks to assess company commitments. This is the primary gap a crosswalk of published documents cannot examine.

Implications

  1. Read both documents, or neither. Where a company publishes a pair, the regulatory-facing document is the thinner one, and it is the one most readers will pick up. Judging a company on it alone understates what that company has actually written down.
  2. Publication is promised in general terms. Ten of twelve frameworks commit to publishing evaluation results, but none says anything specific about biology, and three spell out what a report will contain. Only Anthropic's Responsible Scaling Policy commits both to outside evaluation and to publishing it, and no framework sets out access terms for outside evaluators.
  3. Covering CBRN is not covering biology. 28 of 67 claims in the corpus treat the four hazard domains as a single block, more than any other grouping. A framework that says CBRN cannot be read as addressing what is specific to biological risk: tacit knowledge, acquisition chokepoints, biological design tools.
  4. Saying nothing is not the same as saying no. Cohere sets out why it will not write biological thresholds yet, and that position can be argued with. A framework that leaves biology out gives no one anything to argue with. Scoring both as absent loses the difference.

Text and figures © 2026 Miranda Smith, licensed CC BY 4.0. Quotations from company frameworks remain the property of their publishers. Corrections and questions: GitHub Issues.