Preparedness Framework

The Preparedness Framework measures how close an AI model has come to dangerous capabilities using pre-defined thresholds, and it spells out in advance exactly what the company must do once those thresholds are crossed.

Think of it like triage in a hospital emergency room. If you sort patients into categories like low, medium, high, and critical, you can decide in advance what treatment applies at each stage. The Preparedness Framework works the same way. It breaks down a model's capabilities into levels across four areas—biological weapons, chemical weapons, cybersecurity, and AI self-improvement—and once a model reaches a certain level (especially the 'critical' level), a predetermined response kicks in automatically, such as halting a release or dramatically tightening security.

For example, the 'critical' level in the cybersecurity domain refers to a model being able to discover and exploit previously unknown security vulnerabilities in real, critical systems entirely on its own, without human help. If an assessment concludes that a model has reached this level, or that reaching it cannot be ruled out, enhanced security controls—like isolating access and encrypting data—follow immediately.

Articles use it in phrasing like, "Astra was found to potentially meet the 'critical' cyber capability level under the Preparedness Framework." A common point of confusion is that this isn't a government-mandated legal regulation—it's an internal policy OpenAI created on its own in December 2023. That said, the White House has recently been moving to incorporate this kind of internal evaluation standard into government oversight frameworks, raising the possibility that a company's internal rules could migrate into public policy.