Control
Frontier AI developer without a published catastrophic-risk framework
A large frontier developer must write, implement, and conspicuously publish a frontier AI framework describing how it incorporates recognized standards, defines and assesses catastrophic-capability thresholds, applies mitigations, identifies and responds to critical safety incidents, and manages internal-use catastrophic risk.
Informational data, not legal advice. Summaries are TwinEthos's own words and rules have not been reviewed by a lawyer: check the official text before relying on any of it. A guard addresses an item; adding it is not a statement that your code meets any law.
Reach
Law in force in California (US-CA); enacted, not yet applying in Illinois (US-IL), New York (US-NY); next date 2027-01-01.
The guard to add
Publish a frontier AI framework covering capability thresholds, mitigations, incident response, and internal-use risk, and gate model releases on it.
A public framework page, linked from the developer's website and owned by the frontier-safety lead, that maps each covered topic to the policy implementing it: standards adopted, catastrophic-capability thresholds and the evaluations that test them, mitigations applied when thresholds are reached, critical safety incident identification and response, and assessment of catastrophic risk from internal use. Show that it is implemented: release checklists cite the threshold evaluation results, a versioned changelog records changes with reasons and dates, and internal-use risk summaries sent to regulators are tracked with receipts. A CI or release gate refuses to promote a frontier model whose release record lacks the evaluations the framework calls for.
Where it goes: 12 repository artifacts, 14 user-facing text, 11 CI/CD pipeline.
What reviewers look for: a current, conspicuously linked framework covering each topic; release records for recent models that reference the framework's threshold evaluations and mitigation decisions; a dated changelog; submission receipts for internal-use risk summaries.
Organizational control: the evidence is a kept record, its owner and its upkeep, not code.
Example (Model release record + CI gate), before:
# releases/model-x.yaml
model: model-x
approved_by: research-leadAfter:
# releases/model-x.yaml (CI fails if a required field is missing)
model: model-x
framework_version: 2.3 # https://example.ai/frontier-framework
threshold_evals:
bio_uplift: evals/results/model-x/bio.json
cyber_offense: evals/results/model-x/cyber.json
autonomy: evals/results/model-x/autonomy.json
thresholds_crossed: [cyber_offense]
mitigations: [classifier-gating, staged-access]
incident_runbook: docs/safety/critical-incident-response.md
approved_by: frontier-safety-leadEngineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.
Upcoming dates
- : Large frontier developers must publish and follow a frontier AI framework from 2028 (Illinois SB 315) (Illinois (US-IL); first application)
- : Large frontier developers must publish and follow a frontier AI framework (New York RAISE Act) (New York (US-NY); first application)
- : Large frontier developers must publish and follow a frontier AI framework from 2028 (Illinois SB 315) (Illinois (US-IL); later phase)
Every rule this guard addresses
Binding law — in force (1)
- California (US-CA)
- Large frontier developers must publish an implemented frontier AI risk framework (California SB 53) Cal. Bus. & Prof. Code 22757.12 (frontier AI framework) [per CA AG summary]
Binding law — not yet in force or stayed (2)
- Illinois (US-IL)
- Large frontier developers must publish and follow a frontier AI framework from 2028 (Illinois SB 315) IL PA 104-0538, Sec. 10(a) · applies from 2027-01-01
- New York (US-NY)
- Large frontier developers must publish and follow a frontier AI framework (New York RAISE Act) N.Y. Gen. Bus. Law 1421(1) · applies from 2027-01-01