Anthropic, the developer of the Claude model, privately handed US lawmakers its draft federal law on frontier-model safety — Politico reported this on October 16, 2026, citing three sources. The document has not yet been introduced in Congress, but it already shows what kind of regulation one of the leading labs is advancing: measurable catastrophic-risk thresholds, mandatory independent model testing, and a strict reporting regime for new threats after release.
What happened
According to Politico, the draft gives the federal government a limited right to stop the deployment of highly advanced models, but only in the case of a “predictable, inevitable catastrophic risk.” The thresholds are set numerically: potential damage over $1 billion or death or serious injury to more than 50 people. The document covers three risk categories — biological weapons, loss of developer control over its own model, and cyberattacks. It requires independent testing of frontier models, registration of independent assessors with the US Department of Commerce, and reporting of emergent risks within 72 hours. Enforcement is centralized under a “one agency, one judge” principle: only the Department of Commerce may petition a federal judge to stop deployment. The draft text is confidential and has not yet been formally introduced in Congress; it is known from Politico’s report, which Reuters and Crypto Briefing cite.
Context
The draft is an attempt to translate the internal safety practices of frontier labs into legal norms: risk levels in the spirit of Responsible Scaling Policy, red-teaming, and safety cases are converted into measurable thresholds and mandatory procedures. The three risk categories mirror internal checklists that Anthropic and other labs currently apply voluntarily, so the document effectively proposes making existing internal evals a federal standard. Substantively, the main element is not the “model stop” itself, but the institutionalization of third-party assessments: independent testing and a registry of external assessors at the Department of Commerce turn safety declarations from voluntary internal practice into an auditable regime, while 72-hour reporting shifts testing from a “tested once before release” format to a continuous incident process modeled on cybersecurity. At the state level, California SB 53 already serves as a benchmark, so the federal document is also seen as a model template for further initiatives; the broader discussion is shifting from lab self-regulation to legally binding external testing.
Why this matters for the industry
If the draft from one of the leading labs becomes law, it will set a federal compliance framework for frontier models. For OpenAI, Google, and other frontier developers, this is a direct increase in release costs: mandatory independent testing, working with registered third-party assessors, and a 72-hour incident process will force eval pipelines to be reproducible and auditable, and the corresponding costs will need to be built into budgets and release cycles. In parallel, a market may form around this framework: independent testing services for frontier models, standardized protocols for checking CBRN, autonomy, and cyber risks, and tools for automating incident reporting and post-deployment assessment. The high thresholds, however, leave most AI applications outside the regulatory scope: the law targets frontier developers, not the entire market, so the effect for ordinary AI products is signaling rather than mandatory.
Why this matters for users
For readers, the document is the first detailed picture of how an “emergency brake” for frontier models might work in practice. Deployment could be stopped not by any agency, but only by the Department of Commerce; the decision is made not by the administration itself, but by a federal judge; the mechanism triggers only when agreed catastrophic-harm thresholds are exceeded, meaning ordinary applications on current models are not affected — it is designed for the most advanced systems. Reporting on emergent risks within 72 hours promises users that the government will quickly learn about dangerous manifestations of a model, including after its release: oversight does not end with pre-release testing and continues in production. Two things to watch: the formal introduction of the document in Congress and the reaction of OpenAI and Google to the framework, effectively modeled on Anthropic’s proposal — this will determine whether the framework becomes law or remains a benchmark for other initiatives.
What is still unknown / limitations
The draft text is confidential, and the story relies on three anonymous sources — until it is formally introduced in Congress, its content and timing are not guaranteed and may change. The main uncertainty is methodological: the phrase “predictable, inevitable catastrophic risk” assumes the ability to quantify a threat in advance, while modern evals provide probabilistic snapshots, not binary answers — it is unclear who and by what methodology will determine threshold exceedances. The forecast of a rapid independent-testing market should also be received with caution: the bottleneck is not demand but supply — a substantive audit of a frontier model requires access to the system (API or weights), compute resources, and deep expertise, which potential assessors currently have in limited supply. It is unknown who will sponsor the bill in Congress and when it will be formally introduced.
Sources
- Anthropic quietly pitches its own AI safety bill to lawmakers (Politico)
- Anthropic quietly pitches its own AI safety bill to lawmakers, Politico reports (Reuters)
- Anthropic pitches a frontier AI safety bill to US lawmakers, Politico reports (Crypto Briefing)
Author
Look at AI, editorial team