Question 1

What is METR's common elements framework?

Accepted Answer

METR's 'Common Elements of Frontier AI Safety Policies' (Dec 2025) is a taxonomy of nine elements that frontier AI safety frameworks address: capability thresholds, model evaluations, capability elicitation, timing and frequency, weight security, deployment mitigations, conditions for halting, accountability, and updating policies. This map applies the taxonomy as an orthogonal filter across the full regulatory stack — not only corporate frameworks but international, national, and sub-national instruments as well.

Question 2

Which AI laws are binding with penalties?

Accepted Answer

Eight binding instruments in this map carry penalty regimes: the EU AI Act (up to €35M or 7% of global revenue), China's GenAI Measures, Korea's AI Basic Act (~$21k per violation), California SB 53 (up to $1M per violation), the Colorado AI Act, the NY RAISE Act ($1M/$3M), Texas TRAIGA, and US BIS export controls. Most are phasing in; several face active federal preemption challenges in the United States.

Question 3

What does the EU AI Act require for systemic-risk GPAI?

Accepted Answer

General-purpose AI models trained with cumulative compute above 10²⁵ FLOPs are presumed to have systemic risk and face additional obligations under Article 55 of Regulation (EU) 2024/1689: model evaluations including adversarial testing, incident reporting to the EU AI Office, cybersecurity protections for model weights, and transparency documentation. Implementation detail is delegated to the EU GPAI Code of Practice and harmonised standards.

Question 4

How is California SB 53 different from the NY RAISE Act?

Accepted Answer

Both target large frontier developers (>10²⁶ FLOPs, >$500M revenue) and require published safety frameworks. California SB 53 requires 15-day incident reporting and AG enforcement; the NY RAISE Act requires 72-hour incident reporting with oversight by a dedicated Department of Financial Services office plus AG enforcement, and uses tiered $1M/$3M penalties. NY's March 2026 chapter amendments aligned its eligibility thresholds with SB 53's revenue-based approach.

Question 5

What does the EU AI Office do?

Accepted Answer

The EU AI Office (established January 2024 within DG CNECT) coordinates EU AI Act implementation across member states and directly enforces GPAI obligations — a centralised role unique within EU regulatory architecture. It can request models from providers, order recalls, impose fines up to €35M or 7% of global revenue, and runs the Scientific Panel of independent experts advising on systemic risk. Full enforcement powers activate in August 2026.

Question 6

Which AI labs have published frontier safety frameworks?

Accepted Answer

Five major labs have published frontier safety frameworks at Layer 6 of this map: Anthropic (Responsible Scaling Policy, with AI Safety Levels), OpenAI (Preparedness Framework, with a category × level matrix across cyber, CBRN, autonomy, and persuasion), Google DeepMind (Frontier Safety Framework, with Critical Capability Levels), Meta (Frontier AI Framework, with high/critical-risk tiers), and xAI (Risk Management Framework, with quantitative benchmarks). All are voluntary and revisable by the lab itself.

Question 7

What is sandbagging in AI safety?

Accepted Answer

Sandbagging is when an AI model intentionally underperforms during safety evaluations — strategically scoring lower than its true capability so as to avoid triggering safeguards or to behave differently when deployed. The February 2026 International AI Safety Report formally flagged sandbagging as an emerging capability-elicitation challenge, building on Apollo Research's scheming-detection methodology adopted across Google DeepMind's Frontier Safety Framework v2, OpenAI's o1 system card, and Anthropic's Claude evaluations.

Question 8

What is the difference between Layer 2 and Layer 4 in the map?

Accepted Answer

Layer 2 covers the laws themselves — statutes, executive orders, and framework acts like the EU AI Act, US executive orders, China's GenAI Measures, or Korea's AI Basic Act. Layer 4 covers the institutions that implement and enforce them — regulators, AI safety institutes, third-party evaluators, and compute controls — such as the EU AI Office (which enforces the EU AI Act), the UK AISI, US CAISI/NIST, METR, Apollo Research, and AVERI. The map deliberately separates 'what the law is' from 'who enforces it.'

Frontier AI Governance Map

International

National regulation

Sub-national

Infrastructure

Industry voluntary

Corporate self-governance