Every engineer who has ever shipped a detector knows the first decision is not the model. It is the threshold. Set it too low and you drown in false alarms until everyone ignores the pager. Set it too high and the one incident you were built to catch walks straight past you. On October 16, 2026, at 21:45 UTC, Politico reported that Anthropic has privately pitched members of Congress a draft federal AI safety bill, and the company has now told the country where it wants the threshold to sit: the government could block a frontier model's release or use only when that model poses a foreseeable, imminent risk of more than $1 billion in damages, or of killing or seriously injuring more than 50 people.
The draft is confidential. Politico obtained a copy and cites three people familiar with the effort, and Anthropic confirmed the substance through a spokesperson: "This bill represents the proposals outlined in Anthropic's Advanced AI Framework, which we have been advocating for with federal and state lawmakers since June. These are sensible policies we believe Congress should act on." Because that framework is public, we can do something rare with a lobbying story: read the company's own policy document, the 19-page Advanced AI Framework PDF, and check the private draft against the public position.
What the Draft Would Actually Do
As reported by Politico and echoed across secondary coverage, the architecture of the bill is narrow in four specific ways.
| Provision | What the draft reportedly says |
|---|---|
| Harm trigger | Foreseeable, imminent risk of over $1 billion in damages, or over 50 deaths or serious injuries |
| Covered risk types | Biological weapons, a model evading its developer's controls, or a cyberattack. Nothing else |
| Who can act | Only the Commerce Department, and only by asking a federal judge in the District of Columbia for a suspension |
| Who cannot act | Every other US department, agency, or officer is barred from suspending a model's development or internal use |
| Evaluators | Independent evaluators register with Commerce and must report an imminent enumerated risk within 72 hours |
| States | Preempts state laws on public risk disclosure, third-party evaluation, and critical-incident reporting |
Two of these lines deserve more scrutiny than they have gotten. The three-category limit means that harms outside biology, control escape, and cyber are simply not intervention-worthy under the bill, no matter their scale. AI-powered fraud, for instance, is out of scope entirely. And the single-agency, single-court gate means that even an imminent, enumerated risk cannot be paused by the FTC, the SEC, or a state attorney general. It has to travel one pipeline: Commerce finds the risk, a DC federal judge signs the order, and that judge is the only person in the US government who can stop a model.
Anthropic's lobbying posture around the pitch is itself part of the record. Mother Jones reported that the company spent more lobbying Congress in the first half of 2026 than in all of 2025, and that the draft could preempt states from passing stronger laws. Anthropic's public framework takes a more careful line on exactly this point, saying Congress "should not preempt state law unless it enacts a rigorous federal regime that meets or exceeds the strongest measures proposed in this framework." Whether the draft text holds to that standard is a question nobody outside the pitch meetings can answer yet, because the bill text has not been published.
The Public Framework Behind the Private Draft
The Advanced AI Framework PDF gives us the coverage math that the reported draft does not. Anthropic proposes obligations apply to developers who meet both tests: they develop models trained with more than 10^25 FLOP, and they either earn more than $500 million in annual AI-derived revenue or spend more than $1 billion per year on AI research and development. The framework also names four covered risk categories, and here the public document is broader than the reported bill: alongside bioweapons, offensive cyber, and loss of control, the framework adds automated research and development in key domains that could accelerate the first three. The draft as described by Politico lists only three.
The framework also defines a Critical Safety Incident with unusual precision for a policy paper. It covers unauthorized exfiltration of model weights, malicious modification of weights, harm from a materialized catastrophic risk, loss of control causing death or bodily injury, and a model that uses deceptive techniques against its own developer's monitoring outside of an eval designed to provoke that behavior. That last clause reads like it was written by someone who has watched an agent game its own test harness, which is fair, because it probably was written after exactly the incidents we covered in our analysis of OpenAI's 19 rogue agent reports, where models repeatedly crossed permission boundaries that nobody was watching in real time.
For calibration, it helps to line Anthropic's numbers up against the other frontier rules now on the books or on the table.
| Rule | Coverage line | What it does |
|---|---|---|
| Anthropic Advanced AI Framework | Over 10^25 training FLOP, plus a revenue or R&D spend test | Testing, transparency, evaluation, and a narrow power to block |
| EU AI Act, Article 51 | Over 10^25 training FLOP | Presumes systemic risk; duties attach to the provider |
| China draft export controls (Oct 16, 2026) | 10^26 FLOP, 2 trillion parameters, or a top-10 rank | Restricts export of weights and training code |
The 10^25 FLOP line is not an Anthropic invention. It is the same compute threshold the EU picked for its systemic-risk presumption, which lends the number real legitimacy. But notice what the number is doing: it is a proxy. Nobody has ever demonstrated that 10^25 FLOP is where catastrophic capability lives. It is a workload classifier, convenient because training compute is measurable by a regulator from outside the lab, and Anthropic's own framework admits as much, saying the FLOP threshold may need to become a capability-based one over time "as the FLOP needed to train dangerous models may fall."
Our Read: A Detector Spec Written by the Team That Would Be Paged
Read this draft the way a data scientist or a site reliability engineer would read any incident-response spec, as a detection system with a decision rule, an escalation path, and a service-level objective, and its design becomes very legible.
The decision rule is where the real opinions live. A threshold expressed as "foreseeable, imminent risk of $1 billion in damages or 50 deaths" is an ex-ante injunction standard, and injunctions are the highest-cost false positive in all of regulatory engineering. Stopping a frontier deployment is a multi-hundred-million-dollar event on its own, so a designer rationally fears false alarms and pushes the operating point far up the precision axis. The honest consequence is recall: harm scenarios below the line, whether that is a model enabling a fraud ring that swindles a quarter-billion dollars from retirees or a bioweapons program that kills thirty people, produce no federal remedy under this bill. Anthropic is choosing a detector with very high precision and, by construction, low recall. That is a defensible engineering stance. It is also, unavoidably, the stance that best protects the deployer, because every false-positive cost lands on the lab while every false-negative cost lands on the public. A bill drafted by the regulated party will always sit on that side of the tradeoff, and reading the draft as neutral safety engineering would be a mistake.
Two numbers are more load-bearing than the coverage suggests. First, "$1 billion in damages" needs an estimator, and no one has built one. Who runs the counter for a cyberattack's downstream economic damage, and at what confidence interval? The draft creates a legal trigger whose predicate is a forecast no agency can currently produce with defensible error bars, which means in practice the number will be argued, not measured. Compare this to the FLOP threshold, which fails in the opposite direction: it is trivially measurable and simply not calibrated to danger. A regulator gets one number it can count that does not matter much and one number that matters that it cannot count.
Second, the 72-hour evaluator reporting window is the only clock in the whole architecture, and clocks are where safety systems live or die. We have already watched what voluntary timing looks like: in Anthropic's own incident report, the gap between a breach occurring and anyone outside the company learning about it ran to months, and the White House's April reversal of UK AISI evaluation access showed how quickly a single-government chokepoint turns evaluators into political units. A 72-hour SLA is a good SLA, the kind that would pass review if a platform team proposed it. The open question is enforcement: the draft tells evaluators to register with the same Commerce Department that holds the injunction power, and the framework itself concedes the "evaluator shopping" risk, where labs pick the most forgiving assessor. Registration plus payment-by-the-lab plus a friendly forum is the configuration that quietly degrades every pager system ever built.
Outlook
Nobody has sponsored the draft, and Anthropic has not publicly backed any pending bill. In the House, the FRONTIER Act led by Reps. Lori Trahan and Jay Obernolte already pairs deployment-stop powers with state preemption, and in the Senate, Majority Leader John Thune and Sens. Amy Klobuchar and Ted Cruz are negotiating a catastrophic-risk bill that Sen. Maria Cantwell and safety groups say does not give government enough review power. The FTC's civil investigative demands to OpenAI and Anthropic this same week are a live counterexample to the bill's core premise, since they show another agency already probing safety incidents, exactly the kind of parallel jurisdiction the draft would outlaw.
The signal to watch is boring and decisive: does Anthropic publish the bill text, and does a sponsor attach a name to it? Until then, the most useful artifacts remain the ones we can audit, the 10^25 proxy, the unmeasurable $1 billion, and the 72-hour promise, which together tell you more about where the industry wants the threshold to sit than any press release will. A detection rule is a statement of whose failures you are willing to miss. Anthropic just published its answer, and it is a very large number.