What Is the AGI Deployment Framework? Google DeepMind's 5-Stage Plan
Demis Hassabis proposed a 5-stage framework for deploying AGI safely, from capability thresholds to mandatory pre-release testing and security standards.
A Framework for the Most Consequential Technology Decision in History
When Demis Hassabis and the Google DeepMind team published their technical AGI safety and security framework, they weren’t just releasing an academic paper. They were laying out a concrete plan for how one of the world’s most advanced AI labs intends to handle systems that could eventually match or exceed human-level intelligence across virtually every domain.
The AGI deployment framework — built around five distinct capability stages — answers a question that most organizations have been quietly avoiding: at what point does an AI system become powerful enough that releasing it without structured safety guarantees becomes genuinely dangerous?
This piece breaks down what the framework actually says, why each stage matters, and what it means for enterprises that are already deploying AI today.
Why a Staged Deployment Framework Exists at All
Most conversations about AI safety focus on hypothetical future systems. The DeepMind framework is different — it’s a practical, operational document designed to guide decisions in the present, not just in some distant scenario where machines become sentient.
The core premise is straightforward: as AI systems become more capable, the potential consequences of misalignment, misuse, or unexpected behavior increase proportionally. A chatbot that generates mildly incorrect text is a nuisance. A system that can autonomously conduct research, write functional code, influence financial markets, or coordinate complex multi-step actions at scale requires a fundamentally different level of scrutiny before deployment.
Everyone else built a construction worker.
We built the contractor.
One file at a time.
UI, API, database, deploy.
The five-stage model gives DeepMind — and by extension the broader AI research community — a shared vocabulary for classifying where a system sits on the capability spectrum and what safety requirements apply at each level.
The Five Stages of the AGI Deployment Framework
Each stage in DeepMind’s framework represents a capability threshold. The designation isn’t arbitrary — it’s meant to trigger specific safety evaluations, testing requirements, deployment restrictions, and security measures.
Stage 1: Narrow and Specialized AI
This is where most current commercial AI sits. Stage 1 systems are highly capable within specific domains — generating text, analyzing images, writing code, answering questions — but they don’t generalize meaningfully outside their training distribution.
The safety burden here is relatively low by framework standards. Standard red-teaming, content filtering, bias evaluation, and responsible disclosure practices are sufficient. Most of what enterprises interact with today falls into this category, including large language models used for summarization, drafting, or search.
Stage 1 systems still require governance, but the emphasis is on misuse prevention and output quality rather than existential risk mitigation.
Stage 2: Emerging Cross-Domain Competence
A system reaches Stage 2 when it demonstrates reliable performance across multiple domains simultaneously — not just one. This includes systems that can reason through novel problems, generalize from limited examples, and adapt to contexts that weren’t explicitly represented in training.
At this stage, the framework calls for more rigorous pre-deployment evaluations. Systems should be assessed for unexpected capabilities that weren’t intentionally trained (known as “emergent behaviors”), and deployment should include human oversight mechanisms that can intervene in real time.
The concern here is that cross-domain competence creates new attack surfaces. A system that understands chemistry, biology, and logistics simultaneously might be able to assist with activities that a narrow chemistry assistant never could.
Stage 3: Expert-Level Performance Across Most Cognitive Tasks
Stage 3 is where the framework’s requirements escalate significantly. A system that can perform at or above expert human level across most cognitive tasks — not just specific benchmarks — represents a qualitative shift in capability.
DeepMind’s framework at this stage requires:
- Mandatory capability evaluations before any new deployment
- Structured red-teaming by independent parties, not just internal teams
- Interpretability audits to understand how the system is reaching its conclusions
- Deployment gating — meaning certain use cases are restricted until specific safety criteria are met
- Formal documentation of known failure modes and their mitigations
This is also the stage where the framework begins addressing access control seriously. If a system can produce expert-level scientific, legal, or technical analysis on demand, the question of who can access it — and under what conditions — becomes a genuine security concern.
Stage 4: Superhuman Performance and Autonomous Research Capability
Stage 4 systems are, by definition, better than the best humans at nearly all cognitive tasks. More importantly, they’re capable of autonomous research — generating novel hypotheses, designing experiments, interpreting results, and iterating without continuous human direction.
This is the stage where the framework becomes most stringent. The requirements include:
- Pre-release testing that is mandatory and independent — not a checkbox but a genuine gatekeeping function
- Security standards for model weights and infrastructure that mirror the protections applied to critical national infrastructure
- Staged rollout protocols that begin with highly controlled environments before any broader access
- Ongoing monitoring pipelines that flag behavioral drift or unexpected capability expansion post-deployment
- Formal incident response procedures with clear escalation paths
One coffee. One working app.
You bring the idea. Remy manages the project.
The logic is that a Stage 4 system operating autonomously in a poorly controlled environment could produce downstream consequences that are difficult or impossible to reverse. A human expert making a mistake affects a limited domain. An autonomous system operating at superhuman scale could propagate errors across interconnected systems far faster than human oversight can respond.
Stage 5: Artificial General Intelligence
Stage 5 represents systems that match or exceed human cognitive capabilities across every domain, including tasks that require creativity, physical dexterity, social reasoning, and scientific discovery. This is what most people mean when they say “AGI” in the strict sense.
The framework doesn’t treat Stage 5 as a hypothetical endpoint — it treats it as a planning target. The safety and security requirements at this stage are the most comprehensive, and the framework explicitly states that no Stage 5 system should be deployed without a full safety case: a structured, documented argument that the system will behave within acceptable bounds under all plausible operating conditions.
Stage 5 also introduces the question of oversight itself — specifically, whether human oversight remains meaningful when a system is significantly more capable than the humans doing the overseeing. The framework doesn’t resolve this tension entirely, but it flags it as a primary research problem that must be addressed before any such system could be responsibly deployed.
The Safety Architecture Behind the Stages
The five stages aren’t just labels — they’re tied to a specific technical architecture for maintaining safety as capabilities increase. Three pillars support the entire framework.
Capability Evaluations
Before any system moves from one stage to the next, it must pass structured capability evaluations. These are designed to probe not just what the system was trained to do, but what it might be capable of doing outside its intended use case.
The framework places particular emphasis on evaluating for “dangerous capability uplift” — the ability to meaningfully assist with the creation of weapons of mass destruction, large-scale cyberattacks, or other high-consequence harms. If a system shows credible capability uplift in these areas, deployment is restricted regardless of other safety properties.
Interpretability and Oversight
As systems become more capable, traditional behavior-based testing (input-output evaluation) becomes insufficient. A system can pass thousands of test cases while still harboring internal representations that would produce catastrophic behavior in novel situations.
The framework advocates for interpretability tools — methods for examining what’s actually happening inside a model’s reasoning process. This is an active research area, and the framework acknowledges that current interpretability methods are immature. But it positions interpretability work as a prerequisite for responsible deployment of Stage 3+ systems, not an optional add-on.
Security Standards
One underappreciated element of the framework is its emphasis on infrastructure security. Model weights — the numerical parameters that define a trained AI system — are treated as high-value assets that require protection equivalent to sensitive government or financial data.
This matters because a sufficiently capable model that falls into the hands of adversarial actors could be used in ways that bypass all deployment-level safety controls. The framework recommends:
- Hardware security modules for key management
- Air-gapped training infrastructure for the most sensitive workloads
- Strict access controls and audit logs for anyone who can interact with frontier model weights
- Threat modeling that assumes nation-state level adversaries
How This Framework Compares to OpenAI’s Approach
DeepMind’s five-stage model isn’t the only such framework in circulation. OpenAI published its own five-level AGI progression framework in 2024, but the two approaches differ in meaningful ways.
OpenAI’s framework focuses primarily on what AI systems can do — from conversational assistants (Level 1) through systems that can act as autonomous agents (Level 3) to systems capable of running entire organizations (Level 5). It’s largely a capability taxonomy.
DeepMind’s framework is more explicitly normative. It doesn’t just describe capability levels — it prescribes what safety measures must be in place at each level before deployment is permissible. The emphasis on mandatory pre-release testing, independent red-teaming, and security standards for model weights gives it more teeth as an operational document.
The two frameworks aren’t incompatible, but they reflect different organizational cultures. OpenAI’s framework is more product-oriented; DeepMind’s is more safety-research-oriented.
What This Means for Enterprise AI Adoption Today
Most enterprises are nowhere near deploying Stage 4 or Stage 5 systems. But the framework still matters for anyone building with AI at scale.
First, it establishes that capability thresholds — not just use cases — determine appropriate safety measures. An enterprise deploying a general-purpose reasoning model for internal research workflows may be interacting with a Stage 2 or early Stage 3 system, which carries different risk profiles than a simple text summarizer.
Second, the framework’s emphasis on pre-deployment testing and documentation translates directly into enterprise AI governance. Organizations that want to use frontier models responsibly should be asking their AI vendors:
- What capability evaluations has this model undergone?
- What dangerous capability thresholds has it been tested against?
- What are the documented failure modes?
- What access controls exist at the infrastructure level?
Third, the security standards in the framework have direct implications for data handling. Enterprises that work with sensitive data — healthcare records, financial information, legal documents — should understand how the AI providers they use protect model infrastructure from adversarial access.
Where MindStudio Fits Into This Picture
As capability-based frameworks like DeepMind’s become more influential, enterprises face a practical challenge: how do you build AI-powered workflows responsibly when you’re not an AI research lab?
MindStudio addresses this directly. The platform gives teams access to 200+ AI models — including frontier systems from Google, Anthropic, and OpenAI — in a governed environment where usage policies, access controls, and workflow logic are all configured in one place. You’re not stitching together raw API calls with no audit trail; you’re building through a system that enforces structure.
For organizations navigating AI governance, this matters. When a new model is released and assessed against capability frameworks like DeepMind’s, MindStudio users can switch to or test alternative models without rebuilding their entire infrastructure. The platform abstracts the model layer, so governance decisions (which model to use, under what conditions, with what guardrails) can be made independently of the underlying workflow logic.
You can try MindStudio free at mindstudio.ai — and if your team is evaluating AI governance tools, the MindStudio enterprise overview walks through how access controls and workflow governance are handled at the organizational level.
The Open Questions the Framework Doesn’t Fully Answer
Other agents ship a demo. Remy ships an app.
Real backend. Real database. Real auth. Real plumbing. Remy has it all.
The DeepMind framework is detailed and serious, but it’s not complete. Several significant questions remain genuinely open.
How do you evaluate for emergent capabilities you can’t anticipate? The framework recommends extensive testing, but testing can only probe for capabilities you already know to look for. Truly emergent behaviors — capabilities that arise from scale or novel training regimes that weren’t present at smaller scales — may not show up until after deployment.
Who decides what stage a system is at? The framework describes what evaluations should happen but is less explicit about who conducts them and what authority they have to block deployment. If the same organization building the system is also evaluating it, there are obvious conflict-of-interest concerns.
How does the framework handle multimodal and agentic systems? Most of the framework’s capability taxonomy is built around cognitive tasks. Systems that can perceive and act in the physical world — robotics, computer-use agents — may not map cleanly onto the five stages as currently defined.
What happens when capability improvements are incremental? Stage boundaries imply discrete jumps, but capability improvements are continuous. A system might clear an evaluations threshold on one task while falling short on others, making stage classification genuinely ambiguous.
These aren’t criticisms of the framework — they’re the research agenda it implicitly generates. The value of publishing a framework like this is precisely that it makes these questions concrete and actionable.
Frequently Asked Questions
What is the AGI deployment framework from Google DeepMind?
Google DeepMind’s AGI deployment framework is a five-stage model that classifies AI systems by capability level and prescribes corresponding safety, testing, and security requirements for each level. It was developed to ensure that as AI systems become more capable, the rigor of safety evaluation and deployment controls scales proportionally. The framework covers everything from current narrow AI systems (Stage 1) through hypothetical artificial general intelligence (Stage 5).
What are the five stages in DeepMind’s AGI framework?
The five stages progress from narrow, domain-specific AI (Stage 1) through systems with cross-domain competence (Stage 2), expert-level performance across most cognitive tasks (Stage 3), superhuman performance with autonomous research capability (Stage 4), and finally full AGI with human-matching or exceeding capability across all domains (Stage 5). Each stage triggers specific mandatory safety measures and deployment restrictions.
What safety measures does the framework require before deploying AGI?
The framework requires mandatory capability evaluations, independent red-teaming, interpretability audits, staged rollout protocols, and security standards for model weights and infrastructure. For the highest capability stages, a formal “safety case” — a structured, documented argument that the system will behave within acceptable bounds — is required before any deployment is permissible.
How does DeepMind’s framework differ from OpenAI’s AGI levels?
OpenAI’s framework focuses primarily on what AI systems can do, categorizing them from conversational assistants through systems capable of running autonomous organizations. DeepMind’s framework is more normative — it doesn’t just describe capability levels but prescribes what safety measures must be in place at each level before deployment is allowed. DeepMind’s framework also places significantly more emphasis on infrastructure security and independent pre-deployment testing.
- ✕a coding agent
- ✕no-code
- ✕vibe coding
- ✕a faster Cursor
The one that tells the coding agents what to build.
Why does the AGI deployment framework matter for enterprises today?
Even though most enterprises aren’t deploying Stage 4 or 5 systems, the framework establishes that capability thresholds — not just use cases — determine appropriate safety measures. Organizations using general-purpose frontier models for research, analysis, or automation may already be interacting with Stage 2 or early Stage 3 systems. Understanding the framework helps enterprises ask better questions of their AI vendors about testing, documentation, failure modes, and infrastructure security.
What is “dangerous capability uplift” in the context of AI safety?
Dangerous capability uplift refers to a system’s ability to meaningfully assist with high-consequence harms — such as the development of biological or chemical weapons, large-scale cyberattacks, or critical infrastructure disruption — even when it wasn’t explicitly designed to do so. DeepMind’s framework treats capability uplift evaluations as mandatory checkpoints before any deployment, and a system that shows credible capability uplift in these areas is subject to deployment restrictions regardless of its other safety properties.
Key Takeaways
- Google DeepMind’s AGI deployment framework defines five capability stages, each with mandatory safety, testing, and security requirements that scale with the system’s power.
- The framework treats deployment gating as a function of capability — not just intended use — which is a more rigorous standard than most current enterprise AI governance.
- Three technical pillars underpin the framework: structured capability evaluations, interpretability and oversight tools, and infrastructure-level security for model weights.
- The framework differs from OpenAI’s approach by being explicitly normative — it prescribes what must happen before deployment, not just how to classify what exists.
- Enterprises can apply the framework’s principles today by asking AI vendors specific questions about capability evaluations, documented failure modes, and infrastructure security before deploying frontier models.
- Open questions around emergent capabilities, governance authority, and agentic systems represent the active research agenda that the framework generates.
As AI systems grow more capable, frameworks like DeepMind’s will increasingly shape what responsible deployment looks like at every level — from research labs to enterprise workflows. If you’re building AI applications and want a platform that makes governance decisions manageable without slowing you down, MindStudio is worth exploring.
