Safeguards
Safeguards are built-in protective measures designed to prevent an AI system from providing dangerous, illegal, or severely harmful responses. They usually consist of several layers: rules embedded during training, filters before and after the response, and controls over who is even allowed to use the system.
A computer program that answers questions can, in principle, say anything that was contained in its training data. This includes instructions for crimes, insults, or dangerous medical nonsense. Safeguards are the protective measures that providers build in so that exactly such responses do not come out. You can think of them like the safety features of a car: seatbelt, airbag, brake assist. No single component prevents every accident, but together they significantly reduce the risk. The English term has become established because it is used in industry reports and legal texts.
What happens without protective measures
A language model has no judgment of its own about what is harmful. It predicts which words fit a given question. A well-phrased question about building a weapon looks, for the calculation, exactly the same as a question about a cake recipe. Without additional barriers, the model would answer both equally readily.
For providers, this is a tangible economic problem. A single screenshot with a shocking answer can circulate through the media for days. Large customers from banks, insurers, or government agencies only buy a system if they can rely on its behavior. If damage occurs, lawsuits and fines loom.
On top of that comes legal pressure. The European AI regulation, often called the AI Act, requires documented protective measures and an assessment before high-risk systems can enter the market. Safeguards are thus no longer just a voluntary gesture, but an obligation that must be demonstrated.
The layers behind the answer
The first layer sits in training. Humans evaluate sample responses and mark which of them are undesirable. This is how the model learns to politely decline certain types of requests. Some providers additionally provide a written list of basic rules that the model is meant to follow.
The second layer consists of dedicated review programs, so-called classifiers. These are small models with only one task: to classify an input or a finished response as harmless or problematic. They run before the response and once again afterward. If one of them triggers, the response is blocked or replaced with a standard text.
The third layer lies outside the model. This includes user accounts with age verification, limits on the number of requests per hour, and the suspension of suspicious accounts. The whole system is tested through so-called red teaming: experts deliberately try to circumvent the barriers before others do. Their successful tricks flow back into training.
Safeguards in the chat window and in the headlines
You usually only notice safeguards when they kick in. Sentences like “I can’t help with that” are their visible result. The warning notices under answers about health or law also belong to this category. Image generators, moreover, often refuse to depict real people.
In the news, safeguards mainly appear when they fail. A jailbreak is a trick that users use to get around the barriers, for example by disguising the forbidden question as a harmless role-play. Such loopholes are regularly discovered and patched. It is a race without a finish line.
A common misconception is to equate safeguards with censorship. In fact, there is a genuine trade-off: if the filters are too strict, the system also rejects harmless questions, for example about chemistry in a school lesson. If they are too lax, dangerous answers slip through. Where the line lies is decided by the provider, and that is precisely what is publicly disputed.