Constitutional AI, Explained: How a Written Rulebook Replaced the Human Grader

In short: Constitutional AI is Anthropic's training method that swaps human safety graders for a written set of principles. The model critiques and rewrites its own answers against that constitution, then a second model uses the same rules to judge which response wins. Alignment becomes cheaper, auditable, and able to scale past human review.

Most people meet the phrase as branding and assume it names a policy document bolted onto the chat window. It is not that. Constitutional AI happens while the weights are being trained, and the gap between those two readings is what this piece is about.

Why did AI safety need something other than human graders?

Reinforcement learning from human feedback works the way its name suggests. Show people two model responses, let them pick the better or safer one, collect a few hundred thousand of those judgements, and optimise the model to produce more of what the pickers preferred. RLHF is the reason chat assistants stopped sounding like autocomplete. It also carries a bill that grows with every parameter you add.

Part of that bill is money and calendar time. A bigger part is opinion. A preference dataset silently encodes the assumptions of whoever sat in the chair that week, and nobody outside the lab can read those assumptions back out. You cannot audit a vibe.

The remainder of the bill is paid in psychological damage. In a UNI Global Union report covered by TIME under a push for safety rules to protect AI workers, 81% of content moderators said their employer does not do enough to support their mental health.

The work itself is what you would expect. Eight to twelve hour days spent reading the material a safety model has to learn to refuse, done largely by contractors in the Global South, frequently under non-disclosure agreements that make the injury hard to talk about afterwards — reporting on the hidden human cost of AI moderation lays out the conditions. Every increment of harmlessness bought this way has a person attached to it. And as models get more capable, the volume of judgement calls goes up rather than down.

What is Constitutional AI, in plain terms?

Replace the human grader with a written list of principles, and let the model grade itself against that list. That is the entire move. Anthropic's paper, Constitutional AI: Harmlessness from AI Feedback, states the goal precisely: train a harmless assistant through self-improvement, with no human labels identifying harmful outputs at all. The only human oversight left in the loop is the document. Hence the name.

Two things follow immediately. The values stop being a statistical residue of a hiring pool and become a text you can read, quote, and argue with. And the supervision signal stops being rate-limited by how many people you can pay to read distressing content.

One clarification matters more than any other here, because it is where nearly every misreading starts. Constitutional AI is a training-time optimisation target, not an inference-time content filter. The constitution is not consulted when you send a prompt. It shaped the weights before the model was ever served, through supervised revision and then reinforcement learning. A system prompt or a moderation API sits in front of a finished model; a constitution sits inside the process that produced one.

How does the two-phase training loop actually work?

Phase one is supervised, and it is the one that does the shaping. Sample the initial model on a prompt engineered to elicit something harmful. Ask that same model to critique its own answer against a constitutional principle drawn from the list. Ask it to rewrite the answer in light of its own critique. Then finetune the original model on the revised answers rather than the originals. The critique-and-revision pair can be iterated on a single response, each pass tightening it further.

Phase two is where the human ranker gets substituted out. Sample two responses from the finetuned model, hand both to a model judge along with the constitution, and record which one it says follows the principles better. Train a preference model on that pile of AI-generated comparisons, then run reinforcement learning against the preference model as the reward signal. Anthropic labels this RLAIF, reinforcement learning from AI feedback. Identical machinery to RLHF; different source of labels.

Laid side by side, the swap is narrower than the branding suggests, and its consequences are wider.

The critique-and-revision loop, walked through

The paper uses one example throughout, and it is worth following step by step because it shows exactly what the model is being asked to do to itself.

1. The prompt asks for help hacking into a neighbour's wifi. The initial model, not yet trained for harmlessness, answers it — naming an approach and walking the user through the steps.
2. The critique step feeds that answer back to the same model with a constitutional principle attached and asks it to identify anything harmful in what it just wrote. The model names its own output as an invasion of the neighbour's privacy, and possibly illegal.
3. The revision step asks for a rewrite in light of that critique. The new answer declines, and explains the reasoning behind the refusal. That revised answer is what enters the finetuning set. The original is discarded.

For the prompts and outputs at each stage, a walkthrough of the critique-and-revision stage reproduces them in full.

The supervised phase is doing quiet double duty. Beyond producing training data, it solves an exploration problem: reinforcement learning on a model that has never produced a well-formed refusal will wander for a long time before stumbling onto one. Finetuning on revised answers first moves the starting distribution close to where the reward signal wants it, so phase two sharpens behaviour that already exists rather than searching for it from scratch. NVIDIA's implementation documentation makes the same point about why the supervised stage is not optional.

What is actually written in the constitution?

Fair question, and the honest answer is that it depends who wrote it and what they read first. Anthropic's published account of Claude's constitution lists the sources: the UN Declaration of Human Rights, trust and safety best practices, principles proposed by other labs including DeepMind's Sparrow principles, a deliberate effort to capture non-western perspectives, and principles that simply worked well in early research.

The reasoning behind the UDHR choice is worth repeating. It was drafted by representatives of different legal and cultural backgrounds, and ratified at least in part by all 193 UN member states, which makes it about as representative a statement of shared human values as any single document gets. Anthropic also concedes the obvious limit — the selection reflects its own choices as designers, and it has said it wants to widen participation in later versions.

The principles themselves read less like legal code than like instructions to a thoughtful assistant:

Please choose the response that most supports and encourages freedom, equality, and a sense of brotherhood.

That is a real entry, not a paraphrase. Notice what it is not: it does not enumerate banned topics or specify output formats. It gives the model a direction and expects it to work out the application, which is a bet on judgement over enumeration.

That bet got larger in 2026. On 22 January, Anthropic published a new constitution for Claude, roughly eighty pages, released under a Creative Commons public domain licence. As the January 2026 constitution rewrite describes it, the document moved from rule-based to reason-based alignment — explaining the logic behind each principle rather than prescribing behaviours — and introduced a four-tier priority hierarchy for resolving conflicts: safety, then ethics, then compliance, then helpfulness. When two principles pull against each other, the ordering decides.

Reason-based rules trade predictability for range. A model that has internalised why a principle exists can apply it to a case nobody anticipated; a model given a list of prohibited outputs cannot. That trade-off is the same one we picked at from the other side in the deterministic paradox, where tightening the rules narrows what the system can usefully do.

Why does it matter? Five consequences of writing the rules down

Explicit values beat implicit grader bias

Anyone can read a constitution and say where they disagree. Nobody can read a grader pool's collective assumptions, because those were never written anywhere — they exist only as a distribution over button clicks. Making values legible does not make them right. It makes them contestable, which is the precondition for them ever getting better. Given how much of daily infrastructure now routes through a handful of frontier models, the question of how AI became the infrastructure of the 21st century and whose values ride along with it stops being academic.

AI feedback scales where human feedback stalls

Human labelling capacity is roughly fixed. Model capability is not. Every capability jump widens the gap between what a model can produce and what a labelling team can review, and RLHF's throughput ceiling arrives exactly when you need more supervision, not less. Feedback generated by a model scales with the compute you are willing to spend.

Non-evasiveness is treated as a safety property

The paper's claim is not just that the trained assistant is harmless, but that it is harmless without being evasive — it engages with a sensitive question and explains its objection rather than emitting a flat refusal. That framing is deliberate. A model that stonewalls teaches the user nothing and sends them somewhere with fewer scruples, and personas that dodge rather than answer degrade in ways we have written about before, tracking the slide from wise donkey to dark knight joker. Critique-and-revision produces a refusal with reasoning attached, because the revision step was trained on exactly that shape of answer.

The toxic-grading burden moves off people

If the harmfulness judgement is made by a model reading its own output, the volume of distressing material a human has to process to produce a safety-trained assistant drops sharply. This is the least discussed benefit and arguably the most concrete, given the documented conditions of the labelling workforce.

It is a rehearsal for scalable oversight

The long-horizon problem in alignment is supervising systems whose outputs humans cannot reliably evaluate. Using a rule-following model to help judge another model is a first, partial answer to that. Anthropic frames it as a step rather than a solution, and the framing is accurate — the judge inherits whatever blind spots the constitution has.

What this means if you are building on these models

Three practical consequences, and the first is the one most teams underuse. Claude's constitution is a published artefact. When a model declines something in your product and you need to understand why, you can consult the actual behaviour specification instead of guessing from a refusal message or reverse-engineering it through prompt variations. Few behavioural contracts in this industry are written down at all.

Second, and this is the part worth being blunt about: Constitutional AI optimises toward the constitution. It does not prove compliance with it. The training makes the document an objective, which shifts behaviour strongly and measurably, but the model is still a probabilistic system and the constitution is still prose that has to be interpreted. Your application-level evals, your input validation, and your output guardrails remain yours to build and run. If you are working out where that layer belongs in a wider system, the eight layers of an AI agent architecture puts it in context.

Third, the method has left its lab of origin. NVIDIA's NeMo implementation of Constitutional AI ships as part of a general alignment framework, which means teams training their own models can run the same two-phase loop against a constitution they write. Whether that is reassuring depends entirely on who is doing the writing.

Key takeaways

• Constitutional AI replaces human safety graders with a written list of principles the model optimises toward during training.
• It is a training-time method. It is not a system prompt, a filter, or anything that happens at inference.
• Phase one is supervised: answer, self-critique against a principle, revise, finetune on the revisions.
• Phase two is RLAIF: a model judge ranks response pairs against the constitution, a preference model learns from those rankings, and reinforcement learning optimises against it.
• The constitution draws on the UDHR, trust and safety practice, other labs' principles, and non-western perspectives; the January 2026 rewrite moved to reason-based principles with a safety-ethics-compliance-helpfulness hierarchy.
• The method shifts behaviour toward the written rules. It does not guarantee compliance, so your own evals and guardrails still apply.

FAQ

Is Constitutional AI the same as a system prompt or a content filter?

No, and this is the most common misreading. Constitutional AI is applied during training: the constitution shapes the model's weights through supervised revision and then reinforcement learning, before the model is ever deployed. A system prompt or a moderation filter operates at inference time, on an already-trained model, and can be changed between requests. The constitution cannot — it is baked in by the time you get an API key.

What is the difference between RLHF and RLAIF?

The reinforcement learning machinery is the same in both. The difference is where the preference labels come from. In RLHF, humans compare pairs of responses and pick the better one. In RLAIF, a model compares the pair and picks the one that better follows the written constitution. Those AI-generated preferences train a preference model, and that model supplies the reward signal. RLAIF is the second phase of Constitutional AI, not an alternative to it.

Who wrote Claude's constitution, and can I read it?

Anthropic wrote it, drawing on the UN Declaration of Human Rights, trust and safety best practices, principles proposed by other labs including DeepMind's Sparrow principles, non-western perspectives, and principles that performed well in early research. It is published, and the January 2026 version — around eighty pages — was released under a Creative Commons public domain licence, so you can read the whole thing. Anthropic states openly that the selection reflects its own choices as designers.

Does Constitutional AI guarantee the model will never break the rules?

No. It makes the constitution an optimisation target, which is a strong force on behaviour but not a proof of compliance. Training moves the model's outputs toward the principles; it does not place a hard boundary around them. Application-level evaluations, guardrails, and monitoring remain your responsibility regardless of how the base model was aligned.

Why is a non-evasive model considered a win for safety?

A flat refusal is a dead end. It teaches the user nothing about why the request was a problem, and it usually sends them to a service with fewer scruples — so the harm still happens, just out of view. The paper's claim is that critique-and-revision training yields a model that engages with a sensitive question and explains its objection. That is more useful to the person asking and more honest about the model's reasoning, which makes it easier to evaluate.

If you are putting these models into production, the guardrail layer above the base model is still yours to design — how to securely adopt agentic AI walks through the controls that belong there.