Anthropic✓

Stav AI Act assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

The catalogue lists every family Stav knows about — including families we don’t yet host, so the picture stays authoritative.

• Claude Fable1 model on Stav
• Claude Sonnet 51 model on Stav

• Claude Haiku 44 · Request hosting →
• Claude Opus 44 · Request hosting →
• Claude Sonnet 44 · Request hosting →

Families served on Stav

• Claude Sonnet 5llm · 2026-06-30
  No compliance card
• Claude Fable 5llm · 2026-06-09
  No compliance card
• Claude Opus 4.8llm · 2026-05-28
  No compliance card
• Claude Opus 4.7llm · 2026-04-16
  No compliance card
• Claude Sonnet 4.6llm · 2026-02-17
  No compliance card
• Claude Opus 4.6llm · 2026-02-05
  No compliance card
• Claude Opus 4.5llm · 2025-11-24
  No compliance card
• Claude Haiku 4.5llm · 2025-10-15
  Limited
• Claude Sonnet 4.5llm · 2025-09-29
  No compliance card
• Claude Opus 4.1llm · 2025-08-05
  No compliance card
• Claude Opus 4llm · 2025-05-22

• complianceUnknown

  Full signatory to the EU GPAI Code of Practice (all three chapters: Transparency, Copyright, Safety & Security) as of August 2025 — one of only 26 organisations globally to sign all chapters. This confers a rebuttable presumption of conformity with EU AI Act Articles 53 and 55.

• securityUnknown

  Holds SOC 2 Type II (third-party audited over 12-month period), ISO 27001:2022, ISO/IEC 42001:2023 (world's first AI management system standard), HIPAA-ready (BAA available), CSA STAR Level 2, and NIST 800-171r3 attestation. All documentation available under NDA via trust.anthropic.com. Independently assessed as leading in AI-aligned safety controls versus peers.

• transparencyUnknown

  Publishes comprehensive research on AI safety, interpretability, alignment, and societal impacts. Activated AI Safety Level 3 (ASL-3) protections for Claude Opus 4 (May 2025) and published the activation report publicly, with frontier red-teaming conducted by external partners. Responsible Scaling Policy is publicly available.

• governanceUnknown

  Long-Term Benefit Trust (LTBT) governance structure with independent trustees (Neil Buddy Shah, Richard Fontaine, Mariano-Florentino Cuéllar) holding Class T shares with board election authority provides a structural check on purely commercial decision-making. Board includes independent members Reed Hastings, Vas Narasimhan, and Chris Liddell.

• governanceUnknown

  Anthropic held firm contractual red lines against enabling mass domestic surveillance and fully autonomous weapons in its Pentagon contract, at significant commercial cost (DoD supply-chain designation, lost federal revenue). This demonstrates that its Acceptable Use Policy is not merely aspirational.

• complianceUnknown

  Commercial DPA with EU SCCs (Modules 2 and 3) automatically incorporated into Commercial Terms of Service; Anthropic Ireland Limited is the EEA contracting entity; UK GDPR Addendum and Swiss Addendum included. Enterprise customers can negotiate zero-data-retention agreements.

Privacy policy

https://www.anthropic.com/privacy

Flagged issues

3

• September/October 2025 privacy policy reversal: consumer accounts (Free/Pro/Max) shifted to opt-in model training by default with up to 5-year data retention. This represents a significant departure from prior privacy-first positioning and has been characterised as a dark-pattern UI change by privacy advocates. No formal regulatory enforcement action has been taken as of June 2026, but this is under scrutiny. Enterprise customers on DPA-covered plans are not affected.high
• Consumer accounts (Free/Pro/Max) do not include a Data Processing Agreement; content may be reviewed by human staff; 30-day (or 5-year if training enabled) retention applies. EU customers using free consumer tiers receive materially weaker data protection than enterprise customers. Regulated-sector EU customers must ensure they are on a commercial plan with a signed DPA.medium
• No named Data Protection Officer publicly identified, despite Anthropic processing significant volumes of EU personal data. GDPR Article 37 may require DPO appointment depending on the scale and nature of processing. Privacy contact is privacy@anthropic.com; no DPO register entry independently verified.low

Country

🇺🇸 United States

Open-weights policy

Mixed

Models in catalogue

11

Website

https://anthropic.com

GitHub

https://github.com/orgs

HuggingFace

Anthropic · Verified · 3,673 followers

HF published

0 models · 12 datasets · 3 papers

Creator profile

Anthropic is a US-incorporated AI safety and research company, headquartered in San Francisco, whose Claude models are fully proprietary and subject to CLOUD Act and FISA Section 702 compelled-disclosure risk. Its public-benefit-corporation structure and independent Long-Term Benefit Trust provide governance protections against investor capture, and its July 2025 commitment to the EU GPAI Code of Practice (covering mandatory safety and transparency frameworks) is the strongest EU AI Act compliance signal available from a frontier US lab. However, EU regulated customers must weigh active US political risk — specifically an ongoing legal dispute with the Trump administration's Pentagon over autonomous weapons and surveillance usage restrictions — alongside confirmed security certifications (SOC 2 Type II, ISO 27001:2022, ISO/IEC 42001:2023), a published privacy policy with opt-out training controls, and an unresolved copyright lawsuit relating to training data practices.

Stav editorial summary