Loading the catalogue…
Loading the catalogue…
Cohere is a Canadian enterprise AI company headquartered in Toronto, focused on secure, sovereign AI for regulated industries including finance, healthcare, defence, and the public sector. It holds SOC 2 Type 2, ISO 27001, and ISO 42001 certifications, operates a published Trust Centre, and has signed both Canada's voluntary AI code of conduct and the US White House voluntary AI commitments. A major pending structural event — the announced acquisition of German AI firm Aleph Alpha (subject to regulatory approval as of June 2026) — will give Cohere a European headquarters in Berlin and significantly strengthen its EU presence, though it also introduces transient governance and integration risk. An active US copyright lawsuit (Advance Local Media v. Cohere, SDNY, filed February 2025) in which Cohere's motion to dismiss was fully denied in November 2025 poses material reputational and legal risk around training data practices.
Active US federal copyright lawsuit (Advance Local Media LLC et al. v. Cohere Inc., SDNY). 14 major publishers allege systematic infringement of 4,000+ works in training data and model outputs. Cohere's motion to dismiss was denied in full in November 2025. Publishers seek damages up to $150,000 per work and an injunction on use of copyrighted materials. Case now proceeds to discovery. Raises serious questions about training data consent practices and the legal status of outputs from Command models.
Pending acquisition of Aleph Alpha (announced April 2026) is subject to regulatory approval and is not yet closed. The transaction introduces structural uncertainty: combined entity governance, product roadmap integration, and how Aleph Alpha's EU-specific data sovereignty commitments will be preserved under Canadian ownership all remain to be resolved. Aleph Alpha had previously struggled commercially and pivoted its model strategy.
No confirmed EU AI Act compliance statement or engagement with the GPAI Code of Practice found. While Cohere holds ISO 42001 and signed voluntary AI codes in Canada and the US, no explicit EU AI Act posture or GPAI Office engagement could be verified. This gap may become material as the EU AI Act's GPAI provisions come into full effect.
Privacy policy does not explicitly address GDPR-specific provisions (legal bases for processing, data subject rights procedures, DPO contact, EU-to-Canada transfer mechanism). Canada has only partial EU adequacy under PIPEDA. EU enterprise customers in regulated sectors should request a Data Processing Agreement and verify GDPR compliance before deployment.
While Cohere is not CLOUD Act exposed at the corporate level, it maintains offices in New York and San Francisco and processes some data on US cloud infrastructure (Google Cloud, AWS). Data processed on US infrastructure by a non-US entity remains potentially subject to US legal process. Customers requiring strict EU data residency should use on-premises or EU-region deployment options.
Stav AI Act assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
Holds SOC 2 Type 2, ISO 27001, and ISO 42001 certifications, confirmed via a public Trust Centre (trustcenter.cohere.com). Certifications are requestable with NDA.
Signed both Canada's voluntary AI code of conduct (September 2023) and the US White House voluntary AI commitments (September 2023), demonstrating early proactive engagement on responsible AI.
Command A+ (218B MoE) released under Apache 2.0 in May 2026 — Cohere's first fully permissive frontier model release — enabling complete on-premises self-hosting, fine-tuning, and air-gapped deployment without Cohere API dependency. This is directly advantageous for EU regulated-sector data sovereignty.
Cohere Labs has published over 100 research papers and maintains a 4,500+ member research community. Open-weight model cards on HuggingFace include architecture details, training methodology, and intended use/limitation documentation consistent with EU AI Act transparency expectations.
Rapidly scaling with multiple government and defence-sector partnerships (UK government, Canadian government, Thales, Saab, Bell Canada), strong enterprise revenue trajectory, and pending Aleph Alpha acquisition with anchor investment from Schwarz Group. Organisation is actively growing, not contracting.
Active HuggingFace presence under CohereLabs org with recent model releases (May 2026), community Spaces, and responsive contact channels (labs@cohere.com). Strong track record of open research contributions especially in multilingual AI (Aya family covering 70+ languages).
On-premises and private cloud deployment options are marketed and supported (via 'Model Vault'), enabling EU customers to run models entirely within their own infrastructure and jurisdiction, bypassing Cohere's own data centres entirely.
Privacy policy review
Creator profile
Cohere is a Canadian enterprise AI company founded in 2019, purpose-built for regulated sectors — finance, healthcare, manufacturing, and the public sector — with deployment options spanning VPC, on-premises, and dedicated managed environments that meaningfully reduce data-sovereignty risk for EU customers. The company holds SOC 2 Type II, ISO 27001, and ISO 42001 certifications, publishes a GDPR-aligned Data Processing Addendum with Standard Contractual Clauses, and has conducted a Transfer Impact Assessment following Schrems II. A transformative structural event is underway: Cohere announced the acquisition of Germany's Aleph Alpha in April 2026, pending regulatory approval, which — if it closes — will materially deepen its EU footprint, add German-public-sector institutional relationships, and embed a German co-headquarter.
Stav editorial summary
Stav compliance has not yet scored Cohere. Scores are published once the policy review and infrastructure assessment complete.
Findings
Citations gathered when the Compliance Curator last reviewed this creator’s public-facing documents. Grouped by source so the picture stays auditable.
“Seamlessly complete your privacy and security compliance reviews by visiting Cohere’s Trust Center where you can request a copy of our certifications ...”
“Our API platform is hosted on industry-leading cloud infrastructure and is SOC 2 Type II compliant · Our advanced threat detection systems continuousl...”
“Cohere Inc. is a Canada-based international technology company focused on artificial intelligence. Cohere specializes in large language models and AI ...”
Cohere Inc. is a Canada-based international technology company focused on artificial intelligence. Cohere specializes in large language models and AI ...
In 2017, as a 20 year-old intern at Google Brain, Gomez was one of eight authors of the research paper "Attention Is All You Need", which is credited ...
While Cohere cannot rectify Canada’s reliance on foreign cloud infrastructure, its provision of secure and domestically owned AI systems mitigates ris...
The deal hasn't closed, and the acquisition is subject to regulatory conditions being met.As part of the deal, Schwarz Group — a key backer of Al...
For Cohere, the acquisition provides immediate market access across German-speaking Europe and credibility with regulators who have watched Aleph Alph...
The question remains whether European organizations will view an initiative involving Canada as sufficiently sovereign, or whether they will trust tha...
Seamlessly complete your privacy and security compliance reviews by visiting Cohere’s Trust Center where you can request a copy of our certifications ...
Cohere has been designated a 'national AI champion' by the Canadian government, which is also a customer. This government relationship could create conflicts of interest if government priorities influence model development, deployment restrictions, or access terms for non-Canadian regulated-sector customers.
Published safeguards & certifications
“In 2017, as a 20 year-old intern at Google Brain, Gomez was one of eight authors of the research paper "Attention Is All You Need", which is credited ...”
“Aya 23 is an open weights research release of an instruction fine-tuned model with highly advanced multilingual capabilities.”
“We release the checkpoints under a Apache-2.0 license to further our mission of multilingual technologies empowering a multilingual world. ”
“For Cohere, the acquisition provides immediate market access across German-speaking Europe and credibility with regulators who have watched Aleph Alph...”
“The deal hasn't closed, and the acquisition is subject to regulatory conditions being met.As part of the deal, Schwarz Group — a key backer of Al...”
“For procurement teams making a GDPR-focused comparison, Cohere’s main differentiator is its private deployment model: Cohere’s private cloud option is...”
“The Canadian government has heavily backed Cohere through its Sovereign AI Compute Strategy, pouring roughly $240 M into Cohere’s own computing infras...”
“While Cohere cannot rectify Canada’s reliance on foreign cloud infrastructure, its provision of secure and domestically owned AI systems mitigates ris...”
“The question remains whether European organizations will view an initiative involving Canada as sufficiently sovereign, or whether they will trust tha...”
“Standard Contractual Clauses: The DPA incorporates the Standard Contractual Clauses, approved by the European Commission on 4 June 2021, allowing cust...”
Our API platform is hosted on industry-leading cloud infrastructure and is SOC 2 Type II compliant · Our advanced threat detection systems continuousl...
Standard Contractual Clauses: The DPA incorporates the Standard Contractual Clauses, approved by the European Commission on 4 June 2021, allowing cust...
For procurement teams making a GDPR-focused comparison, Cohere’s main differentiator is its private deployment model: Cohere’s private cloud option is...
Aya 23 is an open weights research release of an instruction fine-tuned model with highly advanced multilingual capabilities.
We release the checkpoints under a Apache-2.0 license to further our mission of multilingual technologies empowering a multilingual world.
The Canadian government has heavily backed Cohere through its Sovereign AI Compute Strategy, pouring roughly $240 M into Cohere’s own computing infras...