Databricks✓

Stav AI Act assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

• securityUnknown

  ISO 27001:2013, ISO 27701, and SOC 2 Type II certifications confirmed; HITRUST CSF for Azure Databricks. Public HackerOne bug bounty programme with 260+ valid submissions from ~150 researchers, supplemented by private programme and third-party penetration testing.

• complianceUnknown

  GDPR DPA available with 2021 SCCs incorporated; self-serve DPA amendment process; subprocessor list published; EU–US Data Privacy Framework participation; EU Data Act Addendum published — demonstrating proactive engagement with EU digital regulation beyond GDPR.

• transparencyUnknown

  Model cards published for DBRX Base and DBRX Instruct with architecture, training data summary (12T tokens), benchmark results, context length, and use limitations. LLM Foundry training framework and Unity Catalog governance framework open-sourced on GitHub. Proactive public security incident disclosure via blog and CVE bulletins.

• communityUnknown

  Deep open-source heritage as creators of Apache Spark and Delta Lake; LLM Foundry, Unity Catalog, and MegaBlocks open-sourced on GitHub. Annual Data + AI Summit with confirmed 2026 edition. Founded by UC Berkeley academics with a strong published research heritage.

• stabilityUnknown

  Actively scaling: completed Series L fundraise in December 2025; acquired Neon in 2025; launched Agent Bricks, Lakebase, Genie Code, and Lakewatch in 2025–2026; partnerships with Anthropic, OpenAI, Google Cloud, Microsoft Azure, and AWS. Founder-led, operationally stable, with confirmed 2026 annual summit.

• complianceUnknown

  Named major European regulated-sector customers (Santander Bank Polska, Rabobank, Raiffeisen, Erste Group, ABN AMRO) actively using the Databricks platform — suggesting a demonstrated track record of operating within EU financial services regulatory environments.

Privacy policy

https://www.databricks.com/legal/privacynotice

Flagged issues

1

• Training data provenance for the MPT series is disputed: the RedPajama/Books3 dataset used was later removed from HuggingFace for copyright infringement. Full training dataset composition for DBRX is not publicly disclosed, directly limiting EU AI Act Article 53 transparency assessment and GPAI Code of Practice Chapter 2 (Copyright) compliance. No public opt-out or consent mechanism described for training data.medium

Privacy policy review

Country

🇺🇸 United States

Open-weights policy

Mixed

Models in catalogue

0

Website

https://www.databricks.com

GitHub

https://github.com/mosaicml

HuggingFace

databricks · Verified · 1,610 followers

HF published

0 models · 1 datasets · 2 papers

Creator profile

Databricks is a privately held, San Francisco-based data intelligence company founded by academics from UC Berkeley, known for pioneering the lakehouse architecture and for releasing DBRX, a 132B-parameter open-weights model under a custom commercial licence. It is fully CLOUD Act exposed as a US-incorporated entity, meaning EU customers in regulated sectors must account for potential US government access to data processed on the platform. While Databricks maintains a robust compliance programme — SOC 2 Type II, ISO 27001, ISO 27701, a public GDPR DPA with 2021 SCCs, and an active HackerOne bug bounty — an ongoing copyright class-action lawsuit (In re Mosaic LLM Litigation) over training data practices for the MPT and DBRX model families represents a material legal risk that EU-regulated buyers should monitor.

Stav editorial summary