Google✓

Stav AI Act assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

The catalogue lists every family Stav knows about — including families we don’t yet host, so the picture stays authoritative.

• Gemini6 models on Stav
• Gemini 2.5 Flash2 models on Stav

• Gemini 2.0 FlashRequest hosting →
• Gemini 2.5 ProRequest hosting →
• GemmaRequest hosting →

Families served on Stav

• Gemini 3.5 Flashllm · 2026-05-19
  No compliance card
• Gemini 3.1 Flash Litellm · 2026-05-07
  No compliance card
• Gemma 4 26B A4B ITllm · Open weights · 2026-04-02
  No compliance card
• Gemma 4 31B ITllm · Open weights · 2026-04-02
  No compliance card
• Gemini 3.1 Pro Previewllm · 2026-02-19
  No compliance card
• Gemini 3 Flash Previewllm · 2025-12-17
  No compliance card
• Gemini 2.5 Flash-Litellm · 2025-07-22
  No compliance card
• Gemini 2.5 Prollm · 2025-06-17
  No compliance card
• Gemini 2.5 Flashllm · 2025-05-20
  No compliance card

Model compliance cards

• complianceUnknown

  Signed the EU GPAI Code of Practice (all three chapters: Transparency, Copyright, Safety and Security) as an early signatory when the Code was finalised on 10 July 2025, alongside Anthropic, Microsoft, OpenAI, IBM, Mistral AI, Cohere, and others. Signing the Safety and Security chapter implies acceptance of systemic-risk obligations under Article 55 of the EU AI Act.

• complianceUnknown

  ISO/IEC 42001:2023 (AI Management System) certification for Google Cloud Platform, Google Workspace, and Gemini App — one of the most AI-specific and EU AI Act-relevant certifications currently available; directly relevant to Article 53 GPAI transparency obligations.

• securityUnknown

  Comprehensive security certification stack: ISO/IEC 27001:2022, ISO 27017, ISO 27018, ISO 27701, and SOC 2 (third-party audited, regular cycle) for Google Cloud — industry-leading certification coverage for enterprise regulated-sector deployments.

• transparencyUnknown

  Detailed model cards published for all Gemma model families (Gemma 1 through 4 and 3n) covering architecture, training data categories, safety evaluations, red-teaming results, and prohibited use policies. Annual AI Transparency Report published since 2019. Both represent proactive disclosure well above the minimum required by the EU AI Act.

• securityUnknown

  Operates one of the industry's longest-running and most comprehensive bug bounty programmes (Google VRP at bughunters.google.com), recently extended to cover generative AI vulnerabilities. Published Secure AI Framework (SAIF) for AI-specific security guidance.

• transparencyUnknown

  Gemma 4 released under Apache 2.0 licence (April 2026) — the most permissive open-source licence used to date for the Gemma family, enabling EU enterprise customers to self-host, fine-tune, and redistribute without royalty obligations, eliminating CLOUD Act exposure on the inference leg when deployed on EU-sovereign infrastructure.

Privacy policy

https://policies.google.com/privacy

Flagged issues

2

• Sustained and escalating GDPR/ePrivacy enforcement history: French CNIL fined Google three times for consent violations (€50M in 2019, €150M in 2021, €325M in September 2025). The 2025 fine — the largest CNIL action against Google to date — came with a compliance order and €100,000 daily penalties for non-compliance, and was triggered by Gmail ad display without consent and invalid cookie consent. The pattern of escalating fines indicates continuing regulatory risk.high
• No publicly documented opt-out or removal mechanism for data subjects whose personal data may have been included in Gemma or Gemini pre-training corpora. This represents a potential gap under GDPR Article 17 (right to erasure) and Article 21 (right to object) for EU enterprises deploying models in regulated contexts, particularly healthcare, finance, and legal sectors.low

Privacy policy review

Country

🇺🇸 United States

Open-weights policy

Mixed

Models in catalogue

9

Website

https://ai.google

HuggingFace

google · Verified · 54,775 followers

HF published

1096 models · 68 datasets · 58 papers

Creator profile

Google — operating its AI research through the wholly-owned subsidiary Google DeepMind — is a US-domiciled, CLOUD Act- and FISA 702-exposed organisation, making data sovereignty a primary concern for EU regulated customers. On the compliance side, it has taken materially positive steps: it became an early signatory to the EU GPAI Code of Practice, holds ISO/IEC 42001:2023 certification for Google Cloud Platform, Workspace, and Gemini, publishes detailed model cards for all Gemma releases, and has published AI principles annually since 2018. The principal EU risk signals are ongoing active GDPR enforcement actions (a CNIL cookie-consent fine issued in 2025), two US federal antitrust findings of illegal monopolisation in search and ad-tech whose remedies now explicitly extend to Gemini AI products, and the inherent jurisdictional exposure that means any data processed through Google APIs is reachable by US government orders.

Stav editorial summary