Loading the catalogue…
Loading the catalogue…
Meta AI (the AI research and product division of Meta Platforms) is headquartered in Menlo Park, California, with full US jurisdiction exposure under the CLOUD Act and FISA Section 702. The Llama series (up to and including 3.3) provides open weights under custom community licences suitable for EU self-hosting, but all Llama 4 and later multimodal models explicitly exclude EU-domiciled licensees and developers from their licence grants. As of April 2026 Meta has pivoted its frontier AI strategy toward closed-weights proprietary models under its new Muse Spark / Meta Superintelligence Labs umbrella — a major shift from its open-weights heritage — and has refused to sign the EU GPAI Code of Practice, placing its Llama models under closer EU AI Office scrutiny.
Full US CLOUD Act and FISA Section 702 exposure. Meta Platforms is a US-incorporated entity; US authorities can compel access to data held globally, including any data processed through Meta-hosted inference endpoints.
Llama 4 multimodal models are contractually prohibited for EU-domiciled individuals and companies under the Llama 4 Community Licence Agreement and Acceptable Use Policy. EU enterprises deploying these models in self-hosted environments are in breach of licence terms.
Meta refused to sign the EU GPAI Code of Practice in July 2025, placing Llama models under closer scrutiny by the EU AI Office. Non-signatories face more frequent inspections and lack the presumption of conformity afforded to signatories.
Meta has the worst GDPR enforcement track record of any major AI model creator: the 2023 €1.2B fine (EU-US data transfers) and ongoing disputes with the Irish DPC over EU user data being used for AI training constitute a material risk signal for EU regulated-sector customers.
Meta uses EU social media user data (Facebook/Instagram public posts) for AI model training under an opt-out mechanism that privacy organisation noyb deemed insufficiently transparent, filing 11 regulatory complaints. This affects the training data provenance of future Llama and Muse models.
Meta has not published GPAI-compliant training data summaries as required by EU AI Act Article 53 obligations that came into effect for new GPAI models on 2 August 2025. This creates regulatory uncertainty for EU deployers of Llama 4 and Muse models.
Llama 4 benchmarking controversy: Meta submitted an unreleased 'experimental chat version' to LMArena rather than the publicly shipped model, understating its actual deployed performance. This raises questions about disclosure practices relevant to regulated-sector evaluation.
Meta's 49% non-voting stake in Scale AI (whose founder Alexandr Wang is now Meta's Chief AI Officer) creates an indirect link to Scale AI's US defence contracts. The implications for EU regulated customers' supply-chain due diligence should be assessed.
Muse Spark (April 2026) is currently only available in the United States and is closed-source with no public architecture paper or model card. EU availability and GDPR/AI Act compliance posture are unknown, making it unsuitable for EU enterprise deployment in the near term.
Stav AI Act assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
Llama 3.x series includes model cards, system cards, and partial training data documentation published on HuggingFace and llama.com — above-average transparency for open-weights models.
Meta AI Research (FAIR) is a prolific and well-regarded academic AI research publisher, with substantial contributions to the open research community through papers, datasets, and the Llama open-weights model family.
Meta operates one of the largest and most established bug bounty programmes in the industry, with a long track record of paying out significant awards for responsible vulnerability disclosures.
Muse Spark Safety & Preparedness Report published alongside model launch, including third-party evaluation by Apollo Research. This represents a positive step toward frontier model safety transparency.
Meta is one of the world's largest technology companies with a well-capitalised parent corporation, Hyperion data centre investments, and a clear multi-year AI roadmap. The risk of model abandonment or organisational collapse is negligible.
Llama 3.3 and earlier non-multimodal Llama models are EU-compatible (no licence exclusion) and can be self-hosted by EU enterprises, providing full data sovereignty when deployed on EU infrastructure.
Published safeguards & certifications
Privacy policy review
Creator profile
Meta AI is the AI research and product division of Meta Platforms, a US-incorporated public company headquartered in Menlo Park, California. It is the originator of the Llama model family — the most widely deployed open-weights large language models in the world — released under custom community licences that are not OSI-certified open source. For EU regulated enterprises, Meta presents a layered compliance risk: it holds the record GDPR fine (€1.2 billion for unlawful EU–US data transfers), has received multiple subsequent DPC and DMA enforcement actions, publicly refused to sign the voluntary EU GPAI Code of Practice, and has had its flagship Llama models classified by regulators as GPAI models with systemic risk. The lab is actively investing in AI and remains operationally strong, but its adversarial relationship with EU regulators and persistent data-sovereignty concerns make it a high-scrutiny supplier for European regulated-sector customers.
Stav editorial summary
Meta AI is a United States entity. Training data and weights produced under United States-jurisdiction are covered by the CLOUD Act.
Exposed on training. Inference is unaffected when hosted on Stav infrastructure inside the EEA.
Stav compliance has not yet scored Meta AI. Scores are published once the policy review and infrastructure assessment complete.
Findings
Citations gathered when the Compliance Curator last reviewed this creator’s public-facing documents. Grouped by source so the picture stays auditable.
“Meta Platforms Inc. (NASDAQ: META) has taken a more confrontational stance, famously refusing to sign the voluntary GPAI Code of Practice in late 2025...”
“This technical benchmark, which captured Meta’s Llama 3.1 (estimated at $3.8 \times 10^{25}$ FLOPs) and the newly released Grok-3 from X, mandates tha...”
The interesting part of this ban can be found by reading the terms of the Acceptable Usage Policy (AUP): With respect to any multimodal models include...
Among other things, the code requires companies to provide and regularly update documentation about their AI tools and services and bans developers fr...
However, this refusal has backfired, placing Meta’s Llama models under "closer scrutiny" by the AI Office.
Muse Spark, Meta's newly released model, is proprietary, a sharp change from its predecessor family of models called Llama, which consisted of op...
But Meta’s new model is not available for download, meaning the technology is not open source. Muse Spark is only available in the United States for t...
After “carefully reviewing” the Code, Meta will not sign because the document “introduces a number of legal uncertainties for model developers, as wel...
The largest fine, a record-breaking €1.2 billion, was imposed back in May 2023. That penalty was for one specific reason: unlawfully transferring the ...
Digiphile Managing Director Phil Lee, CIPP/E, CIPM, FIP, also points to the decision's broad implications, telling The Privacy Advisor, "At ...
"Europe is heading down the wrong path on AI," said Joel Kaplan, chief global affairs officer at Meta, in a LinkedIn post.
Meta Platforms Inc. (NASDAQ: META) has taken a more confrontational stance, famously refusing to sign the voluntary GPAI Code of Practice in late 2025...
This technical benchmark, which captured Meta’s Llama 3.1 (estimated at $3.8 \times 10^{25}$ FLOPs) and the newly released Grok-3 from X, mandates tha...
“According to the April 2025 announcement, Llama 4 emphasizes multimodal capabilities and open access to weights for builders to customize and host on ...”
“Llama 4 is distributed under the Llama 4 Community License Agreement—a custom license that provides access to weights but imposes restrictions via the...”
“On December 17, 2024, the Irish Data Protection Commission (DPC) announced its final decisions on two investigations against Meta Platforms Ireland Li...”
“The Free Software Foundation classified Llama 3.1's license as a nonfree software license in January 2025, criticizing its acceptable use policy, rest...”
“In 2024, our bug bounty program awarded more than $2.3 million in bounties, bringing our total bounties since the creation of our program in 2011 to o...”
“... Meta's recent announcement that they won't be releasing their multimodal Llama 4 model in the European Union has sparked important conversations a...”
“Meta Horizon managed services meets the ISO27001 security standard. Our ISO 27001 certification demonstrates a commitment to security best practice an...”
“The largest fine, a record-breaking €1.2 billion, was imposed back in May 2023. That penalty was for one specific reason: unlawfully transferring the ...”
“Digiphile Managing Director Phil Lee, CIPP/E, CIPM, FIP, also points to the decision's broad implications, telling The Privacy Advisor, "At ...”
“Meta was fined €91 million by the Irish Data Protection Commission (DPC) in October 2024 for storing certain Facebook user passwords in plain text wit...”
“"Europe is heading down the wrong path on AI," said Joel Kaplan, chief global affairs officer at Meta, in a LinkedIn post.”
As of May 27, 2025, Meta (Facebook and Instagram) will start using some of the personal data of European users to train its artificial intelligence (A...
The privacy organization noyb strongly criticized this approach. Following 11 complaints filed by noyb, the Irish Data Protection Commission (DPC) ann...
In a break from Meta’s Llama heritage, it is closed source. The model’s arrival closes a chapter that began in June 2025, when Mark Zuckerberg announc...
Llama 4 had not only disappointed Meta technically but also damaged its reputation: for the LMArena benchmarks, Meta had used a special, unreleased “e...
For EU enterprises, Llama 3.3 70B is the best choice from the Llama family – proven, EU-compatible, and with a strong performance profile.
... Meta's recent announcement that they won't be releasing their multimodal Llama 4 model in the European Union has sparked important conversations a...
On December 17, 2024, the Irish Data Protection Commission (DPC) announced its final decisions on two investigations against Meta Platforms Ireland Li...
Meta was fined €91 million by the Irish Data Protection Commission (DPC) in October 2024 for storing certain Facebook user passwords in plain text wit...
According to the April 2025 announcement, Llama 4 emphasizes multimodal capabilities and open access to weights for builders to customize and host on ...
In 2024, our bug bounty program awarded more than $2.3 million in bounties, bringing our total bounties since the creation of our program in 2011 to o...
Meta Horizon managed services meets the ISO27001 security standard. Our ISO 27001 certification demonstrates a commitment to security best practice an...
The Free Software Foundation classified Llama 3.1's license as a nonfree software license in January 2025, criticizing its acceptable use policy, rest...
Llama 4 is distributed under the Llama 4 Community License Agreement—a custom license that provides access to weights but imposes restrictions via the...