Mistral Ai

Stav AI Act assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

The catalogue lists every family Stav knows about — including families we don’t yet host, so the picture stays authoritative.

• Magistral1 model on Stav

• CodestralRequest hosting →
• Mistral LargeRequest hosting →
• Mistral MediumRequest hosting →
• Mistral NemoRequest hosting →
• Mistral SmallRequest hosting →

Families served on Stav

• mistral-small-2603llm · Open weights · 2026-03-16
  No compliance card
• mistral-large-2512llm · Open weights · 2025-12-04
  No compliance card
• magistral-medium-2509llm · 2025-09-18
  No compliance card
• mistral-medium-2508llm · 2025-08-12
  No compliance card
• codestral-2508code · 2025-08-01
  No compliance card
• open-mistral-nemollm · Open weights · 2024-07-18
  No compliance card

Model compliance cards

• complianceUnknown

  Mistral AI is a confirmed signatory of the EU GPAI Code of Practice (finalised 10 July 2025, endorsed by Commission August 2025), one of 26 signatories globally. Signing creates a 'presumption of conformity' with EU AI Act Articles 53 and 55 obligations — the closest available safe harbour for GPAI providers.

• securityUnknown

  Mistral AI holds both SOC 2 Type II and ISO 27001/27701 certifications, confirmed by the official Help Center (updated 5 June 2026). Compliance reports are available on request via trust.mistral.ai (Vanta-powered, confirmed operational).

• complianceUnknown

  First-party inference API (api.mistral.ai) is EU-hosted with EU data residency and EU jurisdiction — confirmed by Stav provider metadata (last verified 2026-06-15). No CLOUD Act or FISA 702 exposure on either the training-side (French-incorporated entity) or inference-side (EU-hosted). This is the strongest data-sovereignty posture available among frontier labs on Stav.

• complianceUnknown

  A formal Data Processing Addendum (DPA) covering GDPR and CCPA is publicly available and executable by enterprise customers at legal.mistral.ai. API data is excluded from model training by default across all paid tiers — a key requirement for regulated-sector data processors.

• complianceUnknown

  Privacy Policy (effective 8 April 2026) explicitly identifies Mistral AI as GDPR data controller, includes a dedicated DPO contact section, and provides a comprehensive data subject rights framework. EU Consumer Terms (effective 28 May 2026) are maintained separately and updated regularly, demonstrating active EU regulatory maintenance.

• transparencyUnknown

  Hybrid open-weights strategy with Apache 2.0 models (Mistral 7B, Mistral Small 4, Mistral Nemo) publicly available on HuggingFace (mistralai org) enables on-premise deployment and independent security audit — a significant transparency advantage over fully closed labs.

Flagged issues

1

• Free-tier (Le Chat/Vibe free plan) conversation data may be used for model training unless the user or organisation administrator opts out via the Admin Panel. Enterprise API customers are exempt by default, but regulated-sector customers must verify their product tier and confirm opt-out is active for any consumer-grade or free-tier deployments within their organisation.medium

Privacy policy review

Country

🇫🇷 France

Open-weights policy

Proprietary

Models in catalogue

6

Website

https://mistral.ai

Creator profile

Mistral AI is France's leading AI lab, incorporated in Paris and operating its inference API exclusively within EU jurisdiction — making it one of the most sovereignty-friendly frontier labs available to European regulated-sector customers. Its hybrid model portfolio combines Apache 2.0 open-weight releases with proprietary closed-weight models served via its own API, and it has formally signed the EU GPAI Code of Practice. The principal risk signals are: a minority stake held by US firm Microsoft (which scrutinised but ultimately cleared by both the CMA and EU competition authorities), a deep governance nexus with the French state (government contracts, presidential endorsement), and a training data policy that permits use of free-tier conversation data for model improvement unless customers opt out.

Stav editorial summary