Overall risk · medium
jurisdictionmedium
Anthropic is a US-incorporated PBC fully subject to the CLOUD Act and FISA 702; its first-party API offers no EU-only data residency (only 'us' or 'global' inference_geo), so EU customers needing in-region processing must route through AWS Bedrock or Google Vertex AI instead of Anthropic's native API.
compliancemedium
Anthropic settled a US class-action lawsuit for a minimum of $1.5 billion after a federal judge found it downloaded millions of pirated books from shadow libraries (LibGen, PiLiMi) to train Claude models — the largest copyright class-action settlement in US history.
governancemedium
In June 2026 the US Commerce Department invoked export-control authority to force a worldwide, 19-day suspension of Anthropic's newest models (Fable 5/Mythos 5) following a jailbreak report — the first retroactive export-control action against a released commercial AI model, demonstrating that US regulatory intervention can abruptly remove access to frontier models for all global customers, including EU enterprises.
financiallow
Two of Anthropic's largest financial backers (Amazon, Google) simultaneously operate or invest in competing AI labs/cloud platforms, and both have been examined by the FTC and UK CMA over whether their minority stakes constitute de facto acquisitions raising competitive-influence questions.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.