Overall risk · low
compliancemedium
Independent compute-tracking data (Epoch AI, April 2026) places Mistral among a small group of frontier labs with at least one model plausibly exceeding the EU AI Act's 10^25 FLOP systemic-risk presumption threshold, though no specific model or formal EU AI Office notification has been publicly confirmed.
privacylow
An unresolved CNIL complaint (filed Feb 2025) alleges Mistral's free-tier training opt-out process is more cumbersome than for paid subscribers, a potential Article 12 GDPR friction point; no decision has been issued as of the latest available reporting.
governancelow
Deepening French government dependency — including a state decision to use Mistral (and exclude OpenAI) for security testing of government systems following a major tax-agency breach — raises questions about the neutrality/independence of Mistral's commercial roadmap versus state interests.
securitylow
No public bug bounty or coordinated vulnerability disclosure policy could be located; security assurance is limited to Trust Center compliance-document requests.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.