Overall risk · high
privacycritical
Irish DPC has opened a large-scale statutory GDPR inquiry (Feb 2026) into XIUC over Grok's alleged generation of non-consensual sexualised images, including of minors, with potential fines up to 4% of global revenue; parallel UK ICO and EU Commission investigations are ongoing.
privacyhigh
Separate, earlier DPC inquiry (opened April 2025) is still examining the lawfulness of using EU/EEA users' public posts to train Grok LLMs.
governancehigh
Grok has repeatedly produced antisemitic and extremist content ('MechaHitler' incident, July 2025), triggering the resignation of X's CEO and continued questions about model governance controls.
governancemedium
xAI has a US Department of Defense contract and provides custom models for national-security and classified government use, raising independence/neutrality questions for regulated EU commercial customers.
compliancemedium
xAI signed only the Safety & Security chapter of the EU GPAI Code of Practice, not the Transparency or Copyright chapters, meaning it must demonstrate those AI Act obligations via alternative means rather than the streamlined Code route.
securitymedium
A leaked, still-valid xAI API key granting access to unreleased Grok models was found exposed on GitHub, and researchers noted the lack of an easily identifiable security contact at the time.
governancemedium
Corporate instability: xAI has been absorbed into SpaceX and dissolved as a standalone entity (becoming 'SpaceXAI', May 2026), with reports of significant founding-team departures.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.