HIPAA Compliant AI and Beyond: Which LLM Providers Are Safe for Regulated Data

The short answer

No model is compliant by itself. Compliance comes from the tier (consumer vs business/API), the contract (BAA, DPA, zero data retention), the configuration (eligible features only, region pinned) and your own controls. With those in place, regulated data can go to Claude, GPT, Gemini and others today. Without them, even the best model is a reportable disclosure.

• Never use consumer chat apps for regulated data. Free and individual paid plans (Claude Free/Pro/Max, ChatGPT Free/Plus, the free Gemini API tier) may train on your data and offer no BAA or DPA.
• Business and API tiers do not train on your data at Anthropic, OpenAI, Google (paid/Vertex), Microsoft and AWS. Default retention is roughly 0–30 days for abuse monitoring; zero retention is available by approval, with features such as code execution, file storage, batch processing and search grounding excluded. Some newer models (Anthropic's Fable 5/5.1 and Mythos 5/5.1) require 30-day retention and are not available under zero retention.
• HIPAA: all five major routes offer a BAA for eligible services. The BAA covers specific features, not the whole product; anything outside it (web fetch, code execution, your own logging tools) breaks compliance. HIPAA has no certification, so "HIPAA certified" is a red flag.
• Lawyers: yes, officially allowed. ABA Formal Opinion 512 (July 2024) and at least 15 state bars and courts permit AI use under existing duties: competence, confidentiality, informed consent for tools that retain or learn from inputs, verification, supervision and fair billing. The enforcement risk is unverified citations (about 1,600 hallucination cases worldwide by June 2026), not AI use itself. A February 2026 ruling (Heppner) found a defendant's own consumer-Claude chats were not privileged, while two civil courts protected self-represented parties' AI work, so privilege for AI use is still unsettled.
• Government: use only offerings authorized at the data's impact level. Frontier models run at FedRAMP High and DoD IL4/IL5 via AWS GovCloud, Google Assured Workloads and Azure Government, and up to Top Secret in dedicated clouds. Commercial APIs are not the authorized route. Vendor eligibility can change for policy reasons (DoD's 2026 supply-chain designation of Anthropic).
• Privacy law: GDPR needs a DPA, lawful basis and a transfer mechanism (the EU-US Data Privacy Framework is valid but under appeal). The EU AI Act's high-risk rules were delayed to December 2027 / August 2028; transparency duties apply from August 2026. About 20 US state privacy laws are in effect.
• The biggest real-world leak points are on your side: logs, observability tools, vector databases, staff using unapproved tools, and agent tools that send data outside the contract boundary.

Quick answer by provider route for regulated data (details in the matrix below):

Is ChatGPT, Claude, Gemini or Copilot HIPAA compliant?

None of them is “HIPAA compliant” by itself, because HIPAA has no certification. The real question is whether the vendor signs a Business Associate Agreement (BAA) for the exact product you use. Consumer plans never qualify; business and API plans can.

How AI data flows: training, retention and zero data retention

The single biggest factor in AI data risk is not which model you pick but which product tier you send data through. The same model can be safe for client files through an enterprise API under contract, and unsafe through a free consumer chat app.

Inference itself happens in memory and is not the main risk. The risk is the copies: safety logs, stored features, training pipelines, and the logs your own team adds. Every one of these needs an answer before regulated data goes in.

The three tiers, in general terms (provider-specific figures are in the matrix below):

Questions every data flow must answer:

1. Is the data used to train or improve any model? (Must be no, in writing.)
2. How long are inputs and outputs kept, by whom, and why? (Abuse monitoring, legal holds, feature storage.)
3. Which model version is used, and does that model carry its own retention requirement? (Anthropic's Covered Models, for example, require 30-day retention even for customers who otherwise have zero retention.)
4. Can retention be cut to zero, and which features stop working if it is?
5. Where is data processed and stored geographically? (Region, residency, cross-border transfer basis.)
6. Who else touches it? (Subprocessors, the hosting cloud, human safety reviewers.)
7. What do your systems keep? (Application logs, observability tools, vector databases, backups, prompt caches.) This is where most real-world leaks happen.
8. Who inside your organization can see prompts and outputs? (Role-based access, audit logs.)

Legal holds override retention promises. A vendor's deletion promise can be suspended by a court preservation order in litigation against that vendor. That happened to OpenAI in 2025 (see the provider matrix). Zero-retention arrangements are the strongest protection, because there is nothing to preserve.

What “compliant” really means: BAA, SOC 2, FedRAMP and the rest

No AI model is "HIPAA compliant" or "lawyer-approved" on its own. Compliance belongs to a deployment: a specific vendor service, under a specific contract, configured a specific way, used by an organization with its own controls. Badges fall into three kinds, and they prove very different things.

• Contracts create legal obligations for the vendor (BAA, DPA, SCCs, enterprise terms, zero-data-retention addendum). These are what make regulated use lawful.
• Audits and certifications are third-party evidence that the vendor's security program works as described (SOC 2, ISO 27001). They do not make your use compliant.
• Government authorizations are permissions for agencies to use a service at a stated risk level (FedRAMP, DoD IL). They apply to a named cloud offering, not to the vendor as a whole.

What "HIPAA compliant" really means. HIPAA has no certification. The US Department of Health and Human Services (HHS) never certifies products. When a vendor says "HIPAA compliant" or "HIPAA eligible", the only meaningful parts are: (1) they will sign a BAA, (2) the BAA covers the exact service and features you use, and (3) you configure and use it as the BAA requires. The Security Rule obligations (risk analysis, access controls, audit logs, workforce training) stay with you.

Provider matrix: Claude, ChatGPT, Gemini, Azure OpenAI, Bedrock

Every major provider now offers a commercial route with no training on your data, a BAA for eligible services, and some form of zero data retention by approval. They differ on default retention, which features fall outside ZDR or the BAA, regional processing, and government authorization. The route you buy through (direct API vs a cloud platform) changes who the data processor is.

The table scrolls sideways; the first column stays in place.

Certifications (where verified). Anthropic lists SOC 2 Type I and II, ISO 27001:2022 and ISO/IEC 42001:2023 (support article). Cohere lists ISO 27001, ISO 42001 and an annual SOC 2 Type II (trust center). AWS, Google Cloud and Microsoft Azure each hold SOC 1/2/3, ISO 27001/27017/27018, HITRUST-mapped controls and FedRAMP High for their government regions; their trust portals list which AI services are in scope. Always download the current SOC 2 report under NDA rather than relying on a logo.

Who is the processor? On Bedrock and Vertex, the cloud provider is your data processor and its BAA/DPA govern, not the model maker's. On the direct Claude API, Claude Platform on AWS and Claude in Microsoft Foundry, Anthropic is the processor (Anthropic docs). This matters when you choose which contract to sign.

Legal holds in practice. In NYT v. OpenAI, a May 2025 order required OpenAI to preserve consumer and API chats it would otherwise have deleted. An October 2025 order ended the obligation going forward (logs after 26 September 2025), but already-preserved logs and NYT-flagged accounts stayed covered; ZDR customers were not affected (Engadget). The lesson applies to every vendor: retention promises can be suspended by litigation.

Verification gaps. OpenAI's help-center pages on BAAs and certifications could not be opened during research (access blocked); those cells rely on secondary sources. xAI's data terms could not be verified at all, and Mistral's training default, retention and BAA position could not be confirmed on its own pages.

HIPAA compliant AI: BAAs, scope traps and de-identification

You can send protected health information (PHI) to an AI model lawfully only when four things are true: a signed BAA covers the exact service, the features you call are inside the BAA's scope, your own Security Rule safeguards cover the surrounding system, and the use is permitted by the Privacy Rule (treatment, payment, operations, or patient authorization). Any one missing makes it a reportable disclosure.

Who needs a BAA

• Covered entities (providers, health plans, clearinghouses) and their business associates (anyone handling PHI on their behalf) must sign a BAA with any vendor that creates, receives, maintains or transmits PHI for them. An AI API that processes clinical notes is a business associate, or a subcontractor of one.
• If you are a software company building for clinics, you are the business associate. You need a BAA with your customer and a subcontractor BAA with the AI provider (or the cloud platform serving the model).
• A health app used directly by consumers, not on behalf of a provider, is usually outside HIPAA but inside the FTC Health Breach Notification Rule (expanded 2024; unauthorized disclosure counts as a breach, as in the GoodRx and Premom cases) and state laws such as Washington's My Health My Data Act.

BAA scope traps

A trap that is not blocked for you. On Anthropic's HIPAA-ready API, web fetch and code execution are rejected with a 400 error, but the client-side browser use tool is not blocked even though it is outside HIPAA readiness. HIPAA readiness is also permanent once enabled, does not cover Claude Code, is not available on Claude Platform on AWS or Microsoft Foundry, and needs a separate organization for non-HIPAA work (Anthropic docs). Read the eligibility table for every feature you use; don't rely on the API to stop you.

De-identification: the way to use AI without a BAA

Data that is properly de-identified is no longer PHI. HIPAA allows two methods:

1. Safe Harbor: remove all 18 listed identifiers (names, geographic units smaller than a state, all date elements except year, phone, email, SSN, record numbers, device IDs, URLs, IPs, biometrics, full-face photos, any other unique code) and have no actual knowledge the rest could identify someone.
2. Expert Determination: a qualified statistician certifies the re-identification risk is very small, and documents the method.

Free-text clinical notes are hard to de-identify reliably; names and dates hide in narrative. Automated redaction tools reduce risk but do not by themselves meet Safe Harbor. For notes, a BAA-covered service is usually safer than trusting redaction.

Rules that changed or are pending

Architecture checklist for a HIPAA AI system

• BAA signed with the model provider or the cloud platform hosting the model
• BAA or equivalent with every other vendor that sees PHI: logging, vector DB, storage, email, analytics
• Only BAA-eligible features enabled; ineligible ones blocked in code
• Zero or minimum retention configured where available
• Minimum necessary: send only the fields the task needs
• Encryption in transit (TLS 1.2+) and at rest for prompts, outputs, caches and indexes
• Role-based access and audit logs on who sent and viewed what
• Security Rule risk analysis updated to include the AI system
• Human review of AI output before it affects care; Section 1557 bias review for decision-support tools
• Patient disclosures where state law requires them (Texas, California, Illinois)
• Breach response plan that covers prompt leakage and model-output exposure

Building for providers or payers? See healthcare software development.

Can lawyers use ChatGPT or Claude? ABA Opinion 512, state bars and Heppner

Yes. No US jurisdiction bans lawyers from using generative AI, including through APIs, with client information. Every bar that has spoken says the same thing: existing ethics rules apply, and the lawyer stays fully responsible. In practice that means a business or API tier that does not train on inputs and contractually protects confidentiality, client consent where the rules require it, and human verification of every output filed or sent.

The governing national guidance: ABA Formal Opinion 512 (29 July 2024)

ABA Formal Opinion 512 is the main national reference. It creates no new rules; it maps AI onto the Model Rules (summary). ABA opinions are persuasive, not binding; your state's rules govern.

Why the API/enterprise tier matters for lawyers: Opinion 512's consent requirement is triggered by tools that may disclose or learn from inputs. An enterprise or API tier with no training, short or zero retention, and a confidentiality contract is the strongest basis for concluding the risk is low. A free consumer chatbot is the weakest.

State bar guidance (selected)

At least 15 state bars and courts have now issued AI opinions or guidance (compendium). Some are formal ethics opinions and others are guidance or task-force reports.

Courts: disclosure rules

• Hundreds of individual federal and state judges have standing orders requiring AI disclosure or certification; there is no uniform rule. Check every judge's order before filing (running list). The first widely known one was Judge Brantley Starr's certification order (N.D. Tex., May 2023).
• The Fifth Circuit considered a circuit-wide AI certification rule in 2024 and did not adopt it, relying on existing Rule 11-style duties.
• The Illinois Supreme Court AI policy (effective 1 January 2025) says disclosure "should not be required" in pleadings; existing ethics rules govern.
• Proposed Federal Rule of Evidence 707 would hold machine-generated evidence offered without an expert to Rule 702 reliability standards. Public comment closed 16 February 2026; it drew strong opposition and had not been adopted as of this guide (Proskauer).

Sanctions: the real enforcement risk is hallucinated citations

Courts are not sanctioning lawyers for using AI. They are sanctioning lawyers for filing unverified output. A tracking database of AI hallucination cases worldwide counted about 1,598 cases by 9 June 2026, growing by roughly 8 a day (UNC Law Library).

Note the pattern in Johnson and Wadsworth: firms with a written AI policy and verification steps were not themselves sanctioned. A firm policy is a liability shield.

Privilege: United States v. Heppner (S.D.N.Y., Feb 2026)

Judge Rakoff ruled from the bench on February 10, 2026 and issued a written opinion on February 17. He held that about 31 chats a criminal defendant had with Anthropic's consumer Claude, made on his own without counsel's direction, were neither privileged nor work product (O'Melveny, Cleary Gottlieb). The reasoning:

• An AI is not a lawyer, so there is no attorney-client communication.
• The consumer terms allowed the provider to disclose and train on chats, so there was no reasonable expectation of confidentiality.
• Sending outputs to lawyers afterwards did not make them privileged, and pasting attorney advice into the tool risked waiving privilege over that advice.

Work product failed because the materials were not prepared by or at the direction of counsel. In dicta, the court said that if counsel had directed the use, Claude "might arguably" act like the lawyer's agent. Practical reading: lawyer-directed use, on an enterprise or API tier with no training and contractual confidentiality, is the defensible position. Client self-help on consumer chatbots is not.

Civil cases point the other way for self-represented parties. In Warner v. Gilbarco (E.D. Mich., Feb 10, 2026) the court refused to compel a self-represented plaintiff's ChatGPT prompts and outputs, treating AI as a tool rather than a third party. In Morgan v. V2X (D. Colo., Mar 30, 2026) the court held that a self-represented party's AI-assisted preparation is work product under FRCP 26(b)(3), which does not require a lawyer, though the name of the tool used must be disclosed (Kirkland, Bressler). These civil cases are distinguishable from Heppner, a criminal case, but they show the question is unsettled.

Law firms and HIPAA

A law firm is a HIPAA business associate only when it provides legal services to a covered entity or business associate and that work involves PHI (HHS). A firm representing a hospital in a malpractice defense needs a BAA with the hospital, and a subcontractor BAA with any AI vendor that sees the PHI. A firm representing an individual (a personal-injury plaintiff, a party in a divorce) holding that person's own medical records is usually not under HIPAA. Those records are still client confidences under Rule 1.6, so the confidentiality analysis above applies in full.

Outside the US

• UK: The Solicitors Regulation Authority issued a warning notice (Aug 2026) on hallucinated material and entering client confidential information into AI tools without safeguards; the solicitor, not the vendor, is liable (Legal Cheek).
• EU: The CCBE guide (2 October 2025) advises lawyers not to input personal, confidential or client-related information into generative AI tools and to verify all outputs (eucrim). GDPR applies on top.

Law-firm checklist

• Written firm AI policy: approved tools, banned tools (consumer chatbots for client data), verification rules
• Vendor due diligence on file: no training, retention period, ZDR, subprocessors, breach notice, SOC 2 report
• Engagement letter language that specifically explains AI use, plus matter-specific informed consent where data enters a tool that retains or learns
• Citation and quotation verification by a human, logged, before every filing
• Check each judge's standing order on AI disclosure
• Billing policy: no hours for time saved; disclose AI tool costs if passed through
• Training for lawyers and staff; supervision under Rules 5.1/5.3
• Privilege protocol: AI use directed by counsel, on approved tiers, documented as such

For firms building their own tools: legal tech development.

Government data: FedRAMP, IL4/IL5, CJIS and ITAR

For government data the question is not "is the model compliant" but "is this specific cloud offering authorized at the data's impact level". Frontier models are now available from FedRAMP Moderate up to Top Secret, but only through specific government regions and platforms. The commercial API you use for a startup is usually not the authorized route.

Authorization ladder

FedRAMP 20x. FedRAMP is moving to a faster, automation-based process ("20x"). Reported 2026 changes include renaming "authorization" to "certification" and impact levels to Classes A–D; check fedramp.gov for the current terms, as these could not be confirmed against the primary source.

Federal policy that governs agency AI use

Vendor eligibility can change for non-technical reasons

In 2026 the Department of Defense made two separate supply-chain-risk designations of Anthropic (NPR via VPM):

• Under 10 U.S.C. § 3252: struck down and permanently enjoined by the federal court in San Francisco on August 27, 2026 (Anthropic PBC v. U.S. Dep't of War, N.D. Cal.) (Holland & Knight).
• Under the Federal Acquisition Supply Chain Security Act (FASCSA), 41 U.S.C. § 4713: upheld by the D.C. Circuit 2–1 on September 25, 2026 (Clark Hill, Miller & Chevalier).

The surviving order covers removal of Anthropic products from Department systems and contractor-supported Pentagon work. It is not a government-wide ban, and contractors generally may still use Claude in unrelated commercial work. They should document that separation, because FAR 52.204-29 requires a "reasonable inquiry", and some agencies are already asking for certifications. The practical lesson: for defense work, check DoD vendor restrictions, not only FedRAMP status. For civilian agencies, confirm with the contracting officer.

Government checklist

• Classify the data first (public, CUI, PII, CJI, ITAR, classified)
• Use only the offering authorized at that level, in the authorized region
• Confirm the agency's own ATO or reuse of the FedRAMP package
• Check DoD and agency vendor restrictions and any supply-chain designations
• Apply M-25-21 high-impact AI practices (impact assessment, testing, human oversight) where applicable
• Add M-26-04 unbiased-AI contract terms for federal LLM procurements
• For CJI: CJIS agreement, screened personnel, audit logging
• For ITAR: US-person-only support confirmed in writing

More on public-sector builds: government software development.

GDPR, the EU AI Act and US state privacy laws

Privacy law governs personal data whatever the sector, so it applies on top of HIPAA, bar rules or government rules. Using an AI API is lawful under GDPR and US state laws if you have a lawful basis, a processor contract (DPA), a valid transfer mechanism, and you honor data-subject rights. The EU AI Act adds separate duties depending on what the AI system is used for.

GDPR (EU) essentials for AI APIs

• Roles: you are the controller; the AI provider is your processor under a DPA (Article 28). If the provider uses your data to train its own models, it becomes a controller for that use, which is why "no training" terms matter.
• Lawful basis: usually contract or legitimate interest for business use. Special category data (health, biometrics, religion) needs an Article 9 condition as well.
• DPIA: a Data Protection Impact Assessment is expected for new AI processing of personal data at scale or of sensitive data.
• Transfers to the US: the EU-US Data Privacy Framework is valid. The General Court rejected the Latombe challenge (3 September 2025); an appeal is pending before the Court of Justice (C-703/25 P). Keep Standard Contractual Clauses as a fallback.
• Models and personal data: EDPB Opinion 28/2024 says a model trained on personal data is not anonymous by default; unlawful training can taint later deployment.
• Enforcement: Italy's €15M fine on OpenAI (Dec 2024) was annulled on jurisdiction grounds in March 2026 (Ireland is OpenAI's lead authority); the court did not rule on substance.
• Residency: GDPR does not require EU-only processing, but many customers' contracts do. EU regional processing is available from OpenAI, Azure (EU DataZone), Vertex AI and Bedrock EU regions; the direct Claude API offers only global or US inference.

EU AI Act: what applies when

The AI Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) delayed the high-risk rules.

For most businesses using an API, the AI Act duties fall on you as the deployer of a system, depending on use case. Using AI to screen job applicants or score credit is high-risk; drafting marketing copy is not. AI used in the administration of justice is listed as high-risk, which matters for legal-tech products.

UK

The Data (Use and Access) Act 2025 took effect for its main data-protection provisions on 5 February 2026. It relaxes the old ban on solely automated decisions: they are allowed with safeguards (information, representations, human intervention, right to contest), except where special category data is involved. UK GDPR otherwise mirrors the EU rules above.

United States

• No federal privacy law. About 20 state comprehensive privacy laws are in effect in 2026 (MultiState), all requiring processor contracts, and most giving opt-outs from profiling.
• California: CCPA regulations on automated decision-making technology took effect 1 January 2026; ADMT compliance from 1 January 2027; risk assessments due for existing activities by 31 December 2027.
• Colorado: the 2024 AI Act never took effect. It was repealed and replaced by SB 26-189 (May 2026), a narrower ADMT law effective 1 January 2027 (McDermott).
• Federal pressure on state AI laws: Executive Order 14365 (11 December 2025) created a DOJ task force to challenge state AI laws and ties broadband funds to them. It does not itself preempt any state law; comply with state laws until a court says otherwise.
• Sector laws still apply: GLBA (financial data), FERPA (student records), COPPA (children under 13), state biometric laws such as Illinois BIPA.

Breach notification

All 50 states, plus DC, Guam, Puerto Rico and the US Virgin Islands, have data breach notification laws (Jackson Lewis). A vendor processing data for a client is usually a "third-party agent" with its own duty to tell the client. Example: Florida § 501.171 requires notice to the state within 30 days for a breach affecting 500+ Floridians. A third-party agent must notify the covered entity within 10 days, and penalties reach $500,000 per breach. If you build AI products on client data, your contracts and incident plan need these clocks, separate from HIPAA's 60-day ceiling.

Foreign-hosted models

DeepSeek's privacy policy states user data is stored in the People's Republic of China. Italy ordered it to stop processing Italian users' data (January 2025), and Australia, Taiwan, South Korea and the Czech Republic restricted it on government systems (Al Jazeera). Do not send regulated data to a hosted service whose data may be held under a foreign government's jurisdiction without a legal review.

Related: the EU AI Act’s watermarking rules explained and what new AI rules mean for builders.

How to evaluate an AI provider: decision route and questionnaire

Start from the most sensitive data that will ever enter the system, not from the model. The data category sets the minimum contract and authorization; model quality is chosen only among offerings that clear that bar. When data types mix, every rule that legally applies, applies.

If more than one row legally applies (a law firm defending a hospital that is also a federal contractor), every applicable row's requirements apply at once. First check which rules actually reach your data: a law firm holding its own client's medical records is under Rule 1.6, not HIPAA (see the lawyers section).

Five-step evaluation

1. Classify the data. List every data type that could reach the model, including through uploaded documents, retrieval indexes and tool results.
2. Pick the tier and route. Business or API tier only for regulated data. Decide direct API vs cloud platform (Bedrock, Vertex, Azure) based on which contracts and authorizations you need.
3. Get the paperwork. DPA, BAA, ZDR addendum, SOC 2 Type II report, subprocessor list, FedRAMP package as applicable. Keep copies with dates.
4. Configure to match the contract. Enable ZDR or HIPAA mode, disable ineligible features, pin regions, set retention, restrict access.
5. Govern your own side. Logging redaction, vector DB security, staff policy, human review of outputs, incident response, annual vendor re-review.

Vendor due-diligence questionnaire

Red flags: "HIPAA certified" (no such certification), a BAA that does not list services, "we may use data to improve our services" in business terms, no SOC 2 Type II, refusal to name subprocessors, data hosted in a jurisdiction your regulator restricts.

Self-hosted and open-weight models

Running an open-weight model (Llama, Mistral, Qwen, Gemma, gpt-oss and similar) on your own servers removes the third-party processor from the data path, but it moves every compliance duty onto you. It is the right answer when data legally cannot leave your environment (classified, some ITAR, air-gapped networks, contractual no-cloud clauses), and usually the wrong one when a BAA-covered cloud API is acceptable.

A middle path is a managed model inside your own cloud account: the same frontier model served by AWS Bedrock, Google Vertex AI or Azure, under the cloud provider's BAA, FedRAMP scope and regional controls you already use. For most regulated organizations this is the practical sweet spot.

Risks that stay the same either way: prompt injection, data leakage through retrieval (RAG) indexes, over-broad access to source documents, and logs or traces that capture sensitive prompts. Self-hosting does not fix these.

Background: open vs closed AI models.

What is known, and what is not

The data-handling side is well understood and contract-backed; the legal side is still forming, mostly through ethics opinions and a handful of court rulings. Standards bodies have not caught up with AI-specific risks, so certifications prove a vendor runs a sound security program, not that a model is safe for a given use.

Gaps no standard covers yet:

• Memorisation: whether a model trained on data can reproduce it. Irrelevant for API data that is never trained on, central for consumer tiers.
• Prompt injection: a document or web page can instruct an AI agent to leak data it has access to. This is a design problem in your system, not a vendor certification item.
• Agentic tools: when a model can browse, run code or call APIs, data can leave the BAA or ZDR boundary through the tool, not the model. Several vendors exclude exactly these features from ZDR and HIPAA scope.
• Subprocessor chains: a product can route to a different model provider under the hood (for example Microsoft Copilot using Anthropic models outside the EU Data Boundary). Read the subprocessor list, not only the main contract.
• Policy volatility: terms and availability change. Anthropic's consumer training default changed in 2025; litigation suspended OpenAI's deletion in 2025; a DoD designation changed Anthropic's defense eligibility in 2026. In June 2026 a Commerce Department export-control directive restricted access to Claude Fable 5 and Mythos 5 until it was terminated on June 30, with access returning from July 1 (Digital Policy Alert; news reports only, no Anthropic statement found). Re-review vendors at least yearly, and build regulated products with a tested fallback model so they do not depend on one model.

Frequently asked questions