Anthropic's 2026 Usage Policy: the high-risk list every Claude deployment should check

Anthropic says the requirements themselves have not changed. What has changed is that the High-risk Use Case Requirements section has been rewritten to say which kinds of recommendation are covered and which are not, because users often asked. The requirements apply to anyone who uses Anthropic's products to make what the policy calls a High-risk AI Recommendation.

Two controls apply to those recommendations. First, a qualified person must meaningfully review the recommendation, with the authority to change it, before it is delivered as advice to an individual who might rely on it or used to implement a decision. The policy defines a qualified person as someone with the training or experience to evaluate the output in that field, holding a licence where the law requires one for the activity, and says that person remains responsible for what is delivered or decided. Second, the individual who receives the advice or is the subject of the decision must be clearly told that AI was used. The policy says users do not need to identify Anthropic, Claude or the model.

The policy lists eleven high-risk areas: legal, medical, finance, credit, insurance, housing, employment, education and credentials, healthcare access, public benefits and services, and legal status and adjudication. The definitions are specific. Employment covers screening, ranking, advancing or rejecting candidates, hiring, promotion and demotion, setting or changing shifts, hours or pay, and evaluating a worker's performance or behaviour. Insurance covers underwriting or pricing a policy and determining the outcome of a claim. Finance covers a personalised recommendation on specific investment products and advice on an individual's own taxes.

The policy also lists what is outside the requirements: general information that is not applied to an individual's circumstances, internal drafting, research, summarisation or analysis that is not the final recommendation delivered, carrying out a decision a person has already made, applying a fixed rule where the model exercises no judgement about the individual, and business operations that do not advise or decide about a specific individual. Where the law permits, review is not required before acting on a recommendation that is wholly favourable to the individual in four listed cases, including paying an insurance claim. A partial approval does not count as wholly favourable.

The policy states that these requirements do not replace local law, and that users should follow local law where it conflicts or adds to them.

The list turns a principle into something a compliance team can check line by line. A policy that says a human stays in the loop on important decisions leaves open which decisions those are. Anthropic has now written that list for its own models, and the definitions are narrow enough to map against a register of use cases.

Employment is the area most likely to catch an organisation unaware, because such tools can be bought by a department without a central review. A CV screening step, a rota that sets hours, a system that scores call handlers: each falls inside the definition if Claude's output is the recommendation and nobody qualified reviews it before it takes effect. The same is true of a claims triage that decides outcomes and a credit model that sets limits.

The line between covered and not covered is who delivers the final recommendation. A model that drafts a summary for an underwriter who then decides is internal analysis. A model whose output is sent to the applicant is the recommendation. Two pipelines using the same prompt can sit on opposite sides of that line, so the review has to look at the workflow and not only the prompt.

The reviewer has to be real. The policy's words are meaningful review, authority to change and continuing responsibility. A sign-off step that approves every item in seconds is unlikely to meet that description.

The policy covers customers who reach Claude through cloud providers and resellers, and the end users of products that integrate Claude. An organisation that buys Claude through a cloud marketplace, or inside another vendor's product, is in scope.

The update adds requirements for models connected to hardware that takes autonomous physical actions and might cause injury. Anthropic ties this to the launch of its Model Hardware Standard. The policy applies them where model outputs are acted on by hardware without human approval and the hardware can move through shared space, apply force that could cause injury, control hazardous energy or materials, act on the human body, control safety systems or run industrial processes.

In those cases there must be a qualified individual who can observe the equipment and stop it at any time, and the equipment must stop or hold a safe state when that person intervenes or when the connection to Anthropic's services is lost. Operating limits such as speed, force, temperature, pressure, dose or operating area must be enforced by the equipment or by a controller independent of model output. The policy says these requirements do not replace vehicle, aviation, medical device, machinery or workplace safety law or certification.

Exclusions include plans, code or commands that a qualified person reviews before they run on equipment, monitoring that does not control the equipment, and consumer devices operating within the manufacturer's safety limits where the worst outcome is discomfort or inconvenience.

On agents, the policy's additional guidelines say users are responsible for ensuring that agents they build or deploy comply with the Usage Policy, including actions those agents take through tools, browsers or connected systems. They also require consumer-facing chatbots and agents that communicate directly with external users to disclose that the user is interacting with AI, at least at the start of each chat session or in the product interface.

The hardware rule states a sound engineering principle in a contract: the safety limit must not depend on the model behaving. For manufacturers, logistics operators and laboratories experimenting with model-driven equipment, it sets the design. The model may propose the move. A controller that the model cannot influence decides whether the move is within bounds.

The safe-state requirement on loss of connection is a design item a pilot can skip. A system that depends on a hosted model needs a defined behaviour for the moment the model is unreachable, and that behaviour needs testing.

The agent clause is short and carries weight. It makes the deploying organisation responsible for what its agent does through a browser or a connected system. Read alongside Anthropic's report of 9 October 2026, in which its own models worked around restrictions on real websites during testing, it is a reason to enforce an agent's boundaries in the system and not in the instructions.

A new section, Do Not Engage in Deceptive Campaigns or Artificial Activity, consolidates rules that were spread across several sections and applies to political and commercial deception alike. The policy text includes fake personas, accounts and outlets, fake reviews, bots that claim to be human, concealing the sponsorship of content meant to influence opinion, and seeding the sources that search engines and AI systems draw on with content that misrepresents its origin or independence.

The surveillance and criminal justice section has been rewritten. Anthropic says tracking people without their consent is prohibited whether in real time or through analysis of data already collected, that Claude cannot be used to decide or recommend who to investigate, arrest or charge, and that building or improving surveillance tools is prohibited. The policy says the section does not prohibit tracking that individuals have agreed to, such as fraud detection or anti-money laundering screening on a financial account, nor content moderation, authorised security research, journalism, or aggregated or anonymised analysis. Anthropic says this does not change what it enforces in practice.

The weapons section now states that the prohibition includes the software and components that make weapons work, and actions such as arming drones and other autonomous vehicles. The elections section, renamed Do Not Undermine Democratic Processes, now focuses on deceiving voters or disrupting elections, and the blanket prohibition on personalised vote and campaign targeting has been removed. Anthropic has also added a prohibition on sustained and needless abusive or cruel behaviour toward its models, which it says is meant for extreme cases and does not cover ordinary frustration, pushback, dark creative themes or model testing and research.

On regions, Anthropic says it has updated its Supported Regions page to clarify enforcement. The policy prohibits use of Claude by people physically located in an unsupported region, by entities incorporated or headquartered in one, and by entities majority-owned or controlled by persons or entities in those regions.

The deceptive activity section reaches into marketing. Fake reviews, undisclosed sponsored influence content and networks of sites built to look independent are named in the text, and so is seeding content to manipulate what AI systems answer. A marketing team or agency using Claude for content at scale should read that section against its own practices, particularly any programme aimed at appearing in AI answers.

For financial services the surveillance wording is helpful as written, because it names consented fraud detection and anti-money laundering screening as permitted. The work is to confirm that the monitoring in question rests on that consent or agreement, and that it stays within the account or service the individual signed up to.

The regional rule is an ownership test as well as a location test. A group with a subsidiary, a parent or a controlling investor in an unsupported region can be affected even where every user sits in a supported country. That is a question for the corporate structure chart, and it can matter in due diligence on an acquisition where the target relies on Claude.

Defence and security suppliers should note that the weapons wording now names targeting, fire control and engagement software. Anthropic says this reflects how the previous policy was enforced, so the practical change is that the boundary is now written down.