How to check your Claude use cases against Anthropic's 12 November Usage Policy

Anthropic's updated Usage Policy takes effect on 12 November 2026. For most enterprise Claude work, nothing changes. But if Claude helps make a recommendation about a specific person, such as a hiring shortlist, a credit decision or an insurance claim, you need a qualified person who can change the answer, and the person affected must be told AI was involved. Here's how to check every use case in six steps, before the date.

This is for CIOs, AI Ops leads and risk or data protection teams at UK organisations of 1,000 to 10,000 people running Claude Team, Claude Enterprise or the Claude API.

What changes on 12 November

Anthropic published the update on 8 October and says most of it clarifies existing rules. The parts that matter for an enterprise:

• High-risk use cases, rewritten. The new policy lists 11 high-risk areas, what counts as a recommendation in each, and what's excluded. Anthropic says the requirements themselves haven't changed. The list just makes it easier to tell whether yours are covered.
• A new section on deceptive campaigns. It pulls together rules on fake accounts, fake reviews, hidden sponsorship and bots that claim to be human. It also covers seeding the sources search engines and AI systems draw on with content that hides who wrote it. Worth a look from marketing.
• Controls for physical actions. Where Claude drives hardware that could hurt someone, an operator must be able to stop it and the equipment must hold a safe state if the connection drops.
• Clearer surveillance rules. Tracking people without consent, emotion recognition and scoring people's trustworthiness without telling them are spelt out.
• Supported Regions. Access is barred for organisations majority-owned or controlled from an unsupported region. Groups with overseas parents should check.

The policy applies to everyone using Anthropic's products: the Claude apps, Claude Code, the API, and Claude through cloud providers and resellers. If Anthropic suspects a breach, it may warn, throttle, suspend or end access.

Step 1: List every use case, including the agents

You can't check what you can't see. Build one list from:

• Admin analytics and, on Enterprise, smart reports, which became generally available on 28 October and group a team's work into workstreams.
• Your shared skills, projects and connectors.
• Agents and API projects, including ones built by suppliers.
• A short question to each team lead: "What do you use Claude for that touches customers, staff or applicants?"

Record each use case in a sentence, with an owner and who it affects. If you log use cases in Kowalah's Accelerator library, this list already exists, and logging is free.

Step 2: Screen out anything prohibited

Most enterprise work passes in seconds. Look harder at three places:

• Marketing. Generated reviews, undisclosed sponsored content, or networks of sites posing as independent.
• HR and security. Tracking people's location, communications or activity without their consent, inferring emotions outside medical or safety reasons, or testing systems without the owner's authorisation.
• Customer service. Bots that claim to be human.

Anything that fails here stops. It isn't a controls question.

Step 3: Find the high-risk recommendations

Ask three questions of every use case that's left.

1. Is it about a specific person? Business operations that don't advise or decide about an individual are out of scope.
2. Is it in one of the 11 areas? Legal, medical, finance, credit, insurance, housing, employment, education and credentials, healthcare access, public benefits, and legal status and adjudication.
3. Is Claude's output the recommendation that's delivered or acted on? Or is it internal drafting, research or summarising that a qualified person turns into their own advice?

The employment area catches more than people expect. It covers screening, ranking or rejecting candidates, setting shifts, hours or pay, and evaluating a worker's performance, including discipline. Finance is narrower than it sounds: it means personalised investment advice or someone's own taxes, not your finance team's month-end close.

Step 4: Apply the exclusions honestly

The policy excludes:

• General information that isn't applied to someone's circumstances.
• Explaining a decision a qualified person has already made.
• Internal drafting, research, summarising or analysis that isn't the final recommendation.
• Carrying out a decision a person already made, or applying a fixed rule where the model exercises no judgement about the individual.
• Wholly favourable decisions, such as paying an insurance claim in full, where the law allows. A partial approval or one with conditions doesn't count.

The trap is the second-glance review. If a recruiter forwards Claude's top ten candidates without reading the rest, Claude's ranking is the recommendation that's acted on. Calling it a draft doesn't change that. When you're unsure, treat it as high-risk and ask legal.

Step 5: Put two controls on every high-risk use case

A qualified person in the loop. Someone with the training or experience to judge the output, and a licence where the law needs one. They must review it meaningfully, with authority to change it, before it reaches the person or drives the decision. They stay responsible for what's delivered.

Disclosure. The person receiving the advice, or the subject of the decision, must be clearly told AI was used. You don't have to name Anthropic, Claude or the model.

Two more rules apply whether or not a use case is high-risk:

• Customer-facing chatbots and agents must tell people they're talking to AI, at least at the start of each chat or in the interface.
• Agents are your responsibility. Anything an agent does through tools, browsers or connected systems must comply, so the same checks apply to what it can send, change or decide.

One professional services firm we spoke to set a simple rule: AI works behind the scenes, and the client experience stays human. Agents draft, and people check and send. That rule clears most of this step on its own.

Step 6: Record it, own it and recheck it

Write down the result for each use case: clear, controls needed or stop, with the evidence. Name the reviewer and the disclosure wording for every high-risk one. Give each an owner and a date to recheck.

Then close the loop:

• Update your employee AI policy so people know which uses need a reviewer. Our free AI policy template is a starting point.
• Recheck when a release adds a feature that reaches customers or staff. Our release review guide covers that habit.
• Ask legal to confirm group ownership against Anthropic's Supported Regions page if you have overseas shareholders.

Anthropic is clear that its rules sit alongside the law, not instead of it. UK GDPR already has rules on automated decisions about people, and regulated sectors have their own. Where local law asks for more, follow it.

Common questions

Does the 12 November update apply to Claude Enterprise?

Yes. It applies to anyone using Anthropic's products, including the Claude apps, Claude Code, the API, and access through cloud providers and resellers.

Did the human review rules change?

Anthropic says no. The requirement for a qualified human and disclosure stays the same. What's new is a clear list of which recommendations are covered and which are excluded.

Do we have to tell customers we use Claude?

You must tell people when AI was used to produce high-risk advice or a decision about them, and customer-facing chatbots must say they're AI. You don't have to name Claude or Anthropic.

Is using Claude to draft HR letters high-risk?

Drafting on its own is excluded. If Claude decides or recommends the outcome, such as who is disciplined or how a performance rating lands, it's employment and needs a qualified reviewer and disclosure.

Get the checklist

We've turned the six steps into a free Claude Usage Policy Check: one page per use case, with the screen, the high-risk test, the controls, a result and an owner. It's ungated and works without any platform.

Use cases that clear the check are often the ones worth scaling. Score them for impact, confidence and ease, and log the outcomes as they land. In Kowalah, logging opportunities and outcomes is free.

Kowalah is a UK Anthropic Implementation Specialist. If you'd like a second pair of eyes on your high-risk use cases before 12 November, talk to us.