Claude Usage Policy Check

To use this checklist, copy it with the "Copy page" button above or open the Google Doc version. Read the companion guide, How to check your Claude use cases against Anthropic's 12 November Usage Policy, for the thinking behind it.

Claude usage policy check

A free checklist for AI Ops leads, CIOs and risk or data protection teams. Use one copy per Claude use case, agent or integration to check it against Anthropic's Usage Policy, effective 12 November 2026. It works on its own; you don't need any platform to use it.

0. Review details

• ☐ Organisation and team:
• ☐ Reviewer:
• ☐ Date of review:
• ☐ Policy version checked (effective date shown on anthropic.com/legal/aup):

1. The use case

• ☐ Use case, in one sentence:
• ☐ Where it runs (Claude chat, Cowork, Claude Code, a project or skill, an agent, the API, a supplier's product):
• ☐ Business owner:
• ☐ Who it affects (staff, customers, applicants, suppliers, the public):
• ☐ Systems it reads from:
• ☐ Systems it writes to, sends from or acts on:
• ☐ Is Claude's output seen by anyone outside the organisation? Yes / No

2. Universal standards screen

Tick any that apply. If any box is ticked, the result is Stop and the use case needs redesigning or retiring.

• ☐ Creates fake reviews, personas or accounts, or bots that claim to be human
• ☐ Hides who sponsored content meant to influence opinion or decision-makers
• ☐ Seeds websites or sources that search engines and AI systems draw on, while hiding who wrote them
• ☐ Tracks a person's location, communications, activity or associations without their consent
• ☐ Infers people's emotions, other than for medical or safety reasons
• ☐ Scores people's trustworthiness or social behaviour without telling them or getting consent
• ☐ Makes or suggests decisions in law enforcement or criminal justice
• ☐ Tests or accesses systems without the owner's authorisation
• ☐ Anything else in the Universal Usage Standards (check the full list):

3. High-risk test

Answer in order. A No at any question means the use case is not a High-risk AI Recommendation; go to section 5.

• ☐ Q1. Does it advise on, or decide about, a specific individual? Yes / No
• ☐ Q2. Which high-risk area applies? Legal / Medical / Finance (personal investments or someone's own taxes) / Credit / Insurance / Housing / Employment / Education and credentials / Healthcare access / Public benefits and services / Legal status and adjudication / None
• ☐ Q3. Is Claude's output the recommendation that's delivered to the person or used to make the decision? Yes / No
• ☐ Exclusion that applies, if any: general information / explaining a decision already made / internal drafting or analysis that isn't the final recommendation / carrying out a decision already made or applying a fixed rule with no judgement / business operations not about an individual / none
• ☐ Is the decision wholly favourable to the person (for example, paying a claim in full) and does the law allow skipping review? Yes / No. A partial approval or one with conditions is not wholly favourable.
• ☐ Result of the high-risk test: High-risk / Not high-risk
• ☐ Reasoning, in one or two sentences:

4. Controls for high-risk use cases

• ☐ Qualified reviewer (name or role):
• ☐ Their training, experience or licence for this field:
• ☐ They review before the output reaches the person or drives the decision
• ☐ They have authority to change the output, and use it (how you know the review is meaningful, not a rubber stamp):
• ☐ Disclosure wording the person sees (you don't have to name Anthropic or Claude):
• ☐ Where and when the disclosure appears:
• ☐ Evidence kept (review log, sample of changed outputs, screenshot of the disclosure):

5. Rules that apply to every use case

• ☐ Customer-facing chatbot or agent: tells people they're talking to AI at the start of each chat or in the interface
• ☐ Agent actions: everything the agent can send, change or decide through tools, browsers or connected systems has been checked against sections 2 to 4
• ☐ Products serving under-18s: Anthropic's extra guidance has been checked
• ☐ Physical actions: if Claude controls hardware that could injure someone, a qualified operator can observe and stop it, the equipment holds a safe state if the connection drops, and safety limits are enforced outside the model
• ☐ Local law: UK GDPR rules on automated decisions and any sector rules have been checked with your DPO or legal team

6. Supported Regions

• ☐ The organisation is not incorporated or headquartered in an unsupported region
• ☐ The organisation is not majority-owned or controlled from an unsupported region (confirm with legal for groups with overseas shareholders)
• ☐ Nobody using this use case is located in an unsupported region

7. Result and actions

• ☐ Result: Clear / Controls needed / Disclose / Stop
• ☐ Actions needed before 12 November 2026:
• ☐ Action owner:
• ☐ Due date:
• ☐ Sign-off (business owner):
• ☐ Sign-off (risk, legal or DPO, for high-risk use cases):
• ☐ Next review date, or the trigger for one (new feature switched on, new data source, new audience):

8. Opportunities: scale what clears, with ICE scores

Use cases that clear the check are candidates to scale. Score each from 1 to 10 for Impact, Confidence and Ease, then multiply or average. Scale the highest first and record the outcome against a baseline.

• ☐ Opportunity:
• ☐ Impact (1 to 10):
• ☐ Confidence (1 to 10):
• ☐ Ease (1 to 10):
• ☐ ICE score:
• ☐ Outcome it should deliver (for example, hours saved a month, cycle time, error rate), and today's baseline:

Implementation notes

• This is a planning tool, not legal advice. Agree high-risk decisions with your legal, risk and data protection teams.
• Check the current Usage Policy at anthropic.com/legal/aup before each review. Anthropic updates it.
• Keep each completed check with the use case record, so the next review starts from evidence.