AI Model Compliance Comparison (2026)

This AI model compliance comparison shows how the major AI models handle the rules that regulated businesses care about. We track HIPAA, GDPR, SOC 2, ISO 42001, and data residency for Claude, ChatGPT, and Gemini. We update this page each time a new frontier model ships.

Here is the key point most buyers miss. A model is rarely "compliant" or "not compliant" on its own. Compliance depends on the plan you buy, the contract you sign, and the settings you turn on. The same model can be safe on one tier and unsafe on another.

Use this guide to match an AI model to your industry and your risk. We explain where a Business Associate Agreement (BAA) is available, which certifications each vendor holds, and where the common gaps are. Every claim links to the vendor's own documentation.

AI Model Compliance at a Glance (2026)

All three major vendors now offer enterprise compliance coverage. Each one can sign a BAA for HIPAA, holds SOC 2, and supports GDPR through a Data Processing Addendum. The differences show up in the details: which plans are covered, which certifications are held, and how data residency works.

One rule applies to every model. Consumer plans are almost never covered. You need a business, enterprise, or API tier, plus a signed agreement, before you put regulated data into any of these tools.

• Claude (Anthropic): BAA available on the first-party API and HIPAA-ready Enterprise. Holds SOC 2 Type I & II, ISO 27001:2022, and ISO 42001:2023. Zero-Data-Retention addendum available.
• ChatGPT / GPT (OpenAI): BAA available on the API, ChatGPT Enterprise, Business, and ChatGPT for Healthcare. Holds SOC 2 Type 2, ISO 27001:2022, and ISO 27701:2019. Data residency in 11+ regions.
• Gemini (Google): BAA available through Vertex AI and covered Workspace SKUs. Holds SOC 1/2/3, ISO 42001, HITRUST, FedRAMP High, and PCI DSS v4.0. Full regional data residency on Google Cloud.
• Every vendor excludes free and basic consumer plans from BAA coverage.
• Certifications cover the platform, not just one model. A new model on a covered API usually inherits that coverage.

Is Claude Compliant? (HIPAA, SOC 2, ISO 42001)

Claude can support regulated work, but only on the right surface. Anthropic offers a BAA for HIPAA-ready services, which include the first-party API and HIPAA-ready Enterprise plans. An administrator must turn on HIPAA settings and sign the BAA first.

The BAA does not cover Claude Free, Pro, Max, or Team. It also excludes the Workbench, the Console, Cowork, and beta features. Putting patient data into those surfaces gives you no BAA protection.

On certifications, Anthropic is strong. It holds SOC 2 Type I and Type II, ISO 27001:2022, and ISO/IEC 42001:2023 for AI management systems. Enterprise customers can add a Zero-Data-Retention addendum so no conversation data is stored after a session.

Is ChatGPT Compliant? (HIPAA, SOC 2, GDPR)

OpenAI signs BAAs to support HIPAA compliance. Coverage applies to the API, ChatGPT Enterprise, ChatGPT Business, and ChatGPT for Healthcare. Consumer tiers — Free, Plus, Pro, and Team — are not eligible, so they offer zero BAA protection for patient data.

OpenAI holds a SOC 2 Type 2 report covering security, availability, confidentiality, and privacy. It also holds ISO 27001:2022 and ISO 27701:2019. For GDPR, OpenAI signs a Data Processing Addendum with business and API customers.

Data residency is a strength. Eligible customers can store content at rest in the US, Europe, UK, Japan, Canada, South Korea, Singapore, Australia, India, and the UAE. Enterprise and API data is not used to train models by default.

Is Gemini Compliant? (HIPAA, FedRAMP, PCI DSS)

Gemini has the broadest certification list of the three. Through Vertex AI and Google Cloud, it covers SOC 1/2/3, ISO 27001/27017/27018/27701, ISO 42001, HITRUST, FedRAMP High, and PCI DSS v4.0. That FedRAMP High coverage matters for government and public-sector work.

A BAA is available, but Gemini is not HIPAA compliant by default. You need the right surface — Vertex AI on Google Cloud or a covered Workspace SKU — plus a signed Google BAA and controls that keep PHI off unsupported surfaces.

Data residency runs through Google Cloud regions. Vertex AI offers EU regions, but you pin the region per call, not per project. A data protection review should specify and verify region pinning.

What the Latest Model Release Changes

New models usually inherit their vendor's existing compliance coverage. When a model ships on a covered API or enterprise plan, the same BAA, SOC 2, and ISO certifications apply. The contract and settings still matter more than the model name. But mid-2026 added a new wrinkle: the most capable frontier models now ship with access limits and retention rules that a compliance review has to check separately.

Anthropic's Claude Fable 5 is the clearest example. Released June 9, 2026, it runs on the same Anthropic API and Enterprise surfaces, so the SOC 2, ISO 27001, and ISO 42001 coverage carry over, and it adds hard safety limits that fall back to Claude Opus 4.8 on high-risk cyber and bio requests. US export controls suspended it on June 12; after the Commerce Department cleared Anthropic's safeguards, Fable 5 returned to general availability worldwide on July 1, 2026 across the Claude Platform, Claude.ai, Claude Code, and Cowork, with AWS Bedrock, Google Cloud, and Microsoft Foundry re-enabling in stages. One catch for regulated teams: as a "Mythos-class" model, Fable 5 carries a mandatory 30-day safety retention on business accounts (data used only for safety, then deleted), so full zero-retention is not available on it.

Two other frontier releases landed with tighter access. Claude Mythos 5 — the same base model with safeguards lifted for vetted defenders — is not generally available; it ships only through Anthropic's restricted Project Glasswing program, so its standard Enterprise BAA and zero-retention terms do not automatically apply. OpenAI's GPT-5.6 (the Sol, Terra, and Luna tiers, announced June 26, 2026) launched as a limited preview to a small set of vetted organizations at the US government's request, with general availability planned "in the coming weeks." For both, confirm the model is actually in scope for your BAA and retention settings before you send it regulated data — a limited-preview or restricted-access model may not yet sit on the compliant surface you assume.

Which AI Model Is Right for Your Regulated Industry

The best model depends on your rules, not just raw performance. Healthcare teams need a signed BAA and tight PHI controls. Financial and legal teams care most about data residency, retention, and audit logs.

Match the surface to the risk. For the strictest needs, pick an API or enterprise tier with Zero-Data-Retention and region pinning. For lighter use, a covered business plan with a DPA is often enough.

• Healthcare and medical practices: any of the three works with a signed BAA on a covered tier. Confirm PHI stays on supported surfaces.
• Banking and financial services: prioritize data residency, SOC 2, and audit logs. Gemini adds PCI DSS v4.0 and FedRAMP High.
• Legal and professional services: prioritize Zero-Data-Retention and no-training defaults to protect privileged data.
• Government and public sector: Gemini's FedRAMP High coverage is often the deciding factor.

Industry-Specific AI Compliance Guides

Every regulated industry layers its own rules on top of the vendor-level BAA and DPA coverage above. This page compares the models; the guides below cover the industry-specific controls, named regulations, and workflow guardrails you need on top of that.

Use these when you need the compliance detail specific to your sector, not just the model-level certifications.

• Healthcare and medical practices: see AI for Medical Practices for HIPAA BAAs, PHI safeguards, breach-notification steps, and patient-consent handling.
• Law firms: see AI for Law Firms for attorney-client privilege, ABA Formal Opinion 512, outside counsel guidelines, and confidentiality/data-isolation requirements.
• Banks and credit unions: see AI in Banking for SR 11-7 model-risk management, BSA/AML, and fair-lending controls, or AI for Credit Unions for NCUA examiner expectations.
• Credit rating agencies: see AI Compliance for Credit Rating Agencies for NRSRO-specific rules under SEC Rules 17g-2, 17g-4, and 17g-5, plus MNPI and information-barrier controls.

How to Deploy AI Compliantly: A Quick Checklist

Compliance is a setup task, not a single purchase. Follow these steps before you send any regulated data to an AI model.

• Pick a covered tier: API, enterprise, or business — never a free or consumer plan.
• Sign the vendor's BAA (for HIPAA) or DPA (for GDPR) before processing real data.
• Turn on the compliance settings, such as HIPAA mode or Zero-Data-Retention.
• Pin your data residency region if you operate under GDPR or local rules.
• Confirm the specific model is in scope for your agreement.
• Keep audit logs and limit access to staff who need it.
• Review beta features carefully — they are often excluded from BAA coverage.