Anthropic's revised Claude Usage Policy takes effect on 12 November 2026, and it applies well beyond Claude.ai. If your business builds on Claude — through the API, Claude Code, a cloud-provider integration, a reseller, or a product that embeds Claude — you must check your use cases, prompts, data flows and any autonomous actions before that date. The revision tightens surveillance, weapons, deceptive campaigns and high-stakes decisions, and adds a new rule on sustained abusive behaviour toward the models.

This guide explains what has changed in plain terms and gives you a checklist to complete before 12 November. It is a practical starting point, not legal advice — get a qualified adviser to review health, legal, finance, surveillance or safety-critical uses.

Anthropic's New Claude Rules Take Effect 12 November: A Business Checklist

What actually changes on 12 November 2026

Anthropic announced the revised Usage Policy on 8 October 2026, and it takes effect on 12 November 2026. It covers Claude.ai, Claude Code, API developers, cloud-provider integrations, resellers, and products that integrate Claude.

Much of the revision clarifies existing rules, but several changes are material: surveillance rewritten, weapons coverage explicit about software and drones, a consolidated deceptive-campaigns section, the blanket ban on personalised voter targeting removed, a new abusive-behaviour rule, and clearer human oversight for high-stakes and autonomous-hardware uses. Start by listing every place Claude appears in your stack, who can trigger it, what data it receives, what actions it can take, and whether a human reviews the result before it affects a person.

Surveillance: what is now clearly off limits

The rewritten surveillance section prohibits tracking people without their consent, whether real-time or built from past data. Claude cannot decide or recommend who to investigate, arrest or charge, and it cannot be used to build surveillance tools. Consent for the tracking itself is what matters, even if the underlying data was lawfully collected for another purpose.

Legitimate uses remain permitted: consented tracking, content moderation, journalism and legal research. If your product touches people-tracking, document the consent basis, purpose and limits — and if you cannot point to consent, stop and redesign before 12 November.

Questions to ask about any people-data feature

• Did each person consent to this specific tracking, or only to something else?
• Does Claude select or recommend individuals for investigation, enforcement or adverse action? If so, remove that step.
• Could a customer use your feature to build a surveillance tool? If yes, add technical or contractual limits.

Businesses building AI agents or AI calling agents should pay particular attention: an agent that records or profiles callers needs clear consent handling. The same applies to any custom software aggregating data about identifiable people.

Deceptive campaigns and elections: a consolidated ban, one notable easing

The new consolidated section, "Do Not Engage in Deceptive Campaigns or Artificial Activity", covers fake accounts, fabricated news sites, coordinated influence operations, obscuring who is behind a message, artificial amplification, and tools or infrastructure built for influence operations.

On elections, deceiving voters or interfering with electoral processes is still prohibited, but the previous blanket ban on personalised voter and campaign targeting has been removed. That easing is narrow — it does not permit deceptive content, impersonation or interference. For marketing teams, the lesson holds too: any SaaS product or e-commerce platform generating outreach, reviews or social content with Claude should show who is behind the message and that the content is genuine.

The new rule on abusive behaviour toward the models

Anthropic has added a rule prohibiting sustained and needless abusive or cruel behaviour toward the models. The limits matter as much as the rule: it applies to extreme cases only. Ordinary frustration, pushback, dark creative work, model testing and research are explicitly outside it. A developer stress-testing a model, a writer exploring dark fiction, or a user arguing with an answer is not the target.

Enforcement reflects that narrow scope: the primary enforcement is Claude ending the conversation, with warnings, limits, suspension or termination available behind the extreme-case threshold. Do not build products or test harnesses designed around sustained abuse, and do not worry that normal testing or candid feedback will trip the rule. Document red-teaming as testing, and make sure an assistant that ends a conversation does so gracefully — a polite close and a route to human support.

High-stakes uses and autonomous hardware: a human must stay in the loop

For high-stakes uses — health, legal rights, finances, livelihood, and access to essential services — the policy requires a qualified human in the loop. Claude can assist, draft, summarise and analyse, but a qualified person must oversee decisions materially affecting a person's health, rights, money, job or access to essential services. Fully automated decisions in those areas, with no meaningful human review, do not meet the bar.

The hardware rule is equally direct: where autonomous hardware is connected to Claude, a qualified operator must be able to stop the equipment, and it must hold a safe state if Claude is disconnected. These rules fit how responsible AI agent development should already work — agents propose, humans approve where stakes are high — and if your roadmap includes AI agents for small-business automation, build approval in from the start.

Your pre-12-November checklist

1. Audit use cases, prompts and data flows

Review each use case against the new rules, reading system prompts and common user prompts — not just the product description. Record the outcome per use case: compliant, needs a change, or must stop. Weapons coverage now explicitly includes weapons software and components, and arming drones or other autonomous vehicles, so defence-adjacent or robotics work needs a specific review.

2. Add human-approval gates and document consent

For outputs affecting health, legal rights, finances, livelihood or essential services, insert a qualified human approval step, defining who is qualified, what they see, and how approval is logged. For people-tracking features, record the consent basis, what was consented to, and how it can be withdrawn — if you cannot produce that record, treat the feature as unapproved. This supports related work such as AI training opt-out and data controls, and applies to restaurant ERP and CRM workflows alike.

3. Check autonomous actions and keep a fallback plan

List every action Claude can trigger without a human in between — messages, records, payments, bookings, equipment — and decide whether each needs a gate, a limit or a stop mechanism. Keep a provider-switching and fallback plan: an alternative model, a degraded mode without Claude, and a switching estimate. Model rules keep moving, as the Gemini 4 Carbon cybersecurity coverage shows, so a fallback is architecture — and teams planning custom software or SaaS on Claude should treat it as such.

4. Update contracts, prompts and customer guidance

Update your terms, acceptable-use guidance and customer documentation, add prompt-level guardrails, and brief support staff on responding if Claude ends a conversation or a feature is limited. The policy applies regardless of location, so teams in the United Kingdom, UAE, USA and Pakistan all face the same 12 November date. When in doubt, contact Coheser for a review before the deadline.

Frequently asked questions

Does the new policy apply if we use Claude through a cloud provider or reseller?

Yes. It applies to Claude.ai, Claude Code, API developers, cloud-provider integrations, resellers, and products that integrate Claude. Using an intermediary does not remove the obligations.

Can we still use Claude for content moderation, journalism or legal research?

Yes. Consented tracking, content moderation, journalism and legal research remain permitted. The ban targets tracking without consent, deciding who to investigate or charge, and building surveillance tools.

Will normal testing or frustrated users trigger the abusive-behaviour rule?

No. Ordinary frustration, pushback, dark creative work, model testing and research are explicitly outside the rule, which covers sustained and needless abusive or cruel behaviour in extreme cases only.

What is the single most important change to make before 12 November?

Complete the use-case audit and add human-approval gates for high-stakes decisions. That addresses the largest share of the new requirements and leaves documentation you can show customers and auditors. For background, see the analysis of Anthropic's acceptable use policy updates and the 1 November 2026 AI news round-up.