Anthropic's 2026 Usage Policy Takes Effect November 12: What Agent Builders Should Check
Anthropic's updated Usage Policy takes effect on November 12, 2026. Here are the four changes that matter most for Claude-powered agents, and a checklist to review your app before the deadline.
Anthropic's updated Usage Policy takes effect on November 12, 2026. It was announced on October 8, and most of it clarifies existing rules rather than adding new bans. For agent builders, four areas deserve a close look: deceptive campaigns, surveillance and law enforcement, high-risk recommendations that need human review, and agents connected to physical equipment. If your Claude-powered app touches any of these, review it against the checklist below before the effective date.
System requirements
Who should read this
Anyone shipping an app or agent built on Claude
The policy applies whether you call the Claude API directly, go through a cloud platform, or build on Claude Code and the Agent SDK.
Effective date
November 12, 2026
Anthropic announced the update on October 8, 2026. The revised policy replaces the current one on the effective date.
What to have ready
A list of every agent, its tools, and who it affects
Our recommendation, not an Anthropic requirement. The review below is much faster when you already know what each agent can read, change, and decide.
What this article is not
Legal advice or a full summary
It covers the changes most relevant to agent builders. Read the full policy and check the laws that apply to your product.
Deceptive campaigns: is your automation honest about who is behind it?
Restrictions on deceptive activity now live in one dedicated section, covering political and commercial campaigns alike.
The new section, Do Not Engage in Deceptive Campaigns or Artificial Activity, pulls together rules that used to be spread across the elections, fraud, privacy, and disinformation sections. It covers fake personas, accounts, media outlets, or organizations, hiding who is behind a message, and amplifying content so it looks more independent or widely supported than it is.
Automation itself is not the problem. A publishing agent that posts on your company's behalf, clearly as your company, is fine. An agent that spins up personas to make one opinion look like many is not.
What to check: your agent does not create fake identities to mislead people. Your automated publishing and social media workflows do not fake grassroots support. AI-generated messages do not misrepresent their source or sponsor.
Tip
The elections section was also renamed Do Not Undermine Democratic Processes and narrowed to deceiving voters or disrupting elections. Targeting that relies on deception or misused personal data is still prohibited under other sections.
Surveillance: does your agent track people or feed law enforcement decisions?
Tracking people without consent and building surveillance tools are prohibited, and so is recommending law enforcement decisions.
The rewritten section prohibits targeting or tracking a person or their property without consent, whether in real time or by analyzing data collected earlier. It also prohibits using Claude to build or improve surveillance tools. In Anthropic's words, Claude cannot be used to decide or recommend who to investigate, arrest, or charge.
The policy names permitted uses, each on the condition that it is not used for the prohibited purposes: consented monitoring such as fraud detection or anti-money laundering screening, content moderation, journalism, legal research and analysis by law enforcement agencies or courts, aggregated or anonymized analysis, and authorized security research.
What to check: personal data is collected and processed with proper authorization and consent. Your agent does not track individuals or join datasets in ways that build a profile of a person without consent. Monitoring features stay inside a permitted purpose and the law that applies to you.
High-risk recommendations: is the human review real?
Where a recommendation affects someone's rights or livelihood, a qualified person must meaningfully review it and the person affected must be told AI was used.
The core requirement is not new, but the policy now spells out which recommendations are covered. It lists high-risk areas including legal, medical, finance, credit, insurance, housing, employment, education and credentials, healthcare access, public benefits, and legal status.
Where it applies, a qualified person must meaningfully review the AI recommendation, have the authority to change it, and stay accountable for it. The individual affected must be clearly told that AI was used to produce it.
What to check: find every place your agent produces a recommendation that could affect someone's rights, money, job, or access to services. Make sure qualified review happens before that recommendation is delivered or acted on. Disclose AI involvement to the person affected. Never treat an AI answer as an automatically approved decision.
Tip
An Approve button is not meaningful review if the reviewer cannot see the reasoning and inputs, lacks the expertise to judge them, or has no practical way to change the outcome.
Physical systems: can a person stop the equipment without the model?
New requirements apply when model output controls hardware that could injure someone.
As agents start driving robots, vehicles, and industrial equipment, the policy sets three requirements for equipment that could cause injury. A qualified individual must be able to observe the equipment and stop it at any time. The equipment must stop or hold a safe state if that person intervenes or the connection to Anthropic's services is lost. Safety limits must be enforced by the equipment or a controller independent of model output.
The weapons section was also clarified. It now explicitly covers the software and components that make weapons work, including arming drones and other autonomous vehicles. Anthropic says this reflects how it already enforced the policy.
What to check: safety-critical limits live outside the model's control. There is an emergency stop that works even when the agent is misbehaving. You have defined what the hardware does when the connection drops. You have tested those failure scenarios before deployment.
Tip
The model should never be the only thing standing between a person and a malfunctioning machine.
What else changed in the 2026 Usage Policy?
- Abusive behavior toward the models: a new prohibition covers sustained and needless abusive or cruel behavior, in extreme cases only. Frustration, pushback, dark creative themes, and testing or research are excluded.
- Supported regions: enforcement now explicitly covers people located in unsupported regions and entities incorporated, headquartered, or majority-controlled there.
- New examples: the policy adds examples for longer, more independent agent work and for misuse patterns seen in influence operations, weapons development, and surveillance.
Which parts of the policy apply to your agent?
Start from what your agent does, not from the policy's table of contents. Each capability below points to the section you need to read closely.
Checklist: what should agent builders review before November 12?
This is a starting point. It does not replace reading the full policy or checking the laws that apply to you.
- Use case: document what each agent does and who it may affect.
- Tools and permissions: limit each agent to the tools, data, and actions it needs.
- Privacy: check consent, authorization, and how personal data is handled.
- Automation: review publishing, messaging, and multi-agent workflows for deceptive behavior.
- High-risk decisions: mark where qualified human review and AI disclosure are required.
- Physical actions: verify a person can observe and stop the equipment, independent safety limits, and safe failure on disconnect.
- Testing: test edge cases, failure scenarios, and misuse paths, not only the happy path.
- Policy review: read the full Usage Policy and note every section that applies to your app.
Related: sandboxing is one layer, not the whole plan
Several of these checks come down to limiting what an agent can reach. Our guide to GitHub Copilot's local sandbox, linked in the sources below, shows how a sandbox restricts an AI coding agent's files, network, and credentials, and why it should be only one layer of your security.
Most teams will not need to change much, but every team should check. Start by mapping each agent's capabilities to its real-world impact, then read the policy sections that match. If your agent makes consequential recommendations or moves hardware, treat human review and independent stop controls as engineering work with tests, not a line in your terms of service. Document what you changed before November 12.
Frequently asked questions
When does Anthropic's 2026 Usage Policy take effect?+
November 12, 2026. Anthropic announced the update on October 8, 2026.
Does the update ban things that were allowed before?+
Mostly no. Anthropic describes most changes as clarifications of existing rules. The clearly new pieces are the requirements for hardware that takes physical actions and the prohibition on extreme abusive behavior toward the models. The ban on personalized election targeting was removed, though deceptive targeting is still prohibited.
Can I still build a social media or marketing agent with Claude?+
Yes. Automated publishing is allowed. What is prohibited is deception: fake personas or accounts, hiding who is behind a message, and making content look more independent or widely supported than it is.
Does my agent need a human in the loop?+
Only for covered high-risk recommendations, in areas such as legal, medical, finance, credit, insurance, housing, employment, education, healthcare access, public benefits, and legal status. There, a qualified person must meaningfully review and be able to change the recommendation, and the affected person must be told AI was used.
Can Claude control a robot or vehicle?+
It can, with safeguards, as long as the use is otherwise permitted. For equipment that could cause injury, a qualified person must be able to observe and stop it at any time, it must stop or hold a safe state if they intervene or the connection is lost, and safety limits must be enforced independently of model output.
