What are the institutional and regulatory implications of this document?

1. REGULATORY LANDSCAPE: The system card engages with the EU AI Act's provisions for general-purpose AI models with systemic risk, which impose transparency, evaluation, and incident reporting obligations on providers. The FTC's guidance on AI accountability and unfair or deceptive practices is also implicated by Anthropic's safety claims and capability disclosures. The document's disclosure of red-teaming and third-party evaluation methodologies aligns with emerging expectations under the US E…

How does Anthropic's Claude Sonnet 5 System Card affect users?

The system card establishes that certain model behaviors are fixed regardless of operator or user instructions, meaning users cannot prompt Claude Sonnet 4.5 to perform actions in hardcoded refusal categories such as assisting with weapons of mass destruction or generating CSAM. Under these terms, operators who access Claude via Anthropic's API are responsible for deploying the model within Anthropic's published usage policies, and downstream users operate under both Anthropic's and the operato…

How often is Anthropic's Claude Sonnet 5 System Card updated?

ConductAtlas monitors this document daily and captures every version with cryptographic hashing and timestamp verification. Update frequency varies — see the change timeline on this page for complete version history.

Can I get alerted when Anthropic updates this document?

Yes. Monitor subscribers ($19/month) can add Anthropic to their watchlist and receive same-day email alerts whenever this document or any other Anthropic document changes.

CA-D-000921

Claude Sonnet 5 System Card

Anthropic

Last change detected July 7, 2026 System card

SHA-256: 6efa3d43fd9618f4be7… 2 versions captured 0 changes documented

Create free account

Track 3 platforms and get the weekly governance digest. No credit card required.

View original document at Anthropic ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

7 Total

2 High severity

5 Medium severity

0 Low severity

Summary

This is Anthropic's system card for Claude Sonnet 4.5, a technical disclosure document describing how the model is built, evaluated, and constrained. The document states that certain behaviors are hardcoded and cannot be unlocked by operators or users, including refusal to generate content that provides serious uplift toward weapons capable of mass casualties or sexual content involving minors. The document also discloses that Claude Sonnet 4.5 has been evaluated for agentic and multi-agent task risks, and that residual safety risks remain, particularly in adversarial prompting scenarios.

Technical / Legal Breakdown

This document is the Claude Sonnet 4.5 (Claude Sonnet 5) System Card published by Anthropic, governing the design, evaluation, safety posture, and known limitations of a specific large language model release. The system card states that Claude Sonnet 4.5 is trained to balance capability and safety through a layered framework of hardcoded and softcoded behaviors, with the document asserting that certain absolute restrictions (such as refusal to assist with weapons of mass destruction or CSAM) cannot be overridden by any operator or user instruction. Notable provisions include the model's agentic use guidelines, which establish that Claude is designed to apply particular caution in multi-step autonomous tasks where actions may be difficult to reverse, and the document discloses evaluations for catastrophic risk categories including CBRN uplift and cyberweapon development. The document engages with the EU AI Act's high-risk and general-purpose AI provider requirements, the FTC's AI accountability guidance, and emerging frameworks for frontier AI safety governance, with applicability of specific compliance obligations depending on deployment jurisdiction, operator classification, and use-case context. Material compliance considerations include third-party operator reliance on Anthropic's usage policies, the allocation of safety responsibility between Anthropic and API operators, and the model's disclosed residual risks in jailbreak resistance and agentic task execution.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Get Compliance

High — 2 provisions

Agentic Task Minimal Footprint Principle

The document states that Claude is designed to request only necessary permissions, avoid storing sensitive information beyond immediate needs, prefer reversible actions, and err on the side of pausing and confirming with users when uncertain about intended scope in autonomous task execution.

Added July 6, 2026 Rare
Multi-Agent Trust and Prompt Injection Risk

The document discloses that in multi-agent deployments where Claude acts as a subagent receiving instructions from an orchestrating system, it cannot verify the identity or integrity of the orchestrator and must apply its safety standards regardless, and that Claude should be vigilant about prompt injection attacks from external content.

Added July 6, 2026 Rare

Medium — 5 provisions

Hardcoded Absolute Refusal Behaviors

The document establishes a category of model behaviors that cannot be unlocked or modified by any operator or user instruction, including refusal to assist with weapons capable of mass casualties and refusal to generate sexual content involving minors.

Added July 6, 2026 Rare
Operator and User Softcoded Permission Hierarchy

The document establishes a layered permission system in which Anthropic sets the outer bounds, operators can expand or restrict default behaviors within those bounds, and users can further adjust within the scope operators permit.

Added July 6, 2026 Rare
Responsible Scaling Policy and Safety Level Thresholds

The document states that Anthropic evaluates models against defined capability thresholds before training or deploying them, and that Claude Sonnet 4.5 has been assessed against these thresholds as part of its release process.

Added July 6, 2026 Rare
CBRN and Cyberweapon Uplift Evaluation Disclosure

The document discloses that Claude Sonnet 4.5 was evaluated for its potential to provide meaningful assistance in creating weapons capable of mass casualties or attacking critical infrastructure, and that these evaluations informed the model's hardcoded refusal behaviors.

Added July 6, 2026 Rare
Residual Safety Risks and Jailbreak Acknowledgment

The document discloses that Claude Sonnet 4.5 retains residual safety risks, including susceptibility to adversarial prompting and jailbreak techniques, and that the hardcoded and softcoded safety behaviors may not be fully reliable in all adversarial contexts.

Added July 6, 2026 Rare