You may not attempt to reverse engineer Mistral AI's models, use outputs to reconstruct how the AI works, or conduct security testing on the platform without authorization.
This analysis describes what Mistral AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The prohibition on security and penetration testing is notable for enterprise customers who have standard security due diligence requirements, as independent security assessments of the platform are prohibited without Mistral AI's authorization under these terms.
The updated terms redefine when Mistral AI will use customer data and outputs for AI model training. Previously, the terms distinguished between free tiers (where training was opt-out) and Labs Models (where training always occurred). The revised language consolidates experimental models as 'Labs or Preview Models' and explicitly states that training opt-out preferences applied to other products do not carry over to these experimental models. Additionally, the terms now specify that customer data includes 'access to data' and 'coding environment,' expanding what qualifies as trainable material. The liability cap was narrowed to remove the carve-out protecting confidentiality breach claims, meaning liability limits apply more broadly. You can review which Mistral products are set to opt-in versus opt-out by default and avoid Labs or Preview Models if you do not want your data used for training.
View change record →Commercial customers are prohibited from independently testing the security of Mistral AI's platform or using AI outputs to reconstruct the underlying model, which may limit the security due diligence options available to organizations with formal vendor security assessment requirements.
How other platforms handle this
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Microsoft reserves the right to restrict the export of data that may compromise the security of the services or Microsoft's intellectual property.
Datadog reserves the right, but does not assume the obligation, to investigate any violation of these Terms or misuse of the Site.
"Customer will not, and will not permit any other person (including any End User) to: ... (d) attempt to reverse engineer, decompile, or otherwise attempt to discover the source code or underlying components (e.g., algorithms, weights, or systems) of the Mistral AI Products, including using the Output or any modified version of the Output to do any of the foregoing (except to the extent this restriction is prohibited by applicable law); (e) use the Output or any modified version of the Output to reverse engineer the Mistral AI Products; (f) compromise or attempt to compromise the security or proper functionality of the Mistral AI Products, including interfering with, circumventing, or bypassing security or moderation mechanisms in the Mistral AI Products or performing any vulnerability, penetration, or similar testing of the Mistral AI Products.Excerpt from Mistral AI's Commercial Terms
(1) REGULATORY LANDSCAPE: The prohibition on reverse engineering includes a statutory carve-out acknowledging that applicable law may override this restriction in certain jurisdictions (notably EU Directive 2009/24/EC on software interoperability allows some reverse engineering).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Buried in Robinhood's customer agreement is broad authority to close your positions, suspend your account, and force arbitration. Here is what it actually says.
Stripe's terms authorize fund reserves, payout withholding, and account termination. Here is what the agreement states and what business owners should review.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The prohibition on security and penetration testing is notable for enterprise customers who have standard security due diligence requirements, as independent security assessments of the platform are prohibited without Mistral AI's authorization under these terms.
Commercial customers are prohibited from independently testing the security of Mistral AI's platform or using AI outputs to reconstruct the underlying model, which may limit the security due diligence options available to organizations with formal vendor security assessment requirements.
ConductAtlas has identified this type of provision across 263 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Mistral AI.