Businesses using Mistral AI are subject to a layered set of agreements including general commercial terms, additional product-specific terms, deployment-specific terms, and a data processing addendum governing how Mistral handles data on their behalf.
This analysis describes what Mistral AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Commercial customers must comply with multiple overlapping agreements, and the Data Processing Addendum is particularly significant for GDPR compliance, as it governs Mistral's obligations as a data processor for business clients.
Interpretive note: The substantive obligations in each commercial document are not reproduced in this index page; analysis depends on the content of the linked instruments.
This provision primarily affects businesses rather than individual consumers, but it indirectly affects consumers who interact with applications built on Mistral's API, as those applications are governed by this commercial framework including data processing terms.
How other platforms handle this
We will share individual user information with companies, organizations or individuals outside of Google if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to: meet any applicable law, regulation, legal process or enforceable govern...
We may share your personal information with our affiliates, meaning entities that control, are controlled by, or are under common control with Consensys. We also share information with service providers who assist in operating our services, subject to confidentiality obligations.
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
Monitoring
Mistral AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you're a commercial customer: Commercial Terms of Service | Additional Terms | Partner-Served deployment terms | Data Processing Addendum— Excerpt from Mistral AI's Mistral Terms of Use
(1) REGULATORY LANDSCAPE: The Data Processing Addendum directly engages GDPR Article 28, which requires a written data processing agreement between controllers and processors. The EU AI Act may also apply depending on the risk classification of the AI systems deployed by commercial customers. The CNIL and other EU supervisory authorities are the primary enforcement bodies. The FTC Act applies to US-based commercial customers. (2) GOVERNANCE EXPOSURE: High. The existence of both a general Commercial Terms of Service and Additional Product Terms, combined with separate Partner-Served Deployment Terms and a Data Processing Addendum, creates a complex contractual hierarchy. Compliance teams must ensure their internal policies align with all applicable layers, and that the DPA is appropriately scoped to cover all personal data processed through Mistral's services. (3) JURISDICTION FLAGS: EU and EEA commercial customers face the highest compliance exposure due to GDPR Article 28 requirements for data processor agreements. California-based businesses may also need to assess CCPA service provider obligations. Organizations in regulated industries such as healthcare or financial services face additional sector-specific requirements that the commercial terms may not fully address. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should verify that the Data Processing Addendum contains the required GDPR Article 28 elements including processing scope, data subject categories, security measures, subprocessor notification, and audit rights. The existence of Partner-Served Deployment Terms suggests that deployments through third-party partners may involve additional contractual parties whose obligations must be mapped. (5) COMPLIANCE CONSIDERATIONS: Legal teams should conduct a full review of all four commercial customer documents to identify any provisions that shift liability to the customer, limit Mistral's obligations, or require the customer to implement specific technical or organizational measures. The DPA should be compared against internal data processing records and GDPR Article 30 documentation.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Commercial customers must comply with multiple overlapping agreements, and the Data Processing Addendum is particularly significant for GDPR compliance, as it governs Mistral's obligations as a data processor for business clients.
This provision primarily affects businesses rather than individual consumers, but it indirectly affects consumers who interact with applications built on Mistral's API, as those applications are governed by this commercial framework including data processing terms.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Mistral AI.