Usage Policy and Acceptable Use

Anthropic's Usage Policy sets the boundaries for what anyone may do with Claude. Most business use sits comfortably inside it, but the exam expects you to know the shape of the boundaries, to recognise the categories of use that carry extra obligations, and to understand that the Usage Policy and your employer's acceptable-use rules both apply at once. The policy itself is published and updated by Anthropic; read the current version rather than relying on this summary for specifics.

Structure of the policy

The Usage Policy has three broad components.

Universal prohibitions. Uses that are never permitted regardless of plan or purpose. These include creating or facilitating serious harm (weapons, attacks on critical infrastructure, malicious code), child safety violations, generating content designed to deceive at scale (fraud, disinformation, impersonation), harassment and abuse, undermining democratic processes, and violating others' privacy or legal rights. A business user is unlikely to approach these deliberately, but careless framing can: "write a review of our product as if from a customer" is a request to fabricate a testimonial, which is deceptive.

High-risk use requirements. Certain domains are permitted but carry extra obligations because errors can cause significant harm to people. These typically include legal, healthcare, financial and insurance services, employment and housing decisions, and other consequential decisions about individuals. In these domains the policy expects human-in-the-loop review by a qualified person before output affects someone, and disclosure to affected people that AI is involved. Automated decision-making about individuals without human oversight is the classic violation.

Platform and account rules. Minimum age requirements for Claude.ai, prohibitions on circumventing safety features, on sharing accounts, on scraping, and on using the service to build competing models. There are also rules about bots and disclosure when Claude's output is presented to people who may not realise they are interacting with an AI.

Where business users most often brush against it

• Hiring and HR. Screening CVs or drafting performance assessments with Claude is permitted as assistance; letting Claude's ranking decide who is rejected, with no human review, is not.
• Finance and insurance. Drafting explanations is fine; producing individualised financial advice or eligibility decisions delivered to customers without qualified review is a high-risk use.
• Customer-facing automation. Any system where customers talk to Claude needs disclosure that it is an AI and a route to a human.
• Marketing. Fabricated reviews, fake personas, undisclosed synthetic endorsements and deceptive advertising claims are prohibited.
• Research on people. Compiling profiles of individuals from scattered sources raises privacy issues even when each source is public.
• Security work. Testing your own systems is permitted; producing attack tooling or targeting systems you do not own is not.

Your organisation's rules apply too

The Usage Policy is a floor, not a ceiling. Your employer's acceptable-use policy, data classification scheme, regulatory obligations and professional codes sit on top of it. Something permitted by Anthropic may still be forbidden at work (uploading client data to a personal account, for instance), and something your manager asks for may be prohibited by Anthropic (fabricating testimonials). When the two conflict, the stricter rule governs, and the right move is to raise it rather than to comply quietly.

How refusals relate to policy

When Claude declines a request, it is often because the request appears to approach a prohibited or high-risk area. Sometimes the refusal is a misread of a legitimate request, and Domain 7 covers how to rephrase. But a refusal is also a signal worth heeding: if you find yourself rewording a request several times to get past a refusal, ask whether the task itself is the problem.

Scenario: the collections letters

A credit control manager asks Claude to generate personalised letters to customers in arrears, including an assessment of each customer's likely ability to pay based on their payment history, and to send them automatically via a connector. Applying the policy: drafting letters is fine; assessing individuals' financial situations and sending consequential communications automatically is a high-risk use without human review. The compliant design: Claude drafts letters from a template, flags accounts that meet pre-agreed criteria for escalation, and a named person reviews and sends each letter. Disclosure that AI assisted drafting is handled according to the organisation's customer communications policy.

A quick self-check before a sensitive task

• Could the output deceive someone about who wrote it or whether it is true?
• Does it affect a decision about an identifiable person's money, job, health, housing or legal position?
• If so, is a qualified human reviewing before it takes effect, and is AI involvement disclosed where required?
• Does it compile information about a person that they would not expect to be gathered?
• Does my organisation's own policy permit this, on this account?

A "yes" to the first, second or fourth question without a satisfactory answer to the third and fifth is a stop sign.

Exam focus

• The Usage Policy has universal prohibitions (serious harm, deception, abuse, privacy violations), high-risk use requirements, and platform rules such as age and anti-circumvention.
• High-risk domains (legal, health, finance, insurance, employment, housing) require human review by a qualified person and disclosure of AI involvement.
• Fabricated reviews, fake personas and undisclosed synthetic endorsements are deceptive uses and prohibited.
• Your organisation's policies apply on top of Anthropic's; the stricter rule governs, and conflicts should be escalated.
• Repeated rewording to get past a refusal is a signal to question the task, not just the phrasing.