Anthropic tightened its regional sales restrictions on September 4, 2025, barring companies and organizations whose ownership places them under the control of jurisdictions where Claude is not offered, such as China, regardless of where those entities operate. The rule covers any entity that is more than 50% owned, directly or indirectly, by companies headquartered in unsupported regions. The change shifts Anthropic's access rules from where a customer is located to who ultimately controls it, so developers building on Claude now need to consider corporate ownership as well as user geography.

Key Facts#

  • Date: Anthropic announced the update to its regional restrictions on September 4, 2025.
  • Who is covered: Companies or organizations whose ownership structures subject them to control from jurisdictions where Anthropic's products are not permitted, like China, wherever they operate.
  • Ownership test: The ban includes entities more than 50% owned, directly or indirectly, by companies headquartered in unsupported regions.
  • Stated reasons: Anthropic says such companies can be legally compelled to share data or cooperate with intelligence services, could build services that end up serving adversarial military and intelligence agencies, and could use Claude to improve their own models through distillation.
  • Policy text: Anthropic's Supported Regions Policy reserves the right, to the extent permitted by law, to refuse service to entities whose majority direct or indirect ownership is attributable to nations outside its supported list. China is not on that list for API or Claude.ai access.
  • Industry position: In October 2025, CEO Dario Amodei said Anthropic was the only frontier AI company restricting the sale of AI services to companies controlled by the People's Republic of China (PRC), and that it was giving up significant short-term revenue to do so.

What Happened#

Before the change, Anthropic's terms of service already prohibited use of its services in certain regions because of legal, regulatory and security risks. The company said that companies from those regions, including China, kept finding ways in, for example through subsidiaries incorporated in other countries. The September update closes that route by looking at control rather than place of incorporation.

Anthropic framed its reasoning in national security terms. Companies subject to control from authoritarian jurisdictions, it argued, face legal requirements that can compel them to hand over data or work with intelligence services, and that pressure is hard to resist regardless of where a company operates or what its employees would prefer. Access through a subsidiary could therefore let such entities build applications that ultimately serve adversarial military and intelligence services. Anthropic also flagged a strategic risk: these companies could use Claude to advance their own AI development through distillation, the technique of training a model on another model's outputs, and then compete globally with technology companies based in the United States and allied countries.

The company tied the change to its broader policy agenda. It said it would keep advocating for strong export controls to stop authoritarian nations from developing frontier AI capabilities, for faster energy projects on US soil to support AI infrastructure, and for rigorous evaluation of AI models for national-security-relevant capabilities, including ones that adversaries could exploit.

Background#

Anthropic had been making the export-control argument for months. In its March 2025 recommendations for the US AI Action Plan, it called for tighter semiconductor controls, including controls on Nvidia's H20 chips, government-to-government agreements for countries hosting large chip deployments and lower thresholds for license-free exports. When the White House released America's AI Action Plan in July 2025, Anthropic again urged the administration to keep H20 controls in place.

The ownership rule extends that logic from chips to model access. Chip export controls govern hardware, but a hosted model can be reached from almost anywhere with an API key. By restricting access based on who controls a customer, Anthropic applied a similar principle through its own contracts.

Distillation itself is not illegitimate. As Anthropic later explained, frontier labs routinely distill their own models to create smaller, cheaper versions for customers. The concern is competitors using the technique to acquire capabilities without paying the cost of developing them.

Why It Matters for Developers#

  • Ownership is now an eligibility criterion. If your company, a parent company or an important customer is majority owned from an unsupported region, access can be withdrawn even when every user sits in a supported country. Add ownership questions to vendor and customer due diligence before you build a product around one provider.
  • Do not become someone else's proxy. In February 2026, Anthropic described commercial proxy services that resell access to Claude through networks of fraudulent accounts, one of which managed more than 20,000 accounts at once. If your product exposes model capabilities through your own API, verify tenants, enforce per-tenant quotas and watch for high-volume, repetitive prompt patterns. The API security interview guide covers the underlying controls.
  • Plan for losing a provider. Keep model calls behind a provider-neutral abstraction such as IChatClient from Microsoft.Extensions.AI, with tested fallbacks that can include self-hosted open-weight models run through ONNX Runtime, Ollama or Foundry Local.
  • Keep an audit trail. Record which provider and model served each tenant and region, as described in the LLM observability guide, so you can demonstrate compliance or reroute traffic quickly.

What's Next#

Enforcement proved harder than writing the rule. In February 2026, Anthropic reported that three Chinese AI labs, DeepSeek, Moonshot and MiniMax, had used about 24,000 fraudulent accounts to generate more than 16 million exchanges with Claude in violation of its terms and regional restrictions. It said it had strengthened verification for educational accounts, security research programs and startup organizations, and it repeated that it does not offer commercial access in China or to subsidiaries of Chinese companies located abroad.

The open questions are whether other providers adopt ownership-based rules and whether governments turn similar restrictions into law. Anthropic has since called for policy action against distillation attacks, arguing that no single company can stop them alone.

Sources#