Summary: Anthropic’s September 4, 2025 sales update shifted eligibility from operating location to control, barring organizations more than 50% owned directly or indirectly by companies headquartered in unsupported regions. The announcement warned that such ownership can carry legal duties to share data or aid intelligence services, but did not specify verification, existing-contract handling, or appeals.
The rule changed from where you are to who owns you
Anthropic published an update on September 4, 2025, tightening how it sells to organizations tied to regions its Terms of Service already exclude. The announcement states that the company’s terms prohibit use in certain regions for legal, regulatory, and security reasons, and that entities from those regions keep reaching the services anyway — often through subsidiaries incorporated elsewhere.
The mechanism of the change is the interesting part. Anthropic says the update prohibits companies or organizations whose ownership structures subject them to control from jurisdictions where its products are not permitted, regardless of where those companies operate. The stated threshold: entities more than 50% owned, directly or indirectly, by companies headquartered in unsupported regions.
That is an ownership test, not a shipping-address test. A subsidiary in a permitted country can still fall inside the restriction if its parent sits in an unsupported one.
Why a subsidiary structure stops being a workaround
Anthropic’s stated reasoning is that companies subject to control from authoritarian regions face legal requirements that can compel data sharing, cooperation with intelligence services, or other actions creating national security risk. The announcement argues these requirements are hard to resist regardless of where the company operates or what individuals there prefer.
The company also names two downstream concerns: that such entities could build applications serving adversarial military and intelligence services, and that they could advance their own AI development through techniques like distillation while competing with technology companies headquartered in the US and allied countries.
Whether or not you share the framing, the operational consequence is concrete. Corporate structure is now part of the access decision.
What this means if you build on a parent-subsidiary stack
Most builders never think about this until procurement asks. Then it becomes a blocker with a deadline.
If your product sits inside a group with cross-border ownership, the useful questions are: who ultimately controls the contracting entity, where is that parent headquartered, and does the ownership percentage cross the line Anthropic describes? The announcement gives 50% as the marker for direct or indirect ownership, so partial stakes and layered holding structures both matter.
This is the same class of problem as any dependency whose terms can change under you. The practical move is to record the ownership chain next to the vendor in your architecture notes, not in a legal folder nobody reads. When a model provider’s eligibility rules shift, you want to know which of your services inherit the constraint before an invoice or a support ticket tells you.
That habit generalizes. We have written before about giving your coding agent deployment facts instead of just a model name, and the same instinct applies here: the facts that decide whether something runs are often organizational, not technical.
The parts the announcement does not settle
Anthropic describes the policy direction and the ownership threshold. The announcement does not spell out enforcement mechanics, how ownership is verified, what happens to existing contracts, or how appeals work. Those details may exist elsewhere; this source does not contain them.
It also does not define which jurisdictions count as unsupported beyond naming China as an example. If your ownership chain touches a region you are unsure about, that is a question for the vendor, not something to infer from a blog post.
A grounded next step
Pull the ownership chain for every entity that signs your AI contracts, and note the percentage and headquarters at each layer. If any path crosses 50% into an unsupported region, treat it as an open risk with an owner and a date, not a footnote. The rule is about control, and control is something you can actually map.