Methodology
This registry is an evidence index, not a legal determination. It records what public documents say and don’t say about each offering, with a source link and a verification date on every cell. It never answers “can I use this legally”, that is a question for your counsel, informed by evidence like this.
What a cell means
Every cell grades the public evidence for the compliance-favorable answer to a fixed question, for example, “will they sign a HIPAA BAA covering this offering?” The value is a coarse index for scanning; the note and source on each cell are the actual evidence, read them. The grades:
| Status | Meaning |
|---|---|
| yes_public | Publicly verifiable from the provider’s own documents. |
| yes_sales_gated | The provider states it exists, but the artifact (report, agreement, feature) requires a sales conversation, NDA, or enterprise tier. |
| yes_platform_only | Available, but only through a particular deployment or platform path. |
| partial | Some of the question is publicly satisfied; a material part is not. |
| no_public_evidence | No public evidence of the favorable answer. The note says which case it is: an absence (may exist behind an NDA) or a documented “no.” Both are useful to procurement, and both live in the note. |
| not_applicable | The question doesn’t apply to this row (for example, GPAI Code status for a serving platform that is not the model’s provider). |
| unclear | Sources exist but don’t settle the question. |
| conflicting_sources | Public sources disagree. The cell’s notes say how. |
Verification discipline
- Only primary sources are cited: the provider’s own trust center, policies, terms, and official EU pages. Press coverage and law-firm summaries are never cited as sources.
- Every cell carries the date it was last checked. Where an Internet Archive snapshot of the source exists, the cell links it, so a later change to the page can’t orphan the claim.
- Each cell carries a confidence grade. high means the source states it directly; medium means it required minor inference or the source is partly gated; low means treat it as a lead, not a fact.
- Offerings are (developer, platform) pairs. “Claude via AWS Bedrock” is a different row from “Anthropic API” because the certifications, the data path, and the contract you sign are different. For distribution rows, vendor-trust and data-handling dimensions describe the serving platform’s terms for that offering; EU AI Act dimensions describe the model developer, whose obligations they are.
On the EU AI Act columns
The GPAI Code of Practice is voluntary. A provider absent from the signatory list may demonstrate compliance by alternative means. The registry records signatory status (full, partial by chapter, or absent from the list) and whether an Article 53 training-data summary is published, it never claims a provider “has no EU compliance path” or is “non-compliant.”
Corrections policy
If you work for a provider listed here and a cell is wrong or stale: send the primary source that corrects it. Corrections with evidence are folded in within days, credited in the changelog, and the cell’s verification date is refreshed. Submit by email with the source linked. Disputes about grading (rather than facts) get a note in the cell rather than a silent change.
Use the data
data.json is the whole registry, free, machine-readable. Attribution with a link is required. If you need dated, procurement-attachable evidence snapshots or a licensed feed, subscribe in the footer and say so - that demand signal is what decides whether those get built.