AI readiness assessment for Claude: EU checklist

TL;DR

An AI readiness assessment for Claude is worth paying for only if it ends in decisions you can act on this quarter: the residency route, the plan tier that carries your controls, the named owners of data classes and spend, and the gaps that block go-live. A maturity score with no blocking findings is a slide, not an assessment.

What does an AI readiness assessment have to produce?

A usable assessment produces four artefacts: a list of blocking findings with owners and dates, the residency and plan decision with its cost consequence, a records-of-processing entry that a DPO will sign, and a measurement baseline switched on before the rollout starts. Anything else is optional.

The failure pattern is familiar. An assessment runs for six weeks, produces a radar chart across eight dimensions, and recommends “strengthening data governance”. Nobody can act on that. A blocking finding looks different: “the workspace was created with workspace geo us, which cannot be changed, so the HR use case needs a new workspace on a regional Bedrock endpoint before go-live.”

Our test for whether an assessment was worth the fee:

Artefact	Pass	Fail
Findings	Named owner, named date, named setting	“Improve governance maturity”
Residency decision	One route chosen, premium quantified	Comparison matrix handed back to you
Processor chain	Every party named, agreements identified	“Review contracts with legal”
Baseline	Analytics and spend reporting already live	“Define KPIs in phase 2”
Scope boundary	What was not assessed, stated plainly	Silence about the gaps

Which obligations are you actually being assessed against?

Two regimes apply at once, and they ask different questions. The AI Act asks what the system does and who deploys it. The GDPR asks whose personal data is processed and under which contract. An assessment that covers only one of them will miss the finding that blocks go-live.

The AI Act calendar is live, not pending. The European Commission’s regulatory framework page puts the prohibitions and the AI literacy duty in force since 2 February 2025, general-purpose AI obligations and the governance chapter since 2 August 2025, and broad application since 2 August 2026. The AI Omnibus entered into force on 27 July 2026 and moved the high-risk obligations to December 2027 for Annex III and August 2028 for Annex I. It also simplified technical documentation for small and mid-sized companies and widened sandbox access.

The practical consequence for an assessment in late 2026: the literacy duty and the transparency rules are findings you can already be non-compliant on, while the high-risk conformity work is a 2027 project with a published harmonised standard to work against as of 19 October 2026.

On the data protection side, the questions are narrower and more answerable:

1. Which data classes will appear in prompts, and who decided that?
2. Which parties can read prompts, completions or logs, and under which agreement?
3. What is the retention period at each hop, including your own log buckets?
4. What happens to the data when the contract ends?

Our AI compliance matrix for Claude maps the AI Act, GDPR and NIS2 duties against each other, and our AI governance framework covers the roles and approval paths that answer question one.

Which platform checks gate a Claude go-live?

Six technical checks block go-live more often than anything else: residency, identity, audit visibility, retention, spend control, and whether the feature you plan to use is eligible for the data protection posture you promised. Each has a concrete setting behind it, so each produces a yes or no rather than a score.

Residency. On the first-party Claude API, inference_geo accepts only "global" and "us", and workspace geo offers only "us" and cannot be changed after the workspace is created, per the data residency page. US-only inference is priced at 1.1x the standard rate on Claude 4.6 and later models. EU-region processing comes from regional endpoints on Bedrock, Google Cloud or Microsoft Foundry, where the endpoint or inference profile determines the region and inference_geo does not apply. Check which workspaces already exist before promising anything.

Identity. SCIM and audit logs sit on the Enterprise plan, which has a minimum of 20 seats for self-serve and 50 for sales-assisted plans. An assessment that recommends SCIM for a 15-person pilot has not read the plan page.

Audit visibility. The Enterprise Compliance API gives programmatic access to activity logs, chat histories and file content, filterable by user and time range. That is a powerful control and also a data protection question in its own right: whoever holds that key can read employee conversations. Name the holder in the assessment. What the API actually returns is covered in our Claude Compliance API guide.

Retention. Custom data retention controls are an Enterprise feature. Check the actual configured value, not the plan entitlement.

Spend control. Groups carry per-user monthly limits, and some groups can carry a shared monthly budget in beta. The groups documentation sets a ceiling of 1000 groups per organisation and warns that membership in more than 250 groups can slow performance. An individual member’s limit takes precedence over any group limit, and groups synced from an identity provider cannot be renamed or deleted inside Claude.

Feature eligibility. This is the check most assessments skip. Claude Managed Agents is in beta, requires the managed-agents-2026-04-01 header, and is not currently eligible for Zero Data Retention or HIPAA Business Associate Agreement coverage, because sessions are stateful by design and store conversation history and sandbox state server-side. If the roadmap promises ZDR and the architecture uses Managed Agents, that is a blocking finding.

What does a maturity model worth scoring look like?

A maturity model earns its place only if each level is defined by an observable setting rather than a judgement. Score the settings, not the ambition. Five levels is enough, and most organisations starting with Claude land at level 1 or 2 regardless of how mature their general IT governance is.

The model below is our recommendation, not an industry standard:

Level	Residency	Identity and access	Visibility	Spend
1 Ad hoc	Default global, unknown workspaces	Individual accounts, shared keys	None	Credit card
2 Contained	One documented route, one workspace per data class	SSO, manual seat assignment	Spend report pulled manually	Per-workspace limit
3 Governed	Regional endpoint where required, setting verified per region	SCIM-provisioned groups, custom roles	Analytics API or OpenTelemetry running	Group limits set, blocked-member view used
4 Operated	Residency verified by an automated check after every change	Joiner, mover and leaver flow tested	Per-user attribution in your own stack	Forecast against actuals monthly
5 Portable	Route change rehearsed, second provider tested	Exit from the identity provider rehearsed	Audit export tested end to end	Model migration cost modelled in advance

Two measurement facts shape what level 3 can mean. The spend report refreshes daily with a one-day delay, supports custom ranges up to 90 days back, and exports one CSV row per person per model, per the usage analytics documentation. And the visibility is role-dependent: on Team plans only Owners and Primary Owners see analytics, while on Enterprise, Admins see analytics but not Spend. If your governance design assumes a compliance analyst can pull spend, check the role model first.

One more constraint worth writing into the finding: on seat-based Enterprise plans, spend reports appear only when usage credits are turned on, and they cover overage spend only. Usage inside the seat allowance is not metered in dollars. A cost governance process built on the spend report will see nothing until a team goes over.

Run it yourself or outsource?

Run the assessment yourself when you have a DPO, a cloud architect and an identity owner who can each spend a week on it, and when the scope is one route and one plan. Buy it when the assessment has to cover several business units with different data classes, when nobody has read the plan and residency documentation, or when the output needs to survive an external audit.

What the work takes, as our estimate of the effort rather than a sourced benchmark:

Assessment workstream	Effort	Who has to be in the room
Inventory of existing accounts, workspaces and keys	2 to 4 days	Cloud and identity owners
Residency and plan decision	3 to 5 days	Architect plus DPO
Processor chain and records of processing	5 to 10 days	DPO plus legal
AI Act classification per use case	2 days per use case	Business owner plus legal
Control verification against live settings	3 to 5 days	Platform engineer
Baseline instrumentation	3 days	Platform engineer

Our view: the inventory and the control verification are the parts most worth buying, because they are tedious, specialist and finite. The AI Act classification is not, because it depends on knowing what the process actually does, and an external reviewer will take your description at face value. Pay for the verification, do the classification yourself with legal support.

What to demand from an assessment engagement:

1. Findings checked against live settings, with the command or console page named, not against a questionnaire.
2. A scope statement that lists what was not assessed. Shadow usage on personal accounts is the most common omission.
3. The plan tier consequence spelled out, including the 20 and 50 seat minimums.
4. Feature eligibility checked for the features the roadmap actually names, including beta features.
5. The baseline left running after the engagement ends, in your own tooling.

Our Claude data privacy guide covers what happens to business data on each route, which is the evidence base for most of the findings above.

FAQ

What is an AI readiness assessment?

An AI readiness assessment checks whether an organisation can deploy an AI system lawfully and operably before it commits. For Claude that means verifying the residency route, the plan tier that carries the required controls, the processor chain, the audit and retention settings, and the spend controls, then listing the gaps that block go-live with owners and dates.

What does a Claude readiness assessment cost?

We have no sourced market price to quote. Judge an offer against the internal effort instead: roughly 18 to 30 person-days for a single-route, single-plan scope, more where several business units carry different data classes. Insist that the fee covers verification against live settings rather than a questionnaire.

Which plan do we need for the governance controls?

Audit logs, the Compliance API, the Analytics API, SCIM and custom data retention controls sit on the Enterprise plan, which requires a minimum of 20 seats self-serve or 50 sales-assisted. Team plans give SSO, central billing and admin controls but not SCIM or the Compliance API.

Readiness assessment vs governance framework: what is the difference?

The assessment is a point-in-time check that produces findings and a decision. The governance framework is the standing structure of roles, approvals and controls that the findings feed into. Buying the assessment without building the framework produces a report that ages out in a quarter.

Does the AI Act require a readiness assessment?

No. The Act requires specific obligations, including AI literacy since 2 February 2025 and transparency duties from 2 August 2026, and conformity work for high-risk systems from December 2027. An assessment is a way of finding out whether you meet them, not an obligation in itself.

Can we use Claude Managed Agents under a Zero Data Retention commitment?

Not currently. Claude Managed Agents is stateful by design and stores conversation history, sandbox state and outputs server-side, so it is not eligible for Zero Data Retention or HIPAA Business Associate Agreement coverage. You can delete sessions and uploaded files through the API, but the eligibility gap belongs in the assessment.

Sources

1. European Commission: Regulatory framework for AI (28 October 2026)
2. Anthropic Support: What is the Enterprise plan (28 October 2026)
3. Anthropic: Data residency (28 October 2026)
4. Anthropic Support: Usage analytics for Team and Enterprise plans (28 October 2026)
5. Anthropic Support: Groups and group spend limits (28 October 2026)
6. Anthropic: Claude Managed Agents overview (28 October 2026)
7. Anthropic: Claude pricing plans (28 October 2026)