From the Anthropic edition of November 9, 2026
Claude Help Center: Covered Models (now incl. Fable 5.2) require 30-day retention on every surface; ZDR only via limited eligibility or EFS
Anthropic · AI platform vendor / privacy policy · Global
- Publisher
- Claude Help Center
- Original publication
- Undated help article; lists Fable 5.2 (launched Nov. 9, 2026)
- Source retrieved
- 2026-11-10
- Event date
- 2026-11-09
What happened
Anthropic's Covered Models policy, which now names Claude Fable 5.2 alongside Fable 5.1 and 5, requires prompts and completions to be retained at least 30 days on every surface, including Amazon Bedrock, Google Cloud Agent Platform and Microsoft Foundry, and states ZDR is not available where covered models are accessed. Retained data is reviewed by automated safety systems. Enterprise Frontier Safeguards, rolling out in phases from fall 2026, lets eligible customers keep monitoring data in their own cloud; eligible customers also get time-limited ZDR as a transition. The linked retention article says human review occurs only via a controlled, logged path.
Why it matters
This is the controlling document for state, local, HHS and campus privacy reviews of Fable 5.2. Agencies with ZDR commitments in contracts, public-records retention schedules, or CJIS/HIPAA constraints must decide whether 30-day vendor or cloud-held retention is acceptable or keep using non-covered Claude models. Retained prompts may also raise public-records questions.
Evidence and measured results
Vendor policy text listing covered models, surfaces, retention period, review mechanism and EFS transition; separate article describes per-surface configuration (e.g., Bedrock retention data stays in AWS; Azure requires a separate subscription).
Limitations and uncertainty
Undated; the listing of 5.2 implies a Nov. 9 update but the page shows no revision date. Vendor policy, not an independent audit. Cross-tagged state-government and health-human-services because 30-day retention affects records, CJIS, HIPAA and Medicaid data handling decisions.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies with ZDR or strict retention commitments cannot adopt Fable 5.2 without a documented privacy decision.
- Stakeholders
- Privacy officer
- Records manager
- Legal counsel
- CISO
- HHS compliance lead
- Discovery questions
- Which contracts promise zero data retention?
- Would retained prompts be subject to public-records requests?
- Are you eligible for EFS or transitional ZDR?
- Value hypothesis
- A clear per-workload decision lets agencies adopt covered models where acceptable without breaching commitments.
- Potential engagement
- Data-handling decision workshop and routing design.
- Unsupported claims
- 30-day retention satisfies CJIS or HIPAA
- ZDR is available by default
- EFS is generally available
Pre-sales engineering
Role takeaway
- Fit
- Required reading before any covered-model deployment.
- Architecture and integration
- Separate retention-enabled workspaces/accounts; routing controls; model ID logging.
- Prerequisites
- Workload data classification
- Separate workspaces or subscriptions
- Routing policy
- Constraints
- 30-day minimum retention on all surfaces
- EFS phased rollout
- ZDR only for eligible customers, time-limited
- Security
- Retained data protected by vendor security program; human review only via logged controlled path.
- Proof of value
- Routing tests blocking regulated data from covered models
- Per-surface retention verification
Delivery
Role takeaway
- Work
- Classify workloads, configure retention classes, update records guidance.
- Dependencies
- Privacy office
- Records management
- Legal
- Ownership
- Privacy office with AI platform owner.
- Skills and adoption
- Train users on which models are approved for which data.
- Governance checkpoints
- Privacy impact assessment
- Records retention review
- Contract review
- Acceptance criteria
- Proposed: documented decision for each workload
- Proposed: zero ZDR-bound requests to covered models in logs
- Risks
- Misrouted regulated data
- Breach of contractual ZDR commitments
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
ZDR-configured organizations need separate retention-enabled workspaces, accounts or Azure subscriptions to use covered models, which complicates tenancy and logging design.
Governance
Who approves, reviews and stays accountable for outcomes?
Privacy officers should document a decision per workload: stay on non-covered models, accept 30-day retention, or pursue EFS/ZDR eligibility.
Security and privacy
What data, permissions and controls need testing?
Retention creates a data store subject to breach risk and legal process; Anthropic cites a documented security program and tamper-proof access logs for human review.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Not addressed.
Procurement
What should contracts, pricing and exit terms secure?
Contracts and data-use agreements (e.g., Maryland's Attachment Y) should state covered-model retention terms explicitly.
Operating model
Which teams own the service once it runs?
Platform teams must manage two retention classes of Claude models in parallel.
Publication history
- 2026-11-09Anthropic · Issue 118 resources
Stable resource ID: claude-covered-models-30-day-retention-fable-5-2-20261109