Meta AI should not be used for company work. Our verdict for a typical 50–500 person company handling client or regulated data, assessed 29 July 2026: Prohibited. Meta AI reaches employees through personal Meta accounts your company does not hold and cannot administer, offboard or audit — and we found no business tier or enterprise agreement that would change that. It ships inside WhatsApp, Instagram and Facebook, which means it reaches employees’ phones without anyone deciding to adopt it. Name it explicitly in the policy — the reason to prohibit it is that you cannot govern it, which is enough.
This verdict reflects Meta’s published terms as we read them on 29 July 2026. A vendor can change its terms the day after; the primary sources below are how you check.
| Vendor | Meta |
|---|---|
| Category | General assistant |
| Our tier verdict | Prohibited (assessed 29 July 2026) — Meta AI reaches employees through personal Meta accounts your company does not hold and cannot administer, offboard or audit — and we found no business tier or enterprise agreement that would change that. source (archived) |
| Trains on your data? | Not established from a primary source Meta publishes a Privacy Center page, "How Meta uses information for generative AI models," and we read an archived snapshot of it — but the page renders as headings whose detail sections did not expand in the copy we could read, so we do not restate specific training terms here. Treat it as a consumer service governed by consumer terms until Meta gives you something in writing. source (archived) |
| Data retention | Governed by Meta’s consumer privacy policy and tied to a personal account. We did not verify specific retention periods from a primary document on this check date. |
| Admin controls | None. There is no admin console, no SSO and no company-held account. |
| Compliance certifications | None apply — Meta AI is not offered to companies under an enterprise agreement we could verify. |
| HIPAA / BAA | No — No. We found no published BAA or HIPAA-eligible business offering for Meta AI. |
Meta publishes a Privacy Center page, "How Meta uses information for generative AI models," and we read an archived snapshot of it — but the page renders as headings whose detail sections did not expand in the copy we could read, so we do not restate specific training terms here. Treat it as a consumer service governed by consumer terms until Meta gives you something in writing.
Retention: Governed by Meta’s consumer privacy policy and tied to a personal account. We did not verify specific retention periods from a primary document on this check date.
No. We found no published BAA or HIPAA-eligible business offering for Meta AI. As a rule: no signed Business Associate Agreement means no protected health information (PHI) — a BAA is the gate, not the security posture. A vendor can hold every certification on the market and still be the wrong place for PHI, because what makes PHI processing lawful for a covered entity is the contract, not the encryption.
Comparing vendors on this specifically? See BAA status for all 26 tools →
Not verified from a primary document on this check date. None apply — Meta AI is not offered to companies under an enterprise agreement we could verify. Ask for the current SOC 2 report under NDA before you rely on it. A certification is also not a contract: it describes how Meta AI runs its controls, not what your agreement with them permits.
Do not allow Meta AI anywhere near patient information. No. We found no published BAA or HIPAA-eligible business offering for Meta AI.
Meta AI fails the basic vendor-due-diligence test for financial services: there is no auditable control surface. SEC/FINRA recordkeeping duties also mean untracked AI channels are an examination finding waiting to happen.
Privilege and Meta AI do not mix: entering client matter details into a consumer AI service you cannot govern is an uncontrolled disclosure risk no engagement letter contemplates.
Every vendor claim above traces to a document the vendor publishes, and every document below is one we actually opened and read — each carries the date we read it. All of them were read on 29 July 2026. The verdict date on this page is not a build stamp and is not "today": it is the oldest of those dates, because a verdict is only as current as the stalest document under it. Rebuilding the site does not move it.
Where a fact is not in one of these documents, the page says so rather than filling the gap. That is why some rows read "not publicly documented" or "not established from a primary source" instead of naming a certification or rounding an open question to a convenient answer.
Why the tier verdict is "generic": Prohibited is the right starting classification for most 50–500 person companies — but a healthcare company, a law firm, and a SaaS startup should not have identical tool lists. The $79 policy kit classifies Meta AI and 25 other tools specifically for your industry, company size, and the data your team handles.
And a verdict has a shelf life: vendor data policies change quietly — a terms update can move a tool between tiers overnight. This page states what we read on 29 July 2026. The $149/mo Monitor plan exists precisely because that date keeps receding.
Meta AI should not be used for company work. Our verdict for a typical 50–500 person company handling client or regulated data, assessed 29 July 2026: Prohibited. Meta AI reaches employees through personal Meta accounts your company does not hold and cannot administer, offboard or audit — and we found no business tier or enterprise agreement that would change that. It ships inside WhatsApp, Instagram and Facebook, which means it reaches employees’ phones without anyone deciding to adopt it. Name it explicitly in the policy — the reason to prohibit it is that you cannot govern it, which is enough.
Meta publishes a Privacy Center page, "How Meta uses information for generative AI models," and we read an archived snapshot of it — but the page renders as headings whose detail sections did not expand in the copy we could read, so we do not restate specific training terms here. Treat it as a consumer service governed by consumer terms until Meta gives you something in writing.
No. We found no published BAA or HIPAA-eligible business offering for Meta AI. As a rule: no signed Business Associate Agreement means no protected health information (PHI) — a BAA is the gate, not the security posture. A vendor can hold every certification on the market and still be the wrong place for PHI, because what makes PHI processing lawful for a covered entity is the contract, not the encryption.
Not verified from a primary document on this check date. None apply — Meta AI is not offered to companies under an enterprise agreement we could verify. Ask for the current SOC 2 report under NDA before you rely on it. A certification is also not a contract: it describes how Meta AI runs its controls, not what your agreement with them permits.
We classify Meta AI as Prohibited for a typical 50–500 person company, assessed 29 July 2026. Meta AI reaches employees through personal Meta accounts your company does not hold and cannot administer, offboard or audit — and we found no business tier or enterprise agreement that would change that. Your own classification should reflect your industry, data types, and which plan or account type your company actually uses.
New to the topic? Start with what shadow AI is — definition, examples and risks, then measure your own exposure with the shadow AI scorer.
Your team is using Meta AI. Does your AI policy cover it?
Most policies name a handful of tools and go stale the month after they are written. Two ways to find out where yours stands: check an existing policy for gaps in 30 seconds, or generate a policy that classifies Meta AI by name — free preview, no account. Starting from scratch? The free 14-section AI acceptable use policy template is the document itself, ungated.
A 4-document AI policy kit — acceptable use policy, tool tier list, acknowledgment form, manager FAQ — that classifies Meta AI and 25 other tools for your company, industry, and data. Generated in about 10 minutes.
Generate my policy kit →We re-check vendor terms monthly and alert you when Meta AI’s data policy changes — plus regenerate your whole kit so it never goes stale. This directory is a snapshot — Monitor is the live feed.
See Monitor plan →Already have an AI policy? Check it for gaps in 30 seconds →