Anthropic official brand assets (anthropic.com)
The AI company is taking its commercial Claude product through the government's automated authorization track, with no completion date announced
Anthropic is pursuing FedRAMP Moderate authorization for Claude Enterprise. It is using the FedRAMP 20x program, the government’s newer and more automated route to cloud security approval.
FedRAMP sign-off is the badge that lets cloud services handle sensitive government-adjacent data.
The target here is regulated commercial work involving Controlled Unclassified Information, or CUI. That category covers sensitive data that falls short of classified but still comes with strict handling rules.
What Anthropic is actually applying for #
FedRAMP Moderate maps to what the 20x framework calls Class C. That tier covers systems where a breach could cause “serious adverse effects.”
It does represent a significant portion of the cloud services that hold authorization today.
Under the 20x track, Class C relies on 61 Key Security Indicators, known as KSIs. Each one is a measurable checkpoint that a provider must keep satisfying over time. Evidence is submitted in machine-readable form, so the process leans on continuous validation rather than one big review.
As of October 2026, Claude Enterprise does not have FedRAMP authorization. It does hold third-party NIST attestations covering CUI requirements, including attestations tied to NIST SP 800-171.
Those attestations are still not the same as a FedRAMP stamp, which is the credential procurement officers actually check for.
Anthropic has not disclosed a timeline for when the Moderate authorization might be completed.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
A tale of two Claudes #
Anthropic already has a government-grade product on the shelf. Claude for Government held FedRAMP High authorization as of September 30, 2026, and runs in a dedicated environment.
FedRAMP High sits above Moderate in the security hierarchy. So Anthropic has already cleared the tougher bar for one product. Now it is working on the lower-tier bar for another.
Claude for Government is built for federal workloads. Claude Enterprise is the commercial offering, and getting it Moderate authorization would extend a FedRAMP credential to regulated businesses handling CUI.
Today, customers who need FedRAMP compliance have limited choices. They can use Claude for Government, or they can access Claude through specific authorized cloud deployments.
The company’s federal work currently runs mostly through those third-party channels. AWS Bedrock GovCloud and Google Vertex AI are the main routes.
Why the 20x route matters #
FedRAMP 20x launched in 2025. It marks a sharp break from the older Rev 5 approach, which was known for being document-heavy.
Under Rev 5, authorization meant assembling and reviewing extensive paperwork. The 20x model swaps much of that for automated, continuous evidence collection built around the KSIs.
Phase 2 of the 20x Moderate pilot wrapped up in early 2026. The first official authorizations followed in March 2026.
After that, the submission pipeline was set to open gradually by late August 2026. Anthropic’s application fits into that wider rollout, as the program shifts from pilot to something closer to normal operations.
What this means #
For regulated businesses, the stakes are practical. Companies handling CUI that want Claude Enterprise currently have to lean on attestations or route through authorized cloud partners.
For Anthropic, the move widens its compliance footprint across both government and commercial lines. FedRAMP High covers the federal product. A Moderate approval would cover the enterprise product.
The risks are mostly about timing. No completion date has been disclosed, and the 20x pipeline was still opening in phases through 2026.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our