What you will be able to do
- Describe what Enterprise audit logs record and who can export them
- Explain what the Compliance API, the Analytics API and custom data retention controls are for, and which role controls each
- Apply the Diligence competency, including disclosing AI assistance and owning the final output
1.Audit logs: the record behind the policy
A policy that nobody can check can't be shown to have been followed. Claude Enterprise addresses this with audit logs. Audit logs are available for Enterprise organizations only. Organization Owners and Primary Owners can export them from Organization settings > Data and Privacy. When an export is triggered, all audit logs for the organization within the past 180 days will be aggregated, and the requesting Owner receives an emailed download link that stays active for 24 hours.
This matters to a knowledge worker because it shows what an incident review can rebuild afterwards. Each log entry records who acted, what kind of event it was, what it affected and, where available, the IP address.
| Column | Description |
|---|---|
| created_at | When the log was written |
| actor_info | Information on the actor, if available |
| event | Type of event. |
| event_info | Other relevant information for a given event type. |
| entity_info | Entity affected by the operation, if relevant. |
| ip_address | IP Address corresponding to the event, if available. |
Audit logs record activity, not conversations. The title and content of chats and projects are not available to be exported in audit logs. Only their unique identifiers are exported, and chat inputs and outputs go through a separate data export that Primary Owners run. Where an organization uses customer-managed encryption keys, the export button isn't available and the same audit events come through the Compliance API instead. Logs also complement the approval controls from the connector settings: enabling connectors centrally and recording activity together let a review answer who connected what and when. A department that relies on individuals to remember what they linked has neither.
Checkpoint 1 of 6· Check yourself
A compliance reviewer exports Claude Enterprise audit logs, expecting to read what an employee typed into a specific chat. What will they find?
Audit logs export identifiers for chats and projects, not titles or content. Chat inputs and outputs need a separate data export by a Primary Owner.
“title and content of chats and projects are not available to be exported in audit logs”Source: support.claude.com
Checkpoint 2 of 6· Exam question
A journalist uses Claude to help draft portions of an article that will be published under the news outlet's byline. Under Anthropic's Usage Policy guidance for high-risk journalistic content, what is required?
Correct answer: B — The outlet must apply appropriate human editorial review and disclosure practices regarding AI involvement before publication.
- A. Incorrect. Journalistic content generated for publication is treated as a high-risk use case, not an exempt category.
- B. Correct. Journalistic content requires human editorial review and appropriate disclosure of AI involvement before publication.
- C. Incorrect. The policy requires editorial review and disclosure, not a blanket ban on any AI-assisted text appearing in the article.
- D. Incorrect. Anthropic does not require a per-article signed release; the obligation is editorial review and disclosure by the outlet.
Sources1
2.Compliance API, Analytics API and retention controls
Three more governance tools sit behind the scenes. As a knowledge worker you won't call them, but you should know they exist and what they do.
The Compliance API sends Claude activity into the organization's existing security tooling: "Claude activity will flow into the same dashboards and workflows your team uses for every other application." Anthropic presents it as a replacement for manual exports and periodic reviews. For Enterprise, compliance teams get real-time programmatic access to Claude usage data and customer content. They can use it to flag potential issues automatically and to manage retention through selective deletion. The scope differs by product: for the Claude Platform, the activity feed covers admin, system and resource events, and conversation content is not included. Control is concentrated in one role. Only the Primary Owner can turn the API on or off.
| Role | What they can do |
|---|---|
| Primary Owner | Enable or disable the Compliance API from Organization settings > API; create a key covering every linked organization |
| Owner | See the page but not the Compliance API toggle; create keys limited to their own organization |
| Admin | Don't see the page at all |
Checkpoint 3 of 6· Put it in order
Put the steps for bringing Claude Enterprise activity into a security platform through the Compliance API in order.
- 1.The Primary Owner enables the Compliance API
- 2.The instance is connected to a supported security platform
- 3.An access key is created
- 4.Claude activity flows into the team's existing dashboards
Nothing works until the Primary Owner switches the API on. A key is then needed to authenticate the connection to the security platform.
“Connect your instance to a supported security platform.”Source: support.claude.com
The Analytics API answers a different question: not "what happened?" but "who is using what, and at what cost?" Anthropic lists programmatic reporting as "Per-user usage and cost data over an API," provided by the Enterprise Analytics API for Enterprise.
Custom data retention controls let Enterprise organizations set how long Claude stores conversation and project data. Setting them requires the Primary Owner or Owner role. The minimum retention period is 30 days, and each month counts as 30 days. Retention runs from the last activity. Project retention always takes precedence over chat retention for chats inside a project. Because projects are kept indefinitely by default, chats inside projects are not deleted by your chat retention period.
Checkpoint 4 of 6· Check yourself
An Enterprise organization sets a 30-day chat retention period but no custom project retention. What happens to a chat inside a project that has had no activity for 60 days?
Chats inside a project follow the project's retention, and the default for projects is indefinite. The chat retention period only removes standalone chats.
“by default, projects are retained indefinitely, so chats inside projects are not deleted by your chat retention period.”Source: support.claude.com
3.Diligence: disclosure and owning the result
Controls and logs govern the system. The Diligence competency from Anthropic's AI Fluency framework governs the person. "Diligence means taking responsibility for how you use AI." The framework splits it into three parts: Creation Diligence, which means being intentional about which tools you use; Transparency Diligence, which means "being honest about AI's role"; and Deployment Diligence, which means "verifying and vouching for outputs." In practice, it covers protecting sensitive data, checking accuracy, checking for bias and being open about AI's role.
Anthropic models this in its own course materials. The AI Fluency course for pK–12 educators carries a disclosure explaining that Claude helped with structure, drafting and editing, that the human authors made all final decisions, and that "While AI assistance was instrumental in producing these materials, the human authors maintain responsibility for the content." It adds that the disclosure "is made in the spirit of transparency advocated by the AI Fluency Framework." Disclosure and responsibility appear together, and neither replaces the other. The same course for educators builds the habit into its workflow: a closing check to "Document how AI contributed to the deck." When your organization's policy requires disclosure, a heavy edit doesn't remove the duty. It means you vouch for more of the content.
Checkpoint 5 of 6· Check yourself
Which of these is NOT one of the three parts of Diligence in the AI Fluency framework?
Diligence has three parts: Creation, Transparency and Deployment. Delegation is a separate competency, and Diligence keeps responsibility for sign-off with the human.
“Diligence means taking responsibility for how you use AI.”Source: academy.claude.com
Checkpoint 6 of 6· Exam question
A user requests deletion of their personal data from conversation logs. Which action best satisfies this request in accordance with data privacy regulations?
Correct answer: B — Delete all conversation logs containing the user’s personal data and confirm removal promptly.
- A. Incorrect. Anonymizing data may reduce identifiability but does not fully comply with deletion requests under regulations like GDPR, which typically require complete removal of personal data unless a legitimate reason exists to retain it in anonymized form. Keeping the logs for analysis directly conflicts with the expectation that personal data be deleted.
- B. Correct. Deleting all conversation logs containing the user's personal data and confirming removal promptly directly honors the deletion request and aligns with data privacy regulations such as GDPR's right to erasure. This approach represents the most appropriate operational handling of the request.
- C. Incorrect. Disabling the API key prevents future data collection but does not remove existing conversation logs or personal data. This action addresses access control, not data deletion, and therefore fails to satisfy the user's request.
- D. Incorrect. Exporting logs to a secure archive before deleting active records preserves the data rather than eliminating it, which conflicts with the deletion request unless there is a legal basis for retention. This approach does not fully comply unless the archived data is also deleted or anonymized.
Exam traps
Each one states something that sounds right. Open it to see what is actually true.
1.Enterprise audit logs let a reviewer read the content of employees' Claude chats.Why is that wrong?
Audit logs export only unique identifiers for chats and projects, not titles or content. Chat inputs and outputs require a separate data export by Primary Owners.
Covered in Audit logs: the record behind the policy
2.Any Owner or Admin on a Claude Enterprise organization can switch on the Compliance API.Why is that wrong?
Only the Primary Owner can enable or disable it. Owners can create keys limited to their own organization, and Admins don't see the page at all.
Covered in Compliance API, Analytics API and retention controls
3.If you have heavily edited an AI-assisted draft, it is your own work and disclosure no longer applies.Why is that wrong?
Diligence asks you to be honest about AI's role and to own the final result. Editing increases what you vouch for, but it doesn't erase AI's contribution.
Covered in Diligence: disclosure and owning the result
Sources
Every claim above is drawn from one of these pages, quoted as it was written on the date shown.
- 1.
“Audit logs are available for Enterprise organizations only.”
↩︎ Audit logs: the record behind the policy“all audit logs for the organization within the past 180 days will be aggregated”
↩︎ Audit logs: the record behind the policy“Organization Owners and Primary Owners can export data within Organization settings > Data and Privacy”
↩︎ Audit logs: the record behind the policy“Audit log events are available in the Compliance API.”
↩︎ Audit logs: the record behind the policy“title and content of chats and projects are not available to be exported in audit logs”
↩︎ Exam trap 1“title and content of chats and projects are not available to be exported in audit logs”
↩︎ Checkpoint - 2.https://support.claude.com/en/articles/15167101-get-started-with-claude-compliance-api-integrationsOfficial docs
“Claude activity will flow into the same dashboards and workflows your team uses for every other application.”
↩︎ Compliance API, Analytics API and retention controls“Conversation content (prompts and model responses) is not available through the Compliance API for the Claude Platform.”
↩︎ Compliance API, Analytics API and retention controls“only your organization's Primary Owner can enable the Compliance API, from Organization settings > API.”
↩︎ Exam trap 2“Connect your instance to a supported security platform.”
↩︎ Checkpoint - 3.
“compliance teams get real-time programmatic access to Claude usage data and customer content”
↩︎ Compliance API, Analytics API and retention controls - 4.https://code.claude.com/docs/en/admin-setupOfficial docs
“Per-user usage and cost data over an API”
↩︎ Compliance API, Analytics API and retention controls - 5.https://support.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plansOfficial docs
“To set custom retention periods for your organization, you must have either a Primary Owner or Owner role.”
↩︎ Compliance API, Analytics API and retention controls“The minimum retention period is 30 days, and each month is counted as 30 days.”
↩︎ Compliance API, Analytics API and retention controls“Project retention always takes precedence over chat retention for chats inside a project.”
↩︎ Compliance API, Analytics API and retention controls“by default, projects are retained indefinitely, so chats inside projects are not deleted by your chat retention period.”
↩︎ Checkpoint - 6.
“Transparency Diligence (being honest about AI's role)”
↩︎ Diligence: disclosure and owning the result“Deployment Diligence (verifying and vouching for outputs)”
↩︎ Diligence: disclosure and owning the result“Diligence means taking responsibility for how you use AI.”
↩︎ Checkpoint - 7.https://academy.claude.com/courses/ai-fluency-for-educators/applying-ai-fluency-to-learning-materials-and-assignmentsOfficial docs
“Diligence encompasses protecting sensitive data, verifying accuracy, checking for bias, and creating transparency about AI's role.”
↩︎ Diligence: disclosure and owning the result“Document how AI contributed to the deck”
↩︎ Diligence: disclosure and owning the result - 8.
“While AI assistance was instrumental in producing these materials, the human authors maintain responsibility for the content.”
↩︎ Diligence: disclosure and owning the result“This disclosure is made in the spirit of transparency advocated by the AI Fluency Framework”
↩︎ Diligence: disclosure and owning the result
Also cited
“Diligence means owning the final result fully, regardless of AI’s role.”
↩︎ Exam trap 3“Diligence means owning the final result fully, regardless of AI’s role.”
↩︎ Prediction