Honest audit posture for Claude Cowork. Compliance regime table (SOC2, GDPR, HIPAA, ISO, FedRAMP), what gets logged, what's missing for high-assurance audit.
TL;DR. Cowork's audit story is workable for SOC 2, GDPR, UK GDPR, ISO 27001 and CCPA today; conditional for HIPAA (Enterprise BAA required) and PCI-DSS (don't put cardholder data through it); not yet generally available for FedRAMP. Per-action structured logging is improving but not at the level a SOX team would design from scratch — most mid-market customers fill the gap with cloud-sync version history and the workspace conventions in this section.
| Regime | Workable today | Conditions |
|---|---|---|
| SOC 2 Type II (Anthropic) | Yes | Anthropic publishes — review their report |
| GDPR | Yes | Enterprise plan + DPA + DPO sign-off |
| UK GDPR | Yes | Same as above |
| HIPAA | Conditional | Enterprise BAA required; PHI workflows reviewed case-by-case |
| ISO 27001 | Yes | Anthropic certified — review their certs |
| PCI-DSS | Conditional | Don't put cardholder data through Cowork |
| FedRAMP | Not yet | Anthropic on the path; not generally available |
| CCPA / CPRA | Yes | Standard contract handles |
Date-stamped late April 2026. Re-verify monthly — Anthropic's posture is moving forward, not back, but the specifics matter.
Honest assessment: per-action structured logging at audit-grade is improving but is not yet at the level a SOX team would design from scratch. If your auditors expect "Cowork action #4327 modified file X by user Y at timestamp Z, here is the cryptographic chain", that is not what Cowork emits today.
For audit-grade evidence today, Tinkso clients use:
CLAUDE.md, scheduled-tasks.md) as documentation of intended behaviour.This combination is enough for most internal audits. For SOC 2 control activities, it satisfies the file-modification evidence ask without requiring Cowork-native audit infra that does not exist yet.
Most mid-market customers do not need SOX 404 IT general controls applied to Cowork. They need:
That is enough to satisfy most internal audit and SOC 2 control activities. Anything beyond is a function of your specific regulator, not of Cowork's defaults.
For HIPAA, financial controls audit, or anything where documentation is part of the regulatory product:
The pattern: the regulated tools you already have keep their authoritative logs; Cowork sits on top and inherits the trail. Do not try to make Cowork the system of record for audit.
A compact checklist to bring to a security review:
Each item is binary — green or red — for the first cut. Yellows surface in the conversation, not on the checklist.
Audit and compliance is where most mid-market projects stall — not because Cowork cannot be deployed safely, but because nobody has done the documentation. We bring a templated security review pack to every engagement so the conversation with internal audit takes one meeting, not three.
The temptation is to wait for Anthropic to ship better audit infra before deploying. The cost of waiting is real: every quarter spent waiting is a quarter the pilot function does not produce ROI. The right move is usually to deploy with the workarounds above and upgrade the audit posture as Anthropic upgrades the platform.
Take the eight-item compliance review checklist above. Score each item: green / yellow / red. Bring the result to your next security review. The yellows are your work; the reds are your blocker conversation.
Book a 30-minute call. We'll ask where you are, what your team needs, and which systems Cowork should touch.