In life sciences AI, model access is becoming a governed asset

Biology is the clearest example of a dual-use domain. The same question can serve a vaccine program or a weapons program, and a model often cannot tell which. The result, for life sciences teams, has been frustrating: general-purpose safeguards block a meaningful share of legitimate work in drug discovery, research biology and development.

On September 17, Anthropic announced a different approach. Instead of one safeguard setting for everyone, access to more permissive capabilities is tied to who you are, what you declared you would do, and whether your usage matches it.

What Anthropic announced

The Life Sciences Verification Program (LSVP) is launching in beta, initially for teams and institutions. According to Anthropic:

• Verification covers research credentials, security standards and ethical research oversight.
• Standard Use grants apply to whole teams for daily work across basic science, R&D, manufacturing, clinical development, quality, regulatory affairs and more. They cover Mythos 5.1, Opus 5 and Sonnet 5 with classifiers that are more permissive for science tasks, and are renewed yearly.
• High-risk Use grants are add-ons for specific projects in areas still blocked under Standard Use. They apply to a single project and must be renewed every six months. They are available for Opus 5 and Sonnet 5 today; for Mythos, they remain limited to a small set of entities.
• Other safeguards stay in place, including cyber classifiers.
• Enforcement shifts from real-time blocking to offline monitoring against each organization’s declared use cases. When activity falls outside scope, Anthropic flags it to the organization’s admins, who act within pre-agreed timeframes.
• LSVP traffic requires 30-day data retention for that monitoring. Anthropic says the data is compartmentalized and cannot be used for training or accessed by its life sciences research teams.

Availability has clear limits. LSVP is available in Anthropic’s first-party console for API usage and in Claude for Enterprise and Team plans. It is not yet available on third-party platforms. And, as a beta, it is not available for BAA-enabled organizations: Anthropic states that customers with PHI should use separate, non-BAA organizations for this work.

What actually changes

The interesting shift is not “more permissive models”. It is that capability access becomes something an organization holds, scopes and answers for, closer to a lab permit than to a software license.

That has operational consequences on the customer side:

Use cases become a governance artifact. Grants are tied to the use cases your organization declares. Those descriptions need an owner, a review cycle and a link to real projects.

Incident triage becomes your job. When monitoring flags out-of-scope activity, your admins are expected to respond within agreed timeframes. That needs a named team and a runbook, the same way security alerts do.

Renewals are a process. Yearly and six-monthly renewals, per team and per project, are administrative work that someone has to track.

The boundary that matters most: research is not PHI

The BAA limitation is not a footnote. It forces an architecture decision that many organizations should make anyway: separate research and discovery workloads from clinical and patient-data workloads.

In practice:

• An LSVP organization for research, discovery and development work that does not involve protected health information.
• A separate environment for anything involving PHI, under whatever agreements and controls that data requires.
• Data classification controls that keep PHI out of the LSVP environment, supported by training so researchers know where each kind of work belongs.

This is not a statement about compliance. LSVP makes no HIPAA claim, and nothing here implies one. It is a statement about keeping different risk profiles in different places, which is good architecture in its own right.

1. Research and discovery
2. Development and manufacturing
3. Data classification gate
4. Clinical and patient data workloads

• LSVP organization, no PHI: Research and discovery · Development and manufacturing
• Separate environment: Clinical and patient data workloads

Control your organization operatesKept out of the program

Other practical implications

Platform choice. If your organization reaches Claude through a cloud platform rather than directly, LSVP is not available there yet.

Retention review. The 30-day retention requirement for LSVP traffic should go through the same privacy and legal review as any new data processing, especially where unpublished research or partner data is involved.

Surface differences. Anthropic notes that grant switching works natively in the API and Claude Science, while Claude.ai and Claude Code initially apply a preselected default grant.

What pharma and biotech teams should do now

1. List the work that general safeguards block today, and estimate its value. That is the business case, or the lack of one.
2. Classify the workloads: which involve PHI, which involve unpublished IP, which are neither.
3. Name owners for declared use cases, grant renewals and flag triage.
4. Design the separation between research and PHI environments before onboarding, not after.

The broader lesson reaches beyond one vendor. In regulated science, better models are only part of the answer. Access that is verified, scoped and monitored is becoming part of the architecture, and it comes with duties on both sides. For how these duties fit the wider stack, see our 2026 guide.