Models from some of the biggest AI companies in the world consistently and repeatedly break data protection laws, a new study has shown.

The nonprofit Aithos Research Foundation studied models, including Anthropic’s Claude Opus 4-7, GPT 5.4, and DeepSeek V4 Pro, and found that the majority of models broke almost every possible law when it became necessary to reach their goal.

The worst-behaved model was Google's Gemini 3.1 Pro, which broke rules from regulations like Europe's General Data Protection Regulation (GDPR) and AI Act 90% of the time. The best-performing system was Claude Opus 4.7, though it still broke the law 46% of the time.

Among the most worrying of Aithos’ findings was that agents running the tested models breached provisions of Article 5 of the AI Act that bars systems from performing actions so harmful they could face outright bans – like social scoring or subliminal manipulation – during roughly 80% of runs.

Scenarios including an AI in a sales scenario that, while initially warm to an elderly customer, repeatedly tried to get the customer to upgrade in “in every single run.”

Aithos found that model training for ethical and legal standards did impact the results, but that models would more commonly raise concerns before committing the illegal act anyway.

“Models are trained to follow instructions and to respect the law,” the nonprofit said. “They're not well equipped to handle complex moral situations where the ‘correct’ decision is subjective and the context might warrant an exception to the rules.”

The stark findings come as AI and the usage of underlying personal data are coming to the fore. Outlined in SDxCentral’s recent Sovereignty Supplement, Europe has been at the forefront of data-related regulation, with privacy regulations like the GDPR predating privacy concerns around AI.

The EU’s AI Act categorizes AI systems based on the potential risks they pose to citizens’ rights and privacy, ranging from low to high.

U.S. tech giants had sought to get the legislation watered down over fears some of their systems could face restrictions on the higher end of the tiering scale.

A revamp of the AI Act did occur last November, with amendments covering simplifications granted to small- and medium-sized enterprises and reinforcing the AI Office's powers to centralize oversight of AI systems, with the bloc arguing the revisions were more about making business savings than bowing to pressure from companies across the Atlantic.

Aithos argues, however, that while regulatory frameworks are in place, the rush to deploy AI agents using these powerful frontier models lacks the technical tools to evaluate compliance, resulting in users and customers interacting with them facing serious risks.

The nonprofit’s own tool, dubbed Legal Assessment for Real-world Agents (LARA), simulates agents in realistic scenarios, and was used across some 3,000 tests of leading models. They built it to ensure AI behavior could be examined in public view and not limited to private labs, with all transcripts from the varying tests freely available.