
Black Forest Labs
- Rank
- Score
- 4/149
- 60 out of 100
Black Forest Labs is an artificial intelligence company based in Freiburg im Breisgau, Germany, founded in 2024 by Robin Rombach, Andreas Blattmann and Patrick Esser. It develops the Flux family of text-to-image and image editing models, offered as open weights and through its API.
Is FLUX safe?
FLUX scores 60 out of 100 and ranks 4 of 149. Its strongest category is Security, and its weakest category is Transparency.
How is FLUX scored?
FLUX is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- Not found
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50huggingface.co (opens in a new tab) · 23 Oct 2026 - Not found
Did an outside organisation test the model before release?
Company claim0/50huggingface.co (opens in a new tab) · 23 Oct 2026
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
Not enough dataProtecting children
100Points for each confirmed yes.
- Yes
Does the model card report child-safety tests or safeguards?
Company claim50/50“Prior to releasing FLUX 3 Image Klein, we evaluated and mitigated a number of risks, including child sexual abuse material (CSAM) and noncon…” MoreLess
“Prior to releasing FLUX 3 Image Klein, we evaluated and mitigated a number of risks, including child sexual abuse material (CSAM) and nonconsensual intimate imagery (NCII).”
huggingface.co (opens in a new tab) · 23 Oct 2026 - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“Our Services are not directed towards, and we do not knowingly collect, use, disclose, sell, or share any information from children under th…” MoreLess
“Our Services are not directed towards, and we do not knowingly collect, use, disclose, sell, or share any information from children under the age of 18 (“Minors”).”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026
Strong written policies; outside evidence is weaker.
Model documentation
75Points for each confirmed yes.
- Yes
Does the model card describe what the model can do?
Company claim25/25“FLUX 3 Image Klein is a 5.6B open weights model for text-to-image generation and image editing.”
huggingface.co (opens in a new tab) · 23 Oct 2026 - Not found
Does the model card report test results?
Company claim0/25huggingface.co (opens in a new tab) · 23 Oct 2026 - Yes
Does the model card state the model's limitations?
Company claim25/25“This model is not intended or able to provide factual information.”
huggingface.co (opens in a new tab) · 23 Oct 2026 - Yes
Does the model card describe safety safeguards?
Company claim25/25“Prior to releasing FLUX 3 Image Klein, we evaluated and mitigated a number of risks, including child sexual abuse material (CSAM) and noncon…” MoreLess
“Prior to releasing FLUX 3 Image Klein, we evaluated and mitigated a number of risks, including child sexual abuse material (CSAM) and nonconsensual intimate imagery (NCII).”
huggingface.co (opens in a new tab) · 23 Oct 2026
Training-data disclosure
10Average of two independent training-data checks: the Stanford index and an academic grading of EU AI Act training-data summaries.
- 10
EU AI Act training-data summary grades (AI Accountability Lab)
Independent sourceAI Accountability Lab (opens in a new tab) · 10 Nov 2026
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
50Average of the commitments signed.
- Yes
Has it signed the EU code of practice for general-purpose AI?
Company claim100/100“Black Forest Labs”
European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
Security programme and certifications
100Points for each confirmed yes.
- Yes
Is there a way to report security flaws, such as a bug bounty?
Company claim34/34“Contact: mailto:security@blackforestlabs.ai”
bfl.ai security contact (opens in a new tab) · 20 Oct 2026 - Yes
Does it state it holds a SOC 2 Type II report?
Company claim33/33“Black Forest Labs Inc Report SOC 2 Type 2 .pdf”
trust.bfl.ai security page (opens in a new tab) · 20 Oct 2026 - Yes
Does it state it holds ISO 27001 certification?
Company claim33/33“Black Forest Labs ISO 27001:2022 Certificate”
trust.bfl.ai security page (opens in a new tab) · 20 Oct 2026
Software vulnerabilities
Not enough dataData breaches
Not enough dataClear privacy policy
100Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“Communication Information, such as name, address, phone number, and email, which we use to provide the Services and to communicate with you.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say whether your data is used to train AI?
Company claim20/20“We may collect, store and use information you provide via the Services, including text prompts, uploaded content (like images) (together, th…” MoreLess
“We may collect, store and use information you provide via the Services, including text prompts, uploaded content (like images) (together, the “Inputs”), tasks the Service undertakes on your behalf, such as system interactions, research activities and visual grounding (“Tasks”) and the corresponding generated outputs to train and improve our AI models after implementing appropriate technical safeguards like data minimisation and deidentification techniques.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“We retain your information for as long as is reasonably necessary to provide our Service to you, or for other legitimate business purposes s…” MoreLess
“We retain your information for as long as is reasonably necessary to provide our Service to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations..”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“We may disclose your information as follows to: Our affiliates or others within our corporate group.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“You may have certain rights in relation to your information, to the extent provided by applicable law: Access: You have the right to access…” MoreLess
“You may have certain rights in relation to your information, to the extent provided by applicable law: Access: You have the right to access information we hold about you, how we use it, and who we share it with.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026
Training-data defaults
50100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- No
Is your data used for training only if you opt in?
Company claim0/100bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you stop your data being used for training?
Company claim50/50“If you object to us using your data for training and improvement purposes, you can contact us at privacy@blackforestlabs.ai using the subjec…” MoreLess
“If you object to us using your data for training and improvement purposes, you can contact us at privacy@blackforestlabs.ai using the subject heading “Training Opt Out” and providing your account details.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“Portability: You have the right to receive a copy of the information we hold about you and to request that we transfer it to a third party,…” MoreLess
“Portability: You have the right to receive a copy of the information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“You can also stop using the Services entirely and request deletion of your data at any time.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
Not enough dataCourt judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“Should you have any questions about this Privacy Policy, wish to report an incident or would like to request a copy of data associated with…” MoreLess
“Should you have any questions about this Privacy Policy, wish to report an incident or would like to request a copy of data associated with your account, please email us at privacy@blackforestlabs.ai and contact our Data Protection officer dpo@blackforestlabs.ai.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“If you think we have infringed data protection laws, you can file a claim with the data protection supervisory authority in the country in w…” MoreLess
“If you think we have infringed data protection laws, you can file a claim with the data protection supervisory authority in the country in which you live or work or where you think we have infringed data protection laws.”
bfl.ai privacy policy (opens in a new tab) · 20 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
2 Nov 2026
Score 60
Method 2 Nov 2026
+2
28 Oct 2026
Score 58
Method 28 Oct 2026, update 2
-7 · combines both 28 Oct updates (28 Oct 2026 - Update 1 and 28 Oct 2026 - Update 2)
23 Oct 2026
Score 65
Method 21 Oct 2026
+3 · Data fix
21 Oct 2026
Score 62
Method 21 Oct 2026
-3 · Method update
20 Oct 2026
Score 65
Method Not recorded
-