Anthropic has all the answers for that. You’ll go through some compliance exercises and classify them as a subprocessor of highest tier of data sensitivity.
Almost all companies are content to engage with data sub-processors with respect to customer data or some form of PII.
But there are many that will absolutely not let their IP visit or reside on systems they do not control.
This is absolutely a deal breaker for a ton of organizations and it's not going to trigger industry wide adoption like other comments here suggest. Instead another provider will offer a more appetizing deal and they will win market share.
That might work in some countries but Anthropic approach here doesn't fit the legal requirements in the EU.