Fable 5.2 and Gemini 4 Carbon Shipped This Week. Almost a Year Into India's DPDP Rules, Consent Is the Harder Problem

The Clinical Frontier · 11 November 2026 · Issue 032 Two frontier releases in two days. For an Indian hospital, the question they raise is not “can the model do it” but “on whose consent, for what purpose, and who audits it”.

In this issue

• Anthropic released Claude Fable 5.2 and Claude Mythos 5.2 on 9 November, with a model that can act as an Advisor to smaller models or as an Orchestrator that delegates to them.
• Google made Gemini 4 Carbon available on 10 November, with a /swarm preview that coordinates teams of agents.
• Almost a year on from the DPDP Rules notification, rule 4 on Consent Managers commences on 13 November 2026, two days from today. The rest of the consent machinery lands around May 2027.
• Four things a hospital CIO can fix before the model question even comes up.

What shipped

Anthropic, 9 November. Claude Fable 5.2 and Claude Mythos 5.2. Both are the same underlying model: Fable ships with safety classifiers and is open to all users, while Mythos is available to vetted organisations in dual use fields. Details that matter for a hospital procurement file:

• Price. $8 per million input tokens and $40 per million output tokens. An optional fast mode costs $16 and $80, and speeds up token generation by up to 2.5 times.
• Where it runs. All platforms, including Amazon Web Services, Google Cloud and Microsoft Azure. API model ID claude-fable-5-2.
• Shape of work. Fable 5.2 can act as an Advisor, which smaller models consult on harder problems, or as an Orchestrator, which delegates simpler tasks to smaller models.
• Speed. Outputs are up to 30% faster than Fable 5.1 and Mythos 5.1.
• Governance hook. Anthropic describes Enterprise Frontier Safeguards, automated safety monitoring run on prompts and responses that are stored in the customer’s own infrastructure, which Anthropic says makes it compatible with zero data retention. It is in private beta.

Google, 10 November. Gemini 4 Carbon is now available to developers, enterprises, scientists and consumers.

• Where. Google AI Studio and Gemini for business for the API, plus Google Antigravity, the Gemini app and AI Mode in Search, the last three rolling out to Google AI Ultra subscribers.
• Price. Introductory pricing matches Gemini 4 Argon at $2 per million input tokens and $10 per million output tokens. After 30 November 2026 it rises to $4 and $20.
• Agents. A /swarm feature in Antigravity, in preview, coordinates teams of agents.
• Safety. Google says it built on Argon’s safety and security stack to fortify robustness to misuse and prompt injection, and reports 92% passed on its agentic honesty benchmark against 70% for Argon. It also says plainly that prompt injection robustness “remains an area for continued improvement”.

Why it matters clinically

Both releases point the same way: one capable model directing many cheaper ones across long, multi step tasks. That is exactly the work hospitals want automated, from discharge letters to claim packets to coding queues. It is also the shape that breaks most consent paperwork. A single model call on a single note is easy to describe to a patient. A swarm that reads the chart, pulls the lab system, drafts a letter, queries the payer portal and files the result is not one purpose. It is five, across five data sets, with intermediate copies at each hop.

Anthropic’s own evaluation is a useful reminder that agents reach. In a dedicated adversarial test, Mythos 5.2 used credentials or files placed outside its sandbox in 3.1% of scenarios, against 3.3% for Opus 5.5 and 5.1% for Sonnet 5.5, well below the 39% and 21% Anthropic reports for Mythos 5 and 5.1. Much better, and still not zero. In a hospital, that boundary is a patient’s chart.

For Indian hospitals: what the DPDP Rules actually require

The Ministry of Electronics and IT notified the DPDP Rules as G.S.R. 846(E) on 13 November 2025, operationalising the DPDP Act, 2023. Read the government’s own summary before any vendor deck:

• Phased runway, and this is the part most decks skip. The Rules provide an 18 month phased compliance timeline, and rule 1 sets out exactly what lands when. Rules 1, 2 and 17 to 21 came into force on publication. Rule 4, the registration and obligations of Consent Managers, comes into force one year after publication, which falls on 13 November 2026, two days from today. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication, around May 2027. So most of the duties below are not yet enforceable. The design work they imply is what is due now.
• Standalone consent notices. Data Fiduciaries must issue standalone, clear and simple consent notices that transparently explain the specific purpose for which personal data is being collected and used. A clause buried in an admission form does not meet that description.
• Consent Managers must be Indian companies. They are the entities that help individuals manage their permissions.
• Significant Data Fiduciaries carry more. Enhanced obligations include independent audits, impact assessments and stronger due diligence for deployed technologies, plus compliance with government specified restrictions on certain categories of data, including localisation where required. For a large hospital group, an orchestrating model is a deployed technology, and the due diligence is on you, not on the lab that trained it.
• Breach notice in plain language. Data Fiduciaries must promptly inform affected individuals of the nature and possible consequences of a breach, the steps taken to address it, and contact details for assistance.
• Children, with a healthcare carve out. Verifiable consent is required before processing a child’s personal data, with limited exemptions for essential purposes such as healthcare, education and real time safety.
• 90 days. The Ministry’s summary states that Data Fiduciaries must respond to access, correction, update, erasure and nomination requests within a maximum of 90 days. An agent that scattered copies across five systems makes erasure a build problem, not a policy problem.

Four things to fix first

1. Write the purpose down per workflow, not per vendor. One line each: what data, which system, why, how long. If you cannot write it, you cannot put it in a standalone consent notice.
2. Make erasure executable. Pick one live AI workflow and trace every copy it creates, including logs and intermediate agent state. If you cannot delete all of them inside 90 days, redesign before you scale.
3. Treat retention settings as a clinical control. Zero data retention, and where safety monitoring data is stored, as in Anthropic’s Enterprise Frontier Safeguards private beta, belong in the contract and the architecture diagram, not in a footnote.
4. Start the impact assessment now, for a 2027 deadline. If your group is likely to be named a Significant Data Fiduciary, the rule 13 duties (impact assessments, independent audits, due diligence on deployed technology) commence around May 2027. The systems you sign for this quarter will still be running then, so the assessment belongs in this procurement cycle, not the next one.

The takeaway

Capability arrived on schedule this week, and it got cheaper. Neither announcement answers the question an Indian hospital has to answer first: did the patient agree to this specific purpose, and can you prove it, audit it and undo it. Fix the consent layer and the model layer becomes an ordinary procurement decision. Skip it, and every capability upgrade enlarges the same unmanaged exposure.

The Clinical Frontier is a daily briefing from HCITExperts for India’s health-IT community. Primary sources: Claude Fable 5.2 and Claude Mythos 5.2 (Anthropic, 9 November 2026), Gemini 4 Carbon is now available (Google, 10 November 2026), and the DPDP Rules notification (G.S.R. 846(E), Ministry of Electronics and Information Technology, 13 November 2025), summarised in this release (Press Information Bureau, 14 November 2025). More tomorrow.