The sentence that causes most of the confusion
When a provider writes "EU data residency", it means that the data is physically stored or processed in an EU data centre. That is a real, verifiable and useful statement.
What it does not mean: that every element of the processing stays in the EU, that support cannot look in from elsewhere, that the contracting party falls under EU law, or that a third country's authority cannot request access. Geography and jurisdiction are two separate questions, and marketing material routinely treats them as one.
(This article is not legal advice — have your own lawyer review the decision.)
Three different things that get conflated
Separate these three and half the procurement conversation resolves itself:
- Data residency. Where the data and the computation physically are. Region choice, endpoint, data centre. Verifiable, and the easiest to satisfy.
- Data-protection compliance. A GDPR basis, a data-processing agreement, a list of subprocessors, a deletion deadline, training use. This is settled in the contract, not on the map.
- Sovereignty. Whose law the contracting party falls under, who owns it, who has operational access, and which country's authority can demand data. This is the hardest one, and no region dropdown solves it.
What European options exist today?
In autumn 2026 these routes exist, from easiest to hardest:
- An EU endpoint at the large providers. Several major American vendors offer a separate European-region project or endpoint where processing runs in an EU data centre.
- A cloud data zone. The big cloud providers offer an EU data zone or EU inference profile for their models, under your existing contract.
- A European vendor. There is an EU-developed model family with its own European endpoint — here the contracting party is an EU entity too.
- An open-weight model at an EU provider. Downloadable models can be run by any European operator you sign a contract with yourself.
- Self-hosting. Your own server or your own rented machine. Here the question is settled — in exchange the cost and the operations are yours.
Seven questions that decide how sovereign it is
These are the seven to put to the provider. Together the answers give the picture:
- Who is the contracting party? The EU subsidiary or the parent company? Which country's law governs?
- Who owns it, and where? The jurisdiction of the company at the end of the ownership chain is what counts, not the subsidiary's.
- Who are the subprocessors? Ask for the list in writing. Behind an EU endpoint there can still be a non-EU sub-provider.
- Who can look in from operations? Support, debugging and monitoring often come from somewhere other than where the data is.
- Who holds the keys? Encryption with EU key management or with the provider's key — not the same thing.
- What is the legal basis for transfers? If anything leaves, it needs a valid mechanism.
- Do they train on it? By default, or only with consent? This differs between consumer and business plans.
What does the law require, and what does it not?
Two separate rule sets apply to you, and they do not substitute for each other.
GDPR is about personal data and has been in force for years. It is what requires a data-processing agreement, a legal basis, a transfer mechanism and deletion rules. AI is no exception to it.
The EU AI Act is about AI systems and takes effect in stages. The obligations on general-purpose models have been enforceable since 2 August 2026. What touches you from this is typically not the model vendor's obligation but your own deployer-side documentation and transparency. One important difference: the AI Act does not prescribe data location. If you want EU storage, that is a business or GDPR decision, not an AI Act requirement.
How strict should you be? Three levels
Not every kind of data needs the same treatment. Three levels are enough at most companies:
Public or neutral content. Marketing copy, a blog post, an internal note with no sensitive data. Here residency is not a question — use whatever does the job well.
Internal business data. Proposals, pricing, plans, customer names. Here you need a data-processing agreement, training switched off and preferably an EU endpoint. At most companies this is the main category.
Special category data. Health, biometric, criminal-justice, or personal data at scale. Here all seven questions need answers, and self-hosting is often the only clean solution.
The practical order
Four steps, in this order — most companies start with the third, and that is the mistake:
- First classify the data into the three levels above. Without that you will apply the strictest rule to everything, and work grinds to a halt.
- Then look at what you already have. If the company uses a large cloud provider, the models may already be reachable in an EU region under your existing contract.
- Only then choose a provider, using the seven questions.
- Finally, write down what runs where. A one-page table of which task runs at which provider in which region — that is what you have to produce in an audit.
What to take away
Data residency is geography, sovereignty is jurisdiction — the two are not the same, and "a server in Frankfurt" on its own settles only the first. The seven questions produce the real picture, and GDPR and the AI Act are two separate systems, of which only the former is about data location. And classify the data first; choose the provider second.