Where does my data go when AI runs in the cloud?

Three questions, not one

When AI runs in the cloud, your text and files are sent to computers run by the vendor or its partners. Three questions decide your exposure:

1. Where is it stored? This is usually what people mean by data residency.
2. Where is it processed? The AI model may run in a different place from where your files are kept.
3. Whose laws apply? A provider headquartered in one country may have to answer to that country's authorities wherever the data sits.

Would it help to know which of your AI tools keep data in your region, and which do not? Book a free AI Value Briefing and we will look at it with you.

EU and US hosting options

Major vendors increasingly let business customers choose a region, but the details vary by product and even by feature. Three examples from the vendors' own pages, read on 27 October 2026:

• Microsoft states that Copilot is an EU Data Boundary service for EU customers, while noting that models provided by Anthropic as a sub-processor are currently excluded from that boundary.
• OpenAI's API documentation describes a Europe region (EEA and Switzerland) for storage and processing, available under specific retention arrangements that need approval.
• Google's Workspace privacy hub notes that an organisation's data region settings do not apply to data in one of its Gemini features.

The lesson: ask which features are covered, not only whether a region exists.

GDPR and transfers to the US (European Union)

Under the EU General Data Protection Regulation, personal data may leave the EU or EEA only with a legal basis for the transfer. Two are common for US vendors:

• EU-US Data Privacy Framework. The European Commission adopted an adequacy decision on 10 July 2023, so personal data can flow from the EU to US companies that take part in the framework (European Commission). On 3 September 2025 the EU General Court dismissed an action to annul that decision (Case T-553/23, Court press release). Rulings can be appealed and the framework has been challenged before, so ask your legal adviser for the current position.
• Standard Contractual Clauses (SCCs). Model contract clauses pre-approved by the Commission, in their current version since 4 June 2021 (European Commission). Many vendors include them in their data processing terms as a fallback.

Check that your vendor names its transfer mechanism in writing.

The US CLOUD Act in plain words (United States)

The CLOUD Act, enacted in March 2018 (US Department of Justice), says that a US provider served with valid legal process must preserve or disclose data in its possession, custody or control, regardless of whether the data is located inside or outside the United States (text of the Act, section 103). The Act also lets a provider ask a US court to weigh the interests of a qualifying foreign government in some cases.

In practice, keeping data in an EU data centre of a US company does not by itself put it out of reach of US authorities. For many organisations this is an acceptable, low-likelihood risk; for some, such as those handling state, defence or highly sensitive data, it is a deciding factor.

Sovereignty options and encryption

• European providers. AI services run by companies headquartered and operating in the EU reduce exposure to non-EU laws.
• Sovereign cloud offers. Some large vendors offer EU-operated versions with local staff and separate controls; read exactly what is promised.
• Encryption. Data should be encrypted in transit and at rest. Keys held by you, rather than the vendor, add protection, though the AI still needs to read the content to work on it.
• Keep highly sensitive data out. Not everything needs to go to the cloud; anonymise where possible.

This is general information, not legal advice.

Goes deeper in our free AI Field Guide: 10. Data safety: what never to paste, and other rules, 13. Connectors and integrations: letting AI use your tools safely. Ask for these guides.