Infrastructure and sovereignty · Layer 4
AI hosting
Where your AI model runs and reads your data: at a provider, through an API, or in an environment you control.
A way to picture itIt is like choosing between sending your archives to a scanning bureau and bringing the scanner into your offices: the output is the same, but not the list of people who saw the documents.
In practiceDecide by category of data: a well-contracted API for everyday use, controlled hosting for sensitive data.
An HR department wants an assistant to answer staff questions on leave and pay. General questions on the collective agreement go through a major provider’s API, with a data processing agreement and reuse for training switched off. Individual files, which mention sick leave, are handled by an open-weight model hosted in a qualified cloud. The sorting rule is written down, and each request is routed according to its data category.
Processing outside the EU, or remote access by a provider from a third country, even for support, counts as a transfer according to the EDPB (EU · EDPB) and must be properly framed (EU · GDPR, Chapter V). A provider subject to US law can be compelled to disclose data in its possession, custody or control, wherever it is stored (United States · CLOUD Act). The SecNumCloud qualification (France · ANSSI) adds protection against such extraterritorial laws to its security requirements, for a specific service and perimeter. In every case, a provider processing data on your behalf signs a data processing agreement covering instructions, security, sub-processors and what happens to the data at the end of the contract (EU · GDPR, art. 28).
“In which countries are our requests processed and stored, who can access them from abroad, and which laws is your parent company subject to?”
Not on its own. The CLOUD Act (United States · Congress, 2018) targets the provider and what it controls, not where the data is stored. The risk is reduced by an operator outside US jurisdiction or, for stored data, by encryption keys beyond the provider’s reach.
Yes, if the transfer is properly framed: the adequacy decision of 10 July 2023 (EU · European Commission) covers companies certified under the Data Privacy Framework; standard contractual clauses serve for the others. You still need to check how long requests are kept, whether they are reused, and exposure to US law for sensitive data.
For particularly sensitive data held by the French State and its agencies, yes, or a recognised equivalent European certification (France · SREN Act, art. 31). For a private company, it is usually a purchasing criterion proportionate to the risk, not an obligation.
Educational explainer, not legal advice. Up to date as of 29 October 2026.