EU data rules for business AI: GDPR, the AI Act and US law
Four sets of rules decide where a European company can run AI and on what terms. None of them requires self-hosting, and all of them reward knowing where data goes.
Contents
A European company that wants to use AI faces four sets of rules: GDPR on personal data, the AI Act on AI systems, US law on providers headquartered there, and the contractual commitments providers make. Each answers a different question.
The question behind the hesitation
Eurostat reports that 52.52% of EU enterprises that considered AI but did not adopt it cited a lack of clarity about legal consequences, and 48.83% cited concerns about data protection and privacy1. Those are the two most common reasons after a lack of expertise. Much of the uncertainty comes from treating separate rules as one.
Four rules, four questions
| Rule | The question it answers | What it means for AI |
|---|---|---|
| GDPR transfer rules | May personal data leave the EU, and on what basis? | US providers in the Data Privacy Framework can receive personal data; other tools remain for other cases2 |
| EU AI Act | Is this AI system allowed, and what duties attach to it? | Risk-based duties on providers and deployers; no data-localisation requirement3 |
| US CLOUD Act | Can US authorities obtain data held by US-based providers? | Concerns US-based global providers, wherever data is stored; bilateral agreements extend access to partners4 |
| Provider commitments | Where will this provider store and process data? | For example, Microsoft’s EU Data Boundary for its enterprise online services5 |
GDPR and international transfers
GDPR does not forbid using non-EU providers. On 10 July 2023 the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework, under which personal data can flow freely to US companies that participate in it. The Commission notes that the US safeguards apply to all transfers to US companies, whichever transfer tool is used, and that they facilitate other tools such as standard contractual clauses and binding corporate rules2. For an AI project, the practical questions are whether the provider participates, which tool applies and whether the provider's sub-processors do too.
The AI Act timetable
The AI Act entered into force on 1 August 2024. Prohibited practices and AI literacy duties have applied since 2 February 2025, rules for general-purpose AI models since 2 August 2025, and the Act became generally applicable on 2 August 2026. The AI Omnibus, in force since 27 July 2026, moved the deadline for high-risk use cases in sensitive areas to 2 December 2027 and for high-risk systems embedded in regulated products to 2 August 20283. None of these duties depends on where the model runs. A company deploying a high-risk system has the same obligations on an EU cloud as on a US one.
US law and provider nationality
The US Department of Justice describes the CLOUD Act, enacted in March 2018, as a means to speed access to electronic information held by US-based global providers, and as the basis for bilateral agreements with trusted foreign partners. Agreements are in place with the United Kingdom and Australia, and EU-US negotiations resumed in March 20234. This is why some buyers distinguish data residency from sovereignty: data stored in Frankfurt by a US-based provider is resident in the EU, but the provider remains a US company.
What provider commitments cover
Microsoft's EU Data Boundary is the most detailed commitment of its kind. It covers Azure, Dynamics 365, Power Platform and Microsoft 365, with data centres in fifteen European countries, and Microsoft documents the limited circumstances in which data is still transferred outside it. Microsoft 365 customers in the EU or EFTA are in scope by sign-up location, except those with Multi-Geo capabilities; Dynamics 365 customers must both provision in the EU and EFTA region and keep an EU billing address5.
European providers make different promises. OVHcloud states that AI Endpoints is hosted in the EU and that customer data is never used for training6. STACKIT, from Schwarz Digits, states that data and queries are neither stored nor used for training7. OpenLazarus states that European companies can run on servers in the EU, under EU law, and that the code and data belong to the company8.
A checklist for any AI provider
- Where is data stored and processed, including logs and support access?
- Which transfer tool applies if data leaves the EU, and does it cover sub-processors?
- Where is the provider headquartered, and does that matter for your data classes?
- Is customer data used for training, and is that stated in writing?
- Who owns the system and the data, and can both be exported and run elsewhere?
- Which AI Act role does the company hold for this system (deployer or provider), and which duties follow?
Answering these six questions for each AI workload turns a vague concern into a documented decision. That record is what a data protection officer, an auditor or a customer will ask to see, and it is the basis of the comparison in our main guide.
Questions buyers ask
Can EU companies use US AI services under GDPR?
Yes. The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework in July 2023, so personal data can flow to participating US companies. Other tools, such as standard contractual clauses, remain available for other cases.
Does the EU AI Act require data to stay in the EU?
No. The AI Act regulates AI systems by risk, with prohibited practices and AI literacy duties applying since February 2025, rules for general-purpose models since August 2025 and general application from August 2026. It does not impose data localisation.
Does hosting in the EU protect data from US authorities?
Not by itself. The US CLOUD Act concerns access to electronic information held by US-based global providers, so the provider's nationality matters as well as the data's location.
Sources
- Use of artificial intelligence in enterprises. Eurostat. Accessed 8 Nov 2026.
- EU-US data transfers. European Commission. Accessed 8 Nov 2026.
- AI Act: regulatory framework for AI. European Commission, 19 Oct 2026. Accessed 8 Nov 2026.
- CLOUD Act resources. US Department of Justice. Accessed 8 Nov 2026.
- What is the EU Data Boundary?. Microsoft Learn, 21 Jul 2026. Accessed 8 Nov 2026.
- AI Endpoints. OVHcloud. Accessed 8 Nov 2026.
- STACKIT AI Model Serving. STACKIT (Schwarz Digits). Accessed 8 Nov 2026.
- Frequently asked questions. OpenLazarus. Accessed 8 Nov 2026.
Updated 8 Nov 2026: First published, reflecting the AI Act timetable as amended in 2026.