Disclosure: I work at Melious, an EU-hosted and EU-owned AI inference platform, so we have a stake here. Trying to keep this useful on its own. Most AI data-residency discussions stop at “which region is the endpoint in.” That answers where prompts are processed, not whose law can compel access to them. What the CLOUD Act actually does: since 2018, US authorities can compel providers subject to US jurisdiction to disclose data in their “possession, custody, or control,” regardless of where it’s stored (18 U.S.C. § 2713). So the EU region of a US-controlled provider is still in scope. What matters is the control chain: the provider, its parent company and every sub-processor. Why this matters more for AI than for classic cloud: • Prompts are unusually dense data: code, contracts, internal docs, customer tickets. Often more sensitive than the database rows companies spent years locking down. • Agents and RAG pull context in automatically, so teams often can’t say exactly what ends up in a given API call. • The LLM API is often the sub-processor nobody lists. Plenty of “European” AI tools are thin wrappers around a US model API. What it doesn’t mean: it’s not evidence that US providers routinely hand over data. Microsoft France told the French Senate in 2025 that it couldn’t guarantee data wouldn’t be handed over, while also saying it had never happened so far. GDPR Art. 48 says a foreign court order alone isn’t a valid basis for a transfer, so providers can end up in a genuine conflict of laws. Hyperscaler “sovereign cloud” setups (EU subsidiaries, EU-based management) try to address this, but they haven’t been tested against an actual CLOUD Act order in court. A practical checklist if you’re choosing an LLM provider for EU data: Who is the ultimate parent company, and where is it incorporated? What’s on the full sub-processor list, including whoever hosts the model? Can you minimize what goes into the prompt for your use case, or is the prompt itself the sensitive part? Curious how others handle this: does jurisdiction actually come up in your vendor selection, or is “EU region” still enough for most buyers? (Longer write-up in the comments for anyone who wants the details.) submitted by /u/MeliousAI_HQ
Originally posted by u/MeliousAI_HQ on r/ArtificialInteligence