“It is hosted in Europe” is useful information, but it is not a complete answer.
An agency delivering an agent, RAG system or automation participates in a chain that may include the client, the agency, a cloud provider, a model provider, a vector database, observability and support services. Data can move through that chain even when the main server sits in Madrid, Frankfurt or Paris.
This article is not legal advice. It proposes technical and operational questions worth answering before deployment.
1. Who decides why and how data is processed?
The GDPR distinguishes between controllers and processors. The European Commission explains that a controller determines purposes and means, while a processor processes personal data on the controller’s behalf.
A real delivery agreement should clarify:
- what the client decides;
- what the agency decides;
- which instructions the infrastructure can execute;
- whether any party determines its own purposes;
- who handles requests and reports incidents.
The commercial label of a service does not automatically determine the legal role. What each party actually does matters.
2. What data really enters the system?
A diagram may show “documents” or “messages”. That abstraction can hide:
- names and contact details;
- employment or financial documents;
- conversation histories;
- identifiers inside logs;
- metadata and IP addresses;
- content included in prompts;
- generated output that reproduces source data.
Classifying data before choosing architecture makes retention, encryption, access and traceability more precise.
3. Where is it processed, not only stored?
The database region does not tell the entire story. Follow the path:
- data entry;
- temporary storage;
- extraction or transformation;
- model call;
- logging and monitoring;
- backup;
- technical support;
- deletion.
A service may store data in the EU while processing it or providing support from another jurisdiction. The European Commission notes that GDPR protection travels with personal data transferred outside the EU and that those transfers need a valid mechanism.
4. Which subprocessors participate?
“We use Azure” or “we use a European provider” is not a supply-chain inventory.
Maintain a list covering:
- hosting and network;
- models and AI APIs;
- email or messaging;
- observability;
- backups;
- support;
- development tools with production access.
For each one, record the contracting entity, location, purpose, accessible data, retention and change mechanism.
5. Is there an exit path for every piece of data?
Indefinite retention usually appears by default rather than by decision. An AI system may retain information in original storage, chunks, vector indexes, caches, logs and copies.
Deletion must account for all of them. It should also define what happens when the contract ends and how long backups take to expire.
A useful test is to choose one document and identify every copy or derivative of it.
6. Are client environments genuinely separated?
Separate interfaces do not necessarily mean separate data. Review isolation across:
- identity and permissions;
- secrets;
- networks;
- databases and indexes;
- storage;
- logs;
- backups;
- encryption keys;
- resource limits.
The appropriate level depends on risk. What matters is that it is an explicit, verifiable decision.
7. Who can access production?
A long list of permanent administrators undermines many theoretical controls.
You should be able to demonstrate:
- named rather than shared access;
- least privilege;
- strong authentication;
- joiner and leaver procedures;
- temporary access where possible;
- records of sensitive actions;
- an emergency procedure.
Include contractors, provider support and automated tools.
8. Can changes be reconstructed?
Traceability does not mean retaining every possible data point. It means preserving useful and proportionate evidence.
For an incident, you should be able to reconstruct:
- which version was deployed;
- which configuration changed;
- who approved the change;
- which service accessed which resource;
- which alert appeared;
- which action corrected or mitigated the problem.
Logs can contain personal data too. Design them with the same care as the application.
9. What responsibility does each party have for the AI system?
The EU AI Act distinguishes roles including providers and deployers. Its official scope and definitions are published on EUR-Lex.
Not every automation has the same risk and not every agency occupies the same role. Before accepting a label, examine who develops the system, under whose name it is put into service, who defines the intended purpose and who uses it under their authority.
Infrastructure should support any applicable obligations, such as documentation, records, supervision, version control or incident tracking.
10. What happens when a provider changes?
A model may change terms, available regions or retention policies. A subprocessor may join the chain. A feature may disappear.
The system needs a way to detect material change and decide:
- who reviews it;
- when the client is informed;
- which alternative exists;
- how data and configuration are exported;
- how long replacement would take.
Portability does not mean changing suppliers frequently. It means change remains a real option.
11. Is there a shared incident procedure?
The client, agency and infrastructure operator may detect different parts of the same incident.
Before production, agree:
- notification channel;
- severity levels;
- accountable people;
- minimum information;
- preservation of evidence;
- isolation decisions;
- communication and closure.
The worst time to discover responsibilities is during a data exposure.
12. Can the agreement be demonstrated?
A policy not reflected in configuration, records or procedures is difficult to verify.
Evidence may include:
- asset and supplier inventory;
- current diagrams;
- infrastructure as code;
- access reviews;
- restoration tests;
- deployment history;
- incident exercises;
- deletion records.
Not every agency needs a certification. Every agency operating client data needs to be able to explain how its controls work.
European hosting is not the same as European control
Location matters. It reduces some transfer scenarios and may satisfy contractual requirements. Control also depends on identity, subprocessors, support, encryption, portability and responsibility.
Before the next deployment, try answering all twelve questions on one page. Incomplete answers do not automatically mean non-compliance. They show where a commercial promise is not yet backed by a technical or operational decision.
