Guide
GDPR-compliant AI hosting: what to require
“GDPR-compliant AI hosting” is what buyers search for. Nobody can sell you compliance: the GDPR regulates your processing, and a platform can only be built to its requirements. This page lists what to require from any AI vendor.
A prompt is data processing
The GDPR does not ban AI. It requires you to know what personal data goes where, on what legal basis, and who can reach it. For AI that reduces to one sentence: a prompt is data processing. If client, employee or patient data is in it, every rule that applies to any other processing applies to it.
Three risks of public AI
-
Data leaving for a third country
If a prompt contains personal data and the provider processes it outside the EU, or under a US parent company, that is a transfer question, and it ends up with your data protection officer.
-
Training and retention
The terms of public services change: what learns from your prompts, how long they are kept, who can access them. What you switched off today can be the default tomorrow.
-
Shadow AI
The biggest risk is the tool nobody contracted: the colleague pasting client data into a private account because it is faster. The way to end it is a private tool that is just as convenient.
The CLOUD Act: what “EU region” hides
Under the US CLOUD Act (2018), US authorities can compel a US-based provider to produce data even when it is stored in the EU. A US cloud or AI provider’s “Frankfurt region” is in Europe geographically, but its operator still answers to US law. US providers remain usable, but your data protection officer has to assess that exposure too. “The data stays in the EU” is not enough on its own. The full question is: where is the data, and whose law reaches it?
The simple answer is servers in the EU under an operator in EU jurisdiction, with no US processor in the path. Your own datacentre, or your own EU service provider’s, gives you both.
Five things to require from any AI vendor
- EU residency and an EU operator
- Where exactly does the model run, and who owns the operator? Require both: servers in the EU and an operator under EU law.
- A DPA that covers the whole trail
- Beyond the chat: prompts, logs, embeddings, backups. Where does each live, who can access it as an operator, and where is that access logged?
- No training on your data, in writing
- Whatever the vendor, get the no-training commitment written into the contract.
- Provable deletion and export
- Retention you control, deletion you can demonstrate, and a documented export path with deadlines if you leave.
- A commitment with something behind it
- Availability and recovery expectations written into a contract, and infrastructure (redundancy, backups, monitoring) that makes them credible.
GDPR compliance is a process, not a product. Private AI on your own servers or at your service provider solves the technical side: the data stays with you, and every request is logged. Legal bases, notices and internal policies remain your work and your lawyer’s.
Practical guidance, not legal advice.
How ATAILA answers each
ATAILA is a platform you run on your own hardware, or your service provider runs for you. Built to the requirements of ISO/IEC 42001 and the EU AI Act. For the GDPR, what matters is that prompts, documents, logs and embeddings stay on your machines. No model trains on your data, because the models are open models you loaded yourself. Every request, every user and every release is on record, so an auditor can see who did what.
Your data, code, models and backups are yours. An exit guarantee, written into the contract. The availability commitment is one your own team or your provider signs, on machines you can inspect; ATAILA stands behind the platform with updates, security fixes and third-line support.
See the platform in detailOwnership and exitHow pricing works
Bring your data protection officer’s checklist.
We walk through it line by line, including the questions we cannot answer for you.