EU / European Union / revised 28 Oct 2026
Does the EU AI Act Mandate Data Residency? What It Requires
The AI Act is a product safety regulation, not a data localisation law. Nowhere does it require that prompts, training data or inference stay in the EU. What it does require, for high-risk systems and general-purpose AI models, is data governance, logging, transparency and technical documentation that make your routing choices visible to an auditor, while residency obligations continue to come from the GDPR and sector rules.
- Citation
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 10, 12, 19, 26, 50, 53 and Annex IV
- Regulator
- European Commission AI Office and national market surveillance authorities
- In force
- 1 August 2024
- Maximum penalty
- EUR 35 million or 7% of worldwide annual turnover for prohibited practices (Article 99(3)); EUR 15 million or 3% for other operator obligations, including high-risk requirements (Article 99(4))
No localisation clause, and GDPR still applies
Teams often assume the AI Act forces EU-hosted models. It does not. The Act applies to providers placing systems on the EU market wherever they are established, and Article 2(7) states that it is without prejudice to the GDPR. If your architecture must keep prompts in the EEA, the reason is Chapter V of the GDPR, professional secrecy, financial sector outsourcing rules or national health data law, not the AI Act.
Article 10: data governance for high-risk systems
Training, validation and testing datasets for high-risk systems must be subject to data governance practices covering collection, origin, preparation, assumptions and bias examination. Article 10(5) allows providers to process special category data strictly for bias detection and correction, under conditions that include pseudonymisation, access controls and deletion once the bias is corrected. These are quality and provenance duties, not location duties.
Articles 12, 19 and 26: logging and log retention
Article 12 requires high-risk systems to allow automatic recording of events over their lifetime. Providers keep the logs under their control for at least six months (Article 19), and deployers keep the logs under theirs for at least six months (Article 26(6)), unless other Union or national law says otherwise. Those logs frequently contain personal data, which brings them back under GDPR transfer rules.
Article 50, GPAI duties and the application timeline
Article 50 transparency duties (telling people they are interacting with an AI system, marking synthetic content) applied from 2 August 2026, with a short grace period to 2 December 2026 for machine-readable marking by generative systems already on the market. Obligations for providers of general-purpose AI models under Article 53, including technical documentation and a training content summary, have applied since 2 August 2025. The 2026 Digital Omnibus on AI moved the stand-alone high-risk obligations for Annex III systems to 2 December 2027, and those for Annex I regulated products to 2 August 2028. Annex IV lists what high-risk technical documentation must contain, including a description of the system's architecture and computational resources.
- 01
Traceable inference events
Article 12 logging is easier to satisfy at the gateway than inside every application. Each request should produce an event with model id, version, policy outcome and timestamp, retained for at least six months. - 02
Logs that respect the GDPR
Store the logs in the same jurisdiction as the prompts they describe, and hash or redact raw prompt text so the log itself does not become a second, unassessed transfer. - 03
Model and region provenance for Annex IV
Annex IV asks for a description of the system's elements and the resources used to develop and run it. A registry of which provider, model and region served each risk tier gives you that section without reconstruction. - 04
Separate risk tiers by policy
Tag high-risk use cases (credit scoring, recruitment, essential services) with a stricter policy pack so their routes, logs and model versions can be frozen and evidenced separately from low-risk chat. - 05
Disclosure hooks for Article 50
Expose a response header or metadata flag that downstream applications use to show users they are talking to an AI system and to label generated content.
| # | Rule | Legal rationale |
|---|---|---|
| 01 | When X-YTT-Policy is eu-ai-act-high-risk, allow only model ids registered in the tenant's approved model inventory. | Annex IV documentation describes a specific system. Silent model substitution would make the documentation inaccurate. |
| 02 | Pin model version for high-risk tenants and reject provider aliases such as latest. | Article 12 logs and post-market monitoring are only meaningful if the logged version is the version that ran. |
| 03 | Write a decision log entry for every high-risk request and retain it in-region for at least 183 days. | Articles 19 and 26(6) set a six-month minimum; keeping it in the origin jurisdiction avoids a GDPR transfer of the logs. |
| 04 | Apply the eu-gdpr-strict residency rules underneath the high-risk pack. | The AI Act does not supply a residency rule, so the GDPR transfer controls must be layered in explicitly. |
eu-ai-act-high-risk
The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.
Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.
How the policy engine workspackage yttsecunet.policies.eu_ai_act_high_risk
import rego.v1
import data.yttsecunet.policies.eu_gdpr_strict
min_log_retention_days := 183
approved_model if {
some m in data.tenants[input.tenant].approved_models
m.id == input.model.id
m.version == input.model.version
}
deny contains "model not in approved inventory" if not approved_model
deny contains "model alias not permitted for high-risk" if input.model.version == "latest"
deny contains "log retention below six months" if {
input.logging.retention_days < min_log_retention_days
}
deny contains msg if {
some msg in eu_gdpr_strict.deny
}
default allow := false
allow if count(deny) == 0Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.
Does the AI Act ban using a US-hosted model for a high-risk system?
No. It regulates the system's risk management, data quality, logging, oversight and documentation. Whether you may send personal data to a US endpoint is a GDPR question.
Are the high-risk deadlines still 2 August 2026?
Not any more. The 2026 Digital Omnibus on AI deferred stand-alone Annex III obligations to 2 December 2027 and Annex I product obligations to 2 August 2028. Prohibitions, AI literacy, GPAI duties and Article 50 transparency kept their earlier dates.
What are the fines?
Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for breaches of other operator obligations, which include the high-risk requirements.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.