EU / European Union / revised 6 Nov 2026

The EU-US Data Privacy Framework and US AI Vendors

Since 10 July 2023, personal data can flow from the EU to a US organisation without SCCs if that organisation has self-certified under the EU-US Data Privacy Framework. For AI teams the useful questions are narrower than they look: is the exact importer on the DPF List, does its certification cover the data in the prompt, and what happens to every US route on the day the adequacy decision is suspended or annulled.

Test a sovereign route Talk to a sovereign architect

Citation: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, adopted under GDPR Article 45; US Executive Order 14086
Regulator: European Commission (adequacy and periodic review) and EU supervisory authorities; US Department of Commerce and Federal Trade Commission on the US side
In force: 10 July 2023
Maximum penalty: Transfers without a valid Chapter V basis: up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher (GDPR Art. 83(5)(c))

Statutory text

An adequacy decision that covers a list, not a country

The Commission adopted Implementing Decision (EU) 2023/1795 under Article 45 GDPR on 10 July 2023. It finds that the United States ensures an adequate level of protection for personal data transferred from the EU to organisations included in the Data Privacy Framework List, which the US Department of Commerce maintains and publishes. A transfer to a listed organisation needs no further Chapter V tool. A transfer to a US company that is not on the list, or whose certification has lapsed, falls outside the decision and needs SCCs, binding corporate rules or an Article 49 derogation.

Organisations join by self-certifying to the Department of Commerce that they comply with the DPF Principles, and must re-certify every year. Only organisations subject to the investigatory and enforcement powers of the Federal Trade Commission or the Department of Transportation are eligible, so entities outside those powers, such as most banks, cannot take part. Each list entry states whether the certification covers HR data, non-HR data or both, and an organisation that fails to re-certify moves to inactive status.

Executive Order 14086 and the Data Protection Review Court

The decision rests on commitments in Executive Order 14086 of 7 October 2022, which requires US signals intelligence activities to be necessary and proportionate to defined objectives, and on a two-layer redress mechanism. A complaint is first examined by the Civil Liberties Protection Officer in the Office of the Director of National Intelligence and can then be reviewed by the Data Protection Review Court, set up by Attorney General regulation. These safeguards apply to personal data transferred to the US under any transfer tool, which is why transfer impact assessments for SCCs also rely on them.

The Commission's first periodic review, published on 9 October 2024, concluded that the US had put the necessary structures and procedures in place, and set the next review three years later. The oversight bodies the decision describes matter to its stability: in January 2025 the President removed the Democratic members of the Privacy and Civil Liberties Oversight Board, leaving it without a quorum, a change critics of the framework cite when they argue that one layer of oversight has weakened.

Latombe v Commission: upheld at first instance, under appeal

Philippe Latombe, a member of the French National Assembly, asked the General Court to annul the decision. On 3 September 2025 the General Court dismissed the action in Case T-553/23. It found that the Data Protection Review Court offered sufficient guarantees of independence and impartiality, and that the limits US law places on bulk collection by intelligence agencies, together with the oversight around them, were adequate. The Court assessed the legal position as it stood when the decision was adopted in July 2023.

Mr Latombe lodged an appeal with the Court of Justice on 31 October 2025 (Case C-703/25 P), which was pending at the time of writing. The Court of Justice is the court that annulled Safe Harbor in October 2015 and Privacy Shield in Schrems II (Case C-311/18, 16 July 2020), so the appeal is a planning risk to take seriously rather than a formality.

What happens to AI routing if adequacy falls

When the Court of Justice invalidated Privacy Shield, it did so with immediate effect, and the EDPB confirmed there was no grace period for exporters still relying on it. The Commission can also suspend, amend or repeal an adequacy decision itself under Article 45(5). Any of these outcomes would leave every US route that depends on the DPF without a Chapter V basis overnight.

The usual fallback, Article 46 SCCs, would not be a clean substitute. The transfer impact assessment that EDPB Recommendations 01/2020 asks for currently leans on the same Executive Order 14086 safeguards. If the Court found those safeguards insufficient, SCC-based transfers to US AI vendors would need supplementary measures that still work against a provider who must read the prompt in clear text to run the model, and few such measures exist. For inference, the durable answer is an EU processing path that is configured, tested and ready to take the traffic.

Technical requirements for the inference path

01
Certification status as a live endpoint attribute
Store the importer's DPF List identifier, status, covered data types and next re-certification date on each US endpoint record. Re-check against the published list on a schedule, because an inactive entry stops being a transfer basis the day it lapses, whatever the vendor's trust page still says.
02
Match the legal entity, not the brand
AI vendors often contract through one legal entity and run inference through another, or through a cloud provider. Confirm that the entity receiving the data is the certified one, or a subsidiary the certification names, and that onward transfers to its sub-processors meet the Accountability for Onward Transfer Principle.
03
An EU twin for every US model alias
For each model alias that resolves to a US endpoint, register an EU endpoint able to serve the same workload: the vendor's EU region, an EU deployment on a hyperscaler, or a self-hosted open-weight model. Measure quality and latency on it now, not on the day the US route closes.
04
One switch for the whole tenant
Hold the adequacy status as policy data rather than code. Changing a single value from in force to suspended should re-resolve every DPF-based route to its EU twin without an application release, and every receipt from that moment should show the new basis.
05
Receipts that name the transfer basis
A receipt that records the resolved country, the importer and the transfer basis (DPF, SCCs or none) lets you show a supervisory authority exactly which requests relied on the DPF during any period, which is the first thing you will be asked if the decision falls.

Prescribed YTT Secunet routing rules

#	Rule	Legal rationale
01	Permit a US endpoint on the DPF basis only when the importer's DPF List entry is active and covers the data class of the request.	The adequacy decision covers listed organisations for the data types their certification names; anything else needs a different Chapter V tool.
02	Re-verify DPF status daily and deny the route when an entry becomes inactive or its re-certification date passes.	Lapsed organisations are no longer covered, and the gateway is the only place where that check runs on every request.
03	Reject configurations in which a DPF-based model alias has no registered EU endpoint.	Without a tested EU twin, a suspension or annulment turns into either an outage or an unlawful transfer.
04	When the tenant's adequacy flag is set to suspended, deny all DPF-based routes and resolve to EU endpoints only.	Privacy Shield fell with immediate effect and no grace period; the policy has to be able to do the same within minutes.
05	Keep special category data and restricted labels on EU endpoints for eu-gdpr-strict tenants, even where the US importer is certified.	Certification supplies a transfer basis, not a reason to send more sensitive data than the use case needs; Article 9 and the DPIA still decide.

Policy pack excerpt

eu-dpf-transfer

The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.

Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.

How the policy engine works

regoeu-dpf-transfer.rego

package yttsecunet.policies.eu_dpf_transfer

import rego.v1

entry := data.dpf.list[input.endpoint.importer.dpf_id]

dpf_basis if {
	data.dpf.adequacy_status == "in_force"
	entry.status == "active"
	input.request.data_class in entry.covered_data
}

permitted if input.endpoint.jurisdiction == "EU"

permitted if {
	input.endpoint.country == "US"
	dpf_basis
	not input.request.label in {"restricted", "special_category"}
}

deny contains "US importer lacks an active DPF certification for this data" if {
	input.endpoint.country == "US"
	not dpf_basis
}

deny contains "DPF route has no registered EU fallback" if {
	input.endpoint.country == "US"
	not data.routes[input.tenant.id][input.request.model_alias].eu_fallback
}

default allow := false

allow if {
	permitted
	count(deny) == 0
}

Audit checklist

Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.

01Every US AI vendor relied on under the DPF appears on the DPF List as an active participant, checked on a recorded date.
02Each certification covers the right data type: non-HR data for customer prompts, HR data for employee-facing use cases.
03The contracting entity and the certified entity are the same, or the certification names the subsidiary that receives the data.
04The record of processing names the DPF as the transfer basis for each certified US vendor, and SCCs for vendors that are not certified.
05Each DPF-based model alias has an EU endpoint that has served production-like traffic within the last quarter.
06A runbook names who changes the adequacy flag, on which trigger (a Court of Justice judgment or a Commission act), and how internal owners are told.
07Receipts for a recent month can be filtered by transfer basis to list every request that relied on the DPF.
08Transfer impact assessments for SCC-based US routes record their dependence on Executive Order 14086.

EU-US Data Privacy Framework: frequently asked questions

Is an AI vendor's DPF certification enough on its own?

It gives you a Chapter V basis for transfers to that organisation, for the data types it certified. You still need an Article 6 legal basis, an Article 28 processor agreement, and a DPIA where the processing is likely to be high risk. Certification also says nothing about the vendor's own sub-processors beyond the onward transfer obligations it accepted.

What did the General Court decide in Latombe?

On 3 September 2025 it dismissed the action for annulment in Case T-553/23 and upheld the adequacy decision, assessed as of its adoption in July 2023. The applicant appealed to the Court of Justice on 31 October 2025, and that appeal was pending at the time of writing.

If the DPF falls, can we switch to SCCs the same day?

You can sign them quickly, but they need a transfer impact assessment, and current assessments for the US rely on the same Executive Order 14086 safeguards a court would have just found wanting. Plan for EU processing as the immediate fallback and SCCs as a slower, case-by-case route.

Does the DPF settle the CLOUD Act question?

No. The DPF addresses signals intelligence access and redress for transferred data. Disclosure orders served on US providers under the CLOUD Act are a separate analysis, covered in our CLOUD Act guide.

Sovereign route ready

Stop risking 4% global turnover GDPR fines on AI inference.

Deploy sovereign, cryptographically proven AI routing in 15 minutes.

Schedule an architecture demo Start 14-day trial