EU Data Residency for AI in Law Firms: Where ChatGPT, Claude, Gemini, Copilot and the Legal Platforms Actually Process Data

Ask three vendors whether their tool is “EU-hosted” and all three will say yes. Then read the footnotes. OpenAI will store a new Enterprise workspace in Europe, but Business gets nothing. Anthropic’s own platform keeps your workspace in the United States however you configure it. Microsoft calls Copilot an EU Data Boundary service and, three lines later, says the boundary “doesn’t apply to web search queries” and that “Anthropic models are currently excluded” (Microsoft Learn).

EU data residency for AI in law firms is therefore not a yes-or-no question. It is a table with footnotes, and the footnotes are where the professional-secrecy risk lives. Training and retention by tier are in the confidentiality cluster; this page is about geography, as of September 2026.

Storage versus inference: two different promises

Storage at rest means your conversations, files and instructions sit on disks in a named region. Inference means the model that reads your prompt and writes the answer runs there too. Most marketing covers the first and is silent on the second, where the prompt is actually exposed.

OpenAI’s history shows the gap: at-rest residency for new Enterprise workspaces in early 2025, in-region GPU inference only on 16 January 2026 (OpenAI, data residency). Anthropic’s documentation keeps an inference setting and a workspace setting with different options (Anthropic, data residency). Ask every vendor both questions, and which subprocessors sit behind the answer.

The residency table

From the vendors’ own pages, 12 and 13 September 2026; “Not stated” means the page did not say.

OpenAI: Enterprise, Edu and the API, not Business

New Enterprise and Edu workspaces can be created with data at rest in Europe. API projects created with the Europe region are “handled in-region … with zero data retention, meaning model requests and responses are not stored at rest on our servers”.

The developer guide adds what the sales deck omits: “Data residency endpoints are charged a 10% uplift for models released on or after March 5, 2026”, and non-US residency requires approval “for abuse monitoring controls” plus a “Modified Retention amendment” (OpenAI, your data). The Business versus Enterprise comparison explains why EU-facing firms end up on Enterprise.

Anthropic: US first-party, EU only through Bedrock or Vertex

The first-party API’s inference_geo setting accepts “global”, the default, which “may route to any Anthropic-operated data center worldwide”, or “us”, priced at 1.1 times on Claude 4.6 and later. For storage: “Currently, “us” is the only available workspace geo.” Claude Enterprise gets the same two inference choices and the same US storage; no Anthropic page offers Team anything different.

European processing of Claude therefore runs through AWS Bedrock EU regions or Google Cloud Vertex regional endpoints, where the region follows the endpoint and the hyperscaler, not Anthropic, is your processor. One wrinkle survives the move: from 9 June 2026 Anthropic’s “covered models” retain prompts for 30 days “on every platform where these models are offered”. The Claude guide covers the product side.

Google: clear on training, quieter on geography

Google’s Workspace privacy hub answers the first question lawyers ask: content “is not human reviewed or otherwise used for Generative AI model training outside your domain without permission”, under the Cloud Data Processing Addendum. On where Gemini inference runs for a European tenant the pages we checked are less explicit, so put that question in writing.

Microsoft: the EU Data Boundary and its two exclusions

Microsoft completed the EU Data Boundary on 26 February 2025 and states that “For EU customers, Microsoft Copilot is an EU Data Boundary service”. It then carves out two things. “The EU Data Boundary doesn’t apply to web search queries”, which go to Bing “with user and tenant identifiers removed”, Microsoft acting as an independent controller rather than your processor. And “Anthropic models are currently excluded from the EU Data Boundary and when applicable, in-country processing commitments.”

One development helps: the Microsoft–Mistral expansion of 21 July 2026 promises Mistral models “from cloud-scale deployments to customer-controlled and fully disconnected operations”. The Copilot guide covers oversharing, which no boundary fixes.

Legal platforms: Legora, Harvey and Noxtua

Legora, born in Stockholm, lists EU and US residency with ISO 42001, SOC 2 Type 2 and bring-your-own-key encryption; JuriScout calls its hosting “EU-by-design”. Harvey states that it “requires Zero Data Retention (ZDR) by model providers” and offers a Frankfurt region; JuriScout nonetheless assesses it as “not positioned as §203-compliant at architecture level”, a third-party view; test it by asking for a § 43e BRAO agreement.

Prices and the § 203 architecture question are in legal AI tools for Germany, Austria and Switzerland.

The Data Privacy Framework after Latombe, and the CLOUD Act

Transfers to the US providers rest on the EU-US Data Privacy Framework. On 3 September 2025 the EU General Court dismissed Philippe Latombe’s challenge and confirmed the 2023 adequacy decision. Latombe appealed to the Court of Justice on 31 October 2025; the appeal is pending, and WilmerHale notes that “the European Court of Justice has historically been more skeptical than the General Court” (WilmerHale). Keep standard contractual clauses in the DPA regardless; they are what survives if the appeal succeeds.

The CLOUD Act is the other half. EU hosting by a US provider does not by itself stop a US production order, which is why the CCBE’s technical guide of 27 March 2026 tells lawyers to ask “What is the physical location of the provider’s data centre? What laws will govern the processing of data …?” and whether the lawyer “will be informed by the provider before or at least immediately after disclosure” to law-enforcement authorities (CCBE technical guide).

For German and Austrian lawyers the server map is not even the test. BRAK reads § 203 StGB so that it does not matter whether the provider actually looks, “Ausreichend ist … dass sie die Möglichkeit dazu haben”, and advises that “zumindest KI-Anbieter mit Serverstandorten in Deutschland oder Europa bevorzugt werden sollten” (BRAK Hinweise). ÖRAK’s provider checklist demands servers “innerhalb der EU oder in einem sicheren Drittstaat mit Angemessenheitsbeschluss” and notification of any search. Patent lawyers add the USPTO’s foreign-filing-licence warning, covered in the IP guide.

Article 28 terms and SCCs: the contract does the work

GC AI’s privacy team states the recursive point: “the moment you send a draft DPA to an AI platform, that platform becomes a processor of the personal data inside it” (GC AI). Its Article 28(3) checklist is the one to run on the AI vendor’s own DPA: subject matter, purpose and data types; documented instructions; confidentiality and Article 32 security; sub-processor authorisation and flow-down; international transfers (2021 SCCs, Module Two, UK Addendum, Swiss annex); data-subject assistance; breach notification; audit rights; deletion or return. Then check the subprocessor list: location per entry, objection rights, and zero data retention versus mere no training. A legal-AI wrapper adds a subprocessor rather than removing one.

You are reviewing an AI vendor's data processing agreement for a [German / Austrian / UK] law firm as controller. Compare <dpa>[paste]</dpa> and <subprocessor_list>[paste]</subprocessor_list> against our standard positions <standard>[paste]</standard>. Output a table: Clause | Our position | Their text (quoted or MISSING) | Gap | Proposed redline. Cover every Article 28(3) term, then add rows for storage region; inference region; each subprocessor with location; transfer mechanism (DPF entry or SCCs, module named); zero data retention versus no training; law-enforcement disclosure and notification; deletion at matter end; a professional-secrecy undertaking (§ 43e BRAO / § 40 RL-BA). Finish with the five points to negotiate first. Cite only the documents supplied.

A residency checklist for procurement

Six questions condense the CCBE list, ÖRAK’s checklist and the vendors’ own footnotes. Ask them in writing and file the answers next to the AI-literacy records the EU AI Act’s Article 4 expects, explained in the Article 4 guide.

1. Storage region for conversations, files and backups, and whether existing workspaces can move (OpenAI: no).
2. Inference region, named, and its price (OpenAI: 10% uplift; Anthropic: 1.1x for US only).
3. Subprocessors with location per entry, and any excluded from the vendor’s own boundary (Microsoft: Anthropic models).
4. What leaves the boundary anyway: web search, abuse monitoring, safety classifiers, “covered model” retention.
5. Transfer mechanism and law-enforcement access: DPF entry today, SCCs regardless, governing law, notification of a search.
6. Deletion at matter end, and admin controls that lock the residency choice.

Here are the current privacy page, DPA, subprocessor list and data-residency documentation for [vendor and plan]: <docs>[paste]</docs>. For each question, quote the exact sentence that answers it and name the source document: storage-at-rest region; inference region and any price uplift; whether existing workspaces can be moved; subprocessors with location; anything excluded from the stated boundary (web search, abuse monitoring, specific models); transfer mechanism; law-enforcement disclosure and notification; retention that survives deletion; who at the vendor can access content. Where the documents are silent, write NOT ADDRESSED. Do not infer, soften or fill gaps. End with the three questions I must put to the vendor in writing.

This prompt drafts the vendor letter.

Draft a vendor questionnaire for [AI tool] on behalf of a [jurisdiction] law firm bound by professional secrecy. Sections: (1) storage and inference regions with any exclusions; (2) subprocessors and model providers with location and role; (3) data that leaves the stated region (web search, abuse monitoring, classifiers, retained "covered models"); (4) transfer mechanism and current DPF status; (5) law-enforcement access, governing law, and notification before or immediately after disclosure; (6) retention, deletion and what survives zero data retention; (7) willingness to sign a [§ 43e BRAO / § 40 RL-BA] undertaking and an Article 28 DPA with SCCs; (8) admin controls locking these choices. Each item as a question with a must-have or nice-to-have column and space for the answer and evidence. Plain and courteous.

Where to go next: the vendor due-diligence checklist turns these questions into a scored procurement file, and the tier-by-tier confidentiality guide covers training and retention, which residency does not touch; the prompts above sit in the prompt library. AI Lab for Lawyers is taught from Vienna, and in the confidentiality session each participant maps the tier and the region of every tool they actually use, live, before we practise anonymising a real document.