You're using AI with your customers' data. Do you know exactly where it is right now?

Your team is using AI tools every day. To draft proposals. To summarise meetings. To analyse contracts. To classify support tickets.

And in almost every conversation, the prompt contains data that belongs to your customers.

So here's the uncomfortable question: do you know exactly where that data is being processed right now?

The legal gap nobody is talking about loud enough

When you use the big US AI providers — OpenAI, Anthropic, Google, Microsoft Copilot — the data you submit travels outside the European Union to be processed. Even if the front-end is hosted in Frankfurt or Madrid, the inference happens on infrastructure governed by US law.

Two regulations collide on that journey:

• The GDPR says that for certain categories of personal data, transferring it outside the EU without specific safeguards is illegal.
• The US Cloud Act says US authorities can compel American providers to hand over data — regardless of where the servers physically sit — without notifying you.

Both can be true at the same time. And both, in fact, are.

Your customers signed a contract with you. Not with a third party.

When a client trusts you with their information, they're trusting you — your processes, your jurisdiction, your accountability.

If that data ends up being processed by a third-party provider you didn't disclose, in a country whose laws differ from those agreed in the contract, you have a problem. Not a theoretical one. A regulatory one.

And the people in charge of pointing that out — auditors, regulators, compliance officers, opposing counsel — are getting better at it every quarter.

There's AI the customer controls. And there's AI that depends on third parties.

The good news: this is solvable. The choice isn't "use AI" or "don't use AI." It's "where does the inference run?"

Open-source models running on European infrastructure — or, better, on infrastructure you own — give you the same productivity gains without the jurisdictional problem. Llama, Mistral, Qwen and others now match or beat the previous generation of commercial models for most enterprise tasks. The technology has caught up. The deployment story is what's still missing in most companies.

The question to ask before your next AI rollout

Before you sign the next AI contract, before you let the next department turn on Copilot for everyone, ask:

• Where is the inference actually running?
• Under whose jurisdiction is that infrastructure?
• Have you mapped the customer data that flows through these tools?
• Does your DPA cover what the provider is actually doing with the prompts?

If you can't answer all four in under a minute, you don't have an AI strategy — you have AI exposure.

Where we come in

At AP Interactive we deploy private LLMs on infrastructure we operate ourselves under autonomous system AS215691 — in Madrid, the Netherlands and Germany. EU-only inference, no Cloud Act exposure, full audit logs.

If you want to know whether your current AI setup meets the legal bar your customers expect of you, talk to us. We'll map your data flows and tell you, in plain language, where you stand.