EU vs US Data Hosting for AI Tools: Why Location Matters

With data hosting for AI tools, the location determines which law applies to your customer data, which contracts you need and how much documentation lands on your desk. This article explains the difference between EU and US data hosting in plain language and gives you a checklist you can use to assess any provider.

Why location matters more for AI tools than for other software

An AI assistant that answers calls or replies in your website chat processes exactly the data that most needs protecting: names, phone numbers, appointment requests and often the actual reason for getting in touch. In a physiotherapy practice that's the mention of back pain, in a law firm the dispute with the landlord, at a car dealership the question about financing. This content ends up in a database, but before that it is processed by a language model, logged and possibly stored for analysis.

So asking where the server is located isn't enough. It's just as important who runs the service, which sub-processors are involved and whether data is used to train models.

EU vs US data hosting: the legal differences

Processing within the EU

If personal data is processed in the EU, the GDPR applies directly, and you need a data processing agreement with the provider. Additional checks for transfers to third countries aren't needed, as long as all sub-processors also work in the EU or in countries with a recognised level of data protection. For your documentation, this is the simplest case.

Transfers to the USA

The GDPR sets additional requirements for transferring data to third countries. The European Court of Justice has already struck down one data exchange agreement with the USA in the past, in the well-known "Schrems II" ruling. Since then, the EU-US Data Privacy Framework has provided a new basis that US companies can rely on if they have registered for it. However, it has already been challenged in court, and nobody can say with confidence today how stable it will prove in the long run.

If a US provider isn't listed under this framework, other safeguards are needed, usually standard contractual clauses and an assessment of whether the data is adequately protected in the destination country. For a small business, that means extra work checking and documenting.

The catch with an EU data centre

A server in Frankfurt doesn't solve every problem on its own. If the provider belongs to a US group, it may be obliged under US law to give authorities access to data, even if that data is held in Europe. Data protection experts debate this point intensively. For you it means asking not only about the server location but also about where the operator and its parent company are based. You'll find a comparison in the article German vs international AI providers.

Where data quietly leaves the country with AI tools

Many providers advertise EU hosting but use services in the background that run elsewhere. Typical places:

• The language model: the application runs in the EU, but requests go to a model operated in the USA.
• Speech and transcription services: with phone assistants, speech is often converted to text by a separate service provider.
• Support and maintenance: staff in third countries have remote access to systems or logs.
• Analytics and monitoring tools: error reports sometimes contain snippets of conversations.
• Messenger channels: with WhatsApp or other services, their own terms apply as well.

A look at the list of sub-processors, which every reputable provider has to make available, usually reveals these points quickly.

Checklist: how to assess an AI provider

1. Server location: in which country, and with which data centre operator, is data stored and processed?
2. Operator: where is the provider based, and does it belong to a group of companies outside the EU?
3. Sub-processors: which services are involved, especially for the language model, speech and support, and where are they based?
4. Data processing agreement: is there an agreement under Art. 28 GDPR, and does it cover retention periods and technical measures?
5. Training: is your conversation data used to train models? Can this be excluded by contract?
6. Retention: how long are conversation logs and recordings kept, and can you delete them yourself?
7. Security: what evidence is there, such as information security management under ISO 27001 or comparable audits? The article ISO 27001 when choosing a provider explains why this matters.
8. Exit: how do you get your data back when the contract ends, and when is it deleted?

A provider should be able to answer these questions in writing and without evasion. For more on security as a whole, see AI data security for businesses.

Special requirements for professionals bound by confidentiality

Doctors, lawyers, tax advisers and psychotherapists are also bound by professional confidentiality. If they use external service providers, those providers must be bound to secrecy, and disclosure must be limited to what is necessary. Health data also belongs to the special categories of personal data, with stricter rules. In these professions a provider whose operations and data storage are entirely in the EU is usually by far the simpler choice. If in doubt, ask your data protection officer or your professional chamber.

Neurobots runs its digital employees in compliance with the GDPR on servers in Frankfurt am Main. ISO 27001 certification is in preparation. Regardless of that, we recommend going through the checklist above with us too and getting the answers in writing.

When US hosting can still be justified

Not every application is equally sensitive. An AI tool that only drafts anonymised texts or summarises publicly available product information hardly processes any personal data. Here a US service on a sound contractual basis can be justified. As soon as customer conversations, appointments or health details come into play, though, location carries far more weight.

Frequently asked questions

Is a server in Germany enough for GDPR compliance?

No. Location is an important building block, but the data processing agreement, sub-processors, deletion concept, access rights and informing your customers in the privacy policy count just as much. The article GDPR and AI chatbots gives an overview.

Can we still use US tools at all?

In principle yes, if there is a sound legal basis for the transfer and you document it. The effort is greater, and you share the risk of having to rework things if the legal situation changes.

What about the EU AI Act?

The EU AI Act doesn't regulate hosting location but obligations around AI systems. For customer communication this mainly means that people should be able to tell they are talking to an AI. Point this out at the start of the conversation.

Do we have to inform our customers?

Yes. Your privacy policy should name the AI assistant, the purpose of processing and the recipients. Transfers to third countries belong in it as well.

Conclusion

For data hosting of AI tools, an EU location is the simpler, lower-risk choice for most small and medium-sized businesses, especially where health, client or financial data is involved. What counts, though, is the overall picture of operator, sub-processors and contracts, not just the address of the data centre. The page AI practice assistant for medical practices shows how a digital employee with EU data storage works in a sensitive practice setting.