GDPR, sovereign hosting: what compliance for an industrial AI?

GDPR: what the CNIL now requires

The CNIL is clear: an AI system built on personal data must be developed with a determined purpose from the project's outset. Concretely, in an industrial setting, every AI use, including queries against a bill of materials, must rest on a legal basis and be documented. When an engineer queries a BoM through an AI interface, that use must have been approved beforehand, the same way access to a sensitive database would be.

A point of doctrine often misunderstood: the European Data Protection Board's December 2024 opinion establishes that GDPR applies to models trained on personal data, because of their memorization capabilities. Assuming a trained model automatically becomes anonymous is a legal mistake.

An AI project that starts without these elements documented is exposed to a formal notice, and may have to suspend its production deployment until it's regularized. For an ongoing industrial project, that's an operational risk as much as a legal one.

And this is where architecture already comes into play. The right to erasure or objection is only genuinely exercisable if you know exactly where your data is, and that it hasn't been duplicated into a third-party infrastructure you don't control. Data that never leaves your perimeter is data you can actually meet your obligations on.

Sovereignty: the European datacenter trap

This is the most common mistake in tenders. The Cloud Act is a US federal law passed in 2018. It lets US authorities require a US provider to hand over data stored anywhere in its infrastructure. A US company offering hosting in Europe is subject to it, and your data is de facto exposed there.

These frameworks don't just create compliance friction: they impose directly opposing legal obligations on US cloud providers operating in Europe. A legal report commissioned by the German Interior Ministry, published in December 2025, confirms it: any data hosted on a service managed by a US company remains subject to US jurisdiction, regardless of where the server is located.

"European industry built its factories on its own soil. It has the right to build its AI on the same principle."

For European companies, the Cloud Act can act as a lever for industrial espionage: research results, patents, negotiations, confidential projects can become accessible to US authorities. A tender that clears an AI vendor solely on server location leaves a gap open. The day your CISO or DPO spots it, the contract is already signed.

AI Act: a timeline that's accelerating

Obligations for general-purpose AI models have been in force since August 2, 2025. They cover in particular transparency and copyright compliance. Concretely, a vendor who doesn't document the data used to train its model, or can't explain how an answer was generated, is non-compliant, even if its tool is already deployed at your site.

A point often overlooked by buyers: if you purchase or integrate an AI system supplied by a third party, you remain co-responsible for its compliance. Obligations around transparency, documentation and risk assessment extend across the whole value chain. What's at stake in a PLM or industrial environment: auditability of decisions, traceability of answers, formalized human oversight. A deterministic AI, whose answers are explainable and reproducible, meets these requirements.

What it changes in practice

Across these three blocks, one distinction is decisive. GDPR, like parts of the AI Act, sit within a governance logic: defining purposes, keeping registers, producing documentation, setting up processes. These mechanisms roll out progressively, adjust as experience builds, and get audited after the fact.

But sovereignty of hosting and auditability of answers aren't processes: they're built into the system's architecture. And architecture is precisely what a contract amendment can never fix retroactively. A tool that wasn't designed to run on your infrastructure won't become one later; a model whose answers aren't reproducible won't become reproducible either.