Data Residency

Full definition

Drivers include GDPR international-transfer rules, the EU-US Data Privacy Framework, China's PIPL, schmes like FedRAMP, and sector-specific rules (health, finance). For AI systems, residency constrains: where prompts and responses can be sent, where vector stores live, where training data resides, and which model endpoints can be used. Major AI vendors offer regional endpoints (Azure OpenAI per-region, Anthropic on AWS Bedrock per-region, Vertex AI dual-region) to meet these constraints.

Why it matters

Data residency is the most common reason "just call the API" architectures fail in regulated industries. It dictates cloud region selection, which model versions are available, and whether self-hosting is required — sometimes adding 30-60% to the AI infrastructure budget.

Example

A German bank requires all customer data and AI inference inside the EU; the team uses Azure OpenAI in Frankfurt with a Private Link, plus a self-hosted Qdrant cluster, accepting a 25% cost premium over multi-region serving.

Related terms

• EU AI Act
  The EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive, risk-tiered regulation of AI systems, the world's first horizontal AI law, with obligations phasing in from February 2025 and full general-purpose AI rules applying from August 2025.
• AI Governance
  AI governance is the framework of policies, roles, controls, and processes an organization uses to ensure its AI systems are lawful, safe, fair, accountable, and aligned with business intent — across the full lifecycle from problem framing to retirement.
• AI Total Cost of Ownership (TCO)
  AI Total Cost of Ownership (TCO) is the total cost of an AI system over its full lifecycle — including model and inference costs, infrastructure, integration, data preparation, governance, monitoring, retraining, talent, and exit costs — usually expressed as 3-year fully loaded.
• Differential Privacy
  Differential privacy is a mathematical framework that bounds how much any single individual's data can influence the output of an analysis or trained model — providing a quantifiable privacy guarantee (epsilon) rather than relying on after-the-fact anonymization.