When planning a chatbot, image pipeline or voice application, we also need to establish how the computation works. Prompts, images and audio may reach an external provider. Its headquarters do not tell us precisely where that material is processed.
For a tax practice or hotel on Mallorca, the practical questions are which content leaves the system, who receives it and under which rules. European processing is one possible architecture, not an automatic legal guarantee.
What AI Inference Actually Is#
Training develops the model. Inference applies it: generating an answer, editing an image or transcribing speech. Search, storage, logs and messaging can process additional data in the same application.
Computation can run on owned hardware or through an API. The actual region must be checked for the selected service and configuration. US headquarters do not automatically mean US inference, just as a European invoice does not prove European processing.
US Providers, International Transfers and the Legal Position#
Reviewed on 30 September 2026. Legal basis, processor arrangements and possible international transfers need separate assessment. A US service is not unlawful merely because of its headquarters.
The CLOUD Act can concern disclosure of stored data in an affected provider's possession, custody or control, regardless of location. It does not let any authority obtain arbitrary information without lawful procedure. Jurisdiction, lawful orders and provider structure matter. An EU data centre alone does not remove the question.
After Schrems II, the EU-US Data Privacy Framework was adopted in 2023. The General Court dismissed the action challenging it on 3 September 2025. An appeal was filed. Litigation or an appeal is not the same as invalidating an adequacy decision. Whether a particular transfer can rely on the framework depends, among other things, on the covered and appropriately certified recipient.
What EU-Sovereign Inference Means#
Sovereignty is not a uniform certification. It may refer to European hardware, a European contracting party or control over the model and operations. These properties should be stated separately.
A reliable commitment requires checking inference region, storage, logs, subprocessors, support access and connected functions. A European intermediary may use other services. Its agreement does not replace examination of the entire chain. Training, retention and transmission are separate issues.
An Example in Palma: Socaity#
Socaity offers image, video, voice and other AI services with different hosting options. Its website describes selectable regions and infrastructure paths including Azure, Scaleway and RunPod.
That makes it a possible planning option. It does not establish that every endpoint processes exclusively in the EU by default, or that every configuration excludes US providers. Region, subprocessors, retention and terms need clarification for the selected service.
What This Means for Your Project#
Before integrating a service, we document what data enters it, where it goes and who may read it. For personal and sensitive information, this assessment belongs before the first production call.
A hotel can promise EU processing for specified content only when the selected chain supports it. The promise should explain which data and steps it covers. Website hosting, inference and external booking or messaging services are separate parts of one application.
Costs and model quality should be compared for the actual task. “EU rarely costs more” or “no loss of quality” are not reliable claims without that comparison.
Honestly: the Limits#
A smaller European catalogue may be sufficient. A larger provider may offer suitable regional configuration. Both require assessment; origin and size alone do not decide.
Anonymous inputs reduce privacy concerns only when individuals genuinely cannot be identified. Internal non-personal information may still be confidential. Images, recordings and seemingly neutral queries should not be treated as harmless automatically.
The Takeaway#
European inference can be part of a controlled deployment. What matters is the demonstrated processing chain. To discuss your project's options, contact us.
Sources and review date#
Reviewed on 30 September 2026.
