GDPR, the AI Act, and Sovereignty: Choosing an AI Solution Without Asking the Wrong Questions
The choice of an AI solution is often presented as a matter of product compliance. The reality is more complex: regulatory obligations fall largely on the user company, and no supplier contract transfers them.
Microsoft, in fact, states this quite clearly in its service assurance documentation: customers must align their use of AI with applicable compliance requirements, whether those are the GDPR, industry-specific regulations, or the European AI Act. This is a division of responsibilities, not just a formality.
What the provider covers
The sharing arrangement is explicitly documented, and it is worth understanding before entering into contract negotiations.
Microsoft is responsible for the infrastructure, model hosting, security systems built into the product, and platform compliance. The company acts as a processor under the GDPR, in accordance with its data protection addendum and product terms. It commits to not using customer data to train its foundation models without explicit authorization, and Microsoft 365 holds ISO/IEC 42001 certification for artificial intelligence management systems.
According to the same documentation, the following remain the customer’s responsibility: governance and oversight of AI use, internal policies, review processes, training on responsible use, management of identities, devices, and access, as well as data classification and protection. The customer also remains responsible for verifying the results produced.
In other words, product compliance is a necessary condition, but never a sufficient one.
The Issue of Localization, as Seen from Switzerland
This is the point on which most Swiss companies are asking the wrong question, assuming that they are outside the European framework.
The EU Data Boundary is the geographic scope within which Microsoft commits to storing and processing customer data for its enterprise services. It includes the countries of the European Union and those of the EFTA, of which Switzerland is a member. Microsoft further specifies that this scope is supported by data centers located in several countries, including Switzerland.
For Microsoft 365, eligibility is determined by the tenant’s country of registration: an organization whose tenant is registered in a European Union or EFTA country is included in the scope. There is one exception worth checking, as it is easy to overlook: customers who have subscribed to multi-geographic capacities are not included, even if their tenant is associated with a qualifying country.
Two documented limitations round out the picture, and they are by no means minor:
- The EU Data Boundary does not apply to web search queries generated by the assistant when it searches for information online;
- Anthropic models are currently excluded from this, as are, where applicable, commitments to process data within the country.
An organization whose internal policy requires that data processing be localized must therefore explicitly decide where it stands on these two issues, rather than assuming the matter is settled simply by using an enterprise service.
Things to Check Before Making a Choice
Five points, in the order in which they are best addressed.
- The country where the tenant is registered, and the lack of multi-geographic capability if you are targeting the European market.
- The rules applicable to each use: what falls under a contract for services, and what requires a web search subject to other conditions.
- Retention and retrieval: theretention period for interactions, and the ability to search for and produce them during an audit or legal dispute. Exchanges with the assistant are stored in the user’s inbox and follow your existing rules.
- The classification of the data you allow into the assistant's scope, and the protection rules that apply to it.
- Third-party providers you authorize: Microsoft explicitly states that you should review each provider’s privacy statement and terms of service to understand how it handles your organization’s data.
Microsoft also provides regulatory templates in its compliance manager, which allow users to assess a tenant against a given framework and track corrective actions. This serves as a documented starting point and should not be confused with a certificate of compliance.
Our Reading
The most frequently asked question is “Is this solution compliant?”—and that is a poorly phrased question. A solution is not compliant in an absolute sense: it is a process, within a given context and with a specific purpose, that may or may not be compliant. The same product may be perfectly suitable for drafting marketing materials but pose a real problem for analyzing medical records.
Our recommendation is to start with your business processes rather than the product catalog. List the three or four use cases you are actually considering, describe the data each one involves, and assess compliance on a use-case-by-use-case basis. This exercise takes half a day and saves months of discussion about a tool selection that wasn’t the real issue.
On one point, we differ from common practice. Many organizations wait for a comprehensive legal response before authorizing any use whatsoever, and in the meantime, their employees end up getting a head start on consumer-grade tools. We believe it’s a better approach to quickly authorize a limited and well-documented scope—uses that do not involve personal data or sensitive information—and then expand it as the analysis progresses. The risk of waiting isn’t zero; it’s simply less visible.
One last thing we’d like to make clear: a provider’s certification does not protect you. It confirms that the platform is properly managed, which is both useful and necessary. Before a regulatory authority, it is your own documentation—impact assessment, legal basis, information provided to individuals, retention periods—that will be examined. No provision in a provider’s contract can replace this work.
What to Do
- Check your tenant's registration country and whether it has multi-geographic capabilities.
- List your three or four actual use cases and describe the data for each one.
- Make a clear distinction regarding the issue of web search, which falls under a different framework.
- Focus on the models that are exempt from localization requirements, if your internal policy includes such requirements.
- Determine how long interactions should be retained, and make sure you know how to retrieve them.
- Require each authorized third-party agent to provide its own terms of service.
- Keep records of your treatments. It is these records—not the provider’s—that will be requested.
Items 1 through 5 should be handled internally with your IT teams and your data protection officer, without outside assistance. What warrants support is the alignment between these configurations and your specific obligations, particularly in regulated sectors. Lambert Consulting facilitates this process with the relevant parties, drawing on the details of the regulations applicable to data processed by an AI assistant and on a preliminary assessment of existing practices, which often reveals processing activities that no one had reported.
Microsoft Sources
What an article Can't Know
An article describes what applies to everyone. What varies from one organization to another is the inventory: which applications, which accounts, and which pieces of equipment are actually involved in your organization. The inventory determines the scope of the effort, and it cannot be summarized on a single page.
You'll be speaking directly with the engineers who will be doing the work, not with a middleman. We'll respond within 24 business hours.
Check what is still true
Announced dates are sometimes postponed, products are renamed, and conditions change. The blog tracks these topics over time: when a rule changes, a new post announces it.
Search for a topic in the blogIn the same issue
Three articles on the same topic. The blog has 149 articles, all of which are freely accessible.