Data residency by design: pinning AI work to a jurisdiction

Most organisations handle data residency through contracts. A cloud agreement names a region, a data processing addendum lists sub-processors, and a transfer impact assessment explains why that is acceptable. That approach worked when the workload was a database that stayed put. AI inference is different. A single user request may pass through a router, a retrieval step, a model on one provider and a fallback on another, all within a few hundred milliseconds. A contract cannot follow that path. The request path itself has to enforce the rule.

This article sets out what that requires and where the legal requirements differ by region. It also covers what evidence is realistic to expect, since an honest answer on evidence is what separates engineering from marketing here.

Residency is a routing constraint, not a storage setting

For inference, the data that matters is in flight. The prompt, any retrieved documents, intermediate tool outputs, the KV cache on the serving GPU and the generated answer are all personal or confidential data while they exist. Residency therefore needs answers to three questions about every request:

1. Which machines were allowed to serve it? This is a filter applied before routing, not a log reviewed afterwards.
2. What happens when none qualify? A residency rule that quietly falls back to a cheaper region when local capacity is busy only holds when nothing goes wrong.
3. What survives the request? Caches, logs and failover state may carry the data to another machine after the answer is returned.

The design principle that follows is to fail closed. If no machine in the permitted jurisdiction can serve a request, the request is refused, with an error that says why. Availability then becomes a capacity-planning problem you can solve, rather than a compliance gap you discover later.

Failover is where residency usually breaks

Production inference needs failover. Providers go down, GPUs throw errors, and long conversations must survive a node restart. Every failover mechanism is also a data transfer. If a session's KV cache is checkpointed to a standby machine, the standby must be in the same jurisdiction as the primary. If a stalled stream is resumed on another provider, that provider must also meet the pin.

Residency therefore has to be an input to successor selection, not a separate check. The useful pattern is to assign the backup at the start of a session, using the same jurisdiction rule as the primary, and preferably with a different operator or site so a single outage does not take out both.

The legal picture differs by region

The engineering pattern is the same everywhere. The legal triggers are not.

European Union. The GDPR restricts transfers of personal data to third countries unless an adequacy decision, appropriate safeguards or a specific derogation applies. For the United States, the EU-US Data Privacy Framework provides adequacy for certified organisations under a decision the Commission adopted on 10 July 2023. The General Court upheld it on 3 September 2025 in the Latombe case, as IAPP reports. An appeal is pending before the Court of Justice (case C-703/25 P). Its two predecessors were struck down, so many EU buyers want the option to keep inference inside the EEA whatever happens on appeal.

United Kingdom. The Data (Use and Access) Act 2025 replaced the "essentially equivalent" standard for international transfers with a data protection test: protection abroad must not be materially lower than in the UK. According to Burges Salmon, the provisions came into force on 5 February 2026. The test is more flexible than the EU's, but UK organisations serving EU customers still have to meet both regimes.

Saudi Arabia. The Personal Data Protection Law has been fully enforceable since September 2024. SDAIA's amended Regulation on Personal Data Transfer outside the Kingdom, effective 1 September 2024, permits transfers with appropriate safeguards such as standard contractual clauses or binding common rules, as Mayer Brown summarises. Public sector and regulated sectors often go further and require in-Kingdom hosting by policy. That is why Gulf AI buyers often ask about local capacity before they ask about price.

India. India's approach is the reverse of the EU's. Under the Digital Personal Data Protection Act 2023, transfers are permitted by default unless the government restricts a named country by notification, and stricter sectoral rules, such as the RBI's payment data localisation, still apply (King Stubb & Kasiva). The DPDP Rules were notified on 13 November 2025 with a phased start. According to Hogan Lovells, the cross-border transfer provisions become operative on 13 May 2027.

Across these regimes, sovereignty is expressed through a mix of default-deny, default-allow and sector rules. A useful infrastructure layer should not try to encode every law. It should let the buyer state a constraint precisely, enforce it without exceptions, and record that it was met.

Evidence: what a locality record can and cannot prove

Here precision matters. No cryptographic primitive proves where a computation physically happened. Latency triangulation can bound distance, but not reliably enough to settle a legal question. What can be proven is narrower and still useful:

• Which machine served the request. A hardware-rooted identity key signs the response, so the record names one physical node rather than a cluster or an account.
• What that machine's operator declared. The operator states the node's country and blocs in advance, and the declaration is signed.
• That the declaration was bound to a measured environment. On confidential-computing hardware, the declaration can be tied to an attestation report, so it cannot be moved to a different machine.
• That a false declaration costs something. If the operator has published a policy listing its jurisdictions, a signed receipt from outside them is self-contained evidence of a violation, and the operator's stake and reputation stand behind the claim.

This amounts to accountable locality: a signed claim with a named, staked author whose falsehood can be proven after the fact. It is the same evidential standard as a data processing agreement, with a signature behind each request instead of each contract.

What this means for policy makers and CTOs

For EU and national policy makers, the useful requirement to write into procurement and guidance is per-request evidence: a signed record naming the serving machine and its declared jurisdiction, with refusal rather than fallback when no compliant capacity exists. Avoid requiring proof of physical location, which no technology can provide.

For CTOs, three questions separate real residency from residency in name only. Does routing fail closed? Does failover respect the pin? Can you verify the record yourself, without asking the provider? If any answer is no, the residency guarantee is a contract term and nothing more.

Where Tenzro fits

Tenzro is an open network for AI compute and inference. It is live in preview, and governance decides the steps to testnet and mainnet. Jurisdiction-pinned inference is built:

• Pins. A request names a jurisdiction pin, such as "DE,EU" or "SA", on the OpenAI-compatible endpoint, over RPC, over MCP or in the CLI. Only providers whose declared country or bloc matches are candidates.
• Fail-closed matching. A node with no declaration never satisfies a pin. If no matching provider serves the model, the request is refused with an explicit error. For streaming requests the refusal comes before the first token.
• Signed jurisdiction receipts. A pinned response can carry a receipt binding the request hash, response hash, model, provider and declared jurisdiction. On confidential-computing nodes the declaration is bound to the attestation report. The consuming node verifies the receipt before passing it on, and a caller can require one.
• Pinned continuity. Multi-turn sessions can have a standby or hot successor that holds the session's KV cache. The successor is chosen under the same jurisdiction pin, from another operator or site.
• Operator policies. An operator can publish a signed policy listing its jurisdictions. A receipt served outside them proves a violation that fails the operator in every trust verdict that reads it.

The documentation is explicit that a jurisdiction receipt is a signed, attestation-bound claim, not proof of geography. That limit is the honest position for the whole industry.