France's data protection authority published a set of questions and answers on the use of generative AI systems, framing the obligations of the user of the system rather than only those of whoever trained it: legal basis, informing data subjects, controlling what is submitted, and vigilance about possible reuse of prompts.
"We use a sovereign model, so we are compliant." Appealing, and wrong. Hosting jurisdiction settles one question — access by a foreign authority — and settles no other. A model hosted in Europe can perfectly well receive data it should never have seen, retain it in logs, and surface it to another user of the same service.
What leaves? Most leaks do not come from the model but from the context sent to it: the whole document when an extract would do, the client database attached "to improve the answer". A well-built RAG system sends the passages it needs, not the corpus.
What happens to what left? Reuse for training, prompt retention periods, subprocessors, log location. Those answers are contractual, not technical — and they are checked before the first call, not after.
What can you prove? Logging of calls, model versions, sources used to produce an answer. Without that, a data subject request has no possible answer.
We treat this as a three-tier architectural decision, settled document class by document class: an international model where the data allows it, a model under European jurisdiction where it is sensitive, execution on the client's own infrastructure where it must not leave. All three coexist in a single project, and it is the upstream classification — not the vendor — that decides the path.
The standard has been published since 2024. What stalls enterprises is not picking an algorithm — it is knowing where cryptography actually sits, and how long already-deployed equipment will live.
CyberIA Labs