GDPR-compliant AI: how to use AI APIs the European way

What does GDPR-compliant AI mean?

GDPR-compliant AI is the use of an AI system in a way that meets the General Data Protection Regulation: a legal basis for each purpose, a contract with every processor, a lawful route for transfers, short retention and respect for people's rights. The GDPR regulates the processing of personal data, not products, so no AI model or AI API is GDPR compliant on its own.

The GDPR doesn't mention AI, but every rule applies as soon as a prompt, an uploaded file or a model output contains personal data: a name, an email address, a customer number, a support ticket, a CV. Pseudonymised data still counts as personal data under Recital 26 of the GDPR, so removing names alone rarely takes a use outside the law.

An AI vendor can make compliance easier or harder. The easiest setup keeps the whole chain in Europe: a European company as your processor, servers in the EU and AI providers headquartered in the EU. Then the hardest GDPR questions, transfers and foreign law, don't come up for your AI traffic. That is the setup EUrouter is built for, as the section on the European way below shows.

Who is the controller when you call an AI API?

When a company sends personal data to an AI API to get an answer for its own purpose, the company is the controller and the AI provider is usually its processor, as the EDPB guidelines on controllers and processors describe. The controller carries the GDPR obligations; the processor may only act on the controller's instructions.

An AI provider that uses your prompts for its own purposes, such as training its models, decides the purpose of that processing itself. Article 28(10) GDPR treats a processor that does this as a controller for that processing, which is why a no-training commitment matters in an AI contract.

What does the GDPR ask of a team using AI APIs?

The GDPR puts its obligations on your company as controller, not on the AI vendor. Using an AI API with personal data touches these rules:

A GDPR breach can cost up to €20 million or 4% of worldwide annual turnover, whichever is higher, under Article 83(5) GDPR. More often, a misused AI tool leads to a reportable data breach, an order to stop the processing or a complaint from a customer.

Which legal basis applies to AI processing?

No legal basis ranks above another under the GDPR; each company picks the one that fits each purpose. The European Data Protection Board's Opinion 28/2024 on AI models, adopted on 17 December 2024, says legitimate interest needs a three-step test: a real and lawful interest, processing that is necessary for it, and a balancing test against people's rights and reasonable expectations.

The same EDPB opinion adds a duty for companies that use someone else's model: as part of its accountability, a company deploying an AI model should check that the model was not developed by unlawfully processing personal data, in more depth when its own use is riskier. France's CNIL finalised recommendations on AI development on 22 July 2025 that help document whether a model trained on personal data falls under the GDPR.

In November 2025 the European Commission proposed GDPR changes that would state that AI-related processing can rest on legitimate interest, as part of its Digital Omnibus. The proposal had not been adopted when this page was reviewed, so the current GDPR text applies.

Do you need a DPA to use an AI API?

Yes, whenever prompts, files or outputs contain personal data that the AI provider processes for your company. Article 28 GDPR requires a binding contract with every processor, usually called a data processing agreement or DPA. A use with no personal data at all needs no DPA, but free-text input from customers or staff almost always contains some.

Article 28(3) GDPR lists what the DPA must cover. For an AI API, check that it says:

• the provider processes personal data only on your documented instructions
• the provider's staff are bound to confidentiality
• the provider applies the security measures of Article 32
• the provider uses sub-processors, such as the cloud that hosts the model, only with your authorisation, and you can object to new ones
• the provider helps you with data subject requests, breaches and DPIAs
• the provider deletes or returns the data at the end of the contract
• the provider gives you the information and audits you need to show compliance

The GDPR text doesn't mention four points that matter most for AI: whether the provider trains on your data, how long it keeps prompts and outputs, where inference runs, and which law the provider answers to. Look for each of them in the DPA, the terms or the provider's data controls.

Do you need a DPIA to use AI?

Often, yes. Article 35 GDPR requires a data protection impact assessment before processing that is likely to result in a high risk, "in particular using new technologies". Summarising internal documents without personal data may not need one; screening job applicants, answering patients or scoring customers with an AI model is likely to.

A DPIA for an AI API describes the data sent, the purpose, the provider and its sub-processors, retention, transfers, the risks to people (wrong outputs, leaks, unfair decisions) and the measures that reduce them. A DPIA is shorter when the data never leaves Europe and never reaches a company under foreign law.

What risk does a US AI provider bring?

A US AI provider can sign a DPA and run servers in the EU, and using it can be lawful. What it can't change is that US law applies to the company wherever your data is stored, and that the legal basis for EU-US transfers has been struck down twice. For strategic or sensitive data, that is a risk to weigh, not a box to tick.

• US law follows US companies, not servers. The CLOUD Act obliges US providers to disclose data in their "possession, custody, or control" under a US warrant or order, "regardless of whether" it is stored inside or outside the United States (18 U.S.C. § 2713). An EU region of a US company doesn't change who that company answers to.
• The legal basis has fallen twice. The Court of Justice of the EU struck down Safe Harbor on 6 October 2015 (Schrems I, C-362/14) and Privacy Shield on 16 July 2020 (Schrems II, C-311/18), both times over US authorities' access to Europeans' data. The current EU-US Data Privacy Framework, adopted on 10 July 2023, survived a first challenge at the General Court on 3 September 2025 (T-553/23). The applicant appealed to the Court of Justice on 31 October 2025 (C-703/25 P), so check its status before you rely on the framework.
• Control ends at the border. Once data sits with a US company, what happens to it is governed by that company's terms and by US law, and both can change without you having a say. That is a strategic dependency, not only a compliance question.

None of this makes a US provider unlawful: the Data Privacy Framework and Standard Contractual Clauses are valid transfer tools today. A company that relies on SCCs runs a transfer impact assessment, as the EDPB recommendations on supplementary measures describe. What it does mean is extra legal work and a risk outside your control. That is why many DPOs ask for two things for their most sensitive data: processing in the EU, and a provider headquartered in the EU.

What is the European way to use AI under the GDPR?

The European way is to run your AI with European companies, on European servers, under European law. With a European processor and EU-headquartered providers, your AI traffic involves no transfer outside the EEA and no company subject to US law, so what's left is the GDPR work every company does anyway: a legal basis, a privacy notice and, where needed, a DPIA. EUrouter is the easy path: one OpenAI-compatible API, EU-hosted on every plan and one setting away from European companies only.

A European company, with its router in Amsterdam

EUrouter B.V. is a Dutch company in Amsterdam, and its terms are governed by Dutch law. The router runs on Scaleway in Amsterdam, and section 5 of the EUrouter DPA commits EUrouter to processing personal data only within the EEA, with no transfer outside it unless you authorise it in writing.

Section 4 of the EUrouter DPA covers requests from authorities: EUrouter discloses personal data only on your written instruction or an order from a judicial or administrative authority, tells you within 5 business days where the law allows, and gives you a reasonable opportunity to respond before it discloses, unless the law requires otherwise.

EU-only on every plan, Free included

Every EUrouter request goes only to providers configured with EU-hosted endpoints, by default, on every plan from Free upwards (pricing, routing docs). There is no EU endpoint to remember and no plan to upgrade to. When a provider is down, EUrouter retries with another EU-hosted provider of the same model, so a request never leaves Europe to stay online.

European companies all the way down

On 27 October 2026, 15 of the 17 providers in the EUrouter catalog were headquartered in the EU, among them Mistral AI, Scaleway, OVHcloud, IONOS and Nebul (providers). The other two, AWS Bedrock and Microsoft Foundry, are US companies that serve Claude and GPT models from EU configurations. When your policy asks for European companies only, set eu_owned: true on a request, or once for your whole account as a routing rule, and those two are excluded (routing docs).

101 of the 154 models in the EUrouter catalog run on at least one EU-headquartered provider, including Mistral's models and open models such as OpenAI's gpt-oss-120b. Mistral models on European providers, with live prices:

Every model, with its providers and prices, is in the EUrouter model catalog.

No prompts stored, no training

EUrouter applies a zero-retention policy to the content of API requests and responses by default and keeps only metadata such as timestamps, model identifiers and token counts for billing (EUrouter DPA, section 10). EUrouter doesn't use API data to train models and doesn't sell it. On 27 October 2026 all 17 providers were listed with no prompt retention and no training on your data.

Each request, or a routing rule for your account, can make your policy a hard rule:

• eu_owned: true to use only providers headquartered in the EEA
• data_residency to pin a country or region, such as de or fr
• zdr: true or max_retention_days: 0 to use only zero-retention providers
• data_collection: "deny" to exclude providers that train on your data

For retention, the strictest of your routing rule and the request always applies; a request can't loosen it.

Less legal work, no code rewrite

With EUrouter you sign one DPA under Dutch law, and the AI providers are sub-processors under it, each listed with the country where it processes data. That replaces a DPA review per vendor and, with eu_owned set, a transfer assessment for a US AI provider. Your developers change two lines in an OpenAI SDK client: the base URL becomes https://api.eurouter.info/api/v1 and the key becomes an EUrouter key (quickstart).

EUrouter's standard DPA isn't meant for special-category data such as health data, or for criminal-offence data, unless agreed in writing. Teams in healthcare, HR or law should talk to EUrouter before sending such data.

Is ChatGPT, the OpenAI API or Claude GDPR compliant?

None of them is GDPR compliant or non-compliant by itself. The business APIs of OpenAI, Anthropic, Google and Mistral all come with a DPA, so each can be used lawfully with the right setup. What separates them for a European company is which law the provider answers to, whether it trains on your data, how long it keeps prompts and outputs, and where inference runs. The table compares what each vendor publishes, checked on 27 October 2026.

Sources: OpenAI data controls, OpenAI DPA, Anthropic retention, Anthropic data residency, Anthropic DPA, Gemini API terms, Mistral data location, Mistral training opt-out and the EUrouter DPA.

Is ChatGPT GDPR compliant?

ChatGPT, the chat app, is a different product from the OpenAI API, and for a company the question is which contract covers the data. An employee who pastes customer data into a personal ChatGPT account leaves the company without any processor contract for that data. The Dutch data protection authority has received breach notifications from organisations whose staff entered patient data and customer addresses into AI chatbots, and warned in August 2024 that this can be a data breach that has to be reported.

Regulators look at vendors too: Italy's Garante fined OpenAI €15 million over ChatGPT in December 2024, and the Court of Rome upheld OpenAI's challenge in judgment 4153/2026, published on 18 March 2026, after which the Garante took the decision offline.

What this means for an EU company: a ChatGPT business plan gives you OpenAI's DPA, but OpenAI stays a US company, with the risks above. The European alternative is a company assistant that calls EU-hosted models through the EUrouter API, plus clear rules for staff on what they may paste.

Is the OpenAI API GDPR compliant?

The OpenAI API can be used in a GDPR-compliant way. OpenAI acts as processor under its DPA, signed with OpenAI Ireland Ltd for customers in the EEA or Switzerland, and according to OpenAI's data controls page it has not used API data for training since 1 March 2023 unless the customer opts in. OpenAI keeps abuse-monitoring logs, which can contain prompts and outputs, for up to 30 days by default, and zero data retention and the Europe region both need OpenAI's approval.

What this means for an EU company: even in its Europe region, OpenAI is a US company subject to the CLOUD Act. EUrouter serves OpenAI's GPT models from Microsoft Foundry in EU configurations, under EUrouter's Dutch DPA. Microsoft is a US company too, so for European companies end to end, use OpenAI's open-weight gpt-oss-120b, which EUrouter runs on eight EU-headquartered providers, with eu_owned: true.

Is Claude GDPR compliant?

Claude can be used in a GDPR-compliant way. Anthropic's API comes with a DPA that includes the EU Standard Contractual Clauses, Anthropic doesn't train on customer content from its commercial services, and Anthropic deletes API inputs and outputs within 30 days unless a longer period applies, such as up to 2 years for content flagged as a policy violation. Anthropic's own API offers no EU processing: the inference_geo parameter accepts global or us, according to Anthropic's data residency docs on 27 October 2026.

What this means for an EU company: Claude in the EU always runs on a US company's cloud. EUrouter serves Claude models from AWS Bedrock in EU configurations, under EUrouter's Dutch DPA and with no prompts stored by EUrouter. When your policy asks for European companies only, Mistral's models and open models on EU-headquartered providers are the European alternative.

What about Mistral and Gemini?

Mistral AI is a French company that hosts data in the EU by default, so the US law question doesn't arise. Mistral's help center says API data can be used to improve its services until an admin switches off "Anonymous improvement data" (3 September 2026), so switch it off, or reach Mistral through EUrouter, which lists Mistral AI with no training on your data. Google is a US company, and its Gemini API terms allow caching "in any country in which Google or its agents maintain facilities".

What to check before you send personal data to an AI API

1. Map the data. Note which prompts, files and outputs contain personal data, and whether any of it is health or other special-category data. EUrouter: the standard DPA excludes special-category and criminal-offence data unless agreed in writing, so talk to EUrouter first.
2. Pick a legal basis for each purpose, and document the balancing test if you rely on legitimate interest.
3. Sign the DPA and read the sub-processor list. EUrouter: one DPA under Dutch law, a provider list with the country of each, 10 business days' notice of new sub-processors with a right to object (section 7), and breach notice within 48 hours (section 9).
4. Confirm the provider doesn't train on your data. EUrouter doesn't, all 17 providers are listed with no training, and data_collection: "deny" enforces it per request.
5. Find the retention period for prompts and outputs, including abuse-monitoring logs. EUrouter keeps no request or response content by default (section 10); zdr: true or max_retention_days: 0 makes zero retention a hard rule.
6. Check where inference runs for the exact model you use. EUrouter: EU-hosted endpoints only, on every plan; data_residency pins a country such as de or fr.
7. Record transfers and which law the provider answers to. For a provider outside the EEA or a US-owned one, record the transfer tool and your transfer assessment. EUrouter: processing only in the EEA (section 5), and eu_owned: true, per request or as a routing rule, keeps US-headquartered providers out.
8. Ask how the model was trained, as the EDPB expects of companies deploying a model.
9. Run a DPIA when the use is likely to be high risk, and keep a human in decisions with legal or similar effects. EUrouter helps with DPIAs on request (section 6).
10. Update your privacy notice and record of processing, and tell staff what they may paste into AI tools. EUrouter: name EUrouter B.V. as processor and link its sub-processor list.

Start with AI in Europe

Create a free account, point your OpenAI SDK at https://api.eurouter.info/api/v1, and your next request runs in Europe, on the Free plan too. Create a free account, compare plans, read the routing docs, or talk to us about your DPA review.