It is the first thing decided, before writing a single line. Some data can
go to an AI provider in Europe under a data processing agreement, some can only be
handled by a model installed on your own infrastructure, and some never goes into any AI
system because it doesn't need to.
With health, children's or financial data, the default answer is inside.
With a supplier invoice, outside but in Europe. And it gets written into the working
session document, so management approves it knowing what it is approving.
I work with OpenAI, Anthropic and open models that get installed on a
server of yours, and I choose according to the case, not the fashion.