The Legal AI Data Residency Compliance Report 2026: What Law Firms and Legal Departments Actually Know — and Don't Know — About Where Their Matter Data Is Being Processed

Research briefing — a review of public sources. The Legal Stack did not conduct a survey, benchmark or interviews for this piece.

What can and cannot be said from public evidence

No public dataset shows how many law firms or legal departments have enforceable data residency terms in their AI vendor contracts. Nor does any public data show how many have audited where their prompts are actually processed. Vendor agreements are confidential, and we found no bar body or regulator census of them. Any claim that "most" firms lack enforceable terms is a judgement, not a finding.

What is documented is the legal framework that decides whether residency matters, and the residency options major AI and cloud providers now offer. Together they define what a defensible position looks like. This briefing sets out both. Our analysis, labelled as such, covers how GCs and law-firm leaders should close the gap between what a contract says and what actually happens to the data.

Storage and inference are different questions

Vendors' own documentation makes clear that "where data is stored" and "where a model processes a request" can be configured separately. When OpenAI announced data residency in Europe on 5 February 2025, the features differed by product:

ChatGPT Enterprise and Edu: customer content, including prompts and uploaded files, is stored at rest in Europe.
API Platform: requests made through eligible European Projects are handled in-region with zero data retention. Residency must be chosen when a Project is created, and existing Projects cannot be switched.
In-region inference: a January 2026 update said eligible ChatGPT Enterprise, Edu and Healthcare customers could choose in-region GPU inference in the US or Europe.

Microsoft's EU Data Boundary shows the same layering at hyperscaler level. Microsoft said in February 2025 that the third and final phase was complete. Customer data and pseudonymised personal data for Microsoft 365, Dynamics 365, Power Platform and most Azure services are now stored and processed in the EU and EFTA, with technical support data covered too. Microsoft also stated an exception: in limited security incidents needing a coordinated global response, essential data may be transferred out of the region. Its announcement did not mention Copilot specifically.

Analysis. For a legal buyer, the lesson is that "residency" is not one yes-or-no feature. A defensible contract specifies three things:

where data at rest sits;
where inference runs;
what retention applies to prompts and outputs.

It also states which named products, workspaces or projects those commitments cover, because residency is often opt-in and set when a workspace or project is created.

The sub-processor chain is the controller's problem

Many legal AI products are built on foundation-model and cloud providers, so the real processing location depends on the sub-processor chain. European regulators have been explicit about who is responsible for that chain. In Opinion 22/2024, adopted on 9 October 2024 at the Danish data protection authority's request, the European Data Protection Board (EDPB) said:

controllers should keep the identity details of all processors and sub-processors, including name, address and contact person, "readily available at all times", whatever the risk level;
the initial processor proposes sub-processors, but the controller keeps the final decision and the responsibility for verifying their guarantees;
where data moves outside the EEA between sub-processors on the controller's instructions, the controller still owes its Article 28(1) duty to ensure sufficient guarantees.

Analysis. For a law firm acting as controller of EU client or counterparty data, this cuts against relying on a vendor's marketing page. A residency clause in the primary agreement is only as good as the flow-down to each sub-processor. Firms should get the full sub-processor list, including the model and inference providers. They should check that the residency and retention terms appear at each layer, and keep a process for reviewing change notices when they arrive.

Cross-border transfers: the DPF survived, for now

On 3 September 2025 the EU General Court dismissed French MP Philippe Latombe's annulment action in Latombe v Commission (T-553/23). The court held that the EU-US Data Privacy Framework (DPF) provides adequate protection for personal data transferred from the EEA. Wilson Sonsini noted that an appeal to the Court of Justice was possible within two months.

Analysis. For legal teams, the practical position is that the DPF remains a valid transfer route for certified US recipients. Its predecessors were struck down, however, so many organisations keep Standard Contractual Clauses (SCCs) as a fallback. The original version of this briefing cited a "January 2026 EDPB opinion" questioning DPF adequacy for AI human-review pipelines. We could not verify that any such opinion exists, and it has been removed.

Sector rules that make location a contract term

Some client sectors convert residency from a preference into a regulatory requirement.

Financial services in the EU. The Digital Operational Resilience Act (DORA) has applied since 17 January 2025. According to McCann FitzGerald, Article 30 requires contracts with ICT third-party service providers to state the locations from which the service will be provided and where data will be processed. They must also include termination rights and minimum notice periods. Law firms serving DORA-regulated clients should expect these terms to flow into outside-counsel guidelines where the firm's tools touch the client's data.

Health data in the US. Washington's My Health My Data Act became enforceable on 31 March 2024, with small businesses given until 30 June, according to Clark Hill. Violations are treated as unfair or deceptive acts under the state Consumer Protection Act, which gives consumers a private right of action. Plaintiffs must still prove actual damages. Clark Hill expected processor agreements to be updated to bar processors from using consumer health data for unapproved purposes.

New York financial services. NYDFS's cybersecurity regulation, 23 NYCRR 500, reaches most law firms only indirectly, through the third-party service provider requirements in §500.11 that regulated clients impose on their vendors.

Analysis. The original article said specific regulators had issued AI-specific residency guidance, citing "enforcement guidance" from the California Privacy Protection Agency on DPA flow-downs. We found no such guidance and have removed that claim. The documented pressure comes from general outsourcing and privacy rules applied to AI vendors, not from AI-specific residency mandates.

Professional-responsibility overlay

Bar guidance treats confidentiality in AI use as a duty in its own right, whatever the privacy law says.

ABA Formal Opinion 512 (29 July 2024) addresses confidentiality, alongside competence and supervision, when lawyers use generative AI.
The State Bar of California's Practical Guidance (November 2023) and New York City Bar Formal Opinion 2024-5 (7 August 2024) both address protecting confidential client information shared with generative AI tools.
Florida Bar Ethics Opinion 24-1 (19 January 2024) frames the issue around confidentiality-based informed consent and oversight of vendors.

None of these opinions mandates a particular data location. All of them expect lawyers to understand how a vendor handles client information, and where that information goes is part of how it is handled.

A practical residency checklist (analysis)

For GCs, legal ops leads and law-firm IT and risk committees, a defensible programme answers five questions for each AI tool used on client or matter data.

Storage. In which named jurisdictions is data at rest held, under which product tier or workspace, and is that a contractual commitment or a configuration setting?
Inference and retention. Where are prompts processed, are they retained, for how long, and for what purposes? This is the gap that the OpenAI and Microsoft documentation shows can differ from storage.
Sub-processors. Do you hold the full list, including model and inference providers, with identity details as the EDPB expects? Does each layer carry equivalent location and retention terms?
Change control. Who reviews sub-processor change notices, against what criteria, and what objection or termination right applies? DORA makes termination rights mandatory for in-scope clients.
Exceptions. What carve-outs exist, such as global security-incident transfers like Microsoft's, and are they acceptable for the client's sector?

When outside counsel get questionnaires from clients, answers backed by contract excerpts and configuration evidence will carry more weight than restated policy. That is our assessment, not a measured finding. But it follows directly from the controller-verification duties the EDPB describes.

Sources

OpenAI, "Introducing data residency in Europe" (5 Feb 2025; updated Jan 2026): https://openai.com/index/introducing-data-residency-in-europe/
Microsoft On the Issues, "Microsoft completes landmark EU Data Boundary, offering enhanced data residency and transparency" (26 Feb 2025): https://blogs.microsoft.com/on-the-issues/2025/02/26/microsoft-completes-landmark-eu-data-boundary-offering-enhanced-data-residency-and-transparency/
Hunton Andrews Kurth, "EDPB Adopts Opinion on Processors and Guidelines on Legitimate Interests" (Oct 2024): https://www.hunton.com/privacy-and-cybersecurity-law-blog/edpb-adopts-opinion-on-processors-and-guidelines-on-legitimate-interests
Wilson Sonsini Data Advisor, "EU Court Upholds the Validity of the EU-U.S. Data Privacy Framework" (Sep 2025): https://www.wsgrdataadvisor.com/2025/09/eu-court-upholds-the-validity-of-the-eu-u-s-data-privacy-framework/
McCann FitzGerald, "Delving into DORA: ICT Contractual Arrangements": https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/delving-into-dora-ict-contractual-arrangements
Clark Hill, "It's Here: The Who, What, and How of Washington's New My Health My Data Act and Its Private Right of Action" (29 Mar 2024): https://clarkhill.com/news-events/news/its-here-the-who-what-and-how-of-washingtons-new-my-health-my-data-act-and-its-private-right-of-action
American Bar Association, "Formal Opinion 512: Generative Artificial Intelligence Tools" (29 Jul 2024): https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf
State Bar of California, "Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law" (Nov 2023; the linked file is now the 2026 revision): https://www.calbar.ca.gov/sites/default/files/portals/0/documents/ethics/Generative-AI-Practical-Guidance.pdf
Ezel, summary of New York City Bar Formal Opinion 2024-5, "Generative AI in the Practice of Law" (7 Aug 2024): https://ezel.ai/ethics-opinions/nyc-bar/2024-5-generative-ai-in-the-practice-of-law
The Florida Bar, "Ethics Opinion 24-1" (19 Jan 2024): https://www.floridabar.org/etopinions/opinion-24-1/
Cornell Legal Information Institute, "N.Y. Comp. Codes R. & Regs. Tit. 23 § 500.11 - Third-party service provider security policy" (accessed Oct 2026): https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.11