Not necessarily. Storage location, processing location and the model provider are three separate questions. Data can rest in a UK region while prompts are processed abroad, or handled by a sub-processor in another country. Make a supplier state all three in writing. On-premise AI collapses the question: storage and processing both happen on hardware you own.
What is the difference between storing data and processing it?
Storage is where a file rests when nobody is touching it. Processing is what happens while something works on that file: reading it, transforming it, passing it through a model, returning an answer. Under UK GDPR the legal definition of processing already covers storage, so in law both are processing. Commercially they are different layers, built, priced and hosted separately, and a contract can be exact about one while saying nothing useful about the other.
Ask whether your data is in the UK and most sales teams answer the storage question, because that one has a clean answer. Buckets and databases are pinned to a named region and the pinning is visible in a console. Inference behaves differently. A request has to reach a machine with the right accelerator attached and free capacity to take the job, and that capacity is scarce and unevenly spread. If the nearest free machine sits in another country, the request goes there unless the architecture forbids it.
So there are three questions. Where does the data rest, where does the computation happen, and who owns the model performing it. The first tells you nothing reliable about the other two. This is the narrow, practical version of a wider point: data residency is not data sovereignty.
Does a UK data region cover the AI processing step?
Usually not on its own. A UK region commitment describes where data sits at rest and sometimes where one named service executes. The inference path has more parts than that.
Four things commonly break the assumption. Endpoints: an application can write to UK storage and still call a global model endpoint, which is the default in many client libraries. Capacity behaviour: failover and burst routing exist to keep a service available, which can mean serving from elsewhere. Model availability: newer or larger models reach some regions long before others, so a team that wants the more capable model quietly accepts a different location. Surrounding services: content filters, classifiers, routers and rate limiters are separate systems with their own footprints.
None of that is sinister. It is how a global platform is engineered. It does matter legally, though. Where personal data moves outside the UK you are making a restricted transfer, and the ICO's international transfers guidance sets out that a restricted transfer must be covered by UK adequacy regulations, or by one of the appropriate safeguards in Article 46 with a transfer risk assessment behind it, or by an exception in Article 49. Chapter V of the UK GDPR on legislation.gov.uk is the underlying text, as amended by the Data (Use and Access) Act 2025. Neither can be completed without knowing which countries are involved, so "UK region" on a web page is not evidence you can file.
Who is the model provider, and where does it sit?
The company selling you the software is often not the company running the model. A typical arrangement involves at least three parties: the application vendor you signed with, the platform hosting that application, and the organisation operating the model behind an API.
That third party is a sub-processor, and it carries obligations. The ICO's work on the generative AI supply chain deals directly with how responsibility should be allocated across these layers, based on each party's real influence over the purposes and means of the processing rather than the label a contract gives it. In practice this is where diligence stops too early. Buyers read the top-level data processing agreement, see a UK entity and a UK region, and never open the sub-processor annex where the model provider sits with a different country beside its name.
Ask for that annex. Ask for the legal entity, not the brand, the country it operates from, and the notice you get before the list changes.
Which other steps can move data out without anyone noticing?
The paths that surprise people are operational, not headline features, so nobody demonstrates them in a sales call.
Prompt and response logging is the first. Abuse monitoring and safety review are the second, and some of those pipelines include human review under defined conditions. Then embeddings: if you use retrieval, your documents have become vectors in an index derived from your content, so treating that index as anonymous is a mistake. Caches hold recent inputs and outputs, and evaluation suites replay real traffic. Crash reporting and product analytics usually go to a different vendor entirely, on a contract your legal team may never have read. Support access, debugging sessions and connectors each move data along their own route. All of these can be governed properly. None of them is governed by a storage region setting. NCSC's guidelines for secure AI system development treat the AI supply chain as something to secure in its own right.
What should a supplier put in writing about each layer?
Named layers, named countries, named legal entities, and a date. Anything less is a conversation, not a control.
The list I would send, and expect to answer myself:
- where data rests, by region name, including backups and disaster recovery sites
- where inference executes normally, and where it can execute during failover or capacity pressure
- which legal entity operates the model, registered in which country
- the full sub-processor list, each with function, country, and notice period before it changes
- retention periods for prompts, outputs, logs, embeddings and caches, stated separately
- whether human review of inputs or outputs is possible, and under what trigger
- whether inputs or outputs are used for training, fine-tuning or evaluation, with an opt-out
- the transfer mechanism relied on wherever data leaves the UK, and the risk assessment supporting it
- which of the above you can verify yourself, and how
That last line separates suppliers. A commitment you cannot test is a statement of intent. Evidence you can check without asking permission is a control. Technical sovereignty is the difference between the two.
Does the answer change for training, fine-tuning and telemetry?
Yes, and each changes it in a different direction. Training and fine-tuning copy data into a pipeline that often runs in a different region from serving, because training and serving are rarely the same fleet. Fine-tuned weights are then artefacts of their own: stored somewhere, backed up somewhere, carrying the imprint of the data used to produce them. Telemetry runs on a third path, usually through an analytics provider, often outside the scope of the main agreement.
Deletion is where this bites. Removing a source document does not remove its embeddings, cache entries, place in an evaluation set, or influence on a set of weights. To satisfy a retention obligation or a deletion request, you need to know every copy the pipeline made, not only the one in the file store.
How does running AI on your own hardware change all three answers?
It collapses three questions into one. When the model runs on a machine you own, in a building you control, storage location, processing location and operator identity are the same answer, and you are that answer.
That is what we built. The MICKAI® Sovereign Intelligence Operating System (SIOS) runs on hardware the customer owns. Storage and processing both happen on that hardware. There is no default outbound connection, and any path out stays switched off until the operator turns it on for a named purpose. That is what zero data egress means here: a property of the deployment, not a setting somebody has to remember to check.
Two things make it auditable rather than merely private. Every consequential action is sealed in the Open Audit Record under ML-DSA-65, the post-quantum signature scheme NIST published as FIPS 204 in 2024. An auditor exports a record and verifies it offline with a public key, using tools that are not ours. That record is tamper-evident, not tamper-proof: nothing physically prevents a determined operator editing a file, but editing it breaks verification, and the break is visible to whoever checks. Second, consequential actions wait for a named person to approve them, so each decision has a human attached rather than a service account.
I will be straight about maturity. Of 63 studios, 14 are production ready at launch and 49 are in development. The closed beta is open, with one regulated company onboarding as a design partner. A local OCR runtime has read scanned PDFs in controlled tests, though extraction and ingestion into SIOS is still being completed.
None of this is an argument against the companies building the compute and cloud layer. That is hard engineering, and cloud remains right for most work that is not regulated. The argument is against one assumption: that a regulated organisation must rent its intelligence, ship its data offsite, and take a supplier's word for what happened to it. We set the options side by side in sovereign AI, data residency, air gapped and on premise, and the wider case sits on our sovereign AI page. When you can answer all three location questions by pointing at a rack, you no longer need anyone's word.
Frequently asked questions
Does storing our data in the UK mean it is processed in the UK?
No. A UK region commitment normally describes where data rests, and sometimes where one named service runs. Inference can execute elsewhere, especially during failover, capacity pressure, or when a more capable model is only available in another region. Ask separately where computation happens in normal operation and under load, and get the answer in the contract.
Is the AI model provider a sub-processor?
Usually yes, where it processes personal data on your supplier's behalf. It should appear by legal entity and country in the sub-processor annex, not only as a brand name in marketing. The ICO's work on the generative AI supply chain addresses how responsibility is allocated across these layers according to each party's real influence over the processing.
Can prompts, logs and telemetry leave the UK even when the files do not?
Yes, and this is the common case. Prompts travel to wherever the model endpoint resolves. Logs, abuse monitoring, caches, embeddings, evaluation sets, crash reports and product analytics each follow their own path, sometimes to a different vendor under a different agreement. Ask for retention and location for each of them separately, not as one line.
How do we get a straight answer from a supplier about processing location?
Ask in writing, layer by layer, and require named countries and named legal entities. Where does data rest, where does inference execute normally, where can it execute under failover, which entity operates the model, and who is on the sub-processor list. Then ask which of those answers you can verify yourself rather than accept on trust.
Does on-premise AI remove the processing location question?
It answers it by removing the distance. When the model runs on hardware you own, storage and processing happen in the same place, under your control, with no default outbound connection. You still need to govern access, approvals and retention internally, but there is no supplier region, no sub-processor country, and no transfer to assess.
Related briefings
Data protection and UK GDPR
- UK GDPR and AI: Does Your Data Have to Stay in the UK?
- Controller or Processor? AI Suppliers and UK GDPR Roles
- Right to Erasure in an AI Knowledge Base: How to Comply
- Employee Pasted Client Data Into AI: Is It a Breach?
- AI Call Transcription and UK GDPR: What Firms Must Do
Governance, audit and oversight
- Tamper-Evident vs Immutable Log: The Real Difference
- Human on the Loop vs In the Loop: AI Oversight Explained
Part of a series of 60 briefings on deploying and governing AI in UK regulated organisations, archived with a DOI at 10.5281/zenodo.22975756.
Evaluating AI for a regulated organisation? Mickai runs on hardware you own, offline. Consequential actions wait for a named person to approve them, and what the AI did is sealed into a signed record an auditor can check without us. Applications for the invitation-only closed beta are open. Apply for the closed beta.
Written by Micky Irons, founder and chief executive of Mickai LTD.
Top comments (0)