What EU product teams should check before adopting an AI tool — the 2026 checklist
For EU product teams, "GDPR-compliant" on a marketing page isn't enough in 2026. The checklist: data residency vs sovereignty, sub-processors, training-data, and EU AI Act scope.
If you're an EU-based product team adopting an AI tool in 2026, "it's GDPR-compliant" on a marketing page isn't enough. Four things actually matter — data residency vs sovereignty, sub-processors, whether your data trains the vendor's models, and EU AI Act scope. Here's the checklist to run before you sign.
This is general information, not legal advice. Verify against primary regulation (GDPR, EU AI Act) and your own DPO or counsel.
Why "GDPR-compliant" stopped being enough
Serious EU buyers in 2026 now ask a vendor: Which legal entity contracts with us, and which controls the infrastructure? What happens to our data if the EU–US Data Privacy Framework is invalidated? Are any AI features in scope for Annex III of the EU AI Act, and what's your conformity posture? Who are your sub-processors for AI inference, and in what jurisdiction? A tool that can't answer these crisply is a liability you inherit.
Residency ≠ sovereignty (the distinction most miss)
- Data residency = personal data stored and processed inside the EEA. Selecting an "EU region" gets you this.
- Data sovereignty = who has jurisdictional control. A US-headquartered provider running a Frankfurt data center still has data reachable under the US CLOUD Act — EU location, US jurisdiction.
Residency addresses where the bytes sit. Sovereignty addresses who can be compelled to hand them over. For sensitive product data, you want both.
The training-data question
The primary emerging GDPR risk in 2026 is AI/ML processing without an adequate legal basis or DPIA; regulators are actively investigating LLM training-data lawfulness. Nail down two things: Does the vendor train its models on your data? ("No, your data never trains our models" is materially stronger than "we may use data to improve our services.") And is there a DPIA covering the AI processing, with a documented legal basis?
Keep reading
Spec Hallucination: The 15-Minute Claim Trace for AI-Written Specs
AI writes specs that sound sourced but often aren't. The Claim Trace is a 15-minute audit that labels every claim Sourced, Inferred, Assumed or Invented before engineering builds from it.
What Counts as Evidence? The Risk Receipt for Value, Usability, Feasibility, and Viability
AI made feasibility cheap to prove. Value, usability, and viability still need their own evidence — and a great prototype demo counts for less than it feels like. Here's the Risk Receipt framework for checking what you've actually retired.
How to Review What AI Agents Build: A PM's Acceptance Checklist
Building got cheap; accepting the result did not. The four-rung Acceptance Ladder helps PMs review agent-built changes against the decision, the brief, the edge cases, and the outcome.