Residency tells you where your data sits. Jurisdiction tells you who can reach it. And a third question gets almost no airtime: what your vendor learns from the way you work.
In June 2025 a Microsoft lawyer sat in front of a French Senate inquiry and was asked a question that sounds simple. Could he guarantee, under oath, that data passing through France’s public procurement body would never reach the American authorities without French approval?
He said he couldn’t. He also told them it had never happened.
When the story did the rounds, most of the reaction went straight to a different question: where is our data? That is a sensible thing to ask, and the lawyer had been answering something else. The gap between where your data sits and who can reach it is what this piece is about. I think it matters even more for services firms than for most businesses, for a reason that waits near the end.
One note before we start. Where a sentence has a link, it comes from a source you can check. Where I’m giving you my own view, or a hypothesis I can’t prove, I’ll say so.
Three questions, not one
It helps to pull the problem into three questions, because a good answer to the first can easily feel like an answer to all of them.
Residency is about where your data is stored and where it is processed. Jurisdiction is about whose law can force the vendor to hand it over, and which court hears a dispute. The third question is the one hardly anyone asks: what does the vendor learn from how you use the service, as opposed to what you send it? Most of what follows covers the first two, because those are the ones senior leaders are most often given a confident answer to. The third is where I think the biggest long-term exposure sits.
Residency: where the data sits
Imagine your IT lead has just set up an AI assistant for the firm. Somewhere in the setup there is a region dropdown, and they choose Europe. Everyone relaxes. (This is an invented example, but I suspect it will feel familiar.) The trouble is that “Europe” can mean two different things, because storing data and processing it are separate promises. The processing part has a name, inference: the moment the model actually reads your request and writes its reply.
Here is what the documentation says today. Anthropic’s API gives you two choices for where inference runs, global or the US, and workspace storage is US only. OpenAI is more flexible: API customers can pick the US or Europe for processing on supported endpoints, and at-rest storage is available in ten regions. Its ChatGPT help page adds a caveat, which is that inference residency doesn’t cover all CPU-based processing or system data. As documented today, that leaves a buyer with an in-country processing rule in the UK or Japan without a direct option on either API. Azure offers three levels: Global deployments may process in any Azure region, Data Zone deployments stay within the US, EU or Asia Pacific, and Regional deployments process in the single region you chose. So whether your residency claim is true can come down to a setting somebody chose during setup.
There is also a layer that is easy to forget. Many of the specialist tools sold to professional firms are built on top of the big labs’ models. Fortune reported Anthropic and its launch partners saying that legal AI products including Harvey and Legora are built on Claude’s models. So your data may pass through a second vendor, and a second legal regime, behind the tool you actually signed up to. A regional login page tells you where the front end lives, which is a different thing from where the model runs.
My view: ask for the full chain of sub-processors, the processing region of each link, and where logs and traces go, because they carry the same prompts.
Jurisdiction: whose law reaches the vendor
Now for the part the Microsoft lawyer was really talking about. Picture a vendor that receives instructions from two legal systems that don’t agree with each other. That is close to the situation the law has created.
On the American side, the Cloud Act says that providers of electronic communication or remote computing services must disclose data within their possession, custody or control, wherever it is located. There is a narrow way out. A provider can ask a court to quash an order within 14 days if the customer isn’t a US person and doesn’t live in the US, and handing the data over would risk breaking the law of a “qualifying foreign government”, a status that depends on that government having an executive agreement with the US.
European law pulls the other way. The European Data Protection Board and Supervisor said in a joint response in 2019 that unless a US warrant is recognised through an international agreement, providers subject to EU law can’t legally base a disclosure on it (here is a law firm summary). So a vendor can find itself caught between the two.
That is the position the Microsoft lawyer was describing. According to Heise, he said Microsoft can refuse only requests that are formally unfounded, and that it would want to tell customers if their data were requested but must first ask the US authorities for permission to do so. Microsoft’s own answer to the wider worry has been about residency. Its EU Data Boundary, completed in February 2025, stores and processes core customer data in the EU and EFTA, with exceptions for rare security incidents. That is a real commitment about where data sits. The Senate’s question was about who can compel it.
Two things are still moving, and a senior leader should know about both. First, the EU General Court upheld the EU-US Data Privacy Framework on 3 September 2025, the arrangement that lets personal data flow to certified US companies. An appeal to the Court of Justice was still pending in October 2026. Second, Section 702 of the US Foreign Intelligence Surveillance Act was automatically repealed on 12 June 2026, yet surveillance authorised under court certifications carries on until 17 March 2027, by which date Congress has to act. Whether a particular AI vendor counts as a covered provider under any of these laws is a question for counsel. I haven’t verified it, and it matters.
Then there is a third meaning of jurisdiction, and it is the one that shows up in your contract: the law and court that apply if you and the vendor fall out. Anthropic contracts through Anthropic Ireland for customers in the EEA, Switzerland and the UK, under Irish law with arbitration in Dublin, and through Anthropic PBC elsewhere, under California law with arbitration in San Francisco. Cursor’s master agreement picks Texas law and Texas courts. Where a contract dispute is heard is a different question from which authority can compel the vendor to hand data over.
My view: treat any vendor with US parentage as reachable by US legal process, and decide what goes into it on that basis. Residency reduces real risks, including regulatory ones, and it is worth having. It doesn’t remove that jurisdictional risks, and I would be wary of a contracting entity that is offered as if it did.
What a services firm sells (my view)
This is where the story turns, and where I think services firms should pay particular attention. Picture a mid-sized accountancy firm in the last week of a client’s year-end close. (Another invented example, but you will recognise the shape.) A senior manager knows, without looking anything up, which accounts to reconcile first, which odd-looking journal entries are probably fine and which need a partner’s eyes, and when to ask the client for one more document before going any further. None of it is written down. It lives in that manager’s head.
That know-how is the reason the client pays what they pay, and for decades it has been protected by something unglamorous: it is hard to copy. A competitor could hire your people, but reproducing how they work together would take years.
Now bring in an AI agent. To get it to do any of that work, somebody has to write the method down: which tools to call, in what order, what to check, when to stop and ask a human. These are tool definitions, workflow steps, instructions and skill files. At that moment the method stops living in a head and starts living in a file, and that file runs on someone else’s infrastructure. Once it does, its shape can be seen by the people who run it.
My view: if a model can run a method, the price of that method drifts towards the cost of running the model. For a services business the method is the revenue model, so this is an economic shift, and protecting how you operate belongs on the board agenda next to data protection.
What has happened in law
Law is the sector that has lived through the first chapters of this story, so it is worth seeing how it has gone.
In 2023, when Harvey went firmwide at Allen & Overy, its founders described the method plainly. The model is fine-tuned on the firm’s own historical work product and templates, and it stays specific to that firm. They compared it to teaching an associate how this particular firm works. That is a perfectly good pitch, and it describes exactly the asset I am talking about.
Three years on, the biggest firms have noticed what that implies. Bloomberg Law reported in June 2026 that big firms are building on their internal data, on the logic that when everyone can buy the same tools, proprietary knowledge is what sets a firm apart. Kirkland & Ellis has committed $500 million. Freshfields’ announcement describes co-developing agentic workflows with Anthropic’s product teams, plus early access to future models. PitchBook characterises that as early access in exchange for knowledge sharing, which is its framing rather than the firm’s.
It would be easy to read this as law firms walking away from vendors. They aren’t. In Bloomberg Law’s survey of build versus buy, one firm executive called Harvey and Legora “a bridge”, while Ropes & Gray has chosen to buy. Kirkland says it will keep licensing third-party tools. My summary is hedging: buy now, and build the parts you most want to keep.
The worry underneath is specific. Dom Conte, co-founder of Purple, which builds AI tools for law firms, told Bloomberg Law that firms have shown the startups what legal workflows look like by buying and collaborating with them. He is an interested party, so weigh that. Harvey denies any plan to become a law firm. It also says it used no customer data to post-train its own legal model, which trained on about 1,750 agentic legal task environments, each a closed-universe client matter with an expert rubric. I take that at face value. But notice what a task environment for legal work is: a model of how legal work gets done.
What the contracts say
So what do the contracts actually promise? For paying business customers, the content clauses are reasonable. Anthropic’s Commercial Terms give the customer ownership of Outputs, bar training on Customer Content and treat it as confidential, and they define Customer Content as Inputs and Outputs. They say nothing about usage data. An opt-in “Development Partner Mode” in the service-specific terms does allow training on submitted data.
Cursor is more explicit. Its master agreement lets Anysphere analyse “technical logs, data, and learnings” about your use for its business purposes, including development, and disclose them to third parties only in aggregated or de-identified form. Usage Data excludes Customer Data, and Cursor won’t train on your data unless you explicitly agree.
Your account tier matters too. Anthropic trains new models on Free, Pro and Max chats and Claude Code sessions when the setting is on, and excludes services under its Commercial Terms. So a consultant working on a personal account is under different terms from the ones in the firm’s contract.
Put it together and you get something I find useful to say out loud: “we won’t train on your data” and “we can’t learn how you work” are different promises. The terms above make only the first.
A hypothesis, clearly labelled
Let me tell you the story I am worried about. I know of no public case of it, so treat it as a hypothesis.
Suppose a lab never touches your prompts and keeps its promise to the letter. It still sees which tools your agents call, in what order, where humans step in, and how long each stage takes. Now add up that picture across thousands of firms. You wouldn’t need anyone’s documents to learn how a claims team works. You would need the workflow, and a signal for when a step went well. That is the raw material of reinforcement learning environments. Scale, a vendor, describes environments that model the workflows and task structures of real applications, and Epoch’s interview survey names enterprise workflows as a major growth area.
The coarse version of this already happens in the open. Anthropic said in May 2026 that legal professionals had become its most engaged Cowork users, and then announced more than 20 legal connectors and 12 plugins. That was ordinary telemetry on its own product and a reasonable business decision, and it shows how a usage signal turns into a product. Anthropic’s Economic Index research goes further, classifying millions of conversations by occupational task, though it excluded business customers.
The next part is my own suspicion. I think the speed with which models became capable agents owes something to this kind of material, including open skills libraries. I can’t prove it, and the public account credits reinforcement learning environments and trajectory data. If I’m right, the cost to a services firm would be quiet. No clause is breached, nothing leaks, and your method comes back in the next model release, available to every competitor.
The strongest objection
The best argument against all this is economic, and it deserves a fair hearing. Ropes & Gray’s CIO argues the technology moves too fast for a proprietary build to make sense, and Bloomberg Law reports that beyond the top 50 firms the build option doesn’t apply. Most firms will buy, and I think that is right.
It sharpens the point, though. If much of a method can be learned from public and aggregate sources, the valuable part is what is distinctive and unpublished: your exceptions, your judgement calls, the reasons behind your thresholds. You may not be able to build your own platform. You can decide what goes into a vendor’s system and what stays out.
This is why we position WrangleAI as a platform to help you decouple from the major labs and remain in control of your data and IP.
Questions to ask on Monday
If you take one thing from this piece, take these questions into your next vendor conversation.
- Residency: where does inference run, for every link in the chain, and what do logs and traces carry?
- Jurisdiction: which entity are we contracting with, which government can compel it, and what happens when two legal regimes disagree?
- Method: how do you define content, what counts as usage data, and what happens to anything derived from either?
- Exit: if we left tomorrow, what could we take with us?
Then take an afternoon to inventory every place your method has been written down for a machine. Treat that list as an IP register, and check which account tier your staff are actually using.
Go back to that Senate hearing for a moment. The question was whether data would leave the building. I would love to hear the same question asked about how a firm works. Services firms have always sold their method. The open question is who else gets to learn it, and under whose law.
This article is analysis, not legal advice. Dave Maddock is the founder of WrangleAI.
Sources
- Heise, Microsoft France testimony to the French Senate: https://heise.de/-10494789
- Anthropic API reference, data residency settings: https://platform.claude.com/docs/en/api/typescript/organization/workspaces.md
- OpenAI, business data privacy and residency: https://openai.com/business-data/
- OpenAI Help Center, data residency and inference residency: https://help.openai.com/en/articles/9903489-european-data-residency
- Microsoft Learn, Azure OpenAI deployment types: https://learn.microsoft.com/en-nz/azure/ai-foundry/openai/how-to/deployment-types
- Microsoft, EU Data Boundary completion (26 February 2025): https://blogs.microsoft.com/on-the-issues/2025/02/26/microsoft-completes-landmark-eu-data-boundary-offering-enhanced-data-residency-and-transparency/
- TechRepublic, EU Data Boundary exceptions: https://www.techrepublic.com/article/microsoft-cloud-eu-data-boundary/
- CLOUD Act text: https://epic.org/privacy/cloud-act/cloud-act-text.pdf
- EDPB and EDPS, joint response on the CLOUD Act (2019): https://www.edpb.europa.eu/our-work-tools/our-documents/letters/edpb-edps-joint-response-libe-committee-impact-us-cloud-act_en
- McCann FitzGerald, summary of the EDPB and EDPS position: https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/edpb-and-edps-adopt-restrictive-view-of-gdpr-transfer-provisions
- IAPP, General Court dismisses Latombe challenge: https://iapp.org/news/a/european-general-court-dismisses-latombe-challenge-upholds-eu-us-data-privacy-framework
- University of Copenhagen research portal, Latombe v Commission and the pending appeal: https://researchprofiles.ku.dk/en/publications/the-euus-data-privacy-framework-upheld-at-first-instance-latombe-/
- Congressional Research Service, impact of FISA Section 702’s repeal: https://www.congress.gov/crs-product/LSB11444
- Brennan Center, Section 702 explained: https://www.brennancenter.org/our-work/research-reports/section-702-foreign-intelligence-surveillance-act
- Anthropic Commercial Terms of Service: https://www.anthropic.com/legal/commercial-terms
- Anthropic Service Specific Terms: https://www.anthropic.com/legal/service-specific-terms
- Anthropic, updates to Consumer Terms and Privacy Policy: https://www.anthropic.com/news/updates-to-our-consumer-terms
- Cursor Master Services Agreement: https://cursor.com/terms/msa
- LawSites, Allen & Overy deploys Harvey (2023): https://www.lawnext.com/2023/02/as-allen-overy-deploys-gpt-based-legal-app-harvey-firmwide-founders-say-other-firms-will-soon-follow.html
- Bloomberg Law, law firms capitalise on internal data (8 June 2026): https://news.bloomberglaw.com/legal-ops-and-tech/law-firms-capitalize-on-internal-data-to-stand-out-in-ai-age
- Bloomberg Law, build versus buy (25 June 2026): https://news.bloomberglaw.com/artificial-intelligence/law-firm-tech-budgets-drive-the-build-versus-buy-ai-debate
- Freshfields, collaboration with Anthropic (23 April 2026): https://www.freshfields.com/en/our-thinking/news/news-search/2026/04/freshfields-and-anthropic-team-up-to-co-build-ai-legal-workflows-deploying-claude-across-the-firm-globally
- PitchBook, legal AI startups’ new competition: https://pitchbook.com/news/articles/legal-ai-startups-new-competition-big-law
- Harvey, Tenet research preview (20 August 2026): https://www.harvey.ai/blog/post-training-update-harvey-tenet
- Fortune, Anthropic legal release (12 May 2026): https://dc.fortune.com/2026/05/12/anthropic-legal-plug-in-release-claude-cowork-big-law/
- Anthropic, Claude for the legal industry (12 May 2026): https://claude.com/blog/claude-for-the-legal-industry
- Epoch AI, an FAQ on reinforcement learning environments: https://epoch.ai/gradient-updates/state-of-rl-envs
- Scale AI, RL environments: https://scale.com/blog/rl-environments
- Anthropic, Which Economic Tasks are Performed with AI?: https://assets.anthropic.com/m/2e23255f1e84ca97/original/Economic_Tasks_AI_Paper.pdf
