You have two quotes on the table. Same scope, same promised deadline, two prices that have nothing to do with each other. One comes from a team based in Lyon, the other from a provider with no establishment in France, sometimes from a vendor or an agency outside the European Union. The question is not which one is more serious. It is what you buy on top, or lose, when you sign.
Key Takeaways
- The law does not follow the flag: GDPR and the EU AI Act apply to a non-EU provider as soon as its system is used in the EU.
- Three things genuinely change: the path your data takes, the strength of the contract, and how fast you can leave.
- A provider established outside the EU is still your processor. An Article 28 contract and a Chapter V transfer framework are mandatory.
- An adequacy decision, such as the one adopted on 10 July 2023 for the United States, simplifies the transfer. It does not remove it.
- The day rate is not the cost. Rework days, travel, currency and exit costs usually weigh more.
What does not really change: the applicable law
This is the point many executives get backwards. A provider based outside the Union does not escape the European framework. The French Directorate General for Enterprises states it plainly: the regulation "concerns any organisation, whether a company, an association or a public body, that provides, imports, distributes or deploys AI systems or models covered by the regulation. This includes entities established in the European Union, as well as those located outside the Union, as soon as their products are used or distributed in the EU", according to the Directorate General for Enterprises (page updated 28 July 2025).
The same logic applies to GDPR. If your provider processes the data of your customers or your employees on your behalf, it acts as a processor, wherever it is based. The processing agreement and the transfer rules apply. The provider's nationality exempts it from nothing.
The AI Act calendar, as published by the Directorate General for Enterprises: entry into force on 1 August 2024, prohibition of unacceptable uses on 2 February 2025, rules for general-purpose AI models on 2 August 2025. Since 2 August 2026, the transparency obligations of Article 50 apply, including for chatbots, which must state that they are machines. High-risk systems follow a separate calendar spread over several years.
What this means for you: the law does not protect you differently depending on the provider's address. What changes is your ability to enforce that law.
First point: the path your data takes
Processing that stays inside the Union does not trigger a transfer. Processing that leaves for the United States, India or the United Kingdom does.
The Court of Justice of the European Union set the limit in 2020, in the Schrems II ruling. The CNIL summarises its effect: "Regarding the United States, the Court held that US law on access to data by intelligence services (in particular section 702 of FISA and Executive Order 12333) does not ensure a level of protection essentially equivalent", according to the CNIL (ruling of 16 July 2020). Put differently, where data is stored is not enough. What matters is who can legally order access to it.
Since then, the European Commission has adopted an adequacy decision for the United States, on 10 July 2023. Adequacy means data can flow without any further safeguard, because the transfer is treated like an intra-European transmission, according to the European Commission. In practice, you no longer need to sign clauses for a transfer to a provider certified under that framework.
But adequacy is not a blank cheque. The CNIL restates the method: you still have to assess the law of the destination country, document additional measures, and suspend the transfer if the level of protection does not hold. An adequacy decision can also be withdrawn, as happened with Safe Harbor and then Privacy Shield.
If your provider is not covered by an adequacy decision, standard contractual clauses take over. The 2021 set, the only one usable since 27 December 2022, covers four situations, including transfers between a processor established in the EU and a processor outside it. That is the typical case of a French agency that hosts its model or its support elsewhere. The transfer exists, even if your contract is signed in Paris.
Second point: the contract and your legal recourse
A service contract is judged by what it lets you do when things go wrong.
With a provider established in France, you negotiate governing law, jurisdiction, late-payment penalties, a liability cap and an exit clause. All of it is enforceable before a French court, in a language you read, within timelines you know.
With a provider outside the EU, you often sign its terms of service. Take it or leave it. Governing law is that of its registered office. Recourse exists in theory, and is practically out of reach for an SME: arbitration costs, distance, foreign law. Your only real lever becomes commercial bargaining power, which is close to nothing once the project has shipped.
That asymmetry is not about how serious a provider is. It is structural. A small team abroad can be excellent and entirely honest. It simply does not carry the same obligations to answer you.
Third point: support, response times and language
An outage at 2 p.m. on a Tuesday does not cost the same depending on where the person picking up the phone sits. Support six time zones away means a lost production day before the first diagnosis.
Look at three things in the offer: contractual support hours, the name of the person who escalates, and the language of deliverables. An audit delivered in English turns into internal meetings, vocabulary disagreements and back-and-forth. None of that shows up in a quote.
Add one point people forget: who holds the keys. If the model, the hosting and the logs are controlled by the provider, your ability to change your mind depends entirely on its goodwill. That is where reversibility of an AI agent is decided, long before the contract ends.
Fourth point: the full cost
The day rate is the most visible line, and the least decisive.
The real calculation includes rework days, travel if the provider is far away, currency if the invoice is in dollars, the tax treatment of the service, testing you have to redo yourself, and the exit cost. A service that is twice as cheap but absorbs three extra weeks of your internal team is not cheaper.
So the right question is not "how much is a day?" but "how much does the outcome cost, and how much does a mistake cost?" Two figures you can only compare properly by writing down the scope, the deliverables and the exit terms. That is exactly the work of an AI audit and advisory carried out before signature, not after.
| Topic | Provider established in France | Provider established outside the EU |
|---|---|---|
| Law applicable to processing | GDPR and AI Act | GDPR and AI Act |
| Data transfer | None if everything stays in the EU | Mandatory framework: adequacy or standard clauses |
| Authority access | French and European law | Law of the home country, on top |
| Contract negotiation | Possible, French law | Terms of service often imposed |
| Recourse in a dispute | French court | Foreign jurisdiction, prohibitive cost |
| Support | Same time zone, same language | Time difference, language to verify |
| Exit | Reversibility is negotiable | Depends on who holds access |
Six questions to ask in both cases
- Where is the data hosted, and where are the backups?
- Who can access the data, and on what legal basis?
- Which sub-processors do you involve, and which of them are outside the EU?
- What happens if I want to leave in six months?
- What is the contractual response time in the event of an incident?
- Which documents can I hand to a client who audits me?
If the provider answers those six questions in writing, nationality becomes a secondary criterion. If it dodges them, nationality becomes a signal. This questionnaire overlaps with what we describe in the warning signs of an unreliable AI provider and, upstream, in the questions to ask before signing with an AI agency.
FAQ
Is a foreign provider breaking the law in Europe?
No. GDPR and the AI Act apply as soon as the system is used or distributed in the EU, whatever the provider's registered office. What changes is how easily you can establish a breach and obtain compensation.
Can I work with a non-EU provider without transfer clauses?
Not if personal data leaves the Union. You need either an adequacy decision covering the recipient, standard contractual clauses, or a derogation provided for by GDPR. The Article 28 processing agreement remains necessary in every case.
Is the adequacy decision with the United States enough?
It simplifies the transfer for certified organisations. You still have to check that your provider is actually listed under the framework and keep a record of that check. Adequacy can be annulled, as the two previous frameworks were.
Does a French provider guarantee my data stays in France?
No. A French agency can host in the United States or hand its support to a team outside the EU. The transfer then exists, even if your contract is signed in France. Ask for the list of sub-processors, not the registered office.
How long does it take to change provider?
It depends on who holds access and documentation. With a documented model, instructions and logs, a change can be prepared in a few weeks. Without documentation, you often have to rebuild. To frame the skills you need internally, see also AI agents in business.
Conclusion
The provider's nationality is not the right decision criterion. The right criterion comes down to three questions: where does my data go, what can I invoke if something goes wrong, and how fast can I leave. A French provider that answers those three badly is riskier than a foreign provider that answers them in writing.
If you want to settle that choice before signing, our AI audit and advisory page is built for exactly that: scope, hosting, contract, exit terms. To discuss it, use the contact page.
