The Sovereignty Gap: Why US-Based Infrastructure Risks Compliance

The primary conflict in modern AI infrastructure is the tension between the US Cloud Act and the European General Data Protection Regulation (GDPR). Under the Cloud Act, US authorities can compel US-based companies to provide data stored on their servers, regardless of where that data is physically located. For a German medical startup or a French fintech firm, this creates a legal paradox: even if the GPU is in Frankfurt, the corporate ownership of the provider may invalidate the data residency guarantees required by their customers. This jurisdictional reach means that data subjects in the European Economic Area (EEA) may have their personal information accessed by foreign entities without the protections afforded by EU law.

The EDPB and Supplementary Measures

According to a recent report by the European Data Protection Board (EDPB), specifically the recommendations on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, the reliance on non-EU providers for processing sensitive personal data remains a high-risk area for enforcement. The EDPB emphasizes that technical measures must be robust enough to prevent access by the provider itself if that provider is subject to laws that do not align with GDPR standards. This has led to a growing demand for EU-sovereign infrastructure where the entire stack, from the physical data center to the software orchestration layer, is managed by European entities.

Establishing Sovereign Boundaries

For teams building LLM-powered applications, this means moving beyond simple data-at-rest encryption and ensuring that the inference execution itself happens within a sovereign boundary. Lyceum operates its own GPU infrastructure in European data centres in Spain, Paris and the Nordics, and contracts through European legal entities in Berlin and Zurich. Inference prompts and outputs are processed but not retained after processing, and customer data is never used for training. In the serverless catalogue, four of the 35 models are global-hosted and never receive traffic unless you explicitly select them; everything else runs in the EU. A DPA carrying the named sub-processor list is available on request.

Technical Requirements for Production-Grade Inference

Achieving compliance does not mean sacrificing performance. Modern inference stacks must balance the strictures of GDPR with the technical demands of low-latency model serving. This requires a move away from black-box APIs toward transparent, open-stack architectures. By utilizing tools like vLLM and optimized inference frameworks, which have matured recently, teams can achieve throughput levels that rival proprietary US engines while maintaining full control over their deployment environment. The ability to inspect the code and the environment where the model runs is a critical component of the transparency required by the EU AI Act.

Optimizing Local Cluster Utilization

A common mistake for scaling teams is underestimating the complexity of memory management and cold starts in a compliant environment. When you cannot rely on a global pool of shared GPUs, you must optimize for local cluster utilization. Lyceum addresses this by providing dedicated inference endpoints that provision rapidly, allowing teams to scale their capacity based on real-time demand without the data leakage risks associated with multi-tenant public clouds. This dedicated approach keeps VRAM and compute cycles isolated, so throughput stays consistent regardless of other users on the platform.

Illustrative Scenario: Regulated Industry Inference

The following is a hypothetical worked example, not a customer case. Consider a medical imaging company. They require H100 or B200 GPUs for high-speed segmentation inference. If they use a US-based API, they are effectively sending patient data outside their regulatory boundary. By hosting the same model on Lyceum's EU-sovereign infrastructure, they keep the same OpenAI-compatible API interface while the workload runs in Lyceum's European data centres in Spain, Paris or the Nordics. Running their own model on exclusively allocated hardware is Dedicated Inference, billed per GPU-hour, while a self-serve GPU VM is billed per second with no base fee, so the meter follows actual use even for bursty workloads. The use of optimized kernels and quantization techniques further helps these deployments meet the latency budgets typical of production medical software.

The EU AI Act: Preparing for Enforcement

The regulatory landscape shifted significantly with the EU AI Act, whose high-risk obligations under Chapter III Sections 1-3 have been deferred to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. For AI startups, compliance is no longer just about privacy: it is about the accountability of the entire model lifecycle. High-risk AI systems, particularly those used in critical infrastructure, education, or employment, must now demonstrate rigorous data governance and risk management. The Act introduces a tiered approach to regulation, where the level of scrutiny depends on the potential impact of the AI system on fundamental rights and safety.

Accountability and High-Risk Systems

Infrastructure providers play a pivotal role in this ecosystem. Enterprise buyers increasingly ask for audit trails and third-party assurance reports such as ISO 27001 certification or a BSI C5 attestation. Lyceum holds none of these today and says so: no ISO 27001 certificate, no SOC 2, no C5 attestation. Certification work is a live topic internally, and being direct about where that work stands is the position Lyceum takes in sales conversations. Regulatory uncertainty is a common reason European enterprises give for delaying AI adoption. By choosing a provider that treats compliance as a core feature rather than an afterthought, startups can turn these regulations into a competitive advantage when selling to risk-averse corporate clients. The EU AI Act specifically targets systems that could influence elections or be used for biometric identification, requiring these developers to maintain detailed logs of their inference activities.

The Role of Infrastructure in Governance

Lyceum states no conformity position under the EU AI Act. What it does provide is infrastructure-level detail that customers can fold into their own Article 11 documentation: GPU model, inference engine and version, and the data centre region a workload ran in. The obligation itself sits with the provider of the AI system, not with its compute supplier. As the Act enters full enforcement, the ability to prove that data has been handled in a transparent and secure manner will be the difference between a successful product launch and significant fines. The Act also mandates human oversight and high levels of cybersecurity, which under Article 15 are design-and-development duties on the provider of the high-risk AI system rather than obligations facilitated by the choice of hosting infrastructure.

Cost Optimization and GPU Availability in Europe

The economic argument for EU-native infrastructure is becoming as strong as the legal one. Hyperscaler pricing for high-end GPUs like the NVIDIA H100 often includes a significant "convenience tax," with rates reaching high premium rates in some regions. Furthermore, the lack of dynamic availability often forces teams into expensive block reservations that leave clusters underused for much of their reserved term. This inefficiency is a major drain on the capital of European AI startups, which often operate with smaller budgets than their US counterparts.

Eliminating Hidden Costs

Lyceum operates its own GPU infrastructure in European data centres in Spain, Paris and the Nordics. H100 capacity is listed at $2.79 per GPU-hour on an on-demand VM and $3.59 per GPU-hour for dedicated inference and serverless training, billed per second, which is materially below what traditional cloud providers publish for the same silicon. For a startup running sustained inference or weeks-long fine-tuning jobs, these savings are the difference between a sustainable burn rate and a premature exit. Furthermore, the absence of egress fees means that moving large datasets or model weights between S3-compatible storage and compute nodes does not result in unexpected billing spikes. Egress charges can be a meaningful share of a monthly hyperscaler bill. Lyceum's S3-compatible storage carries no ingress or egress charges.

Intelligent Scheduling and Resource Allocation

Effective scaling also requires intelligent scheduling. The intelligent scheduling system used by Lyceum predicts VRAM requirements and estimates runtimes to automatically select the most cost-effective GPU for a given task. This level of orchestration can reduce job costs substantially, allowing engineers to focus on model architecture rather than infrastructure plumbing. When you combine this with rapid VM provisioning, the result is a platform that matches the speed of the most advanced US providers while remaining firmly rooted in European soil. By matching workloads to the right GPU and billing per second, Lyceum keeps European AI teams from paying for capacity they are not using.

The European Data Protection Board (EDPB) has provided clear guidance on the measures required to protect personal data when using cloud services. Their recommendations emphasize that the mere physical location of a server is not enough to guarantee GDPR compliance if the service provider is subject to the laws of a third country that allow for disproportionate access to data. For LLM inference, this means that the technical measures must be so robust that the provider cannot access the data even if compelled by a foreign court. This is a high bar that many traditional cloud providers fail to meet because their management planes and support staff are often located outside the EEA.

Technical and Organisational Measures

Article 32 GDPR asks the controller and the processor for technical and organisational measures appropriate to the risk, and lists pseudonymisation and encryption as examples rather than as a fixed requirement, so what a supplier will commit to in writing matters more than the adjectives on its security page. Lyceum's contribution to these safeguards is narrow and worth stating plainly: processing happens in European data centres, inference prompts and outputs are not retained after processing, and customer data is never used for training, though the EDPB's "supplementary measures" concern transfers to third countries, and for cloud processing that requires access to data in the clear it identified no effective technical measure. This level of security is essential for processing sensitive data, such as personal health information or financial records, where the risk of unauthorized access is highest.

The Importance of Legal Recourse

Another key aspect of the EDPB guidance is the availability of legal recourse for data subjects. When data is processed by a US-based company, European citizens may find it difficult to exercise their rights under GDPR if their data is accessed by US authorities. By using a provider like Lyceum, which is headquartered in Berlin and Zurich and runs its GPU infrastructure in European data centres in Spain, Paris and the Nordics, companies keep their users' rights inside the reach of European law. This not only simplifies compliance but also builds trust with users who are increasingly concerned about how their data is handled by AI systems. The EDPB's focus on the "essential equivalence" of protection means that any transfer to a third country must be assessed case by case, so choosing a local provider avoids the Chapter V transfer question altogether, though an adequacy decision under Article 45 and appropriate safeguards under Article 46 remain lawful alternatives.

Infrastructure Roles in High-Risk AI Systems

The EU AI Act introduces a classification system that identifies certain AI applications as "high-risk." These include systems used in recruitment, credit scoring, law enforcement, and the management of critical infrastructure. For developers of these systems, the requirements for compliance are extensive, covering everything from risk management to technical documentation and human oversight. The infrastructure used to host these models is a critical part of the compliance chain. If the underlying hardware or software stack is not secure or transparent, the entire AI system may fail to meet the Act's standards.

Supporting Risk Management Frameworks

A key requirement for high-risk AI is the implementation of a risk management system. This system must identify and mitigate the risks associated with the AI system throughout its lifecycle. Lyceum supports this by providing a stable and predictable environment for inference. By offering dedicated resources and detailed monitoring, Lyceum allows developers to track the performance and behavior of their models in real-time. This data is essential for identifying potential biases or errors that could lead to harm, allowing for rapid intervention. The ability to isolate workloads also ensures that a failure in one part of the system does not compromise the safety or security of the entire application.

Ensuring Human Oversight

The EU AI Act also mandates that high-risk systems be designed in a way that allows for effective human oversight. This means that the system must be transparent and its outputs must be explainable. While the model architecture itself plays a large role in this, the infrastructure must support the logging and auditing necessary for humans to review the system's decisions. Lyceum's platform is designed with these requirements in mind, providing the necessary hooks for logging and the performance required to run explainability modules alongside the main inference task. As the Act moves toward full application, the infrastructure provider will remain outside the certification process for high-risk AI, which binds the provider of the AI system rather than its compute supplier.

Technical Documentation and Article 11 Compliance

Article 11 of the EU AI Act specifies the technical documentation that must be maintained for high-risk AI systems. This documentation must be detailed enough to demonstrate that the system complies with the Act's requirements and must be kept up to date. For many startups, the burden of creating and maintaining this documentation can be overwhelming. However, by using a compliant infrastructure provider, much of the data required for this documentation can be collected automatically. This includes information about the hardware used, the software environment, and the performance characteristics of the system during inference.

Automating the Audit Trail

Lyceum assists its customers by providing detailed logs and system specifications that can be directly incorporated into their technical documentation. This includes information on the specific GPU models used, such as the NVIDIA H100, the versions of the inference engines like vLLM, and the data centre region a workload ran in. By automating the collection of this data, Lyceum allows AI teams to focus on their core product while supporting, rather than discharging, their own compliance with the Act's transparency requirements. This audit trail is also vital for responding to requests from national supervisory authorities, who have the power to inspect the documentation and the system itself.

Data Governance and Quality

The Act also places a strong emphasis on data governance, requiring that the datasets used for training and testing be relevant, representative, and free of errors. While the infrastructure provider does not typically manage the training data, the way data is handled during inference is equally important. What Lyceum can state about inference is narrower: prompts and outputs are processed but not retained afterwards, prompt caching stays in GPU memory for the session only, and customer data is never used for training. Those are the facts to carry into your own integrity assessment, which under Article 24 remains the controller's to make. As part of a broader compliance strategy, the use of Lyceum's sovereign cloud can support, but does not by itself provide the foundation for, the data quality requirements of the EU AI Act, which bind the provider of the AI system rather than its infrastructure supplier.

Sovereign Boundaries and Limits on Provider Access

The concept of a "sovereign boundary" is central to the future of AI in Europe. It refers to a technical and legal environment where data is processed entirely under the jurisdiction of the EU, free from the influence of foreign laws. This is particularly important for LLM inference, where the data being processed is often highly sensitive. To achieve a true sovereign boundary, every layer of the stack must be considered, from the physical security of the data center to the network protocols used to transmit data. Lyceum is built on this principle, offering a platform that is designed from the ground up to meet the needs of European AI teams.

What Limits Provider Access

Vendors often describe this as a zero-trust architecture, and Lyceum makes no such architectural claim. In a traditional cloud environment, the provider has high-level access to the virtual machines and containers running on their hardware, and the question worth asking a supplier is which parts of that access it will rule out in a contract. Lyceum's published position is narrow and verifiable: inference prompts and outputs are processed but not retained afterwards, prompt caching happens in GPU memory only, per session, for minutes at most, and is never written to a database, and customer data is never used for training. The EDPB's recommendations on supplementary measures point in the same direction, though they address transfers to third countries rather than processing inside the EEA. None of this removes the need to trust the provider. It narrows what you are trusting it with, and puts what remains into a DPA you can hold it to.

Physical and Legal Security

Physical security is another critical element. Lyceum runs its GPU infrastructure in European data centres in Spain, Paris and the Nordics, and the data centre operators hold ISO certifications at facility level. This ensures that the hardware cannot be tampered with or accessed by unauthorized individuals. Legally, whether a provider such as Lyceum falls within the reach of the US CLOUD Act is, on the DOJ's own account, a highly fact-dependent jurisdictional question rather than one settled by European incorporation alone. This provides a clear legal framework for data processing, giving customers the certainty they need to operate in regulated industries. As the EU AI Act and GDPR continue to evolve, the importance of these sovereign boundaries will only grow, making Lyceum an essential partner for any AI company looking to scale in Europe.

Sources

[1] EU AI Act: first regulation on artificial intelligence; [2] EDPB Recommendations 01/2020 on measures that supplement transfer tools; [3] EDPB: Opinion 28/2024 on Data Protection Aspects Related to the Processing of Personal Data in AI Models; [4] Art. 32 GDPR: Security of processing