Short answer. Data residency for AI in a CEE bank rarely means every byte must sit in one country. Under GDPR Chapter V you may move personal data outside the EEA only through an approved mechanism, and a breach carries fines up to EUR 20 million or 4% of global annual turnover. The practical decision has three layers: keep regulated data in an EU region, strip or tokenize personal identifiers before anything reaches a large language model, and write data-location and supervisory-access clauses into the vendor contract. Get those three right and you can use modern AI without failing an audit.
Residency is not one rule you can point to. It is the combined effect of GDPR restrictions on international transfers, the European Banking Authority expectation that critical outsourcing contracts state where data lives, DORA contract terms on the location of data and processing, and the view of your national supervisor. A bank that treats residency as “the server is in Frankfurt” and stops there will still fail on transfer mechanisms, subcontracting chains, or audit access.
The workable approach is a three-layer decision, taken before the first model runs rather than during remediation:
Most banks find that only a fraction of their AI workload actually needs the strictest treatment. The classification work, deciding which data is regulated personal data and which is not, is what makes the architecture affordable.
For financial services the residency question is supervised, not optional. The EBA Guidelines on outsourcing arrangements require a bank to record the specific locations where data is stored and processed for any critical or important function, and to guarantee that the competent authority can exercise access and audit rights at those locations. DORA, which applies to financial entities since 17 January 2025, requires the same location transparency in the contract under Article 30 and gives the bank a right to monitor the provider at all times.
The stakes rise when the AI system itself is high-risk. Credit scoring and creditworthiness assessment are named high-risk uses under the EU AI Act, whose obligations for such systems phase in through 2026 and 2027. When personal data crosses to a country without an EU adequacy decision, the Schrems II ruling requires a transfer impact assessment and, often, supplementary safeguards on top of Standard Contractual Clauses. Accountability to the regulator stays with the bank in every case. You can outsource the processing, not the responsibility.
Residency is a three-layer decision: EU region pinning, boundary tokenization, and enforceable contract terms.
No. GDPR does not ban leaving the EEA. It requires a lawful transfer mechanism when personal data does leave: an adequacy decision, Standard Contractual Clauses, or Binding Corporate Rules, backed by a transfer impact assessment where the destination lacks adequacy. Data that carries no personal identifiers, such as aggregated statistics or fully tokenized text, sits outside Chapter V altogether and can move more freely.
This is why classification comes first. A bank that separates regulated personal data from non-personal data can keep the sensitive slice in an EU region and route the rest through the best available model without a transfer problem. Treating every byte as maximally sensitive is the fast route to a project that never ships.
Three controls make it workable. First, call the provider through an EU-region endpoint with a zero-retention or no-training setting, so prompts are not stored or reused. Second, tokenize or pseudonymize personal identifiers before the prompt leaves your perimeter, then re-insert them on the way back inside the bank. Third, put a data processing agreement with current Standard Contractual Clauses in place and run a transfer impact assessment for any residual US processing.
With those controls, the model sees “customer 7F2A requests a limit increase” rather than a named person, and the personal data never leaves your control. The heavy lifting is at the boundary, not inside the model.
Under DORA Article 30 and the EBA outsourcing guidelines, the contract for a critical or important function has to name the countries and regions where data is stored and processed, and require notice before any change. It must grant the bank and its supervisor full access and audit rights at those locations, cover subcontracting so a fourth party cannot quietly move data offshore, and set an exit plan that returns or deletes data on termination. The contract should also require the provider to give notice before any development that could materially affect the location or protection of the data, and to keep a full service level description with quantitative targets for a critical function. A datasheet promise of “EU hosting” is not enough. The obligation has to be enforceable in the signed agreement, kept in one durable written document, and mapped to the entry a financial entity records in its DORA register of information.
Reserve the most expensive options for the most sensitive data. A sovereign or EU-operated cloud region suits data that must stay under EU legal control with no exposure to third-country access requests. Self-hosting a smaller open model inside the bank fits the narrow set of use cases where even pseudonymized data cannot leave, such as internal fraud signals or supervisory correspondence. For everything else, a region-pinned hosted model with boundary tokenization gives most of the benefit at a fraction of the cost. The decision is a data-sensitivity map, not a single company-wide switch.
Ableneo shipped 34 production AI projects in 2025, 94% of them using large language models, across regulated financial services and insurance in Slovakia, the Czech Republic, and Austria. In that work the data-location and supervisory-access questions are settled in the architecture before the first model call, using region pinning and boundary tokenization so the sensitive data never becomes a transfer problem. That production track record in the same regulatory world as ČSOB, Erste, and UNIQA is what turns a residency debate into a shipped system. See the full AI transformation FAQ for related guidance on governance and compliance.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.