An AI agent hosted in France or a non-European service?
Hosting in France simplifies the GDPR file and brings recourse closer. It narrows model choice and often costs more. No location settles the question of foreign law on its own.
The debate is regularly reduced to a slogan. It deserves better: both options have concrete consequences, and some of them count against hosting in France. This page states them in both directions.
The six criteria, from the most decisive to the most contingent
Ranked by the weight they carry in the files we handle, public sector and private sector alike.
-
The regime applicable to personal data
Processing carried out within the European Union falls under the GDPR without any transfer framework having to be built. Using a service established outside the Union means identifying the basis for the transfer and documenting it.
This is not an insurmountable obstacle: transfers outside the EU are lawful and happen every day. It is additional compliance work, to be done and kept up to date.
-
Foreign law, and what location does not settle
The Cloud Act allows United States authorities to require a provider subject to their jurisdiction to hand over data it holds, including data stored outside the United States. FISA 702 separately governs certain intelligence collection.
Hosting in France reduces exposure, but location alone is not enough to set those texts aside: the contracting entity, its subcontracting chain, remote access and who holds the encryption keys weigh as much as the address of the data centre. We present no architecture as placing anyone beyond the reach of those laws.
-
Choice and capability of models
This is the most concrete trade-off, and it counts against local hosting. The best-performing models on the market are mostly operated from outside the Union, and some are not available for local installation.
Depending on the task, a model running on your own machine may be markedly less capable than a leading remote service. We measure this during scoping rather than turning it into a matter of principle.
-
Cost
A non-European service pooled at very large scale is often cheaper per use than dedicated capacity installed in France, hardware included.
The gap narrows when volume is high and regular, since a machine you own is not billed per call. It widens on low or irregular usage.
-
Recourse and control of the contract
A contract under French law, with a reachable contact and an accessible court, changes the nature of recourse if something goes wrong — service withdrawal, unilateral change of terms, a dispute over data.
This is often decisive for a public buyer, and rarely advertised by very large services.
-
Reversibility and end of service
What is exported, in what format and how quickly must be written down before starting, whichever option is chosen.
This is true on both sides: hosting in France under a poor contract is no more reversible than a remote service. The contract decides it, not the geography.
The two options, criterion by criterion
| Criterion | Hosted in France | Non-European service |
|---|---|---|
| Personal data regime | GDPR, no transfer framework to build | Transfer to be qualified and documented |
| Foreign law | Reduced exposure, never nil by location alone | To be assessed by provider and chain |
| Model choice | Narrower | Wider, often more capable |
| Cost per use | Often higher at low volume | Often lower, at scale |
| Recourse and contract | French law, reachable contact | Variable, often foreign law |
| Health data | Specific requirements, to be examined before any commitment | To be checked case by case |
| Reversibility | Decided by the contract | Decided by the contract |
Neither column wins on every line, and a page claiming otherwise would be an advertisement. The trade-off depends on the sensitivity of the data processed, the volume, and the task given to the agent.
What is included and what is rebilled at cost
| Item | Included in the published price | Rebilled at cost |
|---|---|---|
| Scoping, connection, training | Yes | No |
| Human supervision and monitoring | Yes | No |
| Model token consumption | No | Yes, at observed cost |
| On-site hardware (100 % Sovereign) | Depends on the option chosen | No |
| EU AI Act compliance file | Optional | No |
Token consumption is rebilled with no margin. In the 100 % Sovereign option, inference runs on your own machine, so this item drops sharply: that is the main economic effect of the option, and it works the other way on the entry price.
When a non-European service is the reasonable choice
We install agents hosted in France. That does not entitle us to stay silent about the cases where the other option is the right one.
- The task processes no personal data and no confidential information — generic drafting, translating public documents, exploring ideas.
- It requires the best reasoning available today, and the capability gap is measured, not assumed.
- Volume is low and irregular: dedicated capacity would sit idle most of the time.
- You already have a tested transfer framework, kept up to date by your legal department.