DORA and the CLOUD Act: two reasons to keep inference on your hardware
One is a European resilience regime that counts every ICT dependency; the other is a US statute that follows a provider’s nationality, not its data centre. Both point the same way for regulated Luxembourg.
DORA’s view of an AI provider
The Digital Operational Resilience Act, applicable since 17 January 2025, treats any ICT service provider as a third party to be contracted, monitored and, where the function is critical or important, reported in the register of information. It requires exit strategies, concentration-risk assessment and specific contractual clauses.
A hosted AI service used on client files is an ICT third party in that sense. If it becomes critical to a process, the full DORA apparatus applies to it — and the provider may itself be designated a critical third-party provider subject to EU oversight.
The CLOUD Act’s reach
The US Clarifying Lawful Overseas Use of Data Act of 2018 allows US authorities to compel providers subject to US jurisdiction to produce data in their possession, custody or control — regardless of where it is stored. An EU data centre run by a US-controlled company does not put data out of reach.
For a Luxembourg bank bound by banking secrecy, or a law firm bound by professional secrecy, that is not theoretical: it is a foreign order the firm cannot see, arriving at a provider the firm does not control.
Hardware you own, in Luxembourg
An appliance inside your own infrastructure is not an ICT third-party service for inference: there is no provider to register, no concentration risk on a hyperscaler, and the exit strategy is trivial because nothing has left. A machine owned by a Luxembourg entity, on Luxembourg soil, held by no US-controlled provider, gives a CLOUD Act order nothing to attach to.
The supplier relationship that remains — installation and support — is documented like any hardware maintenance contract.
Engineering guidance, not legal advice. We work alongside your DPO and counsel.
Official sources
See it on your own documents.
Thirty minutes on your use case, against a sample of your kind of files. We come to you.