Suppliers and EU residency

Picking an AI vendor is not a demo war. It is a list of questions that fit in an email, and that an honest salesperson can answer in writing within a week.

SMEs sign fast because the pilot “is small”. Then the same vendor enters invoices, tickets and the site. Switching hurts. Better to ask now, while scope is still narrow.

EU residency is not a fetish: it is simpler to explain to a customer, a reviewer and your own team. It is not the only criterion. It is the first that clears the map.

The questions that matter

• Where is data processed and stored (a concrete region, not “the cloud”)?
• Do you train on our inputs or documents? If not, how is that blocked in the contract?
• Sub-processor list and prior notice if it changes.
• Who can read one of our prompts in support? How long do logs live?
• How do I delete a customer or a batch? How long does it really take?
• What if you triple the price tomorrow or close the EU region?
• Is there an export outside the EU? If yes, which mechanism and for what purpose?

Residency, transfer and marketing

“Servers in Frankfurt” is not enough if support, training or backups leave that jurisdiction without you being told. Ask for the full flow, not the marketing map.

A transfer can be lawful and you can still not want it: more complexity, more explaining, more failure points. If the case does not need it, do not buy it for a feature you will not use in the first quarter.

A processor contract, not a trust PDF

The processor agreement (or the order clauses) must state purpose, duration, data type, measures, sub-processors and what happens at the end. If there is only a “trust centre” link that changes without notice, you do not have a contract. You have a blog.

Get the no-training term in writing. Console checkboxes get unchecked. Clauses do not.

A plan B before you depend

Export the corpus and queues in a format you understand (documents, CSV, JSON). Do not let process knowledge live only in prompts locked in their UI. If the flow owner cannot explain the process without the vendor, you are already captured.

A plan B is not “we rebuild the same thing in a month”. It is being able to go back to the manual process or a sheet in one afternoon. That is why the kill switch is part of the purchase.

Price, lock-in and the silent 3×

Token prices look small. The lock is in the connector, in team memory, and in logs you cannot extract. Price a year, not the trial week. Ask the cost of leaving: export, support hours, retention.

If the salesperson will not talk about exit, they are selling a subscription, not a tool.

Programme fit

Vendor criteria are advisory (Kit Consulting) and then a line in implementation. An agent who pushes their single partner without this list is not orienting you. They are placing a product.

A one-page card per vendor

Name, process and storage region, trains yes/no (clause), sub-processors (link or list), usage price at your volume, exit price, kill switch (where the key is revoked), date of the last written answer.

Three filled cards beat a 30-question RFP nobody answers. If a salesperson will not fill the card, they do not get a second meeting. The criterion is boring on purpose: that is how you compare without theatre.

Review the card at day 90 or when scope changes. A vendor that was fine for an internal FAQ may not be fine for invoices. Scope leads, not the brand.

When the salesperson says “we are ChatGPT for companies”

Ask for the same card. The slogan does not answer region, sub-processors or exit. If the demo is brilliant and the card is empty at day seven, the brilliance was the product. You need a processor, not a slogan.

Always compare two. One alone anchors you to the first price and the first fear (“if we do not sign now we lose the discount”). The discount does not pay for a three-year lock.

Keep the salesperson’s reply next to the card. That thread is part of the informal contract: what they promised on residency and no-training. If the console later flips a checkbox, you have a date and a text. Without the thread, only homepage marketing remains.

Frequently asked questions

EU vendors only?

Not a dogma. It is simpler. If a non-EU vendor answers the list and the flow justifies it, you can argue it. If they do not answer, they drop.

Does local open source avoid all this?

It avoids some processors. Hosting, backups and the team perimeter remain. Not magic; another map.

Can we start on the free tier?

With synthetic data, yes. With real invoices, no. Free tiers often have the worst training clauses.

Next: GDPR basics and minimum security. Ask us to review a concrete vendor.