How are residency and jurisdiction different?
Residency records where processing and storage occur; jurisdiction records which entities and legal regimes apply. Keep those fields separate from the subprocessor list, international-transfer mechanism, retention terms, and deletion path. One region selector cannot resolve all six questions.
The European Commission’s controller-processor clauses require the contract to state the processing subject and duration, nature and purpose, personal-data types, data-subject categories, and the parties’ obligations and rights. They also require international transfers to follow documented controller instructions and the applicable Chapter V conditions.
Source: European Commission Decision (EU) 2021/915, recitals 7–10 and clause 7.8 · verified 2026-08-10
What does enterprise AI compliance cover?
It covers decision rights and evidence across the supplier chain and the deployed system’s lifecycle. NIST’s Generative AI Profile calls for use-case supplier risk assessments, contract clauses that permit evaluation of third-party processes, an inventory of approved providers, and continuous monitoring of third-party generative AI in deployment.
The practical record names the use case, data categories, provider, exact model ID, processing scope, contract owner, incident owner, last verification date, and the event that forces a new review. The failure mode we watch is scope drift: a policy may exist while its evidence points to a different model, region, or contract.
Source: NIST AI 600-1, Generative AI Profile, actions GV-6.1 and GV-6.2 · verified 2026-08-10