Data sovereignty in Spain and AI conversations

The strategic data of Spanish companies and sensitive public-sector information should remain, by default, in Spain or under European Union infrastructure, jurisdiction and effective control. The rule covers databases, but also documents, code, contracts, images, keys, prompts, attachments, responses and complete conversations with artificial intelligence systems. A conversation with an AI can reveal more competitive knowledge than a customer table: it contains questions, hypotheses, problems, decisions and internal materials. The Agencia Española de Protección de Datos advises against sharing personal data or delicate or sensitive information with AI tools, including medical, financial or contractual details.[1] Physical residency is not enough on its own; you have to check who controls the provider, which sub-processors are involved, which laws can compel it, and whether the organization can recover, move or destroy the information.

Key findings

AI turns the conversation into a new corporate repository. The AEPD recommends not entering personal data or medical, financial or contractual information; the risk does not end at a database and extends to the prompts, files and context supplied to obtain an answer.[1]
Terms change by product and configuration. OpenAI does not train by default on data from its business offerings, while a personal workspace lets the user disable use for training; the difference between consumer and enterprise is part of the assessment, not a licensing detail.[2][3]
Other systems' policies show the same contrast. Anthropic applies a five-year retention to consumer chats when the user authorizes their use for improvement; Google keeps Gemini activity for 18 months by default and certain human-reviewed chats for up to three years.[4][5]
A European region does not remove all foreign exposure. Section 2713 of US Title 18 obliges certain providers to preserve or disclose communications in their possession, custody or control even when stored outside the United States.[7]
The European Union already treats sovereignty as a procurement requirement. In April 2026 the Commission awarded a 180 million euro contract for sovereign cloud for Union entities and proposed CADA with a common framework for sovereignty and public-sector adoption.[10][11]

Why is a conversation with an AI also a data asset?

Because it does not contain only the sentence typed into the text box. It can include attachments, code, emails, reports, screenshots, system instructions, data pulled from connectors, account metadata, history used as memory and the generated response. When someone asks "how do we solve this problem?", they are already revealing that the problem exists, which alternatives they are considering and which criteria they use to decide.

In a company, that sequence can expose pricing strategy, vulnerabilities, litigation, designs, acquisitions, customer lists, credentials, personnel files or unpublished knowledge. In a public administration it can contain case files, health consultations, tax information, investigations, regulatory decisions or data about critical infrastructure. The competitive and security risk exists even when the content does not fit the legal category of personal data.

An AI conversation contains more layers than the prompt

Strategic data can appear before, during and after the response.

Source: own elaboration based on the data policies of OpenAI, Anthropic and Google and the recommendations of the AEPD.[1][3][4][5]

Do all AI services treat data the same way?

No. Even within the same brand, a consumer product and an enterprise product can have different rules. OpenAI states that it does not use ChatGPT Business, Enterprise and API data by default to train models and that certain enterprise administrators control retention; in personal workspaces, the user can turn off "Improve the model for everyone".[2][3] That difference does not automatically make an enterprise plan sovereign, but it changes a material part of the risk.

Anthropic asks consumer users to make a choice about model improvement. If they authorize the use, it applies a five-year retention to new or resumed chats; if not, the company states that it keeps the 30-day period described in its update.[4] Google reports that Gemini Apps with activity turned on stores data for 18 months by default, may use conversations to improve models and keeps human-reviewed ones for up to three years; for Workspace Business or Enterprise accounts it states that chats and files are not reviewed or used to improve generative models.[5][6]

Example	Consumer product	Enterprise product
OpenAI	The user can disable the use of new conversations for training.	Business content is not used for training by default; administration and retention controls exist depending on the product.
Anthropic	Choice on model improvement; five-year retention if authorized, per the 2025 update.	Enterprise terms and controls are different and must be reviewed in the contract.
Google Gemini	Activity kept 18 months by default; a portion may be reviewed and kept up to three years.	Workspace Business/Enterprise states it does not review chats and files or use them to improve generative models.

The conclusion is not that any specific provider breaches its commitments. It is that the organization must deliberately choose product, configuration, retention, region, connectors and contract. Using a personal account for sensitive work can turn a corporate purchasing decision into an individual preference.

Where are the data, and who can compel the provider?

Residency describes the storage or processing location. Jurisdiction describes which laws and authorities reach the provider, its parent, its subsidiaries and the information under its control. Hardware ownership, encryption keys, sub-processors and administration add further layers. A piece of data can sit physically in Madrid and still be subject to an order directed at a company controlled from another country.

The CLOUD Act added to 18 U.S.C. §2713 an explicit obligation covering communications and records located inside or outside the United States when they are in the possession, custody or control of the provider subject to the order.[7] That does not authorize automatic or indiscriminate access: it requires the corresponding legal process. But it shows why "European region" and "European company" are not equivalent expressions.

The GDPR provides mechanisms for international transfers: adequacy decisions, standard contractual clauses and other safeguards. An adequacy decision allows flows without additional safeguards to the covered country or framework; standard clauses serve certain recipients outside the EEA.[8][9] Complying with those mechanisms can make a processing operation lawful. It does not by itself remove the strategic risk of concentration, foreign access, dependency or the impossibility of exit.

Which data should remain under Spanish or European control by default?

The answer must be proportional to the possible harm. Not all content needs the same environment, and requiring every public dataset to remain inside Spain would be unnecessary. The strong presumption applies to whatever could, through exposure, withdrawal or dependency, harm rights, competition, continuity or security.

Class	Examples	Infrastructure presumption
Public or low impact	Published content, non-confidential translations, promotional material.	May use global services with basic controls and ordinary assessment.
Internal, non-critical	Drafts, general procedures, operational data of limited impact.	Managed enterprise service, EU region, controlled contract and retention.
Confidential or strategic	Unpublished code, pricing, contracts, M&A, architecture, customers, research.	By default, EU provider and control, own keys, tested exit or private/local infrastructure.
Regulated or essential	Health, justice, defense, public case files, identities, critical infrastructure.	Maximum Spanish/European control; any exception must be justified, documented and reversible.

The greater the impact, the greater the control must be

Location is one layer; the decision includes provider, keys, administration and exit.

Source: editorial assessment framework based on the AEPD, the Commission's Cloud Sovereignty Framework and CCN-CERT publications.[1][10][12]

Why is the problem also a competitive one?

Because the knowledge handed to an AI does not always appear as "personal data". A product plan, a negotiation, an algorithm or the diagnosis of a fault can be legally processable and still be decisive for the company's advantage. Contractual confidentiality and the absence of training reduce risk, but the organization still depends on access rights, sub-processors, availability, export and service continuity.

Competitive protection requires minimization: not handing over more context than necessary, separating identities, avoiding credentials, controlling connectors, using enterprise accounts and keeping a usable copy of the generated knowledge. For critical systems, it also requires being able to run models or services under your own or European control. CCN-CERT publishes both a guide on data protection in the cloud and digital sovereignty and a technical document on installing and hardening an LLM chatbot locally.[12] The existence of those guides does not mandate a single architecture; it recognizes that location and control are security dimensions.

What changes for public administrations, healthcare and defense?

The burden of proof changes. A public service does not manage only a company's economic risk: it handles rights, public powers, health information, public decisions and, in some cases, national security. Allowing civil servants to enter case files or operational information into personal AI accounts without a contract, classification or record is incompatible with serious governance.

The European Commission already applies this reasoning to its own procurement. In April 2026 it awarded 180 million euros to four providers through a Cloud Sovereignty Framework with additional sovereignty scores.[10] The CADA proposal introduces a single European framework for assessing cloud and AI sovereignty and a public-sector adoption mechanism, in addition to prioritizing facilities that reinforce essential public functions.[11] It is a proposal and may change, but it marks the direction: in sensitive functions, sovereignty stops being a voluntary commercial attribute.

My position is stricter for health, defense, justice, security and critical infrastructure: their AI conversations, documents and operational data should remain under Spanish or European control except by documented exception. That exception must identify benefit, jurisdiction, transfers, keys, retention, sub-processors, auditability, continuity and exit. The convenience of a tool is not enough.

Can European legislation tighten after you have signed?

Yes. An architecture that is valid today can become subject to stricter requirements tomorrow. The Data Act already regulates provider switching and third-country government access to non-personal data in the Union; CADA proposes new sovereignty requirements for cloud and AI.[13][11] A company that concentrates data, models and processes on a platform that is hard to leave does not only take on current law: it takes on the cost of adapting to any future rule.

The best protection against that regulatory risk is not predicting every law, but preserving reversibility. Exportable formats, portable software, an inventory of dependencies, controlled keys, separate copies and an alternative infrastructure reduce the cost of complying when the rules change.

Does this mean all Spanish data must stay physically in Spain?

No. The thesis is limited to strategic, sensitive, regulated or essential data and accepts global services when the risk is low or there is a clear justification. It also distinguishes Spain from the European Union: for many workloads, a European provider with controllable contract, operations, keys and exit offers an adequate level without demanding an absolute national border.

Residency in Spain provides proximity, physical access and a local legal relationship. European control widens the available market without handing the decisive layer to an external power. The specific choice depends on the type of data and the impact; what should not be accepted is that the location is unknown, the configuration depends on each employee and the exit exists only in a sales deck.

What does ipcore contribute, and what can it not promise?

ipcore operates MAD-NE as an independent Spanish company and lets you host your own hardware in Madrid, choose connectivity and reach the local team.[14] That infrastructure can keep servers, storage, backups or models under a Spanish relationship and be combined with European software, open source, MSPs and cloud. It does not automatically make an application sovereign: the operating system, virtualization, keys, AI model, administrators and external providers must each be assessed separately.

The contribution of a local facility is concrete: it makes the physical layer controllable and allows equipment to be removed or replaced without depending on an API. Total sovereignty does not exist as a single product. It is built with known layers, coherent contracts and an exit designed before it is needed.

Methodology and limitations

This opinion piece combines AEPD recommendations, public AI-provider policies, US legislation, European transfer mechanisms, CCN-CERT documents and Commission proposals in force as of August 25, 2026. Policies may change and must be verified against the specific product and contract. The text expresses an editorial position and does not constitute legal, data-protection, healthcare or national-security advice.

Conclusion

Which Spanish data should stay in Spain or the EU? Companies' strategic data and the public sector's sensitive or essential information, including AI conversations, should do so by default; any exception must be justified and preserve a workable exit.

Spain does not protect its knowledge merely by locating databases. It must also protect the prompts, documents, code, responses and decisions that feed the new artificial-intelligence layer. For a company, handing them over without control is a privacy and competition problem. For healthcare, public administration, defense and critical infrastructure it can become a national-security problem. European protection does not require closing off the Internet or giving up the best services: it requires that dependency be chosen, limited, auditable and reversible.

Frequently asked questions

Is a conversation with an AI a business asset?

Yes. It can contain problems, hypotheses, documents, code, decisions and derived responses. Even without personal data, it can reveal trade secrets or strategy. The AEPD advises against entering delicate or sensitive information, and provider policies show that retention and use vary by product.[1][4][5]

Does an enterprise plan prevent the provider from using the data for training?

It depends on the provider and the contract. OpenAI states that it does not train on business data by default; Google states the same for chats and files under certain Workspace plans. That does not remove operational retention, sub-processors, legal obligations or the need to configure access rights and connectors.[3][6]

Does storing data in a European region avoid the CLOUD Act?

Not necessarily. 18 U.S.C. §2713 refers to information in the provider's possession, custody or control, even when it is outside the United States. Access is not automatic and requires legal process, but physical location alone does not remove the parent company's jurisdiction.[7]

Does the GDPR prohibit using US providers?

No. It provides for adequacy decisions, standard contractual clauses and other mechanisms for international transfers. Legal compliance must be assessed case by case. This piece also argues a strategic thesis: a transfer can be lawful and still create dependency or competitive risk.[8][9]

Must every piece of government data remain in Spain?

Not necessarily, but sensitive case files, health, defense, security, justice and critical infrastructure justify an especially strong presumption of Spanish or European control. The Commission already uses sovereignty criteria in cloud procurement and proposes extending them to public adoption of cloud and AI.[10][11]

Can a company combine foreign AI with local infrastructure?

Yes. It can use external services for low-risk information and keep strategic data, keys, backups and sensitive models under European control. The Data Act and the CCN-CERT guides reinforce the importance of exit, sovereignty and local alternatives.[12][13]

Sources

AI tools were used for light editing and corrections in the preparation of this article. Research, claims and editorial responsibility remain with the signing author.

Share this article