Data sovereignty and the AI in your QMS
An AI assistant reads your complaints, deviations and SOPs to answer you. Whose law reaches that content, what to ask a provider, and the European options.
In this article
A quality manager wants a summary of a long deviation report before the morning meeting, pastes it into a public chatbot, and has the summary in ten seconds. The report named a customer, a batch and two colleagues. Where it went, which country’s law now covers it, and who keeps it, nobody asked. AI in a quality management system is useful for exactly this kind of job: summarising, finding and counting records that people used to trawl through by hand. The question worth settling before you switch it on is one of data sovereignty: where the words go, and whose rules apply once they are there.
What a QMS holds that should not travel#
Quality records are among the most sensitive documents a company keeps, and they are dense with the details regulators care about.
- Complaints name customers and products, and often the person who complained.
- Deviations, non conformances and CAPAs name batches, suppliers, and the people who found and fixed the problem.
- Training records are employee data: who read what, when, and who is overdue.
- SOPs and work instructions describe how you make and check your product, which is the know-how your competitors would most like to read.
- Audit findings are what an inspector reads first.
Under the GDPR, the names in those records are personal data, with rules on who may process them and on transfers outside the EU and EEA. Under your customer contracts, the rest is usually confidential. An AI assistant that reads these records to answer a question is a processor of that content, wherever it runs.
Where the words go#
Every AI assistant works the same way underneath: your question, and the content it reads to answer it, are sent to a model. What differs is where that model runs and on whose terms. Three questions settle most of it.
- Where is the service hosted, and in which region are the requests handled? A European provider, or a cloud region you choose, keeps the content under EU law. A service run from the United States brings the transfer rules into play.
- Does the provider train on your content? The answer should be a plain no, in writing. M‑Files, for example, states that it does not use your documents, related metadata or questions to train its own assistant, Aino.
- Who can see the logs, and for how long are prompts and answers kept? A summary of a deviation report is a copy of the deviation report.
If a vendor cannot answer these three questions on one page, the AI is not ready for quality records.
Sovereignty is about whose law reaches the data#
Data sovereignty means that data is governed by the laws of the place where it is stored and processed, and by the laws that bind the company processing it. For quality records both halves matter. The United States CLOUD Act of 2018 allows US authorities to require a provider under US jurisdiction to hand over data it holds, wherever in the world that data is stored. A European data centre run by a US company answers to both sets of rules.
Transfers of personal data from the EU to the United States rest on the EU-US Data Privacy Framework, adopted in 2023. Its two predecessors, Safe Harbour and Privacy Shield, were struck down by the Court of Justice of the EU in 2015 and 2020, so a careful company plans for the legal basis changing again rather than building on it. The two options that do not depend on a framework holding are a provider under EU jurisdiction only, and your own servers.
Sovereignty also has a practical side: being able to leave. If the AI is a service you cannot swap, your quality records are tied to that provider’s terms, prices and jurisdiction for as long as you use it. An assistant that can run on a European provider today and on your own hardware next year, without changing how people work, keeps the decision yours.
The European options#
There are three places to run the model, and each is a real choice rather than a compromise.
A European provider. Scaleway is a European AI provider hosted in the EU. Content stays under EU jurisdiction, and the capable models available there handle the everyday jobs of a QMS assistant well: summarising a procedure, comparing two versions, finding the CAPAs behind a non conformance and counting them by stage.
A hyperscaler in a European region. Azure AI Foundry lets you run models in a region you choose. Your IT team already knows the contracts and the controls, and the data region is a setting rather than a negotiation. The provider’s home jurisdiction still applies, which is the trade-off to write down.
Your own servers. A model on your own hardware means the content never leaves the company, and no foreign law reaches it through a provider. Smaller open models are now good enough for most of what a QMS assistant does, and this is the option for organisations whose customers or regulators ask exactly where their records are processed. It asks more of your IT team, and the answers are only as good as the model you choose.
What the AI Act adds#
The EU AI Act entered into force on 1 August 2024 and became generally applicable on 2 August 2026, with some parts still to come. Two pieces already apply to any company using AI at work: the ban on certain AI practices and the duty to ensure AI literacy among staff, both in force since 2 February 2025, and the obligations for general-purpose AI models, in force since 2 August 2025. The rules for high-risk systems in sensitive areas follow in December 2027, and for AI in regulated products in August 2028.
Summarising a procedure or counting open CAPAs is not a high-risk use, so for most quality teams the Act is a documentation and awareness duty rather than a redesign. Two habits cover a lot of it: know which AI services your people use for quality records, and make sure the people who use them know what the tools do and do not do. Your own advisers can tell you where your organisation stands.
How VisualQMS handles it#
The AI assistant we supply alongside VisualQMS sits inside M‑Files, beside the record you have open, and you choose where it runs: Scaleway, OpenAI, Azure AI Foundry, or a model on your own servers. The questions, and the content the assistant reads to answer them, go to that service and nowhere else, and the choice can be changed later without changing how people work.
Three things hold whichever service you pick. Every search, read and count runs as the person asking, so a record they may not open never reaches the answer. Files a user attaches from their own computer go to the same service, and attachments can be switched off. If you switch on search by meaning, the documents you choose are indexed in advance, and the index can live in a store you run.
Put M‑Files and the model on your own servers, with the search index and the service that prepares it alongside them, and your quality records never leave the company. See AI in VisualQMS for what the assistant does and what each option needs.
Six questions for your own set-up#
- Which AI services do people already use for quality records, sanctioned or not?
- Where is each one hosted, and under which country’s law does the provider operate?
- Does the provider train on your content, and how long are prompts and answers kept?
- Does the assistant respect the permissions on each record, or does it see everything?
- What would a customer audit or an inspection ask about where the records are processed?
- Could you move the model to another provider or in-house later without changing how people work?
Book a demo and we show the assistant running on a European service and talk through what your own servers would need. Or write to sales@solutionmanagement.eu with your data policy in hand, and we answer the same working day.