Two statements often taken for one
Data residency means where data sits when it sits. Inference means where the compute happens when your prompt is processed. The first is a storage location, the second a compute location, and providers' EU residency commitments largely concern the first.
For ChatGPT Enterprise, per research dated 2026-09-01: EU residency covers data at rest, not inference (sources: stackcyber.com, radar.firstaimovers.com).
Why that is the decisive point for a prompt
At the moment of processing a prompt is not "at rest". It is in cleartext exactly where the compute happens. If your requirement is "this content does not leave the European legal area", then a storage commitment answers a different question.
What you can verify, and what you cannot
- Verifiable: what your contract says about storage, which subprocessors are listed, which certifications exist.
- Not verifiable from outside: which data centre processed one particular prompt. The provider does not log that for you.
So the only provable boundary is the one you draw yourself: a control layer that classifies, masks and logs before egress. What leaves masked can be processed outside the EU without cleartext leaving the legal area.
What BRANE does not do here. It proves what the model received — not what the provider does with it afterwards. That limit is why masking sits before egress and not after.