AI Compliance: GDPR, SOC 2, HIPAA, EU AI Act

Procurement teams evaluating LLM vendors in 2026 need answers to seven questions: SOC 2 Type II date, HIPAA BAA availability, GDPR-compliant data residency, sub-processor list, DPA terms, zero-data-retention options, and EU AI Act risk tier. Vendor marketing rarely answers them in one place.

These pages cite each vendor's trust page, security portal, and sub-processor list as of June 2026 so you can build the security review packet in an afternoon, not a quarter.