Run Claude with EU Data Residency (2026): The Three Paths

EU residency for LLM inference removes the cross-border transfer question for the inference path. Without EU residency, your inference traffic crosses from the EU to the LLM vendor's processing region (often US), which triggers GDPR Chapter V (cross-border transfers) requirements: Standard Contractual Clauses (SCCs), transfer impact assessment (Schrems II), and additional supervisory authority scrutiny.

With EU residency: the controller (you) processes EU personal data in the EU; the processor (your cloud vendor for Bedrock / Vertex / direct Anthropic) processes the data in the EU; no transfer outside the EU occurs for the inference path. Article 28 processor contract (your DPA with the cloud / Anthropic) still applies, but Chapter V transfer mechanics do not.

This simplifies the DPIA, simplifies the privacy notice to data subjects, and reduces the supervisory authority risk surface significantly. For higher-risk processing (special-category data, vulnerable populations, large-scale monitoring), EU residency is often the practical requirement rather than an optional preference.

Note: EU residency for inference does not eliminate residency questions for adjacent surfaces. Your application's database, your logging infrastructure, your CDN, your analytics — each can be a separate cross-border concern. Audit the full data flow.

AWS Bedrock EU is the most-deployed path in 2026 for EU enterprises that want Claude with EU residency. Benefits: broadest EU region selection (5+ regions), mature contracting surface (AWS DPA + GDPR DPA), HIPAA-eligible BAA already covering Bedrock, established AWS region for adjacent services (S3, RDS, OpenSearch, EKS), strongest sub-processor flow-down clarity (AWS is the primary processor, Anthropic is a sub-processor under AWS).

Google Vertex AI EU is competitive. Benefits: Vertex AI's broader generative AI tooling (Model Garden, Vertex Agent Builder, Vertex AI Search), Google Cloud's mature GDPR DPA, EU residency natively in Vertex's data governance documentation, often faster GA on new Anthropic models than Bedrock (Vertex's partnership with Anthropic has historically been earlier). Trade-off: smaller adjacent-services ecosystem compared to AWS for many enterprises.

Anthropic direct via Enterprise is a third path. Benefits: simplest model selection (direct API access to Claude as Anthropic publishes), no cloud-partner intermediary, fastest access to new model GA. Trade-offs: requires separate Anthropic Enterprise procurement (2-6 weeks), separate DPA review, separate sub-processor management. For most EU enterprises, this is the path only if Bedrock and Vertex don't fit their existing cloud strategy.

Decision rule: pick the path that aligns with your existing cloud. AWS-heavy: Bedrock EU. Google-heavy: Vertex EU. Neither: Anthropic Enterprise direct, or pick one of the clouds based on broader cloud strategy.

The EU AI Act treats Anthropic as the GPAI provider for Claude. Article 53 GPAI provider obligations apply to Anthropic: technical documentation, training-data summary, copyright policy, Code of Practice signing.

Anthropic signed all chapters of the Commission's GPAI Code of Practice as of June 2025. This means EU deployers downstream of Anthropic-as-GPAI-provider have access to the Commission-acknowledged baseline of provider compliance information, reducing the deployer's evidentiary burden for GPAI-provenance documentation.

For AWS Bedrock and Google Vertex paths: AWS / Google are the distributors and processors; Anthropic remains the GPAI provider under the EU AI Act. The deployer (you) still references Anthropic's GPAI Code of Practice signature as the provenance proof.

If your AI system is high-risk under Annex III: the EU AI Act Article 26 deployer obligations apply regardless of EU residency. EU residency does not change the deployer obligations; it changes only the cross-border transfer posture for personal data processing. For high-risk systems, you still need to implement risk management (Article 9), data governance (Article 10), technical documentation (Article 11), transparency to users (Article 13), human oversight (Article 14), accuracy and robustness (Article 15), and the Article 26 instructions for use plus monitoring.

Pitfall 1: defaulting AWS SDK to us-east-1. The AWS SDK defaults to us-east-1 if no region is specified. A misconfigured deployment can silently route EU customer data to us-east-1. Mitigation: set region explicitly in code; add a runtime check that the resolved endpoint is in the EU region set.

Pitfall 2: cross-region S3 buckets. If your application stores prompts / responses / fine-tuning data in S3, ensure the S3 bucket is in the same EU region as the Bedrock endpoint. Cross-region replication should be disabled for sensitive buckets, or replication to non-EU regions explicitly excluded.

Pitfall 3: logging to a non-EU CloudWatch Log Group. CloudWatch Logs are region-scoped. If your application writes logs to a CloudWatch Log Group in us-east-1 while invoking Bedrock in eu-central-1, the log destination is non-EU. Mitigation: configure CloudWatch Logs in the same EU region.

Pitfall 4: Vertex AI default location. Vertex AI generative AI calls can default to global / us-central1 unless the location is set explicitly. Mitigation: set location='europe-west1' (or your chosen EU region) on every Vertex client invocation.

Pitfall 5: Vector DBs in non-EU regions. If your application uses a vector database (Pinecone Serverless, Weaviate, Qdrant) for retrieved-context RAG, ensure the vector DB index is in an EU region. Pinecone Serverless has eu-west-1 region; Weaviate Cloud has EU regions; Qdrant Cloud has EU regions. Verify.

Periodic verification (recommended quarterly + on every material change):

Bedrock: enable CloudTrail logging in the EU region. Query CloudTrail for InvokeModel events on the Bedrock service. Confirm all events originate from the EU region. Sample a small set of events and confirm the resource ARN includes the EU region identifier.

Vertex AI: enable Cloud Audit Logs for the Vertex AI service in your EU region. Query for Vertex AI generative inference events. Confirm the resource location is EU. Sample events and verify.

Anthropic direct: there is no equivalent customer-side audit log surface; rely on the Anthropic Enterprise account team to provide written attestation of EU residency provisioning for your account.

Application-level: every LLM invocation in your application's audit log should record the endpoint URL or resource ARN. Periodically sample the audit log and confirm only EU endpoints / ARNs appear for EU-customer traffic.

Save the verification artifacts (CloudTrail samples, Vertex audit log samples, attestation letters) to your evidence library for SOC 2, GDPR DPIA, and EU AI Act documentation.

Per-token pricing for Claude on Bedrock and Vertex is aligned with Anthropic direct pricing (June 2026 — verify on current pricing pages). EU residency does not carry a per-token premium on Bedrock or Vertex.

Bedrock VPC endpoint hourly charge: ~$0.01/hr per endpoint plus per-GB data processing — small for typical workloads ($10-50/month).

Vertex Private Service Connect: similar order of magnitude.

Anthropic direct EU residency on Enterprise: bundled in the Enterprise pricing — verify with your account team. No published per-token EU surcharge.

Adjacent infrastructure cost: EU regions sometimes carry a 5-15% premium over us-east-1 for compute, storage, and network. This is universal across AWS and Google Cloud, not specific to AI workloads. Frankfurt is typically slightly cheaper than Ireland for some services; Paris is comparable to Frankfurt.

Total cost impact of moving from us-east-1 to eu-central-1 for an AI workload: usually 5-15% all-in, dominated by adjacent infrastructure not the LLM call itself.