Is it GDPR-compliant to use a US-based AI tool for EU client data?

Using a US-based AI tool for EU client data is GDPR-compliant if — and only if — appropriate safeguards are in place for the cross-border transfer. Under GDPR Chapter V, personal data may be transferred to third countries (including the US) only when: (a) the European Commission has issued an adequacy decision for that country (the EU-US Data Privacy Framework, effective July 2023, provides this for DPF-certified US companies); (b) appropriate safeguards such as Standard Contractual Clauses (SCCs) are in place; or (c) binding corporate rules or other derogations under Article 49 apply. For US AI vendors, the most common compliance mechanism is SCCs incorporated into the DPA, often combined with a Transfer Impact Assessment. Vendors certified under the EU-US Data Privacy Framework benefit from an adequacy decision, simplifying compliance.

What are Standard Contractual Clauses and when do I need them?

Standard Contractual Clauses (SCCs) are pre-approved contractual clauses, issued by the European Commission, that enable lawful transfer of EU personal data to third countries without an adequacy decision. The current SCCs were issued in June 2021 (replacing the prior 2010 SCCs) and come in four modules: controller-to-controller, controller-to-processor, processor-to-controller, and processor-to-processor. For a law firm (as controller) using a US AI vendor (as processor), the applicable module is controller-to-processor. SCCs must be incorporated into the DPA, not merely referenced. They may not be modified except where the clauses explicitly permit modification. You need SCCs when: you transfer EU client personal data to a US AI vendor that is not certified under the EU-US Data Privacy Framework, or when transferring to any country without an EU adequacy decision.

How do I verify that a US AI vendor is Schrems II compliant?

Post-Schrems II compliance for a US AI vendor involves two elements. First, a legal transfer mechanism: verify that the vendor's DPA includes current SCCs (the 2021 version, not the 2010 version) or that the vendor is certified under the EU-US Data Privacy Framework (check the DPF list at dataprivacyframework.gov). Second, a Transfer Impact Assessment (TIA) documenting that the legal transfer mechanism is effective given the specific circumstances of the transfer — particularly US government access laws. The TIA is the firm's obligation, not the vendor's, but vendors increasingly provide TIA templates or documentation packages to assist customers. Verify that the vendor can identify the geographic locations of all processing (including subprocessors) so the TIA covers the complete processing chain.

Cross-Border Data Transfer (Legal)

The movement of legal data — including client personal information — across national borders, a critical compliance issue for law firms using US-based AI vendors for EU client data, governed primarily by GDPR Chapter V and the Schrems II decision.

Last reviewed: 2026/05/25

Definition

Why It Matters for Lawyers

How AI Tools Handle It

Frequently Asked Questions

Is it GDPR-compliant to use a US-based AI tool for EU client data?: Using a US-based AI tool for EU client data is GDPR-compliant if — and only if — appropriate safeguards are in place for the cross-border transfer. Under GDPR Chapter V, personal data may be transferred to third countries (including the US) only when: (a) the European Commission has issued an adequacy decision for that country (the EU-US Data Privacy Framework, effective July 2023, provides this for DPF-certified US companies); (b) appropriate safeguards such as Standard Contractual Clauses (SCCs) are in place; or (c) binding corporate rules or other derogations under Article 49 apply. For US AI vendors, the most common compliance mechanism is SCCs incorporated into the DPA, often combined with a Transfer Impact Assessment. Vendors certified under the EU-US Data Privacy Framework benefit from an adequacy decision, simplifying compliance.
What are Standard Contractual Clauses and when do I need them?: Standard Contractual Clauses (SCCs) are pre-approved contractual clauses, issued by the European Commission, that enable lawful transfer of EU personal data to third countries without an adequacy decision. The current SCCs were issued in June 2021 (replacing the prior 2010 SCCs) and come in four modules: controller-to-controller, controller-to-processor, processor-to-controller, and processor-to-processor. For a law firm (as controller) using a US AI vendor (as processor), the applicable module is controller-to-processor. SCCs must be incorporated into the DPA, not merely referenced. They may not be modified except where the clauses explicitly permit modification. You need SCCs when: you transfer EU client personal data to a US AI vendor that is not certified under the EU-US Data Privacy Framework, or when transferring to any country without an EU adequacy decision.
How do I verify that a US AI vendor is Schrems II compliant?: Post-Schrems II compliance for a US AI vendor involves two elements. First, a legal transfer mechanism: verify that the vendor's DPA includes current SCCs (the 2021 version, not the 2010 version) or that the vendor is certified under the EU-US Data Privacy Framework (check the DPF list at dataprivacyframework.gov). Second, a Transfer Impact Assessment (TIA) documenting that the legal transfer mechanism is effective given the specific circumstances of the transfer — particularly US government access laws. The TIA is the firm's obligation, not the vendor's, but vendors increasingly provide TIA templates or documentation packages to assist customers. Verify that the vendor can identify the geographic locations of all processing (including subprocessors) so the TIA covers the complete processing chain.

Related Concepts

Security

Data Processing Agreement (DPA)

A contract required by GDPR between a data controller and processor, governing how personal data may be handled, secured, and returned or deleted.

EU Regulation

EU AI Act (Legal Implications)

The EU's comprehensive AI regulation, in force August 2024, imposing risk-tiered obligations on AI developers and deployers — with legal sector compliance requirements escalating through 2026–2027.

Security

GDPR Compliance (AI-Assisted)

Using AI tools to identify, manage, and document compliance obligations under the EU General Data Protection Regulation across organizational data practices.

Security

Zero Data Retention (ZDR)

An AI vendor commitment that customer inputs and outputs are not stored beyond the immediate processing session — the strongest available privacy assurance for sensitive legal queries.

Related Tools

Ironclad
Full-stack CLM with native AI for contract drafting, approval, and analytics.
Onit
Enterprise legal management platform for in-house teams — matter management, e-billing, legal holds, and workflow automation.
Drata
Continuous security compliance automation platform for SOC 2, ISO 27001, GDPR, HIPAA, and 20+ frameworks.

AI Tools by Practice Context

Move from this definition to role-based legal AI shortlists and the selection criteria that matter for each type of legal team.

AI Tools for Big Law
Am Law 200 and global firm workflows: accuracy at scale, security compliance, and matter-level auditability.
AI Tools for In-House Counsel
Legal department workflows: contract lifecycle, regulatory tracking, outside counsel management, and risk.
AI Tools for Legal Ops
Legal operations workflows: vendor management, matter management, spend analytics, and process automation.

Browse all legal AI solutions by role

Last reviewed: 2026/05/25. Definitions are written by the LawyerAI Editorial team. Commercial relationships are disclosed and do not determine editorial scores or conclusions. See our Sponsorship & Affiliate Disclosure.

← All glossary terms

Cross-border data transfer refers to the movement of personal data across national borders — from the jurisdiction where it was collected to another jurisdiction for processing, storage, or other use. In the legal AI context, the most significant cross-border data transfer scenario is EU personal data (including EU clients' legal information) being transferred to US-based AI vendors for processing.

Under the GDPR, cross-border data transfers are not automatically permitted. GDPR Chapter V (Articles 44-49) establishes a set of conditions that must be satisfied before EU personal data may be transferred to a country outside the European Economic Area (EEA). The fundamental concern is that EU data subjects' personal data should not lose its GDPR protections simply because it is transferred to a country with weaker data protection laws.

The historical legal basis for EU-US data transfers was the Privacy Shield framework, which the Court of Justice of the European Union invalidated in the Schrems II decision (Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems, Case C-311/18, July 2020). The court found that US surveillance law — particularly Section 702 of FISA and Executive Order 12333 — provided inadequate protection for EU data subjects' rights because US authorities could access EU personal data transferred to the US without equivalent legal remedies available to EU data subjects.

Following Schrems II, the European Commission and US government negotiated a successor framework — the EU-US Data Privacy Framework (DPF), effective July 2023 — which provides an adequacy decision for DPF-certified US companies. The DPF enables EU data transfers to certified US companies on the same basis as transfers within the EEA. For US AI vendors that are not DPF-certified, the primary compliance mechanism is Standard Contractual Clauses (SCCs) combined with a Transfer Impact Assessment (TIA).

For law firms, cross-border data transfer compliance is directly implicated every time EU client personal data is submitted to a US-based AI tool — which includes most of the major legal AI platforms (Harvey AI, CoCounsel, Westlaw Precision AI, Lexis+ AI).

Cross-border data transfer compliance is a mandatory legal obligation, not a best practice, for law firms that process EU client personal data. Non-compliance can result in GDPR enforcement by EU data protection authorities, with fines reaching 4% of global annual turnover or €20 million. The Irish Data Protection Commission and French CNIL have been particularly active in cross-border transfer enforcement, and the legal sector has not been immune from scrutiny.

Beyond direct enforcement risk, clients impose cross-border data transfer compliance obligations on their outside counsel through outside counsel guidelines. Many EU corporations require their law firms to certify that they do not transfer client data to third-country AI vendors without adequate safeguards. These client requirements create contractual obligations for law firms that use non-compliant AI tools.

The professional responsibility dimension also applies. Submitting EU client data to a US AI vendor without adequate transfer safeguards may constitute a breach of the attorney's confidentiality obligations under ABA Model Rule 1.6 — if the transfer lacks legal authorization, the disclosure of client personal data to the AI vendor's US-based systems is effectively an unauthorized disclosure. The GDPR violation and the professional responsibility violation are two aspects of the same underlying problem.

For US law firms representing non-EU clients, cross-border data transfer concerns may still arise if the clients operate in EU markets, if counterparties to transactions are EU-based, or if the matters involve EU-regulated industries. The EU's broad extraterritorial scope of GDPR means that EU data appears in more US law firm matters than a purely territorial analysis would suggest.

How It Works

GDPR cross-border transfer compliance for law firms using US AI vendors proceeds through a structured analysis.

Step 1: Identify whether EU personal data is present. The first question is whether the specific data being submitted to the AI tool includes personal data of EU data subjects. Not all legal AI use involves EU personal data — purely domestic US matters with no EU connection may involve no EU personal data at all. If the matter has no EU connection, GDPR cross-border transfer rules do not apply.

Step 2: Identify the transfer mechanism. For transfers that do involve EU personal data, identify which transfer mechanism applies. Three main options:

EU-US Data Privacy Framework (DPF) adequacy decision. If the US AI vendor is certified under the DPF, the transfer is permitted on the basis of the adequacy decision — the simplest compliance path. Check the DPF list at dataprivacyframework.gov.
Standard Contractual Clauses. If the vendor is not DPF-certified, verify that the vendor's DPA incorporates the current 2021 European Commission SCCs, Module 2 (controller to processor). The SCCs must be in their original form — they cannot be modified except where the clauses expressly permit modification.
Binding Corporate Rules, Article 49 derogations. These mechanisms are generally less applicable to law firms' AI tool relationships and are not addressed in detail here.

Step 3: Conduct a Transfer Impact Assessment. Post-Schrems II, the law firm (as controller) must conduct a Transfer Impact Assessment (TIA) for transfers based on SCCs. The TIA assesses whether the legal transfer mechanism (SCCs) is actually effective given the specific circumstances of the transfer — particularly the risk of US government access to the transferred data under US surveillance law. For most standard commercial legal AI use cases, a standard TIA template addressing the relevant factors is sufficient. The TIA must be documented.

Step 4: Verify subprocessor transfer compliance. The cross-border transfer analysis must extend to the AI vendor's subprocessors. If the primary vendor is DPF-certified or uses SCCs, but relies on subprocessors whose transfers are not adequately covered, the overall transfer chain may be non-compliant. Review the vendor's subprocessor list and DPA provisions covering subprocessor transfers.

Step 5: Implement supplementary technical measures where appropriate. For high-sensitivity transfers, technical measures may supplement the legal transfer mechanism. These include: encryption with keys held only by the law firm (preventing vendor access to plaintext data), pseudonymization before transfer (reducing the identifiability of transferred data), and data residency requirements restricting EU data to EU-located servers.

Key Considerations for Law Firms

The DPF's legal durability. The EU-US Data Privacy Framework is the third attempt at a stable EU-US transfer framework following Safe Harbor (invalidated 2015) and Privacy Shield (invalidated 2020). There is active litigation challenging the DPF's legal basis — privacy advocates have already indicated plans to challenge the DPF in the CJEU on the same grounds that invalidated Privacy Shield. Law firms should have contingency plans (SCCs and TIA readiness) in case the DPF is invalidated, rather than treating DPF certification as permanently reliable.

TIA documentation matters. The TIA is not just a compliance exercise — it is a risk assessment that must be documented in the firm's data protection record. The TIA should be proportionate to the sensitivity of the data and the scale of the transfer. For routine transfers of non-highly-sensitive commercial legal data to major US AI vendors with established security practices, a standard TIA template adapted to the specific vendor is typically sufficient. For transfers of highly sensitive data (criminal defense, whistleblower matters, sensitive M&A), more detailed TIA analysis is warranted.

Multi-cloud AI processing creates complex transfer chains. Many AI platforms process data across multiple geographic regions as part of their standard operation — routing requests to the closest available inference server, replicating data across geographic regions for resilience. This geographic distribution creates complex transfer chains that may include transfers to countries other than the US. Law firms should require AI vendors to specify the complete geographic scope of their data processing and confirm that all relevant transfers are covered by adequate transfer mechanisms.

Brexit creates a distinct UK transfer analysis. Following Brexit, the UK is no longer part of the EEA. Transfers of EU personal data to UK-based AI vendors or UK-based AI processing require a separate transfer mechanism — currently, the EU has issued an adequacy decision for the UK (renewable). UK-based AI vendors are not within the scope of the EU-US DPF. Law firms with UK operations or UK-based AI tools must maintain a distinct UK transfer analysis.

Limitations and Risks

Political risk to transfer frameworks. The EU-US DPF, like its predecessors, depends on the maintenance of the political commitments made by the US government about surveillance law limitations. Changes in US government policy or legislation affecting US intelligence access to EU data could destabilize the DPF. Law firms relying on the DPF as their primary transfer mechanism should maintain SCC and TIA capability as a contingency.

Vendor representations about data residency may not be accurate. AI vendors may represent that EU data is processed only within the EU, but their subprocessors — particularly cloud infrastructure providers — may route processing through global infrastructure. Verifying the complete geographic scope of data processing for a complex AI platform is technically challenging and depends substantially on vendor disclosure.

TIA determinations involve legal judgment under uncertainty. The TIA requires a legal assessment of the risk of US government access to transferred data. This assessment involves applying evolving legal standards to facts about how surveillance law operates in practice — areas of genuine legal uncertainty. Firms should document their TIA analysis and legal reasoning, accepting that the assessment involves judgment calls that regulators may ultimately view differently.