#16

Inability to ensure location compliance for model hosting and data processing

Risk taxonomy

Definition

Inability to ensure adherence to hosting and data-processing regulations that mandate the storage and processing of data within specific geographic boundaries or jurisdictions.

Controls & guardrails that address this

Grouped by control function, with the AI lifecycle stage(s) to apply each and the other risks it addresses. Filter by control category below.

Control category

Preventive · 4

Jurisdiction mapping for data processing at intake

Map all jurisdictions involved in planned data collection, processing, and storage at use case intake.

Lifecycle stage1 – Use Case Context & Design

Residency compliance verification during acquisition

Verify residency compliance for all data collection, storage, and cross-border transfers during acquisition.

Lifecycle stage2 – Data Acquisition & Processing

Geo-fenced architecture enforcing data residency

Architect the system to enforce data residency constraints technically via geo-fenced cloud configuration.

Lifecycle stage3 – Onboarding, Build & Review

Pre-launch verification of residency controls

Confirm all data residency controls are active and verified in the production environment before go-live.

Lifecycle stage4 – Deployment

Corrective · 1

Continuous monitoring of data residency violations

Continuously monitor production data flows for residency violations. Alert and escalate immediately when detected.

Lifecycle stage5 – Usage, Monitoring & Change

Open these in the Control Library →

Other risks in Legal & Regulatory

#17 Unclear data ownership #18 Unauthorised data transfer and storage #19 Breach or misalignment with regulatory or organisational standards #20 IP infringement #21 Unavailability of IP protection #22 Inadequate privacy protection #23 Unclear data retention and deletion