Traceability is the hinge. Article 10 requires high-risk systems to show quality, representativeness and traceability across training, validation and test datasets [5]. Traceability is a record somebody keeps about the data, not a property the data has on its own. Once that record exists, its fields have to say which environment each set was processed in and who could administer that environment. That is the point at which a region selection stops being procurement and becomes an entry read back to you.
The second mechanism is the overlay. Osborne Clarke's reading, cited in the dev.to piece, is that a regulated AI system handling personal data falls under the AI Act and the GDPR jointly [6], and the GDPR puts the place of processing and the applicable jurisdiction directly in scope [7]. The article's own summary is that AI Act compliance, nominally a risk-management exercise, ends up touching where the data lives, who operates it, and which law applies to it [8].
Those three do not arrive in one purchase. The article separates data residency, meaning the data stays physically in the EU; operational autonomy, meaning the infrastructure can run and be administered without non-EU resources or personnel; and jurisdictional sovereignty, meaning the data is outside the reach of extra-European law [9]. Residency is the one available from a region menu. The other two are properties of an operating model and a corporate control chain. Data can sit in Frankfurt and remain, in theory, reachable under US law where the provider depends on a US parent [10], because the CLOUD Act permits US authorities to demand data from a US company wherever it is stored [11]. The author calls "sovereignty" an overused word [14]; on his own decomposition it is three requirements sharing one label.
Sequencing follows from the calendar. The Digital Omnibus deferred the main high-risk obligations to end 2027, possibly 2028 [3], while 2 August 2026 still carries the transparency rules and the GPAI sanctions, according to the Commission's AI Act Service Desk [4]. That is roughly 17 months between the 2026 date and the earliest high-risk deadline, and up to 29 months to the later one [1]. Disclosure and GPAI work is the near-term item. The dataset governance file can be staged against the later date, on the assumption the deferral survives, which depends on legislative politics rather than technical certainty.
On the vendor side, the piece treats AWS European Sovereign Cloud as an element of compliance architecture rather than a hosting preference [12], and notes that the AI Act itself never uses the phrase "sovereign cloud" [13]. The supplied text breaks off before it enumerates what ESC does and does not provide [15]. Read the gap the way you read a benchmark table: the label is a claim about someone else's threat model, and for it to transfer, an offering would have to satisfy all three of the article's requirements, the third being the one the CLOUD Act complicates.
Classification still comes first. Of the four tiers, one is prohibited outright and one carries no specific obligations at all [2], which leaves two where documentation exists for a processing location to appear in [2]. If your system lands in minimal risk, the honest entry is that you chose a region on latency and price.
