AI as a service in Luxembourg: 7 checks before you rent

Learn more about AI implementation in Luxembourg, and for the infrastructure decision behind this one, see sovereign cloud vs hyperscalers vs on-premise.

Most AI decisions I see in Luxembourg companies are not "build or buy". They are "which subscription, on which settings". Someone buys Microsoft 365 Copilot seats, a developer opens an API account, a department signs up for a chatbot platform. Each of those is AI as a service, and each comes with a data-location story that the sales page tells in one sentence and the documentation tells in twenty.

I build and run AI automations for Luxembourg SMEs at 20 More, almost always on rented models. This guide is what I check first, provider by provider, and the seven questions I would put to any AI service before a contract is signed. For a full procurement questionnaire, our 12-point AI vendor checklist goes further.

What are you actually renting?

"AI as a service" covers four different purchases, and the checks differ for each:

In Luxembourg the phrase also has a local meaning: the Luxembourg AI Factory around MeluXina-AI offers AI-as-a-service computing to companies, which suits teams that want to train or run their own models on national infrastructure. Most SMEs will use the first two layers.

Where do the big providers process your data?

This is the part that changed most in 2025 and 2026, and where defaults matter. As documented by each provider at the time of writing:

Two lessons come out of that table. First, "EU data residency" usually means storage; where the model computes the answer is often a second setting. Second, defaults change: a tenant created this year can behave differently from one created last year, which is why the check has to be repeated, not done once.

The seven checks before you rent

1. Where does inference run, and who chooses?

Ask for the processing location of prompts and responses, not only the storage location, and whether it is a contract term or a setting. If it is a setting, record who in your company controls it and check it after every major product change.

2. How long are prompts and outputs kept, and for what?

Ask for the retention period of prompts, outputs and logs, whether any of it is used to train models, and whether abuse-monitoring copies are kept separately. Zero-retention options exist for some APIs but are often limited to specific plans or approvals.

3. Is there a GDPR processing agreement, and what about transfers?

Any provider that processes personal data on your behalf needs a contract meeting Article 28 GDPR, with its list of sub-processors (GDPR). If data can reach the United States, the transfer relies on the EU–US Data Privacy Framework, adopted on 10 July 2023 (European Commission) and upheld by the EU General Court on 3 September 2025 in Latombe (CJEU), or on standard contractual clauses. An appeal is pending, so keep the clauses in the contract as a fallback.

4. What changes without your consent?

Sub-processors, regions and defaults change. Check how you are notified (email, a web page you have to watch, or the admin centre's message feed) and whether you can object. The Copilot flex-routing change above reached tenants as a default, not as a contract amendment.

5. What is your role under the EU AI Act?

When you rent AI and use it in your business, you are usually a deployer. Three duties matter most:

• AI literacy (Article 4), which has applied since 2 February 2025: people who use AI for you need proportionate training. Our guide on Article 4 AI literacy covers what that means in practice.
• Transparency (Article 50), applicable since 2 August 2026: for example, people chatting with an AI system must be told so unless it is obvious.
• Deployer duties for high-risk uses (Article 26) apply only if you use AI for an Annex III purpose such as recruitment or credit scoring.

The dates for high-risk uses moved with the Digital Omnibus: 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products (Commission).

6. Are you a financial entity under DORA?

For banks, investment firms, insurers, payment institutions and most other CSSF- or CAA-supervised entities, DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 (EUR-Lex). An AI service is an ICT third-party service like any other: it goes into the Article 28 register of information, and the contract must carry the key provisions DORA lists for ICT services. Our guide to DORA and the AI Act in Luxembourg goes into the detail.

7. How do you leave, and what does it really cost?

Rented AI is priced per seat, per token or per month, and the three behave very differently as usage grows. Ask for a cost estimate at your expected volume, a cap or alert, and what you can export if you leave: your prompts, workflow definitions, fine-tuning data and logs. An automation built around one provider's proprietary agent features is harder to move than one built on a plain model API.

When renting is the right call, and when it is not

Renting is right for nearly every SME use case: drafting, summarising, document extraction, internal assistants, customer-service triage. The models are better than anything you could host, and the EU options above cover most data-protection needs when they are configured.

Owning or self-hosting starts to make sense when a regulator or client contract rules out any third-party processing, when volumes are high and stable enough that dedicated capacity is cheaper, or when you need a model fine-tuned on data that must not leave your infrastructure. For those cases, an open-weight model on EU or Luxembourg infrastructure is the usual answer, and the decision is covered in our sovereign cloud comparison.

The third option is to rent the outcome rather than the tool: a provider builds the automation, configures the model, and runs and monitors it for a monthly fee. That is how we work in our managed AI engagements, and it moves checks 1 to 4 onto the provider's desk, where they belong in the contract.

Frequently asked questions

What is AI as a service?

AI as a service (AIaaS) is AI you pay for as a subscription or by usage instead of building and hosting it: AI assistants such as Microsoft 365 Copilot, model APIs such as Azure OpenAI, Amazon Bedrock or Google Vertex AI, managed AI services, or GPU computing capacity. The provider runs the infrastructure; you control the settings and the contract.

Can i keep my AI data in the EU?

Usually yes, if you choose the right option. Microsoft, OpenAI, Google, AWS and Mistral all document EU processing or storage options, but several are deployment types or settings rather than defaults, and storage and processing location are often separate. Anthropic's own API and apps do not offer an EU region; EU-region Claude is available through Amazon Bedrock or Google Cloud Vertex AI.

Is Microsoft 365 Copilot processed in the EU?

Copilot is covered by Microsoft's EU Data Boundary. However, Microsoft's "flex routing" setting can send inference to data centres in the United States, Canada or Australia during peak demand. It is on by default for eligible tenants created after 25 March 2026, and administrators can turn it off.

Does the EU AI Act apply when i only rent AI?

Yes, usually as a deployer. The AI literacy duty in Article 4 has applied since 2 February 2025, and Article 50 transparency duties since 2 August 2026. The stricter deployer obligations in Article 26 apply only to high-risk uses listed in Annex III, from 2 December 2027.

Is there AI as a service in Luxembourg itself?

Yes. The Luxembourg AI Factory, built around the MeluXina-AI supercomputer, offers AI computing to companies, researchers and public bodies. It suits teams training or running their own models. For using AI in everyday business tools, most SMEs rent from the providers above with EU settings.

If you want a second opinion on the settings of a tool you already rent, tell us which one and how it is configured.