Designing for Verifiable Operations
For an operator serving tenants across jurisdictions, a claim about where a workload runs must be one that the responsible service provider can substantiate. That means identifying who can administer the workload, how data moves between regions, where backups are maintained, and which records document those arrangements.
A tenant promising to run a workload within a particular jurisdiction needs assurance that its data, backups, and access arrangements satisfy the applicable requirements. Workload placement alone cannot establish where a backup resides or from where an administrator can access a system. Those questions must be addressed across compute, storage, network paths, security controls, and third-party access, with responsibilities established during procurement and verified before service begins.
Not all of those controls necessarily reside with the data center operator. A colocation provider may be responsible for physical access, facility security, and designated infrastructure services, while a tenant or cloud provider controls the applications, storage configuration, backup locations, and logical access to workloads. The operating agreement must distinguish between what the facility provider can verify directly and what remains within the tenant’s systems.
The EU AI Act makes that division of responsibility particularly important. Its requirements for covered high-risk AI systems include logging, documentation, human oversight, robustness, and cybersecurity, subject to the law’s applicable implementation dates. These obligations attach to the relevant providers and deployers of AI systems, rather than automatically to every company hosting them. A data center operator may nevertheless be required by contract to provide physical-access records, security evidence, or information about infrastructure location so that a tenant can substantiate its own compliance.
A further distinction concerns data residency. The AI Act is not itself a general requirement to keep all AI workloads or associated data within the European Union. Geographic restrictions may instead arise from data-protection law, national-security requirements, sector-specific regulations, or customer agreements. For infrastructure providers, the practical requirement is to identify the applicable obligations and establish which party has the technical means and contractual responsibility to satisfy them. The distinction is already visible in Microsoft’s parallel development of sovereign cloud regions and AI factory campuses, which addresses different customer requirements for localized data handling, compliance, and large-scale computing.
Consider a colocation operator supporting a European financial-services tenant deploying a regulated AI application. Depending on the workload and applicable requirements, the tenant may need documented controls over data location, privileged access, backup arrangements, and maintenance activity. The operator could be responsible for facility-access records and physical security evidence, while the tenant remains responsible for its AI application, data handling, and logical access controls.
In that situation, neither party benefits from a service agreement that simply promises compliance without identifying the systems and records needed to demonstrate it. The contract needs to specify which controls apply, who operates them, who retains the associated evidence, and how the information can be retrieved for an audit or regulatory inquiry.
The same principle applies to backups and third-party maintenance access. A contractual restriction on location or access is meaningful only if the underlying operating configuration supports it. If a tenant requires evidence of privileged access, the parties need to establish which systems generate the records, who maintains them, and whether they can be produced when required.
Rules for general-purpose AI models create another point of contact with the physical facility. Under Article 55 of the EU AI Act, providers of general-purpose AI models posing systemic risk must ensure an adequate level of cybersecurity protection for both the model and its physical infrastructure. A tenant providing such a model may consequently request evidence from its data center operator concerning physical access, security procedures, or incidents affecting the environment where the model operates.
Those requests do not transfer the model provider’s statutory obligations to the data center. They do, however, create operational expectations that can influence facility contracts, security documentation, and the procedures required to support regulated customers.
For operators, this is where fragmented AI governance becomes a practical infrastructure challenge. Regulatory obligations may originate with the tenant or model provider, but the evidence needed to satisfy them can depend on physical facilities, network arrangements, operational procedures, and the capabilities of third-party service providers.
Establishing these boundaries before deployment can reduce uncertainty over compliance, improve accountability, and prevent disagreements when customers or regulators request evidence of how a workload has been operated.
