Agentic-AI data-residency requirements are not cleanly inherited from existing GDPR cross-border transfer practice. Agent context windows, retrieval indexes, and reasoning traces all create new categories of personal-data processing that have to be located, documented, and (for high-risk Annex III deployments) data-resident inside the EEA before EU AI Act Article 16 enforcement opens on 2 August 2026. The deployment topology has to shift to single-region EEA-resident for high-risk systems; hub-and-spoke remains defensible for general-purpose deployments under documented GDPR Chapter V transfer mechanisms.
60-day cadence because the August 2026 enforcement window opens inside the next-after-this review. Three review checks: Commission delegated/implementing acts on Article 10 or Article 12 narrowing or widening the four-surface analysis, EDPB published guidance on agent context windows or reasoning traces, vendor patchwork closure (AWS European Sovereign Cloud GA, Anthropic EU residency tier extension, Microsoft EU Data Boundary exception narrowing, Google sovereign-controls extension). None moved → Holds. One or two → Partial with appended correction. Three → Strengthened, claim text retained.
Correction log
- 29 Apr 2026Initial publication 29 Apr 2026. Initial verdict 'Partial' — spine is anchored to the Act itself plus current vendor compliance pages, but the four-surface Article-mapping has not yet been tested against an enforced case (the August 2026 enforcement window opens inside the next review cycle). REVIEW: Peter — please verify claim text + Article references + vendor citations before removing rewriteInProgress flag.
/holding/AM-108/Embed this claimiframe + oEmbed
The card auto-updates when the claim's status, last-reviewed date, or correction log changes. Embedders never need to refresh — the card is rendered live from the canonical record.