Technology & Platforms ยท TEC-03
Hosting and data location
Requirements for where AI is hosted and where its data is processed and stored are defined, and each use of AI is checked against them before and during live use.
Why it matters
Many AI services process data in places the organisation has not chosen, sometimes in other jurisdictions or through subprocessors. Legal, contractual and sensitivity requirements on location only hold if they are stated and then checked against what the service actually does.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Hosting and data location are not considered; they follow whatever the supplier offers. |
| 2 Developing | Location is checked for some services, usually at purchase, without stated requirements or later checks. |
| 3 Defined | Documented requirements set where AI may be hosted and data processed for each class of data, and every use, including subprocessors, is checked before go-live. |
| 4 Managed | Compliance with location requirements is rechecked on a set cycle and when suppliers change terms or infrastructure, and breaches are acted on. |
| 5 Optimising | Location requirements are refined from changes in law, risk and the market, and checks rely on continuous supplier attestation rather than one-off reviews. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- TEC-03.1 Documented requirements set where AI may be hosted and data processed for each class of data.
- TEC-03.2 Every use of AI is checked against the requirements before go-live.
- TEC-03.3 The pre go-live check covers subprocessors.
Assessment questions
- Where is each AI service hosted, and where is your data processed and stored, including by subprocessors?
- What are your requirements for location, and how are they set for different kinds of data?
- How would you find out if a supplier moved processing elsewhere?
- Documented hosting and data location requirements
- Location checks for a sample of AI services, including subprocessor information
How to reach Level 3
- Set requirements for where AI may be hosted and data processed, for each class of data, informed by legal obligations (RSK-04).
- Ask suppliers where they host and process data, and who their subprocessors are.
- Check every use of AI against the requirements before go-live, including subprocessors, and record the result.
Common pitfalls
- Checking the main supplier's location but not its subprocessors.
- Forgetting that a supplier can move processing after the contract is signed.
Starter artefacts
- Hosting and data location requirements
- Pre-go-live location check record
Ownership and sequence
- Accountable
- delivery lead
- Contributors
- security lead, data owner, risk lead
- Depends on
- RSK-04
- Roadmap step
- 3
- Lifecycle
- acquire_build, deploy, operate
Cross-references
| AI Cyber Security Code of Practice | 6.6 partial |
|---|---|
| ISO/IEC 42001 | A.4.5 partial |
| MITRE AI Maturity Model | P4.3 partial; P5.2 partial |
| UNESCO AI Maturity Framework | 3.2 partial; 6.3 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.