ChatGPT
Claude
Perplexity
Gemini
GrokFor an Irish college, "EU-hosted" is the starting point, not the finish line. Ireland is an EU member, so the question is not whether Irish or EU hosting is lawful but whether anything about the service sends or exposes personal data outside the EEA. Hosting location tells you where data sits. It does not tell you who controls the vendor, which sub-processors sit behind it, or who can reach the data from elsewhere. This guide sets out the checks as of 12 October 2026.
We name no vendors: a fair comparison needs dated public evidence for every cell, and that is a separate job. Paid keyword volume and difficulty data were unavailable for this topic, so the angle comes from official sources.
Why Irish colleges and universities ask the question
An admissions chatbot collects names, emails, phone numbers, course interests and, in free text, whatever a prospective student shares. Many conversations happen before the CAO application window, or during the weeks when Leaving Cert students compare options at institutes of technology, universities and private colleges.
The college remains the controller even when the vendor runs the technology. Recital 81 of the GDPR asks controllers to use only processors providing sufficient guarantees (GDPR, official text on EUR-Lex). In Ireland, the Data Protection Commission (DPC) is the supervisory authority. Institutions that depend on QQI for programme validation or HEA funding conditions often meet the data-protection question alongside those compliance reviews.
One Irish nuance: many US technology companies have their EU base in Dublin. An Irish subsidiary or an Irish data centre does not by itself answer who can access the data from the United States, so ask directly.
Hosting versus transfers: what the rules say
Storing data in the EU does not rule out a transfer to a third country. The EDPB's guidelines on the interplay between Article 3 and Chapter V treat making data available to an entity in a third country as a potential transfer, including remote support access (EDPB, Guidelines 05/2021). A US engineer opening a conversation to fix a fault can trigger Chapter V.
The DPC explains that once an adequacy decision applies, personal data can flow from the EEA to that third country without any further safeguard being necessary, and that transfers must comply with Chapter V of the GDPR (DPC, transfers to third countries). Without an adequacy decision you need appropriate safeguards, such as standard contractual clauses, and an assessment of the destination.
Where the Data Privacy Framework stands
The European Commission adopted its adequacy decision for the EU-US Data Privacy Framework (DPF) on 10 July 2023, covering participating US companies (European Commission, EU-US data transfers). A vendor that is not a participant is outside it.
The General Court dismissed Philippe Latombe's challenge on 3 September 2025 (Case T-553/23), as the Spanish authority noted in a press release (in Spanish). To our knowledge an appeal is pending before the Court of Justice. The framework is valid today, with no guarantee for tomorrow; its predecessor, Privacy Shield, fell in 2020 in the Schrems II judgment.
| Vendor setup | Likely transfer basis | Check before signing |
|---|---|---|
| European vendor, EU hosting, EU sub-processors | No transfer to a third country | Sub-processor list, support access |
| European vendor, AI model outside the EU | Adequacy decision or standard clauses | Destination country, data sent |
| US vendor, DPF-certified, EU region | Adequacy if certification is active | Active DPF listing, access from the US |
| US vendor, not certified | Standard clauses plus risk assessment | Supplementary measures, documentation |
Four kinds of alternative
There is no single European option, only four architectures with different trade-offs. We quote no prices because no public price list allows a fair comparison.
| Type | Main strength | Watch-out |
|---|---|---|
| European vendor on European cloud | Legal and technical control in the EU | Which AI model answers, and from where |
| Non-European vendor with EU region | Mature product | Remote access, parent company outside the EU |
| Open-source, self-hosted | Full control of data | Security and upkeep sit with your IT team |
| In-house build on an EU cloud | Tailored to your processes | Maintenance and answer quality |
Skolbot is a French vendor of admissions chatbots. Apply the same checklist to it as to everyone else, starting with the processing agreement and sub-processor list.
The AI layer is a sub-processor
The language model is a sub-processor in its own right. If an EU-hosted chatbot sends each conversation to a model API outside the EU, the hosting promise fails. Ask which model answers, in which region, how long prompts are kept and whether conversations train the model.
Free text raises the stakes: prospective students mention health, immigration status or money worries unprompted. Our article on hosting student prospect data outside the EU covers those scenarios.
Ten questions for the vendor
- In which countries are conversations, backups and logs stored?
- Which legal entity signs the contract, and where is it established?
- Who can access data remotely, from which countries and why?
- What is the full sub-processor list, including the AI model provider?
- If the vendor is US-owned, what is its DPF status, and which entity is the processor?
- Are conversations used to train any model?
- What is the default retention period, and how are erasure requests handled?
- How and how fast are personal data breaches notified to you?
- Does the processing agreement include the Article 28 terms?
- What are the exit and data-return terms?
Get the answers in writing and attach them to the contract. A verbal assurance will not help in a DPC inquiry.
What EU hosting does not fix
Hosting does not replace a lawful basis, a clear privacy notice or data minimisation. The chatbot should ask only for what admissions needs, tell applicants who is responsible for their data and make rights easy to exercise. Our guide to GDPR-compliant chatbot vendors covers these points.
To place this in the market, see the comparison of AI agents for student recruitment and the guide on choosing an AI agent. The overview is in our AI chatbot for student recruitment guide.
