AI and privacy
Which European AI assistants and models exist, what European actually means and which part of your privacy questions a European provider solves.
The best-known European AI is France's Mistral AI with the Mistral Vibe assistant. There is also Lumo from Swiss Proton, German Aleph Alpha's organisational models, DeepL's translation and writing services, and the Dutch language model GPT-NL. None solves the GDPR for you: they reduce one aspect.
This article names only providers whose own sites were checked on 13 October 2026. It is not a ranking or quality test. It addresses an organisation's questions before switching: what do I get, where is my data held and what must I still arrange? Offerings and terms change quickly. Open the links before choosing.
This is an explanation, not legal advice. The overview of chatbots and GDPR is on ChatGPT, Claude, Mistral Vibe and the GDPR.
The word covers three different things. A provider can be European in all three or only one.
Where is your contracting party established? A company established in the EU falls under the GDPR and a European supervisory authority. This is less distinctive than it appears. Article 3 GDPR says the regulation also applies to a company outside the EU offering services to people in the EU. A non-European provider must therefore follow the GDPR too.
Where are conversations stored and processed? This is the question Chapter V GDPR addresses. Personal data may go outside the EEA only under that chapter's conditions (Article 44): a European Commission adequacy decision (Article 45) or appropriate safeguards such as standard contractual clauses (Article 46).
Registered office and storage do not automatically coincide. A European company can run components with parties outside the EU. A non-European company can offer European storage.
Who built the language model? A European app may use a model from a non-European provider. The interface is then European but your question still goes to a third party. Conversely, you can run a European model on infrastructure of your choice. Always ask which model underlies a service and who operates it.
| Meaning | The question to ask | Where to find the answer | What it does for the GDPR |
|---|---|---|---|
| Registered office | Where is my contracting party established? | Imprint, terms, data processing agreement | Determines your contracting party and lead supervisory authority |
| Storage and processing | Where is my data held and processed? | Data location page and sub-processor list | Determines whether Chapter V on transfers applies |
| Model | Who develops and runs the model? | Product documentation and sub-processor list | Determines whether an additional party receives your input |
As of October 2026, based on providers' own sites.
Mistral AI was founded in April 2023 and is based in Paris. It develops its own language models and an assistant called Mistral Vibe since 2026, previously Le Chat. On its product page, Mistral describes Mistral Vibe as an assistant and agent for work and coding, with connections to other tools. Conversations, settings and subscriptions carried over with the name change.
Mistral says data is hosted in the European Union by default. Depending on features, it may temporarily go outside the EU. For large customers, the product page mentions running Mistral Vibe in their own environment.
Of the providers here, Mistral AI comes closest to what people call a European ChatGPT: one window for questions, documents and tasks, with a free version and paid subscriptions.
Lumo is the assistant from Proton, the company behind Proton Mail. Proton AG is based in Switzerland and, according to its privacy policy, has an EU representative. On its Lumo page, Proton says stored conversations are encrypted so only the user can read them, conversations are not used to train models and the code is public. According to Lumo's privacy policy, Proton uses only feedback you submit yourself to improve the model. There is a free version, paid version and business offering.
Switzerland is not an EU or EEA member. Under the GDPR, it is a third country with an adequacy decision: it is on the European Commission's adequacy decisions list. Transfers may therefore rely on Article 45. It is a transfer you record in your record of processing activities.
Aleph Alpha GmbH is based in Heidelberg. On its site, it offers its own language model, Kolibri, with a platform for building AI applications and people to help implement them. It targets governments and businesses. No consumer assistant is listed. This therefore does not replace ChatGPT for an individual employee. It is a building block for an organisation developing its own application.
Cologne-based DeepL SE is known for translation and also offers writing assistance. It is not a general chatbot, but for much office work it is people's first AI. DeepL's privacy policy shows the same pattern as major chatbots. The free version retains entered texts for a limited time and uses them for training. In paid Pro versions, DeepL says texts are not permanently stored or used to improve the service. The policy says documents are processed on EEA infrastructure.
GPT-NL is a Dutch language model from TNO, NFI and SURF, three not-for-profit organisations. The site calls it a business model developed with lawfully obtained data, for tasks such as summarising and searching your documents. The first version is announced for autumn 2026; the site says it is initially available only to a first group of customers. It is not yet an assistant you can open today.
| Provider | Country | Offering | Where to find terms |
|---|---|---|---|
| Mistral AI | France | Own models, Mistral Vibe assistant for work and code, an API | Mistral's legal pages, including the data processing agreement |
| Proton (Lumo) | Switzerland | Lumo assistant, free, paid and for business | Lumo privacy policy on Proton's site |
| Aleph Alpha | Germany | Kolibri model, platform and implementation support for organisations | Privacy statement and individual contractual agreement |
| DeepL | Germany | Translation and writing, free and Pro | Privacy policy and terms on DeepL's site |
| GPT-NL | Netherlands | A language model for organisations, still at an early stage | GPT-NL site; terms follow on participation |
As of October 2026. The list is incomplete. More European companies offer AI, often as a wrapper around another model. Ask those three questions first.
If the contracting party is in the EU and data stays there, Chapter V GDPR does not arise or arises much less. You need not assess an adequacy decision or standard contractual clauses, nor record a third-country transfer. For a small organisation without a lawyer, this saves work and uncertainty.
Mistral describes the limits itself, as of October 2026. Choosing the US API endpoint means data is hosted in the United States. Some features may temporarily send data outside the EU to sub-processors listed in Mistral's Trust Center, with standard contractual clauses where needed. Only Enterprise customers can disable some features. For every provider: read the sub-processor list before writing “in the EU” in your record.
Everything unrelated to location. Detail by subject is in Mistral Vibe and the GDPR: is a European chatbot automatically safe?. Here are the main points.
Mistral's help centre says input and output are used to train models by default, unless disabled. Enterprise customers are off by default. Thumbs-up or thumbs-down feedback allows the rating and associated conversation to be used on every subscription. At DeepL, the dividing line is free versus Pro. A European registered office says nothing about training. Check each subscription, just as with ChatGPT and Claude.
Article 28 GDPR requires an agreement with every party processing personal data on your behalf. An employee's own free European account has none. Unseen personal-account use is the same problem with a European service; see Shadow AI: what it is, how large the risk is and how to manage it. What to check in the agreement is in Data processing agreement with OpenAI, Anthropic, Microsoft or Mistral: what should you check?.
Article 5(1)(c) requires processing only what is necessary. Uploading a whole file to ask one question sends just as much to a provider in Paris as elsewhere. Mistral expressly treats uploaded documents as input.
You need a lawful basis and, for health or other special category data, an exception to the prohibition. Those bound by professional secrecy also assess whether a third party may see the file; see Professional secrecy and AI: what lawyers, notaries and accountants need to know. Processing also belongs in your record, with a DPIA if risk is likely high.
Using Mistral Vibe resembles ChatGPT: a window for questions, document uploads, service connections and a team version. Subscriptions are similarly structured: free, paid personal, teams and a contract for large organisations.
The GDPR difference is in one place: Mistral AI hosts in the EU by default and is European. With ChatGPT, European storage is an option on the highest subscription. On other points, the comparison is less favourable than origin suggests. Mistral enables training by default, except Enterprise. ChatGPT, Claude and Mistral subscriptions are compared in ChatGPT Free, Plus, Business or Enterprise: which subscription may you use for business?.
PrivaSearch is not an AI assistant or an alternative to the providers above. It addresses what European providers also leave unresolved: how much goes along. Personal data is detected within PrivaSearch and replaced with pseudonyms, and a colleague checks before a document becomes searchable. See How PrivaSearch works.
You can search entirely within PrivaSearch. Semantic search uses a European AI provider and only pseudonymised, reviewed text. Originals, the pseudonym vault, search index and detection run in data centres in the EU. Parties involved are in the sub-processor overview, and principles on Hosting in the EU.
If you also want an assistant to search, connect using the open MCP standard. Connections work with Claude, ChatGPT Business and Mistral Vibe. The assistant receives only released, pseudonymised passages with a short source reference and no files. What it receives becomes part of the conversation at its provider, while anything you type goes there directly. We therefore recommend a business account with a data processing agreement even for a European assistant.
Pseudonymisation is not anonymisation. For your organisation, it remains personal data, so lawful basis, record and DPIA remain your work. The difference is in Pseudonymisation or anonymisation: the difference and why it matters for AI.
To see a file question answered without sending the file, book a demo.
For an individual user, Mistral Vibe AI comes closest: an assistant for questions, documents and tasks, with free and paid versions. Swiss Proton's Lumo is a second assistant for everyone. Aleph Alpha and GPT-NL supply organisational models rather than an immediately accessible chatbot. Test whether quality suffices for your work yourself.
No product has that name. People searching “European ChatGPT” usually mean a European company's chatbot storing data in Europe. Mistral Vibe most closely fits: Mistral is French and hosts in the EU by default. Mistral says some features may temporarily send data outside the EU. Read the sub-processor list.
That depends on subscription and settings, as with other providers. Mistral AI hosts in the EU by default, reducing the transfer question. Its help centre says training is on by default except Enterprise. For personal data work, you need a business account with a data processing agreement and employee input rules. This reflects October 2026.
No. A European provider largely removes one subject: transfers outside the EU. Lawful basis, data processing agreement, training, retention, data minimisation and documentation remain the same. No product arranges that for you. Assessing your situation remains yours and your data protection officer's responsibility, with a lawyer if needed.
Not automatically. A company's registered office does not tell you where every component runs. Mistral hosts in the EU by default but names features temporarily sending data elsewhere. Other services use third-party models. The answer is in the data location page and sub-processor list, not the name or origin.
Geographically yes; legally, not quite. Switzerland is not an EU or EEA member. The European Commission has adopted an adequacy decision for it, permitting personal data transfers under Article 45 GDPR. You still record the transfer. The GDPR's other requirements apply as with every provider.
Where an uploaded file ends up, how long it stays, who can access it and what deletion means. With four approaches for files containing personal data.
How schools use AI, why pupil data receives extra protection, which applications are prohibited or high risk, and what a school needs to arrange.
What ChatGPT stores, who can access it, how to turn off training, and what temporary chats, memory and shared links do. Includes a practical checklist.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →