When a Regulator Asks 'Where Was This Number Processed?', Can You Answer?
Data Processing Location Accountability in AI-Augmented Financial Workflows
---
A regulator asks one question: "Where was this number processed?" They want a location, a system name, a date, and a data access record. They are not asking whether your vendor is certified or whether your data is encrypted. They are asking for processing provenance — a record that most organizations have never created and cannot reconstruct quickly.
Picture the specific moment: a DGFiP tax examiner (DGFiP is France's national tax authority) or CNIL investigator sits across from your team and asks about a specific VAT calculation in your FEC — the standardized accounting export that French tax authorities can demand with 15 days' notice. "For this figure from March — where was it processed, on which system, and who had access to the underlying invoice data?" The room goes silent. Not because the answer is incriminating — because the answer has never been assembled.
---
What Regulators Mean When They Ask
Think of it as processing provenance — the same concept that applies to food supply chains. When a regulator asks "where was this number processed?" they want the financial equivalent of a farm-to-table record: the source document, the system that read it, the location of that system, the date and time, and the identity of anyone who touched the result. For a human accountant entering figures manually, that record is implicit in the workflow. For an AI system processing data in distributed cloud infrastructure, it must be explicit.
Auditors are not asking whether your AI vendor is reputable. They are asking for documentation of exactly where each computation occurred, who had access to the underlying data, and what the audit trail contains. "We use a well-known AI vendor" is not an answer to that question — it is a description of a vendor relationship. A processing record with location, date, and data category — that is an answer.
---
Three Regulations Pointing at the Same Gap
Since January 2025, DORA — the Digital Operational Resilience Act, Regulation (EU) 2022/2554 — has applied fully to EU financial entities. Article 28 requires every regulated financial entity to maintain a mandatory ICT service register — a formal record of every technology service provider handling their operations, including the geographic location where services are actually delivered. AI systems processing financial data are ICT services under DORA's definition, and they belong in that register.
GDPR Article 30 requires organizations processing personal data to maintain written records covering the name of each processor, the categories of data processed, and the transfer mechanism for any cross-border processing. AI tools introduced in 2023, 2024, or 2025 are almost never included in GDPR Article 30 registers — the registers were last updated before those tools existed.
EU AI Act Article 12 adds automatic logging requirements for high-risk AI systems in financial services — meaning the system itself must generate a record of what it processed, when, and with what result. Three separate regulatory frameworks point to the same documentation need: where did this AI computation run, what data did it touch, and who has access to the record?
Most organizations currently satisfy none of the three for their AI systems. The gap is not hidden — it opened gradually and visibly as AI adoption moved faster than data governance documentation cycles.
---
The Surprise in DORA's Requirements
One detail surprises most organizations: the ICT register requirement specifies "geographic location of service delivery" — meaning the country or region where the AI computation actually runs, not where the vendor is headquartered or where the contract is governed. For distributed cloud AI, those can be three different jurisdictions. A US-headquartered vendor with an EU data center and a support team in India is processing your financial data in a supply chain with at least three regulatory exposure points.
The Dutch central bank (DNB) issued supervisory guidance in Q1 2025 specifically requiring ICT service chain documentation for AI systems processing financial data — including the geographic location of every processing node. French DGFiP audits of financial AI systems began specifically asking about data processing location as part of FEC examination procedures. These are not hypothetical future requirements. They are examination questions being asked now.
Daily penalties for non-compliance reach up to 1% of average daily global turnover per day of infringement. For a mid-market European company, that is a material liability accumulating every day the DORA ICT register is incomplete.
---
The Gap That Opened Quietly
Many organizations maintain a complete GDPR Article 30 register for their human workforce — every department, every system, every data category. Almost none have updated that register to include AI systems introduced since 2022. The AI adoption wave happened faster than the documentation cycle.
Every AI tool added to a finance workflow without updating the GDPR register, the DORA ICT register, and the internal ICT risk management framework creates a compounding gap. When a supervisory authority examines the ICT register and finds AI systems not listed, the finding is logged for future reference and the organization must both reconstruct historical documentation and implement ongoing processes simultaneously. The reconstruction is expensive. The ongoing documentation is straightforward — but only if the AI runs somewhere you can see.
Article 5 of DORA makes the management body of financial entities directly responsible for ICT risk management — including ensuring the ICT service register is complete and accurate. The CFO and CTO who approved AI tool deployments without updating the DORA register share direct management body accountability for the documentation gap. This is not delegatable to IT operations.
Under the same framework, an AI system not documented in the DORA ICT register is also an undocumented IT control under internal controls over financial reporting (ICFR) scope. The same gap appears in two separate compliance frameworks simultaneously.
---
When a Regulator Asks, Can You Answer?
For the regulators asking where your financial data was processed, "in the cloud" is not an answer. A jurisdiction, a server, a timestamp, and an access record — that is an answer.
Organizations whose financial AI runs on their own infrastructure can answer in minutes: all processing occurred on servers located at this address, in this jurisdiction, under this organization's direct control, with this access log, and no data left the environment. The answer is verifiable, auditable, and complete.
Cloud AI users can attempt to assemble the answer, with caveats: the vendor may or may not provide geographic processing location data, their infrastructure may route queries across regions dynamically, and the access log may reflect vendor operations staff in addition to authorized internal users. "We believe it was processed in the EU" is a different answer than "here is the exact processing record."
Consider the examination scenario: your AI-assisted FEC preparation is reviewed by a DGFiP examiner. They identify a specific entry and ask for the data lineage from source invoice to recorded figure. With sovereign infrastructure, you produce the complete record from your own systems. With a cloud AI vendor, you produce what the vendor can provide — which may be partial, delayed, or formatted for their audit processes rather than yours.
---
Building the Answer Before the Question Arrives
Phase 1, this week: inventory every AI system processing financial data — including tools embedded in approved software that may have activated AI features automatically. Cross-check each against the DORA ICT service register and the GDPR Article 30 register. Identify which are documented and which are not.
Within two weeks: request geographic processing location documentation from all cloud AI vendors. Ask specifically: in which countries or regions can my data be processed, under what conditions does geographic routing change, and what access log format do you provide for audit purposes?
Over 30 days: update both the DORA ICT register and the GDPR Article 30 register with complete AI system entries. Ensure every entry includes processing locations, data categories, access controls, and the contact details for the vendor's data protection representative.
Final step: evaluate whether sovereign infrastructure eliminates the documentation maintenance burden — when financial AI runs on your own systems, the DORA register entry is your own organization, the geographic location is your server room, and the access log is your IAM system (your Identity and Access Management system, which controls who in your organization can access which data and tools).
---
What Becomes Possible When the Record Is Always Ready
Regulatory examinations change character when financial AI runs on infrastructure you control. Instead of a period of anxious document assembly, they produce complete processing records in the first meeting. The examination moves to substantive financial questions because the procedural documentation is already in order.
That shift — from documentation scramble to operational confidence — is the practical outcome of building AI governance into the infrastructure rather than adding it as a documentation exercise after the fact. Regulators who see complete, current, auditable AI processing records close procedural findings quickly. The time savings in an examination are real and significant.
Sovereign financial AI does not eliminate regulatory examination. It eliminates the documentation gap that makes examinations expensive. When a regulator asks "where was this number processed?" — the answer is always ready.
---
Stralevo runs on infrastructure you control. Every computation is logged automatically, in your environment, accessible under your audit procedures. When a regulator asks for processing provenance, your team produces it from your own systems — no vendor coordination required, no geographic routing uncertainty, no partial records.