AI transcription and GDPR: why European teams can't just use the best US tools

I run explicare, a GDPR-compliant transcription tool in Germany, so this tension is basically my day job. I want to open it up as a discussion rather than push a conclusion.

Here's the practical reality for a European company. Most of the best speech and AI services run on US infrastructure. The moment audio, transcripts, or personal data leave the EU and land on a US server, you're in GDPR territory: lawful basis, transfer mechanism, sub-processors, all of it. For many of our enterprise and public-sector users, that alone rules out half the market before accuracy or price even come up.

The legal ground keeps moving, too. The EU-US Data Privacy Framework is still valid today, but a French challenge is now pending at the European Court of Justice, and a US Supreme Court ruling this June, plus the oversight board (PCLOB) losing quorum, have weakened the exact safeguards the framework was built on. A "Schrems III" case is widely expected. If you plan a product roadmap around that, you're building on sand.

So European teams end up doing what we did: EU-only hosting, on-device processing, avoiding the strongest US models on purpose. Sometimes that's better engineering. Sometimes it just means shipping a weaker product for reasons that have nothing to do with the user.

What I can't tell from inside Europe is how the other side sees it.

For Americans building AI tools: do you even feel this? Is GDPR a real design constraint, or a checkbox legal handles once? Do you lose EU deals over it, or is it just noise?

For Europeans: how are you solving this right now? EU regions on AWS/Azure, fully local models, or accepting the risk and hoping the framework holds?

Curious where people land, especially where the two sides disagree.