From Compliance to Evidence: Provable Offline AI under the GDPR and the EU AI Act

Two regulatory regimes shape how organisations may use artificial intelligence on personal and sensitive data in Europe: the General Data Protection Regulation and the Artificial Intelligence Act. Both impose duties, of residency, record-keeping, traceability and human oversight, that an organisation using a remote AI service typically discharges by trusting a processor and its contracts. This paper argues that an architecture in which inference runs offline, on hardware the controller owns, and in which every action seals to an independently verifiable record, reframes these duties from a matter of trust into a matter of evidence the controller holds. We map specific obligations, records of processing and data-transfer restrictions under the GDPR, and logging, traceability and oversight under the AI Act, to specific properties of the architecture, and we argue that in regulated procurement the effect is practical rather than merely rhetorical: the security and compliance review, which is frequently the gating step, is answered with an artefact rather than an assurance.