I mapped every subscription tier from OpenAI, Anthropic, Google, and Mistral against four questions a pharma board needs answered before any AI procurement decision. The result is sobering. 𝗧𝗵𝗲 𝟰 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻𝘀: 𝟭. Does the provider train on our inputs by default? 𝟮. Can we lawfully process EU personal data on this tier (GDPR)? 𝟯. Can we lawfully process US patient data on this tier (HIPAA)? 𝟰. Is DPA + BAA + Zero Data Retention available on the same tier? 𝗧𝗵𝗲

A pharma client recently told me: "We moved to AWS European Sovereign Cloud. We are GDPR-safe now." I asked one question: "Who owns the parent company?" Silence. Here is what most people miss: no US hyperscaler sovereign cloud fully eliminates CLOUD Act exposure as of May 2026. Not AWS ESC. Not Microsoft Bleu or Delos. Not Google T-Systems. The European Commission's Cloud Sovereignty Framework, the EDPB, and the French Senate (where US providers conceded they cannot guarantee