Before selecting a hosted model, the city reviews whether inference and logs stay inside committed data-residency regions. What compliance check is this?

Evaluating data residency for municipal AI model hosting is the correct compliance check when, before selecting a hosted model, the city reviews whether inference and logs stay inside committed data-residency regions. That works because municipal contracts, privacy policies, and sometimes sector rules constrain where resident and staff data may be processed and stored. Encryption protects confidentiality in transit/at rest but does not by itself satisfy residency commitments; inference payloads and logs must actually remain in allowed regions under the city's obligations.

Ignoring residency because encryption alone meets every policy fails by concept: encryption and location are different controls addressing different requirements. Choosing the cheapest region regardless of contractual commitments fails by concept—price cannot override residency clauses the city already owes residents and partners. Storing residency questions only in marketing decks, not contracts, fails by concept: decks are not enforceable; residency must appear in binding terms and technical configuration.

Exam caveat: residency must cover subprocessors and log/telemetry destinations, not only the primary inference endpoint shown on a sales slide. Keep municipal model-hosting / procurement framing. Operational check: list committed regions from policy and contracts; ask vendors for inference and log locations including subprocessors; verify configuration and DPAs match; reject options that cannot meet residency; and re-check when vendors announce region or subprocessor changes.