A decade ago, compliance sat in an appendix. Buyers asked for a SOC report, filed it, and went back to features. That order flipped. In regulated and merely nervous companies, the feature that wins is the one that can prove where the data sat, who touched it, and which model was not allowed to see it.
Vendors noticed. Region pins, customer-managed keys, and “no training on your prompts” are now sales motions with list prices. Some of that is real control. Some of it is a checkbox with a surcharge.
Ask where the log lives
An audit trail that lives in the vendor’s cloud in a different country than the workload is a story, not a control. Ask for the region of the logs, the retention you can set, and whether you can export without a professional-services ticket. If the answer is a PDF, you bought theater.
A control you cannot export is a control you do not own.
The model clause is a product decision
“We don’t train on your data” is not one setting. It is training, evaluation, human review, and subprocessors. Map those four. If any one of them is “maybe, in a different product tier,” price that tier as the real SKU.
Policy as a wedge
Export rules, privacy law, and sector guidance will keep splitting the market into “good enough for a startup” and “good enough for a bank.” The second market pays more and moves slower. Builders who ignore it will still sell. Builders who fake it will get a lawsuit with a product name on it.
Treat compliance as packaging only if you can open the box. Otherwise it is a liability with a landing page.
The pages that open the box are the guides: What Article 50 asks a buyer, What belongs in a processor clause, and A one-page AI use rule. Gartner’s September 19 post says EU AI Act literacy requirements are now in effect. That is Gartner’s claim. The timeline is the EU briefing.
Sources
- Gartner on X, September 19, 2026: Gartner says EU AI Act literacy requirements are now in effect.
The dates this desk uses are in the EU briefing. This note does not add a literacy procedure.