Overall risk · medium
jurisdictionhigh
Google LLC is US-incorporated; all Google-hosted AI inference (Gemini API, Vertex AI, Workspace Gemini) is subject to CLOUD Act and FISA Section 702 compelled-access risk regardless of EU data-residency configuration. This is a structural exposure that cannot be remediated by SCCs or a DPA alone.
privacyhigh
Escalating French CNIL enforcement pattern against Google: €50M (2019), €150M (2021), and a record €325M fine in September 2025 for Gmail ad display without consent and invalid cookie consent, with a €100,000/day non-compliance penalty attached.
governancehigh
The EU's Court of Justice permanently upheld a €4.1 billion antitrust fine against Google's Android practices in 2026, on top of a separately confirmed €2.42B Google Shopping fine and a €2.95B ad-tech fine (2025), plus a $1.5B Swedish damages award to PriceRunner — an entrenched pattern of EU competition-law liability.
governancemedium
A US District Court found in April 2025 that Google willfully monopolized the publisher ad server and ad exchange markets, triggering multiple private treble-damages lawsuits (PubMatic, Magnite) still working through litigation.
privacymedium
Consumer-tier Gemini (gemini.google.com) has no Data Processing Addendum, may retain and human-review prompts, and is described by third-party GDPR analysis as unsuitable for processing EU personal data on an employer's behalf — a materially different posture than the enterprise Vertex AI or Workspace tiers.
compliancelow
No publicly documented opt-out or erasure mechanism has been identified for personal data potentially included in Gemma/Gemini pre-training corpora, a potential gap against GDPR Article 17 for EU regulated-sector deployers.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.