How do you know whether an AI API creates a cross-border data transfer?

APIs from providers such as OpenAI, Anthropic and Google process requests on servers outside Türkiye. If the text or file you send contains information that identifies or can identify a person, that is a cross-border transfer. Choosing a European region does not change this; from Türkiye's perspective the EU is abroad too.

Five questions

Is there personal data in the request?If the user's name, email, uploaded document, voice, photo or free-text personal details go into the request, the answer is yes. If only content unrelated to people, such as product descriptions, is sent, there is no transfer.
Where are the API servers and data?The provider's data processing addendum states where requests and logs are processed and stored. Any location outside Türkiye, including the EU, falls under Art. 9.
Does the provider keep requests?Requests may be retained for a period for abuse monitoring; some providers offer zero retention. This should also be reflected in your retention policy.
Which safeguard do you rely on?Absent an adequacy decision you need standard contractual clauses, binding corporate rules or an undertaking approved by the Board. Standard clauses must be notified within five business days; failing to do so can lead to an administrative fine.
Have you told your users?The privacy notice should clearly state that data is transferred to an AI provider abroad, the purpose and the legal basis. A generic tick box in a cookie banner does not replace this.

The most effective way to reduce transfers is to strip or mask personal data before sending the request. Truly anonymised data is not personal data, but deleting the name alone is often not enough.