صياغة التميز في البرمجيات
دعنا نبني شيئاً استثنائياً معاً.
اعتمد على شركة Lasting Dynamics للحصول على جودة برمجيات لا مثيل لها.
نونزيو جيوجليانو
أكتوبر 16, 2026 • 10 min read
Every large AI vendor now sells something called sovereign AI, and the most useful sentence spoken about it so far came from one of those vendors, under oath. On 10 June 2025 a French Senate inquiry into public procurement asked Anton Carniaux, director of public and legal affairs at Microsoft France, whether he could guarantee that French citizens' data entrusted to Microsoft through the French state's central purchasing agency would never be handed to US authorities, on a US government order, without the explicit agreement of France. His answer, in the Senate's own transcript, was a single sentence.
Non, je ne peux pas le garantir, mais, encore une fois, cela ne s'est encore jamais produit. No, I cannot guarantee it, but, once again, it has not happened so far. Both halves matter, because together they show that the vendor was honest, that the transfer had never occurred, and that the guarantee still could not be given. The problem is structural, not a question of anyone's intentions.
For governments, sovereign AI is a national project, and AI sovereignty in that sense is about chips, computing capacity, models and talent. For a company the question is narrower and, unlike the national one, answerable. Microsoft now defines sovereign AI as the design, deployment and operation of AI workloads under defined controls for data, access, governance, infrastructure, and operations, which is a reasonable starting point as long as you remember that it is a vendor's definition, written by a company that sells those controls.
The useful version of the idea fits in four questions, asked separately for each thing you use AI for: where does the data go, whose law can reach it, could you switch provider tomorrow, and what does each extra level of control cost. A sovereign label on a product answers none of them for you. One line of disclosure before going further: Lasting Dynamics builds AI software in the EU, so we have a stake in this question, and we will say plainly where full sovereignty is not worth the money.
Keeping data inside the European Union is the easy half of sovereign AI, because almost every major provider now offers an EU region. The real work is listing everything the AI actually touches, which is always more than the files someone uploads.
Start with the questions your staff type, which often carry the most sensitive detail of all. Add the documents the AI reads in order to answer, and the searchable copy the system builds of those documents so it can find the right passage quickly. Then come the conversation logs, the backups of everything above, and any of your data used to tune or improve the model. Each of these can sit in a different place under a different retention rule, and a well-designed document search system makes that map explicit rather than leaving it to chance.
Two terms get used interchangeably and should not be: data residency means your data is stored in the EU, while data sovereignty means that only EU law can force access to it. The first is a question of geography, the second of jurisdiction, and most of what follows lives in the gap between them.
For transfers to the United States, the legal basis today is the EU-US Data Privacy Framework, adopted by the European Commission in 2023. The EU General Court upheld it on 3 September 2025 in Latombe v Commission, Case T-553/23, and an appeal, Case C-703/25 P, is pending before the Court of Justice. Its two predecessors, Safe Harbor and Privacy Shield, were both struck down by the Court of Justice, in 2015 and 2020.
The framework is valid today and could change, so the sensible response is contractual rather than anxious: your contract should say what happens to your data if the legal basis for the transfer falls away. Meanwhile, choosing an EU region and switching off training on your data are, with most providers, settings rather than projects, and worth doing this week.
An EU data center run by a company under US jurisdiction is still within reach of US law. The question is therefore not only where the building is, but who owns the service, who operates it day to day, and which country's law governs that operator.
دعنا نبني شيئاً استثنائياً معاً.
اعتمد على شركة Lasting Dynamics للحصول على جودة برمجيات لا مثيل لها.
The reason is the US CLOUD Act. Its operative provision, 18 U.S.C. § 2713, requires a provider of electronic communication or remote computing services to disclose data within its possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States. The test is control, not location, which is why an EU region answers the residency question but not the sovereignty one.
Such orders are rare in practice. Before the same inquiry, Carniaux also said that no European company had been affected by such a case, and for many workloads that risk is entirely acceptable. The point is to decide it workload by workload, on purpose, rather than to discover it during an audit or a client's due diligence.
For the conversation with vendors, the European Commission has supplied a useful vocabulary. Its Cloud Sovereignty Framework, published on 20 October 2025 for the Commission's own cloud tenders, rates providers on assurance levels from SEAL-0 to SEAL-4. SEAL-0, which the Commission labels No Sovereignty, describes a service under the exclusive control of non-EU parties. SEAL-4, Full Digital Sovereignty, describes technology and operations under complete EU control, subject only to EU jurisdiction, with no critical non-EU dependencies. Private companies are not bound by it, but it makes a sound checklist for any sovereign AI or sovereign cloud offer.
What comes next is still a proposal. On 3 June 2026 the Commission proposed the Cloud and AI Development Act, and as of mid-October 2026 it is awaiting a committee decision in the European Parliament. It is not law, and it changes nothing about your obligations today.
The sovereignty risk a company is most likely to meet is not a foreign court order. It is a price rise, a model retired at short notice, or a change in the terms of use, and the only real defense against all three is being able to leave.
Open-weight models are the clearest route to that freedom. They are models whose files are published, so you can run the same model with another provider or on your own servers. Mistral, a French company, publishes several of its models this way, including Mistral Small 4 under the Apache 2.0 license. Not every model in its range carries the same license, so check it model by model. Running such a model yourself is what people usually mean by a private LLM or a self-hosted LLM: a large language model on servers you control.
Whatever model you choose, three things should belong to you rather than to the provider: your data, the instructions you give the model, and the set of test questions with known good answers that you use to check its output. With those in hand, switching becomes a matter of reconnecting and retesting rather than rebuilding, and you can measure whether the new model is really as good on your own work.
Write the exit into the contract before you need it. The contract should let you export your data and configuration in a usable format, give you advance notice before a model you depend on is retired, and state that your data is not used to train or improve the provider's models. The same lock-in logic applies to the infrastructure underneath, which we cover in our piece on EU sovereign cloud software.
Control is a dial rather than a switch, and every step up removes a dependency while adding work. The comparison below covers four broad categories rather than named vendors, because the category decides most of the answers and the vendor only the details.
بدءاً من الفكرة إلى الإطلاق، نقوم بتصميم برامج قابلة للتطوير مصممة خصيصاً لتلبية احتياجات عملك.
شارك معنا لتسريع نموك.
| Category | Where the data sits | Whose law can force access | How easily you can switch | What you give up or take on |
|---|---|---|---|---|
| A US provider's AI service in an EU region | In the EU, once you choose the region | US law can still reach it through the provider's control | Depends on the contract, and on whether you own your data, instructions and test set | The least work and the widest choice of models, with the jurisdiction question left open |
| A US provider's sovereign offering, run by an EU operator or partner | In the EU, operated by an EU entity | Narrower, depending on how fully the EU operator is separated from the US parent | Depends on which models the offering includes | More assurance than the first row; check exactly what the separation covers |
| An EU-owned cloud or AI provider | In the EU | EU law, unless it has a US presence that brings it under US jurisdiction, or critical parts depend on non-EU suppliers | Depends on whether its models are open-weight or proprietary | Clearer jurisdiction; compare its range of models and services with what your workloads need |
| An open-weight model on servers you or an EU host control | Wherever you put it | Whoever controls the servers, so EU law if that is you or an EU host | The easiest, because you hold the model files | You take on running it: updates, security patches, monitoring and capacity at peak hours |
The last row deserves a warning, because it is the one that sounds like the answer to everything. Someone has to run it, applying updates and security patches, monitoring it, and making sure there is enough capacity when everyone uses it at once on a Monday morning. That takes a standing team or a specialist partner, not a one-off installation, and it is where the real cost of full control lives.
We give no prices here on purpose, because they go out of date faster than this article will. The factors that drive cost are stable, though: how much you use the model, how quickly answers need to come back, how many hours a day it must be available, and how much of the operating work you take on yourself. And take nobody's word on whether an open or a closed model suits you better, ours included: test the candidates on your own tasks, with your own test set, before you decide.
Most uses of AI do not need full sovereignty, but a few really do. Paying for it everywhere is as much a mistake as ignoring it everywhere, and the way out is to sort your workloads by the data they touch.
| Data the workload touches | What it needs |
|---|---|
| Public content, such as marketing copy and public documentation | A standard provider in an EU region, with training on your data switched off |
| Personal and commercial data, such as customer emails, contracts and HR records | EU residency, a solid data processing agreement and a tested exit plan |
| Regulated or strategic data, such as health records, banking, insurance claims or defense work | A sovereign offering run by an EU operator, an EU-owned provider, or an open-weight model on servers you or an EU host control, depending on what your regulator and clients require |
Regulated sectors add obligations of their own on top of this, and we have written separately about security in financial services, about healthcare software and about what the EU AI Act requires depending on what a system does.
There is also a plain business reason to get this right. Among EU enterprises that had considered using AI but did not adopt it in 2025, 48.83% cited concerns about data protection and privacy as a reason, according to Eurostat, behind only a lack of expertise and unclear legal consequences. A clear control model per workload removes one of the main brakes on adoption, because it turns a vague worry into a decision someone has made and can defend.
Which brings us to the honest part. “Sovereign everything” is expensive and usually unnecessary, and we would not recommend it to most of our clients, including the ones who could afford it. The companies that handle sovereign AI well reserve full control for the handful of workloads where jurisdiction really matters, and spend the rest of their effort on contracts and exit plans.
Before you sign, send the vendor six questions in writing and keep the answers on file. Ask where your data, logs and backups are stored and processed (including the searchable copy of your documents) and find out who operates the service and who owns that operator. Get a written answer on which laws could compel them to hand over your data, and on whether they will tell you if that happens.
Then confirm whether your data is used to train or improve any model, and check whether you can export your data, configuration and test sets, and how much notice you get before a model is retired. Finally, ask which model you are actually using, and whether you could move to an open-weight alternative without rebuilding.
The companies that get sovereign AI right do not buy the most sovereign product on the market; they know which of their workloads need it, and they can prove it.
نحن نصمم ونبني منتجات رقمية عالية الجودة ومميزة.
الموثوقية والأداء والابتكار في كل خطوة.
Do some of your AI workloads need to stay under EU law only? Tell us which ones.
This article was written by Nunzio Giugliano at Lasting Dynamics, an EU-based custom software development company that also builds AI software. Our clients put their own data into the systems we build, which is why where it goes and whose law can reach it are questions we answer in writing. The legal references above are dated and linked to their sources, so you can check whether they still hold when you read this. The four questions are yours to ask, and the answer for each workload is yours to decide.
For governments, sovereign AI means national control over computing capacity, models and talent. For a company it means running AI under controls you define and can evidence: knowing where the data goes, whose law can reach it, and whether you could switch provider. It is a level of control chosen per workload, not a single product.
No. Data sovereignty, meaning that only EU law can force access to your data, is one part of it. Sovereign AI also covers the model you depend on, who operates it, and whether you could move to another provider without rebuilding.
Not on its own. An EU data center gives you data residency, but if the provider is under US jurisdiction, the CLOUD Act can still require it to disclose data in its possession, custody or control wherever that data is stored. Sovereignty depends on who controls the service, not only where it runs.
Usually not. A self-hosted LLM, meaning a large language model on servers you or an EU host control, is the highest level of control and suits regulated or strategic data. For most workloads, an EU provider with a solid contract and a tested exit plan is enough.
Yes. The EU General Court upheld it on 3 September 2025 in Case T-553/23, and as of 16 October 2026 an appeal, Case C-703/25 P, is pending before the Court of Justice. Because it could still change, your contract should say what happens to your data if it does.
حوّل الأفكار الجريئة إلى تطبيقات قوية.
لنصنع معاً برمجيات تُحدث تأثيراً.
نونزيو جيوجليانو
Nunzio Giugliano is a Marketing Specialist at Lasting Dynamics, where he works on SEO strategy, technical content and B2B research across AI, enterprise software and digital transformation topics. His work focuses on making complex technology subjects clear, useful and accessible for CTOs, founders, decision makers and technical teams.
