What is sovereign AI? A guide for Europe

Sovereign AI: where the term comes from

"Sovereign AI" became a common phrase in 2024, and one of the companies that pushed it hardest sells the chips. In a February 2024 post, NVIDIA defined it this way: "Sovereign AI refers to a nation's capabilities to produce artificial intelligence using its own infrastructure, data, workforce and business networks" (NVIDIA blog, archived copy). The original address now redirects to a newer post, which is why we link an archive.

That definition is national and industrial: a country building its own AI capacity. Since then the term has spread to companies, cloud providers and governments, and it now covers at least three different ambitions:

• Sovereign infrastructure — owning or controlling the GPUs, the data centres and the people who run them.
• Sovereign models — models trained in your country or region, in your languages, on data you can account for.
• Sovereign access — using capable models through operators that sit under your own jurisdiction, with control over what happens to your data.

Our short version is in What is frontier AI?. This article goes deeper: what sovereignty is made of, what Europe is building, which labels mean what, and what a company can realistically do in 2026.

The five layers of AI sovereignty

Sovereignty is not one property. It is a stack, and each layer can be under a different country's control.

1. Jurisdiction over your data

Which courts and authorities can compel the operator to hand over what you send it. This follows the company, not the server: the US CLOUD Act of 2018 lets US authorities require a provider subject to US jurisdiction to produce data in its possession, custody or control, wherever that data is stored. Our GDPR vs. CLOUD Act guide goes through the mechanism. A European region run by a US company answers "where", not "who".

2. Compute and infrastructure

Who owns the data centre and the GPUs, and who operates them day to day. A European company renting capacity from a US hyperscaler has a different exposure from one running its own machines.

3. Models

Who trained the model, on what data, and under which licence you use it. An open-weight model can be run by anyone, so who built it and who runs it become separate questions. A closed model can only be used through its maker or the partners it chooses.

4. Operations and supply chain

Even a fully European data centre depends on chips, firmware, drivers and inference software designed elsewhere, mostly in the United States. That is a dependency — updates, support, export rules — rather than direct access to your prompts, and it is worth naming separately so it is not confused with the first layer.

5. The legal bridge, and how fragile it is

Sending personal data to a US company is lawful under the GDPR when there is a transfer mechanism. The current one, the EU-US Data Privacy Framework, rests on an adequacy decision adopted by the Commission on 10 July 2023. On 3 September 2025 the General Court dismissed an action brought against it by Philippe Latombe (case T-553/23) (CJEU press release 106/25), and Mr Latombe appealed to the Court of Justice on 31 October 2025 (WilmerHale); we found no ruling on that appeal as of 2026-10-19. The history is the reason for caution: the Court of Justice struck down the previous framework, the Privacy Shield, in July 2020, finding that US surveillance programmes were "not limited to what is strictly necessary" (CJEU press release 91/20), and its predecessor, Safe Harbor, in 2015. Architecture built on a transfer mechanism has to plan for that mechanism disappearing.

What Europe is building

Most of Europe's public effort targets the second layer — compute — so that European researchers and companies can train and run large models without depending on US clouds.

• AI Factories. The EuroHPC Joint Undertaking oversees 19 AI Factories, complemented by 13 AI Factory Antennas, built around Europe's public supercomputers (EuroHPC).
• InvestAI and the AI gigafactories. On 11 February 2025, at the AI Action Summit in Paris, the Commission launched InvestAI to mobilise €200 billion for AI, including a new €20 billion fund for AI gigafactories — facilities with around 100,000 latest-generation AI chips, roughly four times the AI factories then being set up (European Commission). The call for tenders opened on 30 July 2026 for up to seven AI gigafactories, with submissions closing on 12 November 2026 and more than €20 billion of private investment expected (EuroHPC).
• National commitments. At the same summit, France announced €109 billion of French and foreign private investment in AI in France (Élysée).

Two caveats. First, these are mostly training and research capacities, not an API your product can call next week. Second, the hardware inside them is largely American: public compute raises European control over infrastructure and operations, not over the whole supply chain. For a company deciding whether to build its own cluster, our analysis of building versus using an API puts numbers on the choice.

Labels and certifications: what they prove

Several labels are cited as proof of sovereignty. They do not all measure the same thing.

SecNumCloud is the strictest of the three on jurisdiction, and it is granted service by service. It is why the French "trusted cloud" joint ventures matter: S3NS, a Thales subsidiary in partnership with Google Cloud, announced on 17 December 2025 that its PREMI3NS offering had obtained SecNumCloud 3.2 qualification (S3NS), and ANSSI's decision of the same day states that the service offers protection against non-European law (ANSSI decision); Bleu, which offers Microsoft 365 and Azure services from a French cloud, describes itself as "en cours de qualification SecNumCloud 3.2" (Bleu). These offers are a third category: a European-controlled operator running US technology under licence. Whether that is sovereign enough depends on which layer you care about — the jurisdiction layer improves, the supply-chain layer does not. Before relying on the label for any provider, check the exact service on ANSSI's list of qualified providers.

C5, published by the German BSI since 2016, specifies minimum requirements for secure cloud computing (BSI). It says a lot about security controls, little about who owns the provider.

EUCS, the EU's cloud certification, has been a candidate scheme since ENISA published a first draft on 22 December 2020 (ENISA); ENISA's certification site presents EUCC, for ICT products, as the first scheme available (ENISA). There is no EU-wide sovereignty label for cloud or AI to rely on today.

Why an "EU region" is not sovereign AI

The most common confusion is between data residency and jurisdiction. Every large US cloud offers European regions, and most AI APIs from US companies can be pinned to one. That keeps data physically in Europe; it does not change who can be compelled to disclose it. The same reasoning is behind SecNumCloud's requirements, and behind our own labels: a model served by a US company in its EU region is listed as "fast access", never as sovereign. Our sovereignty methodology spells out the four questions we ask of every route — who owns the operating company, where the compute runs, who operates the cloud, what happens to the data.

The reverse is also true: a European company can serve you from Europe and still keep your prompts for 30 days, or train on them. Jurisdiction is necessary, not sufficient. Our guide to EU-hosted AI models covers the residency and retention checks in detail, and European inference providers in 2026 applies them to twelve providers.

Sovereign AI for a company in 2026: a practical checklist

1. Classify your data first. Health records, client files, source code, HR data: sovereignty matters most where a disclosure would hurt. Public marketing copy may not need it at all.
2. Name the operator of every model call. The company that runs inference, its country, and its parent company. If you cannot name it, you cannot assess it.
3. Read the retention sentence. Zero retention by default, retention for abuse or errors, or 30 days unless you ask: three different answers.
4. Prefer open-weight models for sensitive work. They can be served by European operators today, and moved to another operator, or in-house, later.
5. Make fallback explicit. A failover that silently sends traffic to a US provider undoes the rest. Require that sovereign requests fail rather than leave Europe.
6. Keep the code portable. An OpenAI-compatible API means switching provider is a base URL, a key and a model name.
7. Document it. Sub-processors per model, data processing agreements, and per-request evidence of where each call ran. You will need it for your GDPR records, and to prepare for the EU AI Act.

Many teams do steps 2 to 6 through a single European gateway rather than one contract per provider; our article on what an EU LLM gateway is explains what to expect from one.

Where Frontière AI fits

Frontière AI works on the third ambition, sovereign access. It is an OpenAI-compatible gateway published by FLEECE AI SASU, a French company. It does not own GPUs and does not train models; it routes requests to European inference providers and labels every model by jurisdiction.

• 17 EU-sovereign models live today, served by Scaleway (France), Mistral AI (France), Infomaniak (Switzerland) and AKI.IO (Germany). A sovereign model stays on sovereign providers by default, failover included; if none is available, the call fails instead of leaving Europe.
• 7 fast-access models, labeled as such. They run at US companies, are never called sovereign, and an API key can be restricted to sovereign models only.
• Evidence on each response: X-Routed-Provider and X-Sovereign headers name where the call ran.
• No prompt or completion written to our database.
• Prepaid from €10, VAT included, no subscription.

The limits, stated plainly. The gateway runs on Vercel's Paris region; Vercel is a US company, and requests pass through it in transit (privacy policy). OVHcloud and Scaleway each have a US entity, so the accurate phrase for them is "outside the direct reach of the CLOUD Act", not immune to it. We do not claim a SecNumCloud qualification for our gateway, and we do not claim one for a provider's AI service unless it is on ANSSI's list. And the GPUs our providers use are American. Within those limits, you get named European operators for every sovereign call, and proof of it in every response. Browse the model catalogue, or see what we offer teams that need DPAs and per-key policies.

FAQ