Sovereign AI, defined.

Sovereignty and deployment

Sovereign AI

An AI system whose data, processing, and operational control remain subject to European law rather than a foreign jurisdiction.

The term is used for at least four separate claims — EU hosting, EU corporate ownership, freedom from foreign lawful-access orders, and inference that never leaves a controlled boundary. They fail independently, so establish which one a vendor means before comparing options.

Data residency

A commitment that data is stored and processed within a defined geographic area, such as the EU or a named member state.

Residency answers where data sits. It does not by itself answer who controls the operator or who could compel disclosure, which is why it appears alongside — not instead of — questions about corporate ownership and subprocessors.

On-premise inference

Running an AI model on hardware inside the customer's own datacentre, so that prompts and retrieved content never leave their infrastructure.

It removes the international-transfer question for the inference step entirely, at the cost of operating the infrastructure. Usually chosen for the most sensitive workloads rather than as a default for everything.

Air-gapped deployment

A deployment with no network connection to the public internet, where updates and data move in and out through controlled, deliberate processes.

The strongest isolation posture available. Common in defence, critical infrastructure, and the most sensitive parts of financial and healthcare environments.

Zero data egress

An architecture in which company content does not leave the deployment boundary during processing — including for embeddings, re-ranking, safety classification, or telemetry.

Worth checking in detail. Headline commitments about training data often exclude embeddings and prompt logs, which are exactly the paths through which content leaves in practice.

Dedicated EU cloud

A single-tenant deployment hosted with a European cloud provider, dedicated to one customer rather than shared multi-tenant infrastructure.

The usual middle ground between public SaaS and on-premise: it removes shared-tenancy concerns and keeps processing in the EU without requiring the customer to run the hardware.

European regulation

GDPR

Regulation (EU) 2016/679, the General Data Protection Regulation — the EU's baseline law on processing personal data.

For AI deployments the provisions that bite hardest are Chapter V on international transfers, Article 32 on security of processing, Article 35 on data protection impact assessments, and the accountability principle in Article 5(2).

Chapter V transfers (Article 44 onward)

The GDPR rules governing transfers of personal data to countries outside the EU and EEA.

A transfer needs an adequacy decision, appropriate safeguards such as standard contractual clauses, or a specific derogation. Article 48 additionally provides that third-country court or authority decisions are only recognisable on the basis of an international agreement.

EU AI Act

Regulation (EU) 2024/1689, the EU's risk-based framework for artificial intelligence, phased in between 2025 and 2028.

Prohibitions applied from 2 February 2025 and general-purpose AI obligations from 2 August 2025. Article 50 transparency obligations applied from 2 August 2026. High-risk obligations for Annex III systems were deferred to 2 December 2027 by the Digital Omnibus agreed in 2026, with Annex I obligations moving to 2 August 2028.

DORA

Regulation (EU) 2022/2554, the Digital Operational Resilience Act, applying to EU financial entities since 17 January 2025.

It sets requirements for ICT risk management, incident reporting, resilience testing, and ICT third-party risk. An AI platform serving a financial entity is an ICT third-party service provider and inherits the full contractual, register, and exit regime.

NIS2

Directive (EU) 2022/2555, raising cybersecurity requirements across essential and important entities in the EU.

As a directive it takes effect through national implementing law, so the precise obligations vary by member state. Supply-chain security and management accountability are the themes most relevant to AI procurement.

Schrems II

The Court of Justice judgment of 16 July 2020 in Case C-311/18, which invalidated the EU-US Privacy Shield framework.

The Court found US surveillance access and the absence of effective redress incompatible with EU standards. The EU-US Data Privacy Framework restored a transfer route in July 2023, resting on an adequacy decision of the same reviewable type.

CLOUD Act

A 2018 US statute allowing US authorities to compel providers subject to US jurisdiction to produce data in their possession, custody, or control, including data stored outside the United States.

This is the reason risk teams treat corporate ownership as a separate question from server location. It also sits in unresolved tension with GDPR Article 48.

How the technology works

RAG (retrieval-augmented generation)

A technique where a system first retrieves relevant documents, then asks a language model to answer using only that retrieved material.

It is how an assistant answers questions about a specific company rather than about the public internet. Answer quality is dominated by retrieval quality — whether the right passages were found — more than by which model composes the response.

Permission-aware retrieval

Retrieval that carries each source system's access controls into the search step, so a user's query only reaches material they were already authorised to open.

The alternative — indexing everything under a broad service account and filtering results afterwards — is the most common reason internal AI pilots fail security review. Post-retrieval filtering leaks through summaries, embeddings, and cached answers.

ACL (access control list)

The set of rules in a source system defining which users and groups may see a given item.

Mirroring ACLs accurately and keeping them current as they change in the source system is one of the genuinely hard engineering problems in enterprise AI search.

Connector

The software that links an AI platform to a specific source system in order to read its content and its permissions.

Connector counts are a common marketing metric but a poor quality signal. A connector that reads content without reading permissions creates more risk than value.

Embedding

A numerical representation of a piece of text that lets a system find passages by meaning rather than by exact keyword match.

Embeddings are derived from your content, so where they are generated and stored is a data-protection question in its own right — one often omitted from headline commitments about data use.

Small language model (SLM)

A language model small enough to run on modest dedicated hardware, typically trading breadth of general knowledge for lower cost and easier self-hosting.

For retrieval-grounded work over company documents, the model supplies reasoning and phrasing rather than knowledge, so a smaller model is often sufficient — which is what makes on-premise deployment practical.

Governance and evidence

Citation and provenance

The source attached to a generated claim, identifying the file and location it came from so a reviewer can verify it.

In a regulated setting this is not a convenience feature. It is what makes an AI-produced document reviewable, and therefore usable, in work that carries professional or supervisory consequences.

Audit trail

A durable record of what an AI system retrieved, for whom, and what it generated, kept in a form an auditor can read.

Retrofitting audit onto a system people already depend on is materially harder than starting with it, which is why it belongs in the first pilot rather than in a later hardening phase.

DPIA (data protection impact assessment)

The assessment required by GDPR Article 35 when processing is likely to result in a high risk to individuals' rights and freedoms.

Connecting an AI system to internal repositories usually meets the threshold — large-scale processing of personal data using new technology. A completed DPIA is also the fastest way to answer a supervisory authority.

Shadow AI

Use of AI tools inside an organisation without the knowledge or approval of IT, security, or compliance.

Usually a demand signal rather than a discipline problem: it indicates a task where the sanctioned route is slower than the unsanctioned one. For DORA entities it also represents a gap in the register of information.

Register of information

The structured inventory of ICT third-party contractual arrangements that DORA requires financial entities to maintain and report to competent authorities.

Reporting templates are set by Commission Implementing Regulation (EU) 2024/2956. Informal departmental AI subscriptions are a common source of incompleteness.

Design partner

An early customer who works closely with a vendor during development, shaping the product with real data and real requirements.

In regulated markets the arrangement is usually what makes the hard problems — permissions, evidence, procurement scrutiny — visible early enough to solve properly.

Frequently asked questions