Sovereign AI for enterprise: what it is and when you need it

In 2025 a French Senate inquiry asked Microsoft France's legal director, under oath, to guarantee that data on French citizens could not be passed to the US government without France's agreement. His reply, "No, I cannot guarantee that", is why sovereign AI for enterprise has moved from the IT team to the board. He added that it had never happened. The point stands: where your data sits does not decide whose law can reach it.

Sovereign AI means your company decides where its AI systems run, which law applies to them, who operates them and whether they keep running if a supplier or a government says no. In October 2026 the market moved. NVIDIA's cloud partners are expanding regional AI capacity across Europe, the Nordics, Africa and Central Asia, and the large US clouds now sell sovereign versions of their platforms.

Few firms need sovereignty for every workload, meaning every separate job an AI system does. Sort your AI work into tiers, pay the sovereign premium only where the risk is real, and prove you can leave.

What is sovereign AI?

Sovereign AI is AI that your organisation controls on five counts: where it runs, whose law applies, who operates it, who holds the keys, and whether you can keep it running or move it. Governments use the term for national capacity: their own data centres, models and skills. For a company the question is narrower. Which AI systems touch data or operations that a foreign court, a supplier's policy change or a cut cable must never be able to reach?

Sovereign AI vs private AI: what is the difference?

Vendors blur three terms. Keep them apart, because each one buys a different protection.

• Data residency means your data is stored and processed in a named country or region. It answers "where".
• Private AI means the model runs in an environment only your organisation uses, and your data does not train anyone else's model. It answers "who can see it".
• Sovereign AI adds authority: which courts can order access, which staff can reach the system, and whether a decision taken abroad can switch it off. It answers "who decides".

A system can be resident and private and still not be sovereign. A model hosted in Frankfurt by a company with a US parent is the common case. That may be fine for most of your work. It is not fine for all of it.

What changed: sovereign options are now on sale

Sovereignty used to mean building your own. Now the large providers sell it as a product, and buyers are paying for it.

• Spending. Gartner expects global sovereign cloud spend to rise 35.6% to $80 billion in 2026, with the fastest growth in the Middle East and Africa, Europe and mature Asia Pacific markets. It also expects buyers to shift 20% of existing workloads from global public clouds to local providers.
• Buyer intent. In a Gartner survey of 241 Western European IT leaders, 61% said they want to increase their use of local cloud providers.
• Offers from the large clouds. AWS opened its European Sovereign Cloud in January 2026. It says the cloud is operated exclusively by EU residents, and Amazon plans to invest more than €7.8 billion in it in Germany. On 20 October 2026 Microsoft set out a workload-by-workload approach to sovereign controls, including encryption keys held by the customer.
• Regional AI capacity. In the week before GTC Berlin, NVIDIA committed nearly $10 billion to the technology ecosystem across Europe. The French model maker Mistral trained its latest top-tier model, Mistral Large 4, on 3,800 NVIDIA GPUs, the chips AI runs on, in data centres it operates in Europe.
• Exit rules. Under the EU Data Act, cloud providers may no longer charge for switching or for data egress from 12 January 2027. Data egress is the fee for moving your data out.

How sovereign AI works, layer by layer

Every AI request passes through five layers, and each layer can have a different owner. Your sovereignty is only as strong as the weakest one. Follow a single request: a claims handler asks an AI assistant to summarise a customer file.

1. Data. The assistant reads the file, and the request, the answer and the logs are stored. The question is where every copy sits, including logs, backups and support tickets.
2. Model. The model is the trained program that writes the summary. With a closed model reached over the internet, your request travels to the provider's servers, and the provider decides when that model ends: requests to retired models fail. With an open-weight model, you hold a copy of the model file and can run it wherever you choose.
3. Compute. The model runs on chips in a data centre. This is what vendors mean by sovereign AI infrastructure. The question is which country that data centre is in and who owns it.
4. Operations. Engineers patch, monitor and support the system, often remotely. The question is who can log in, from where, and whether each access is approved and recorded. AWS says its sovereign cloud is operated only by EU residents. Microsoft's Data Guardian works differently: engineers outside Europe can still get remote access, but each access is approved and monitored by European resident personnel in real time and logged. Microsoft now describes this as oversight by a trusted EU partner. Operated only by residents and access overseen by residents are different promises.
5. Law. A government can compel the operator to hand over data. The US CLOUD Act gives the US government authority to obtain data held by US-based tech companies, wherever that data is stored. The question is which legal entity signs your contract, and which courts its parent answers to.

Encryption cuts across all five layers. If your organisation keeps the root encryption key in hardware it owns, an option Microsoft now offers as generally available, stored data is unreadable without you. Data that is being processed is still decrypted inside the provider's machines, unless you also use confidential computing: chips that keep data sealed off, even from the operator, while it is in use. When a vendor says "encrypted", ask which of the two it means.

What sovereign AI means for cost, people, risk and scale

Sovereignty is a price you pay for control, so put a number on both sides before you buy it.

• Cost. Sovereign regions cost more. For its European Sovereign Cloud, AWS estimated the premium at 10% to 15% over its Frankfurt region. Private hardware has its own pressure: a senior Dell sales executive estimated that about 20% more memory will reach the market next year against roughly 200% more demand, which pushes up prices.
• People. Someone has to run what you bring under your control. A private environment needs engineers for patching, monitoring and model updates, or a partner who does that work for you. Strict rules on who may operate a system also shrink the pool of support staff who can help in an incident.
• Risk. Sovereignty lowers legal and continuity risk: fewer foreign orders can reach the system, and no supplier can retire the model you depend on. It raises a different risk: falling behind. Some services and models arrive later in sovereign regions, so check the list.
• Scale. The design must hold as use grows. As inference spending climbs, business leaders are weighing where models run, which models they use and how much of their data they are willing to hand to someone else. Inference means running a model to produce each answer, and its cost grows with every use. A setup that works for one assistant must still work for fifty.

What people get wrong about sovereign AI

Four mistakes come up again and again in board papers and vendor pitches.

"Our data is in an EU region, so we are sovereign"

Location is one layer of five. If the operator's parent company is subject to a foreign law, that law can follow the data. The Microsoft testimony in France is the clearest public statement of this. Residency is necessary for many workloads. It is not enough for the most sensitive ones.

"A European provider puts us out of US reach"

Not by default. AWS has argued that the CLOUD Act applies to any cloud provider doing business in the US, and that European-headquartered cloud providers with US operations are also subject to the act's requirements. OVHcloud, for one, says its French entity is not. The answer depends on the legal entity that holds your data and the group it belongs to. Ask for that in writing.

"Sovereign means running everything ourselves"

Microsoft now designs its sovereign offer around the workload. It notes that a public-facing digital service may benefit from the scale and pace of innovation in the public cloud, while an AI workload that handles highly sensitive data may need to stay in an environment the customer controls. Putting every workload in a private stack doubles your infrastructure and slows every project. Keep the strictest setup for the work that needs it.

"An open model makes us sovereign"

An open-weight model fixes one layer: no supplier can retire it or change its terms overnight. Run it on a cloud that is controlled from abroad and the law and operations layers do not change. You also take on work the provider used to do: security patches, testing, and upgrades when better models arrive. Our guide to open source vs closed source AI covers that trade-off in detail.

Sovereign cloud vs private cloud: the options compared

There are four practical ways to run an AI workload, and most large firms will use more than one. The table compares them on the layers above. A hyperscaler is one of the very large global clouds, such as AWS or Microsoft Azure.

Model choice and cost differ too. The global public cloud has the widest choice of models at the lowest price. A hyperscaler sovereign cloud charges a premium over standard regions, and some services arrive there later. A national or regional AI cloud varies in price by provider and offers a narrower choice, often strong on open models. A private environment runs the open-weight models you hold. It costs the most to set up, but can cost less per task at steady, high use.

The hyperscalers' sovereign versions include the AWS European Sovereign Cloud and Microsoft's Sovereign Public Cloud. National partner clouds, such as Bleu Cloud in France and Delos Cloud in Germany, run Microsoft technology under local ownership. A private environment can sit in your own data centre or with a partner who hosts and runs it for you. Check ownership in every case: a regional data centre can belong to a group with its headquarters elsewhere.

How to decide which enterprise workloads need sovereign AI

Sort every AI workload into one of three tiers by its impact, not by the setup it runs on today. Judge impact with three questions: how much harm if its data were exposed, how much harm if the service stopped, and whether a regulator or a customer requires it to stay under local control. Then put the controls and the money where the tier says. Most firms find that the top tier is small.

1. Tier 1, open. Public or low-risk data: drafting, research, help with code that is not sensitive. Use a standard cloud and the best model for the job.
2. Tier 2, controlled. Personal data, commercial secrets or regulated records. Require processing in your region, no training on your data, customer-held keys where offered, logged operator access and a written exit plan.
3. Tier 3, sovereign. Work that a regulator or a customer requires under local control, operations that must keep running in a crisis, and the data that would do most harm in a rival's or a foreign state's hands. Use a sovereign or private environment, a model you can keep, operators in your jurisdiction and a tested exit.

Then test the setup. A tier 2 or tier 3 workload must pass these five tests before it goes live. For tier 2, a written exit plan can answer the last test. For tier 3, the exit must be tested. Each "no" or "we do not know" is a gap to close in the setup, not a reason to change the tier.

• Do we know every place its data, logs and backups are stored?
• Is the legal entity that operates it outside the reach of any foreign order we cannot accept?
• Is every operator login approved and recorded, and can we see the record?
• Do we, not the provider, hold the keys to the stored data?
• If the provider stopped service tomorrow, could we keep it running or move it within a set number of days?

Questions to ask a vendor

• Which legal entity will hold our data, and in which country is its parent company?
• Has that entity received foreign government orders for customer data, and does it publish the numbers?
• Which of your services and models are available in the sovereign region today, and which are not?
• How much notice do you give before you retire a model, and what happens to our system on that date?
• What does it cost to leave, and how long does a full export take?

How to run a sovereign AI pilot and measure it

Test one workload end to end before you commit budget to a sovereign platform. Pick a tier 3 workload with a known business value, so the pilot measures cost and control together.

1. Write the requirements as tests. For example: no data leaves the region, every operator access is logged, we hold the keys, and the system keeps working if the vendor's main cloud cannot be reached.
2. Set the baseline. Record the current cost per task, response time and output quality on the existing setup.
3. Run the same workload on the sovereign option. Use real volumes for four to six weeks, not a demo.
4. Measure the gap. Compare cost per task, response time, quality, missing services and the staff time needed to run it.
5. Run an exit drill. Export the data and move the workload, or switch the model, within an agreed number of days. An exit plan you have not tested is only a hope.
6. Decide. Extend it to the other tier 3 workloads, change the design, or stop. Write down which test decided it.

Sovereign AI risks and how to control each one

Each benefit of sovereignty has a matching risk, and the two that cost the most rarely appear in a vendor pitch. The first is paying the premium everywhere: applied to every workload, a control meant for a few becomes a standing charge on the whole AI budget, as the worked example shows. The second is falling behind: some services and models arrive later in sovereign regions, so work moved there too early can run on weaker tools than the rest of the business. Give each control below a named owner.

• Paying the premium everywhere. Control: tier the portfolio first, and review the tiers each year.
• Falling behind on models. Control: keep tier 1 on the most capable models, and test new open models for tier 3 each quarter.
• Services missing in the sovereign region. Control: check the service list against your design before you sign.
• A new lock-in to a local provider. Control: open data formats, an exit clause in the contract and, from January 2027, the EU Data Act's ban on switching charges.
• Too few people to run a private stack. Control: a managed partner with named staff, or a budget for the team before you build.
• Model retirement. Control: for closed models, a notice period in the contract and a tested replacement. For open models, keep your own copy.
• Legal uncertainty. Control: a written legal opinion for each jurisdiction on who can compel access. In the EU, the Data Act also requires cloud providers to take reasonable measures against unlawful foreign government access to non-personal data held in the EU.

Where Thriiv fits

Thriiv builds and runs custom AI systems, workflow automation and secure data pipelines for international enterprises. Every system we ship is private by default: it runs in an environment we host and manage, as our security page explains. We put a quantified saving on a workload before budget is committed, and we deliver a working pilot in weeks, not quarters.

Private is not automatically sovereign. For a tier 3 workload, ask any partner, us included, who operates the environment, which law applies to it and how you would leave. Then hold the answers to the tests above.

What to do this quarter

• List every AI workload in use or in build, with its data and its operator.
• Place each one in a tier by its impact, then test its setup with the five questions above. Expect the top tier to be small.
• Get a legal opinion on foreign access for your main cloud and AI contracts.
• Put the vendor questions to each AI supplier, and ask for written answers.
• Pick one tier 3 workload and run the six-step pilot.
• Check the data under that workload first: our note on AI data readiness shows how. When you know where the cost and the risk sit, start the conversation.