Europe’s approach to sovereign cloud offers a practical lesson for AI buyers: define the control your business needs, then ask suppliers to demonstrate it.
Consider a hypothetical German manufacturer choosing an AI assistant for its service team. The supplier promises European hosting. The demonstration is convincing. But the purchasing team still cannot explain who can access diagnostic records, which subcontractors process them or how the service would continue if the supplier became unavailable.
Those unanswered questions are the business substance of sovereign AI. For this article, the term means the ability to retain meaningful control over an AI service, its data and its dependencies. That working definition follows the European Commission’s framework, which treats sovereignty as a combination of legal, operational, technological and data controls. commission.europa.eu
For SMEs, the objective should be a service they can use, oversee and replace at an acceptable cost. A European address is one part of that decision.
What the European Commission case actually shows
On 17 April 2026, the Commission announced four contracts allowing EU institutions and other Union bodies to procure sovereign cloud services worth up to €180 million over six years. This is a procurement ceiling across that period, not money already spent or an AI-only investment. Commission award announcement. commission.europa.eu
Its June explanation describes 48 criteria across eight categories, including data and AI, operations, supply chains, legal jurisdiction and technology. The framework was developed for that procurement; the Commission encourages other public and private organisations to use it. It is not a general purchasing obligation for every SME. Framework explanation. commission.europa.eu
The award also included an arrangement using Google Cloud technology within an environment operated exclusively by EU companies. The Commission says this met its minimum sovereignty requirements. The lesson is specific: technology origin alone did not determine the result under this tender’s criteria. Commission award announcement. commission.europa.eu
The business opportunity is to make dependence manageable
In a statement published on 13 February 2026, Rolf Schumann, then identified as co-CEO of Schwarz Digits, argued that digital freedom depends on control over an organisation’s data and systems. Schwarz Digits supplies cloud services through STACKIT, so this is a supplier’s commercially interested perspective. Schumann’s published statement. schwarz-digits.de
X3AI’s interpretation is that buyers should turn that principle into observable requirements. Who can change the system? What information can leave it? How would the organisation recover or move the workload?
A small company need not operate its own data centre to ask those questions. It does need to understand which responsibilities it retains and which it delegates.
Five steps for choosing an appropriate AI service
The following recommendations adapt these issues to business purchasing. They are X3AI’s proposed approach, rather than a reproduction of the Commission’s assessment.
1. Define the control required by the use case
Begin with the work and information involved. An assistant summarising published product manuals presents different concerns from one searching confidential bids or processing customer service histories.
For the hypothetical manufacturer, separate public documentation from customer records before selecting a platform. Decide which information may enter the service, which users may retrieve it and which actions require approval.
Write down the consequences of disclosure, an incorrect answer and an outage. Use those consequences to set requirements proportionate to the task. Apply stricter controls where a failure would materially affect customers or operations.
2. Map the entire service and its data flows
Ask for a description covering the application, model provider, document storage, search index, logs, backups and support arrangements. Identify which organisations operate each component and where processing takes place.
Require clear answers about retention, deletion, use of inputs for training and access by support staff. Check connected tools separately: a locally hosted assistant may still be configured to send a document to an external service.
The Commission’s framework explicitly considers operational autonomy and supply-chain dependencies alongside data protection. For buyers, the practical task is to document those dependencies before they become difficult to change. Framework objectives. commission.europa.eu
3. Choose an operating model your team can sustain
Deployment options can differ even within one supplier. Mistral, for example, describes both hosted services and downloadable models that customers can run on their own hardware. Its documentation also makes clear that licences vary by model. Mistral deployment options and licensing guidance. Mistral
A managed service may suit an SME with limited technical staff. Self-hosting may suit a defined control requirement when the organisation has the skills and budget to operate it.
Compare the complete workload: installation, updates, monitoring, access management, capacity planning and recovery. Ask who performs each task under the proposed contract. More direct control is useful only when someone can exercise it competently.
4. Check what the assurance actually covers
Request evidence for the exact service being purchased. Establish which components, locations and operations are within scope, and which remain your responsibility.
France’s cybersecurity agency ANSSI makes this distinction explicit for SecNumCloud, its cloud qualification scheme. Qualification applies to a specific offering; a service hosted on a qualified offering does not automatically inherit the qualification. ANSSI also warns that the underlying qualification does not establish the security of the customer’s application. ANSSI clarification. ANSSI
Use that principle when assessing AI claims. Ask for an explanation of the evidence, its limits and any additional controls your implementation needs. Test permissions and data separation in your own configuration.
5. Test an exit before committing to scale
Include a small migration exercise in the pilot. Export representative documents, application settings and available logs. Check whether another environment can restore the essential workflow and preserve its access restrictions.
Record what must be rebuilt, how long migration takes and which licences or supplier services remain necessary. If you change the model, rerun the quality checks; preserving the documents does not demonstrate equivalent answers.
Agree a fallback for disruption. For the manufacturer, that could mean staff returning to an approved manual search process while the assistant is unavailable. The fallback needs an owner and a rehearsal.
The strategic decision is which dependencies you can accept
A suitable purchasing decision balances control, service quality, operational capacity and cost. Highly sensitive work may justify a more restrictive deployment. A limited, lower-risk use case may be adequately served by a managed product with clear contractual and technical boundaries.
Before signing, leadership should be able to identify who controls the service, what evidence supports the promised safeguards and how the business would continue without it. Unclear answers are a reason to narrow the deployment or resolve the gaps before expanding.
Schreiben Sie einen Kommentar