Sovereign AI: real requirement or sales argument?

A word turned sales pitch

"Sovereign AI" now appears in many sales brochures. The term reassures, sounds serious, and covers very different realities. For one provider, it means a data centre in France. For another, a model designed by a European company. For a third, an offer qualified by ANSSI, the French cybersecurity agency. These three promises do not bring the same guarantees and do not require the same effort.

For management teams, the question often arrives through compliance or a customer: "is our AI sovereign?". The right answer starts with another question: sovereign against which risk? Loss of control over sensitive data, access by a foreign authority, dependence on a single provider, a requirement from a prime contractor. Each risk calls for a different answer, and some answers cost a lot in features.

This article does not repeat the comparison of hosting providers. We did that in hosting an AI project in France, which covers data flows, processing location, the law applicable to the provider and reversibility. Here we set out a grid to decide whether sovereignty is a real requirement for your project, and what it implies for your choices.

What sovereignty covers: four distinct layers

When a provider talks about sovereignty, it usually means only one of these layers. Telling them apart avoids paying for a guarantee you do not need, or assuming a guarantee you do not have.

• Data location. Where data is stored and processed, including requests sent to the model, logs and backups. This is the easiest layer to obtain and the most often advertised.
• The law applicable to the provider. Which laws govern the company running the service, wherever the servers are. European hosting says nothing about the operator's legal nationality.
• Control of the model. Who owns the model, who can change or withdraw it, and whether you can run it yourself. This is the technology dependence layer.
• Qualification. Has a recognised third party checked the advertised guarantees. In France, the reference is the SecNumCloud qualification issued by ANSSI.

The first two layers are covered in detail in our hosting article. The last two are explained less often, and they make the difference between claimed and verifiable sovereignty.

One legal point adds to this, independently of sovereignty: the GDPR governs transfers of personal data outside the Union. Its Chapter V requires that such transfers do not undermine the level of protection the regulation guarantees. They rely in particular on a Commission adequacy decision or on appropriate safeguards, such as the standard data protection clauses adopted by the Commission. This framework makes a transfer lawful. It does not answer whether you want your data to leave.

The model layer: three ways to use it

This is the layer most specific to AI, and the least understood. There are three ways to use a language model, with very different degrees of control.

Calling a vendor's API

You send your requests to the vendor's service, which runs the model on its infrastructure. It is the simplest mode and the one that gives access to the latest models. Your control depends on the contract: processing location, retention of requests, possible reuse for training. The CNIL, the French data protection authority, advises in its recommendations on deploying generative AI to check whether the provider may reuse the data you send.

Choosing a European vendor

A model designed by a European company, called through its API, settles part of the question of the law applicable to the vendor. Mistral AI, a French vendor, is the best-known example. You still need to check where and by whom the model actually runs: a European model served by a platform subject to foreign law does not offer the same guarantees as the same model served in Europe by a European operator.

Self-hosting an open-weight model

Some vendors publish their model weights under a licence that allows downloading, modifying and deploying them. Mistral AI's documentation, for example, lists several models under the Apache 2.0 licence. You then run them on your own infrastructure or with a host of your choice. No request leaves your perimeter, and nobody can withdraw or change the model without you. The CNIL also recommends that organisations favour local, secure and specialised systems where possible.

In return, you become the operator: updates, monitoring, compute capacity, supply chain security. And the catalogue is narrower than that of commercial APIs. That is the heart of the trade-off, which we come back to below.

SecNumCloud: what ANSSI says, and what it is made to say

SecNumCloud is a framework ANSSI created in 2016 to qualify cloud service providers. According to the agency's FAQ, the qualification aims to protect against isolated threats and fairly skilled cybercrime, and to ensure immunity from extra-European laws. It covers infrastructure, platform, container and software as a service offers.

Protection against extra-European laws rests on precise legal requirements detailed by ANSSI: a head office in an EU Member State, limited non-European shareholding, controlled use of third-country services, operational autonomy. On the data side, the storage and processing of customer data must be located within the Union, as must administrator and user directories and technical data such as logs.

Three points from ANSSI help when reading sales pitches:

• Qualification applies to an offer, not a company. ANSSI says so explicitly: SecNumCloud recognises a specific cloud offer, not a provider or an infrastructure. A host can have one qualified offer and others that are not.
• It has a validity period. It lasts three years, with annual surveillance audits, and must then be renewed.
• It does not replace your risk analysis. ANSSI asks qualified providers to remind their customers that SecNumCloud addresses specific threats and that each customer remains responsible for managing its own risks.

You must also distinguish qualified offers from those in the process of qualification, which ANSSI lists separately with the providers' consent. "In progress" is not "qualified". Before signing, check the exact name of the offer in the list published by the agency.

Finally, SecNumCloud qualifies a hosting service. If you run an open-weight model on it, you get a qualified infrastructure. If your application then calls an external API, that call leaves the qualified perimeter. A system's sovereignty is judged by its most exposed link.

When sovereignty is a real requirement

In our practice, three situations justify treating sovereignty as a design constraint rather than an option.

Sensitive data goes through the model

Health data, HR files, non-public financial information, industrial secrets, defence or security data. If the agent must read this content to be useful, processing location, applicable law and request retention become central. A leak or uncontrolled access would have heavy consequences, and you must be able to demonstrate your safeguards.

You work for or with the public sector

Administrations, local authorities, public bodies and their contractors handle data whose protection is a matter of public interest. Hosting or qualification requirements may appear in tender specifications. If you supply a public entity, read the hosting clauses before choosing your architecture, not after.

A contract requires it

This is the most frequent and most concrete case. A large account, an industrial prime contractor or a regulated customer writes a location, European operator or qualified offer requirement into its contract. The question is no longer whether sovereignty is useful: it is owed. You then need to read the text precisely, because "hosting in France", "operator subject exclusively to European law" and "SecNumCloud qualified offer" are three different obligations.

When it is mostly a sales argument

Conversely, some signals show the word is used to sell more than to protect.

• The provider talks about sovereignty without saying which of the four layers it guarantees.
• It highlights a French data centre without saying which law governs the company running it.
• It claims "SecNumCloud" without naming the qualified offer, or confuses qualified with in progress.
• The sovereign offer actually calls a model hosted elsewhere, without this being clear in the documentation.
• The extra cost is justified by sovereignty although your use case handles no sensitive data.

That last point is the most common. An agent that helps write product sheets from a public catalogue, or answers FAQs from pages already online, handles nothing that justifies a qualified infrastructure. Demanding maximum sovereignty everywhere means giving up useful tools where the risk is low.

What sovereignty costs in choices

Sovereignty is not free, and the cost is not only financial. It is paid in trade-offs you should know before committing.

• The model catalogue. The higher the requirement, the narrower the choice. Models available as open weights or on qualified offers are not always the best on your task. Measure it on your own cases, not on general rankings.
• Ancillary features. Commercial APIs often bundle tools: search, file reading, code execution, caching. When self-hosting, you rebuild them or do without.
• Operating capacity. Hosting a model means managing compute, updates, monitoring and security. You need a team or a partner to do it over time.
• Pace of change. Each new model version must be evaluated, deployed and tested on your side. You gain stability and lose speed of access to new releases.
• Running cost. Reserved compute is paid for even when nobody uses it. Depending on volumes, this economic model is more or less favourable than pay-per-use.

These trade-offs are costed case by case. Our CADRE framework for managing AI costs helps frame them properly, and the article on what an AI agent costs in production details the items to plan for.

A method to decide without dogma

Most organisations do not need a single answer. They need an answer per data flow. Here is the sequence we follow.

• Map the flows. For each use case, list the data that actually goes through the model, not the data sitting in the database.
• Rank by sensitivity. Public, internal, confidential, sensitive or regulated. The classification often already exists in the company's security policy.
• Reread contracts. Identify hosting, location and qualification clauses imposed by your customers and partners.
• Assign a requirement level per flow. A vendor API with contractual commitments for public and internal, a European operator for confidential, a model hosted on a qualified offer for sensitive, for instance.
• Isolate the levels technically. An abstraction layer between the application and the models routes each request to the right provider, and lets you switch provider without rewriting everything.

This mixed architecture is often the most reasonable: it keeps the sovereignty effort for the flows that justify it and keeps access to the best tools for the rest. It does require design discipline, especially to prevent sensitive data from taking the wrong path by mistake. It is engineering work as much as compliance work, which we carry out with our AI engineer and AI security and compliance profiles.

Sovereignty does not waive other obligations either. A model hosted in France remains subject to the GDPR and, depending on its use, to the EU AI Act, which we summarise in what already applies to your SMB.

Questions to ask a provider that claims sovereignty

To get past slogans, ask these questions in writing and request contractual answers.

• Where are our data stored and processed, including requests, logs and backups?
• Which law governs the company running the service, and its parent company?
• Which model runs, operated by whom, and where? Can requests be sent to a third-party service?
• Can our data be used to train or improve a model?
• Is the offer we use SecNumCloud qualified, under what exact name, and until when?
• How do we get our data back and switch provider?

A serious provider answers each precisely. Vagueness on any of them is information in itself. These questions are part of the approach described on our responsible AI page.

Unsure which level of requirement fits your AI projects? The AI diagnostic maps your data flows, ranks them and decides where sovereignty is needed and where it is not.

Sources

• ANSSI, FAQ on SecNumCloud qualification (in French)
• ANSSI, cloud providers in the process of SecNumCloud qualification (in French)
• CNIL, How to deploy generative AI: first clarifications (in French)
• GDPR, Chapter V: transfers of personal data to third countries (French text)
• Mistral AI, models and licences documentation

Frequently asked questions

Is hosting in France enough to call AI sovereign?

It covers a single layer, data location. The law governing the operator, control of the model and the existence of a qualification remain open questions. Ask the provider to answer each before using the word.

Is an open-weight model necessarily weaker?

Not necessarily, but the gap depends on the task. On some well-defined tasks, a well-chosen open model is more than enough. The only way to know is to test it on a set of real cases from your business.

Do we need a SecNumCloud offer to comply with the GDPR?

No, the GDPR does not require it. It sets its own rules, notably on transfers outside the Union. SecNumCloud serves other goals, such as protection against extra-European laws, and becomes necessary when a contract or your risk analysis calls for it.

Can we start with an American API and migrate later?

Yes, provided the architecture plans for it. An abstraction layer between the application and the models, plus provider-independent prompts and tests, make the switch realistic. Without that precaution, migration often means rewriting part of the system.

Does sovereignty protect against attacks?

It reduces some risks, such as access by a foreign authority or dependence on a provider. It does not protect against prompt injection, leakage by the agent itself or poor permission management. The agent's application security still has to be built, whatever the hosting.