No exit plan, no data sovereignty — even with EU hosting

EU hosting proves location, not control. Follow the legal, operational and technical chain—and learn how to…

The short version

Data sovereignty requires enforceable control over access, legal authority, technical operations, continuity, and supplier exit.
European providers hold about 13% of Europe’s cloud market, while 86% of organisations have significant foreign supply-chain exposure.
Vendor contracts and compliance checkers cannot replace a timed migration that verifies restoration, permissions, portability, and recovery.

The Frankfurt region button has become tech’s most expensive comfort blanket. Click it, sign the DPA, whisper GDPR three times, and everyone goes home convinced the data is safely European.

Meanwhile, a foreign parent controls the service. Its administrators can reach production. Your app depends on a proprietary database that takes a small geological era to migrate. The bytes stayed in Germany; your freedom vanished inside the architecture diagram.

I define data sovereignty as enforceable control over access, legal authority, technical operation, and the ability to keep running or leave. Location matters. Control makes it meaningful.

Consider Concierge, a fictional AI support product. A customer prompt includes a name, account history and internal refund policy. The team sends it to an EU endpoint and gets a location receipt. They must still inspect the model provider, cloud operator, encryption keys, retention settings and exit path. Yes, procurement is now less fun than assembling IKEA furniture after two negronis.

Data sovereignty starts with control

Concierge has independent control points, any of which can fail while the dashboard stays cheerfully green. Data control determines who can read prompts, outputs, logs and backups. Legal control follows the companies possessing or operating those records, including parent entities exposed to foreign demands. Operational control belongs to whoever administers infrastructure, deploys updates and suspends accounts. Technical control becomes obvious when the team tries to replace a model endpoint or restore service elsewhere. A German server can satisfy residency while an overseas company keeps the decisions that matter. Asking only where data sits reduces a complex risk assessment to one suspiciously comforting dropdown.

Bar chart comparing current figures against their baselines: dual-3090 DFlash2 greedy decode… 474 tok/s versus 432 tok/s, single-stream prose decode on the… 85 tok/s versus 98 tok/s, single-user speculative decode at long… 32 tok/s versus 68 tok/s, steady-state aggregate decode throughput… 1100 tok/s versus 46 tok/s.

I once thought sovereignty debates slid too easily into digital autarky: build every chip, cloud and model in Europe, preferably before lunch. I was wrong about the useful part. Europe needs control over critical layers because the market has concentrated around suppliers European customers cannot replace overnight.

Open Future’s 2026 policy brief estimates European providers hold about 13% of Europe’s cloud market, while three US hyperscalers control most of it. That share explains the service gap buyers complain about. European companies fed the hyperscaler flywheel for years, then acted offended when local alternatives lacked the same catalogue.

Complete independence remains a terrible operating model. Capgemini’s September 2026 survey of global executives found 59% considered full digital sovereignty unrealistic and favoured managed dependence around critical operations. Karine Brunet, writing in Capgemini Research Institute’s September publication, described the constraint:

Today’s organisations operate in highly interconnected technology ecosystems where complete independence is rarely achievable.

That is the strongest case against maximalist European sovereignty, and I accept half of it. Modern products will keep using international suppliers. Sovereignty puts boundaries around those dependencies: classify dangerous workloads, identify who controls them, and maintain an alternative before a crisis turns architecture review into forensic archaeology.

Visibility is grim. Capgemini’s Digital Sovereignty Index found 86% of organisations had significant exposure to foreign or externally controlled supply chains, while only 14% reported end-to-end visibility into their broader technology ecosystem. Those mirror-image figures from the same research reveal the job ahead. Organisations cannot manage dependencies they have never mapped.

France is turning cloud qualification into a gate

For sensitive French public-sector data, sovereignty has moved from marketing into procurement. French law and its implementing decree require certified cloud services for relevant data belonging to the state and its operators, making qualification an eligibility gate. SAP’s French sovereign-cloud offer puts its software on Bleu, with services hosted and operated in France to meet French security requirements. Hybrid estates still need placement decisions, so Atos says its CloudPlatform Orchestrator can centrally manage workloads across STACKIT and other platforms. Teams assign workloads by protection requirements instead of rebuilding everything around one provider. OVHcloud adds open APIs and open-source standards designed for interoperability and data reversibility. The mechanism runs from legal classification through qualified infrastructure and controlled placement to a plausible exit.

Done badly, this is bureaucracy. Done well, it forces buyers to inspect operational authority before signing because the logo looked reassuringly tricolore.

OVHcloud now has three SecNumCloud-qualified offerings, up from two before SNC Cloud Platform qualified in September 2026. Qualification is meaningful evidence because ANSSI assessed the service against defined requirements. It cannot prove customers will survive every outage, recover quickly, or resist every coercive-access scenario. Nobody has enough production evidence to claim that.

Localisation deserves the same caution. The French Institute of International Relations argues that keeping data in Europe cannot establish sovereignty when a provider remains exposed to extraterritorial laws such as the CLOUD Act or FISA. A covered US provider may receive a lawful demand for information under its possession, custody or control even if the server stays in Europe. American officials do not teleport into a Frankfurt data centre; the law compels the company controlling the data. Conflicting European obligations can trap the provider between legal systems.

Customer-held encryption keys reduce the useful plaintext a provider can disclose. They do little against account suspension, managed-service withdrawal, hostile software changes or prolonged outages. I love a beautiful encryption diagram as much as the next founder avoiding his backlog, but confidentiality does not keep Concierge online.

Thierry Breton captured the political mood at the DSIN de l’année event in Paris on March 12, 2026:

La confiance s’est effondrée.

Trust will return through verifiable control. Europe needs common assurance levels, stronger EU institutions and procurement rules large enough to create a continental market. Twenty-seven sovereignty strategies would be a very European way to lose while producing excellent PDFs.

Hand lifts a hardware-security smart card from an open key safe in a French cryptographic facility.

Mistral AI vs Claude is an architecture question

A Mistral AI vs Claude comparison matters only after tracing the full deployment. I want Mistral to win because Europe needs AI champions with continental scale, serious infrastructure and customers beyond their home countries. But a French model accessed through a foreign-controlled reseller, wrapped in opaque logging and welded to proprietary services, still creates ugly dependencies. Claude has a different profile because Anthropic is US-controlled, though it may perform better for a given workload. The supplied research contains no current model-quality benchmark, pricing comparison or contractual terms for a fair leaderboard. I refuse to manufacture one from vibes and two screenshots on X.

The prompt’s journey reveals more than the model’s passport. The contracting entity creates the immediate legal relationship and identifies subprocessors. Concierge sends content to a processing location where automated systems or operators may generate logs. Another company may provide the cloud and GPUs beneath the API, adding operational exposure. Retention settings determine what survives inference; key ownership determines who can read stored material. Application code determines whether the team can switch endpoints or has scattered provider-specific features throughout the product. Model origin matters within this chain, but cannot answer the whole sovereignty question.

The Mistral AI API makes an application sovereign only if the purchased service provides the required jurisdiction, access restrictions and portability for that workload. Before production, I want the legal entity in writing, plus processing locations, subprocessors and retention rules. I want to know who holds the keys, which infrastructure provider sits underneath, and how much code migration requires. Check current terms when signing because “European company” is not a deletion policy.

A Mistral AI valuation headline tells me investors expect growth. It says almost nothing about Concierge’s production risk. Valuation cannot establish where API logs go, whether a subprocessor can inspect them, or how fast an application can leave.

That does not weaken Mistral’s case. It strengthens the case for a European AI stack that earns preference through evidence, not flag-waving. Europe’s champions should compete on capability while providing legal clarity, European operational control and migration paths nobody notices until they need one.

An uneventful exit is a feature.

An EU AI Act compliance checker cannot test your exit

An EU AI Act compliance checker can classify Concierge’s role, use case and documentation duties. It cannot prove data sovereignty. The AI Act evaluates risks and obligations attached to an AI system; sovereignty also covers the underlying infrastructure and supplier relationship. A green result does not establish who can access prompts, whether service survives a provider dispute, or whether embeddings can be restored with another supplier. The EU Data Act matters for cloud switching, while sovereignty frameworks can assess operational control, but each answers a different question. Their combined outputs still leave one essential test: attempt the migration.

Every Concierge component gets a dependency record naming its owner, controlling jurisdiction, handled data and key holder. It also records operator access, recovery expectations, proprietary features and replacement provider. Contracts show vendor promises; architecture diagrams and subprocessor lists show how the service is built. Audit reports add external evidence. A timed recovery proves whether any of it works.

On Friday afternoon, the team exports prompts, embeddings, configuration and access policies. It points Concierge at a second endpoint, starts a timer, and records every lost feature and required engineering task. If the replacement cannot restore an index or reproduce permissions, that failure enters the risk register. Procurement may call it “minor transformation effort,” corporate Italian for we have ruined the weekend.

Nobody knows how quickly regulated organisations can move specific production workloads from proprietary cloud services. We also lack solid evidence that SecNumCloud qualification or future EU assurance levels reduce real interruption and recovery risk. The frequency of foreign legal demands affecting European-region customer data remains unclear, as does sovereign-cloud providers’ ability to match hyperscalers across every managed service and AI workload. Honest policy admits those gaps.

My bet: before 2030, Europe’s strongest cloud and AI companies will make departure measurable, and EU procurement will reward them across the single market. Federal scale matters. France can build a gate, Germany can build capacity, and European institutions can turn both into a market large enough to produce global champions.

Ask every vendor: “If your service, government or parent company tells me no tomorrow, how does my product keep working?”

If the answer starts with a region name, keep your hand on the exit door.

Frequently asked questions

What does data sovereignty mean beyond storing data in the EU?

Data sovereignty is enforceable control over who can access data, which laws and companies govern it, who operates the infrastructure, and whether a service can keep running or migrate. Hosting data in the EU establishes location, but foreign legal authority, administrator access, proprietary services, and weak exit paths can still undermine control.

Can an EU AI Act compliance checker verify data sovereignty?

An EU AI Act compliance checker can classify an organisation’s role, use case, risk category, and documentation duties. It cannot establish who can access prompts, whether a provider dispute could interrupt service, or whether data, embeddings, permissions, and configuration can be restored with another supplier. A timed migration is still required.

Does using the Mistral AI API make an application sovereign?

The Mistral AI API supports a sovereign deployment only when the purchased service meets the workload’s requirements for jurisdiction, access controls, retention, key ownership, infrastructure, and portability. A European model or company name alone does not establish where logs go, which subprocessors can inspect data, or how easily an application can switch providers.