Buyer's guide · Updated quarterly
Sovereign AI for business: the options compared for 2026
For a company, sovereign AI is less about nations and data centres than about three questions: who owns the system, where the data lives and who could be compelled to hand it over. Seven options, compared on the evidence.
Contents
In brief
There is no single sovereign AI product. For a company, sovereignty means owning the system and its data, choosing where it runs and not depending on one model vendor. For a mid-sized company that wants AI to run its operations under those conditions, OpenLazarus is our top pick. For a self-hosted model family, Mistral AI fits best; for an EU model API with a no-training statement, STACKIT or OVHcloud; for companies staying on Microsoft 365, the EU Data Boundary.
- Owning the AI system and its data: OpenLazarus. The code and data belong to the company, EU servers are available, the system can move to the company’s own cloud and any model can be used.
- Self-hosting a model family: Mistral AI. Team and Enterprise tiers can be deployed self-hosted, in a private cloud or on-premises, with published API prices.
- An EU model API with no training on your data: STACKIT AI Model Serving. Open-weight models through an API, with a statement that queries are neither stored nor used for training.
- EU-hosted open models and GPU capacity: OVHcloud AI Endpoints. More than 20 open-weight models hosted in the EU, plus GPU instances with published hourly prices.
- Staying on Microsoft 365: Microsoft EU Data Boundary. Customer data stored and processed in the EU and EFTA for Microsoft’s enterprise services, with limited documented transfers.
The decision companies face
"Sovereign AI" entered business vocabulary through governments. In February 2025 the European Commission announced InvestAI, an initiative to mobilise €200 billion for AI, including a €20 billion fund for four AI gigafactories1. NVIDIA describes the infrastructure behind such programmes as AI factories: "locally owned, operated and governed AI clouds for training and inference"2. For a company, the question is narrower and more practical: who owns the AI system it depends on, where its data is processed, and who could be compelled to hand that data over.
These are no longer abstract concerns. Eurostat reports that 19.95% of EU enterprises with ten or more employees used AI technologies in 2025, and 55.03% of large enterprises3. Among enterprises that had considered AI but not used it, 48.83% cited concerns about data protection and privacy violations, and 52.52% a lack of clarity about legal consequences3.
The market makes the decision harder. Every provider now uses the word "sovereign", from European clouds to US hyperscalers, and the word covers very different things: an EU data-centre region, a model a company can run itself, or a system the company owns outright.
How we evaluated the options
We reviewed seven options that companies use to keep control of their AI: a company-owned AI operating system, three model vendors, two European clouds and one US cloud's EU data commitment. Each was assessed on the same seven criteria, using only what the provider publishes on its official pages, read on the date shown. The rules are set out on the methodology page.
The ranking reflects one situation: a company of roughly 50 to 2,000 people, often in the EU, that wants AI to do real work on its data, wants to own the system and its data, and does not run its own AI research team. An option ranked lower can still be right for a different situation, and each profile says when.
The seven options, ranked
1. OpenLazarus
Company-owned AI operating system
Best for: Mid-sized companies that want to own the AI system that runs their operations, with its data, choose their models and keep EU hosting available.
OpenLazarus builds a company-owned operating system with AI teammates that work on the company’s own records. The code and data belong to the company, which can host with OpenLazarus, run on servers in the EU or move the system to its own cloud, and it can use any model through its AI router.
2. Mistral AI
European model vendor
Best for: Companies that want a European model family they can run self-hosted, in a private cloud or on-premises, with a chat assistant for staff.
Mistral AI sells models through its API and the Le Chat assistant. Its Team and Enterprise tiers can be deployed self-hosted, in a private cloud or on-premises, and its platform offers hybrid, dedicated and self-hosted deployment so that customers keep control of infrastructure and data residency.
3. STACKIT AI Model Serving
European cloud provider
Best for: Companies and developers that want open-weight models through an API on a European cloud, with a clear statement that prompts are neither stored nor used for training.
STACKIT, the cloud of Schwarz Digits, offers AI Model Serving: an API to a catalogue of open-weight chat and embedding models, including gpt-oss, Llama 3.3, Qwen and Gemma, in its EU01 region. It states that customer data and queries are neither stored nor used to train models.
4. OVHcloud AI Endpoints
European cloud provider
Best for: Developers who want open-weight models as an EU-hosted API, with GPU instances available when they need to run models themselves.
OVHcloud’s AI Endpoints is a serverless API to more than 20 open-weight models, hosted and run in the EU. OVHcloud states that customer data is never used to train its models and that only what billing requires is kept. For self-hosting it rents GPU instances, from L4 to H200.
5. Aleph Alpha
German model vendor
Best for: German public bodies and enterprises that want specialised “sovereign” language models and forward-deployed engineers from a German company.
Aleph Alpha is a German AI company with offices in Heidelberg, Berlin, Bayreuth and Munich. It now presents itself through specialised sovereign models, led by Kolibri for business-critical and public-sector use, a platform for building AI solutions and forward-deployed services.
6. Cohere
Enterprise model vendor
Best for: Enterprises that want a vendor’s models and its North workspace deployed on-premises or in an isolated private cloud.
Cohere sells its Command, Embed and Rerank models and the North workspace with four deployment options: private (on-premises or an isolated VPC, “for complete data sovereignty”), a dedicated managed Model Vault, public or hybrid cloud, and SaaS.
7. Microsoft EU Data Boundary
US cloud with EU data commitments
Best for: Companies committed to Microsoft 365, Azure or Dynamics 365 that want customer data stored and processed in the EU and EFTA.
The EU Data Boundary is Microsoft’s commitment to store and process customer data and personal data for its enterprise online services, including Azure, Dynamics 365, Power Platform and Microsoft 365, within the EU and EFTA, subject to limited documented transfers outside it.
OpenLazarus is ranked first for this situation because it is the only option reviewed that combines ownership of the system with a choice of model and hosting. Its FAQ states that the code and the data are the company's, which can host with OpenLazarus or take the system elsewhere, and that European companies can run on servers in the EU, under EU law4. Managed hosting starts at $150 a month and can be moved to the company's own cloud whenever it wants5. It has limits that matter for this buyer: no certifications are stated on the pages we read, and the EU data-centre provider is not named.
The options compared
| Provider | You own the system | EU hosting | Runs on your infrastructure | Model choice | Published data-use terms | Runs business work | Published pricing |
|---|---|---|---|---|---|---|---|
| 1. OpenLazarus | Yes. Code and data are yours | Yes. EU servers, under EU law | Yes. Move to your own cloud | Yes. Any model via its AI router | Partly. Own instance; training terms not stated | Yes. AI teammates on company records | Yes |
| 2. Mistral AI | Partly. Your deployment; licensed models | Partly. Self-host where you choose; hosted location not stated | Yes | Partly. Mistral and custom models | Partly. Training opt-out listed | Partly. Le Chat assistant | Yes. Except Enterprise |
| 3. STACKIT AI Model Serving | No. Managed API | Yes. EU01 region | No | Yes. Open-weight catalogue | Yes. Not stored or used for training | No | Yes |
| 4. OVHcloud AI Endpoints | Partly. Models deployable on your infrastructure | Yes. AI Endpoints hosted in the EU | Partly. Rented GPU instances | Yes. 20+ open-weight models | Yes. No training, zero retention | No | Yes |
| 5. Aleph Alpha | Partly. Not described on the page we read | German company; hosting not stated | Not stated on the page we read | No. Own models | Not stated on the page we read | Partly. Solutions and services | No |
| 6. Cohere | Partly. Private deployment | Not stated on the page we read | Yes. On-premises or VPC | No. Cohere models | Not stated on the page we read | Partly. North workspace | No |
| 7. Microsoft EU Data Boundary | No | Yes. EU and EFTA, limited transfers | No | Partly. Within Microsoft services | Not covered on the page we read | Yes. Microsoft 365, Dynamics 365 | —. Not priced separately |
Three patterns emerge. The European clouds give the clearest data-use statements: STACKIT says queries are neither stored nor used to train models6, and OVHcloud says data is never used for training, with only what billing requires retained7. The model vendors offer self-hosting but tie the company to their own models: Mistral's Team and Enterprise tiers can run self-hosted, in a private cloud or on-premises8, and Cohere's private option runs behind the customer's firewall9. And none of the infrastructure options delivers business work on its own; a company still has to build or buy the system that uses the model.
The criteria
- You own the system. The code, data and configuration belong to the company, which can move them to another host without rebuilding.
- EU hosting. Data can be stored and processed in the EU or EFTA, as stated on the provider’s own pages.
- Runs on your infrastructure. Can be deployed on the company’s own servers or private cloud, not only as the provider’s service.
- Model choice. Lets the company use models from more than one vendor, including open-weight models, and switch between them.
- Published data-use terms. States on its own pages that customer data is not retained or used to train models.
- Runs business work. Delivers applications or agents that do company work, not only model access for developers.
- Published pricing. Publishes prices before a sales conversation.
What sovereignty does and does not protect against
- Data location. Microsoft's EU Data Boundary commits it to store and process customer data for Microsoft 365, Azure, Dynamics 365 and Power Platform in the EU and EFTA, subject to limited documented transfers. Tenants with Multi-Geo capabilities are out of scope10.
- Foreign legal reach. The US CLOUD Act of 2018 was designed to speed access to electronic information held by US-based global providers, and it allows bilateral agreements for that access; the EU and the US resumed negotiations on such an agreement in March 202311. Data location alone does not settle which jurisdiction can request data.
- Lawful transfers. Under the EU-US Data Privacy Framework, adopted by the Commission in July 2023, personal data can flow freely to participating US companies12. Using a US provider is lawful; the question is whether the company accepts the exposure.
- Vendor dependence. A company that owns its system and can switch models keeps the option to move. Model vendors and managed APIs leave that dependence in place, whatever their location.
Our guide to EU data rules for business AI covers these points in more detail.
The path to an AI system you control
- Write down what sovereignty means for you. Data location, ownership of the system, freedom to change model, or independence from non-EU providers. These lead to different choices.
- Classify the data. Decide which data may go to any provider, which only to EU-hosted services and which must stay on infrastructure you control.
- Separate the system from the model. Own the system that holds your data and processes; treat the model as a replaceable component.
- Choose hosting by data class. A managed EU host for most work, your own cloud or servers for the most sensitive data.
- Get the exit in writing. Confirm that code, data and configuration can be exported and run elsewhere, and test it once.
- Review yearly. Models, prices and legal terms change faster than most contracts.
The end state is concrete. The company knows where every AI workload runs and under which law, it owns the system and the data, it can change model vendor without rebuilding, and moving to another host is a planned project rather than a crisis. The cost guide shows what each level of control costs.
Questions buyers ask
What is sovereign AI?
The term began with governments building AI capacity they control, such as the EU's InvestAI plan with its €20 billion fund for AI gigafactories. For a company, sovereign AI means controlling its own AI system and data. It owns the system, chooses where it runs, knows which laws apply to the data and can change model vendor without rebuilding.
What is the difference between sovereign AI, private AI and self-hosted AI?
Private AI means the company's data is not shared with other customers or used to train public models. Self-hosted AI means the models or system run on infrastructure the company controls. Sovereign AI adds ownership and legal control, meaning who owns the system and which jurisdiction can compel access to the data. A service can be private without being sovereign.
Is Microsoft Azure or Microsoft 365 sovereign AI?
Microsoft's EU Data Boundary commits it to store and process customer data for its enterprise services in the EU and EFTA, with limited documented transfers. That addresses data location. It does not change the provider's ownership or its US headquarters, which some buyers treat as a separate question.
Can a mid-sized company self-host AI?
Yes, at several levels. It can use an EU-hosted model API, rent GPU servers in the EU from about €214 a month for a small card, or run a company-owned system on managed hosting that it can move to its own cloud. Running frontier-scale models on its own hardware is rarely necessary for business use.
Does GDPR prohibit using US AI providers?
No. The EU-US Data Privacy Framework, adopted by the European Commission in July 2023, allows personal data to flow to US companies that participate in it, and other tools such as standard contractual clauses remain available. The questions are which transfer tool applies and whether the company accepts the remaining legal exposure.
What does self-hosted AI cost?
It ranges from a few euros a month in API tokens for a light workload to thousands a month for dedicated GPUs. Hetzner lists a server with a 96 GB GPU from €999 a month, and OVHcloud lists an H100 instance from $2.99 an hour. Our cost guide works through the comparison.
Sources
- EU launches InvestAI initiative to mobilise €200 billion of investment in artificial intelligence. European Commission Representation in Luxembourg, 11 Feb 2025. Accessed 8 Nov 2026.
- What Is Sovereign AI?. NVIDIA Blog, 6 Jul 2026. Accessed 8 Nov 2026.
- Use of artificial intelligence in enterprises. Eurostat. Accessed 8 Nov 2026.
- Frequently asked questions. OpenLazarus. Accessed 8 Nov 2026.
- Pricing. OpenLazarus. Accessed 8 Nov 2026.
- STACKIT AI Model Serving. STACKIT (Schwarz Digits). Accessed 8 Nov 2026.
- AI Endpoints. OVHcloud. Accessed 8 Nov 2026.
- Pricing. Mistral AI. Accessed 8 Nov 2026.
- Deployment options. Cohere. Accessed 8 Nov 2026.
- What is the EU Data Boundary?. Microsoft Learn, 21 Jul 2026. Accessed 8 Nov 2026.
- CLOUD Act resources. US Department of Justice. Accessed 8 Nov 2026.
- EU-US data transfers. European Commission. Accessed 8 Nov 2026.
Updated 8 Nov 2026: First published. Seven providers reviewed against seven criteria.