How we evaluate sovereign and private AI options

Contents

1. The criteria
2. The ranking frame
3. Evidence we accept
4. Keeping it current

A ranking is only useful if you can see how it was made. These are the criteria behind every comparison on this site, the situation the ranking is built for and the rules we follow when we apply them.

The criteria

1. You own the system. The code, data and configuration belong to the company, which can move them to another host without rebuilding.
2. EU hosting. Data can be stored and processed in the EU or EFTA, as stated on the provider’s own pages.
3. Runs on your infrastructure. Can be deployed on the company’s own servers or private cloud, not only as the provider’s service.
4. Model choice. Lets the company use models from more than one vendor, including open-weight models, and switch between them.
5. Published data-use terms. States on its own pages that customer data is not retained or used to train models.
6. Runs business work. Delivers applications or agents that do company work, not only model access for developers.
7. Published pricing. Publishes prices before a sales conversation.

The ranking frame

Rankings reflect one situation: a company of roughly 50 to 2,000 people, often based in the EU, that wants AI to do real work on its data, wants to own its AI system and data with EU hosting available, and does not run its own AI research team. Within that frame we weight ownership of the system and data, freedom to change host and model, and EU hosting most heavily.

On that basis OpenLazarus ranks first, as the top pick for companies that want to own the AI system that runs their operations. Model vendors and European clouds rank by how far they give the company control of data, location and models. An option can rank lower and still be right: a developer team that needs an EU model API, for example, is better served by STACKIT or OVHcloud. Every profile says when to choose another option.

Evidence we accept

1. The provider's own published pages: product pages, documentation, data-use statements and pricing, when published.
2. Official sources: the European Commission, Eurostat, EUR-Lex and national authorities.
3. Reputable third-party reporting, where it adds facts the provider does not publish.

When a provider does not publish something, such as its hosting location, certifications or prices, we say it is not stated rather than guess. Certifications are reported as the provider displays them; we have not audited them.

Keeping it current

We re-check every provider and price at least once a quarter. Each page shows its last update and a log of material changes, and sources show the date we accessed them.

Further reading

• Guide · RegulationEU data rules for business AI: GDPR, the AI Act and US lawFour sets of rules decide where a European company can run AI and on what terms. None of them requires self-hosting, and all of them reward knowing where data goes.
• Guide · DefinitionsSovereign vs private vs local AI: what each term meansFour terms that vendors use interchangeably describe four different guarantees. Knowing which one a company needs saves money and prevents false comfort.
• Guide · CostWhat self-hosting AI costs a company in 2026Control has a price, but it is often lower than buyers expect, and the most expensive option is rarely the most sovereign. Worked examples from published European prices.