Data sovereignty for AI: why an EU region isn't enough

What is data sovereignty?

Data sovereignty is the principle that data is subject to the laws of every jurisdiction that has power over it: the country where it is stored, and the country whose law binds the company that holds it. For a European company, data sovereignty means that only European law, applied by European courts, decides who can access its data.

Most definitions stop at the first half: data is governed by the laws of the country where it sits. That half is true, and it is why so many providers now sell an "EU region". The second half is the one that matters for AI. A company is bound by the law of the country it is incorporated or controlled in, wherever its servers are, so data stored in Frankfurt by a US company is within reach of US law (18 U.S.C. § 2713).

That is why EUrouter treats data sovereignty as a question about companies, not only about servers. Your AI traffic is sovereign when every company that sees your prompts and outputs is European and every place they are processed is in Europe. The sections below show what that means in law, and how EUrouter makes it the default for AI.

What is digital sovereignty?

Digital sovereignty is the wider idea: according to the European Parliament's research service, it "refers to Europe's ability to act independently in the digital world" (EPRS, July 2020). Data sovereignty is one part of it, next to control over the software, the infrastructure and, for AI, the models.

The European Commission now measures it. Its Cloud Sovereignty Framework, first presented in October 2025 for the Commission's own cloud tender, scores providers on eight objectives. Two of them describe the problem this page is about:

• Legal and jurisdictional sovereignty looks at the "degree of exposure to non-EU laws with cross-border reach (e.g., US CLOUD Act, Chinese Cybersecurity Law)" and at any channel "through which non-EU authorities could compel access to data or systems".
• Data and AI sovereignty asks for "strict confinement of storage and processing to European jurisdictions, with no fallback to third countries", and for AI models and data pipelines that are "developed, trained, hosted, and governed under EU control".

The framework ranks services from SEAL-0, "governed entirely by non-EU jurisdictions", to SEAL-4, "subject only to EU jurisdiction, with no critical non-EU dependencies". In other words, the Commission does not count location alone as sovereignty.

Data sovereignty vs data residency vs data localisation

Data residency is where data is stored and processed. Data sovereignty is whose law can reach it. Data localisation is a legal rule that data must stay in a given country. An AI provider can give you residency without sovereignty, and no localisation rule changes which law binds a provider.

Does the EU require data localisation?

Mostly not, and that is deliberate. The GDPR says the free movement of personal data within the Union "shall be neither restricted nor prohibited" for data protection reasons (Article 1(3) of the GDPR). For non-personal data, Regulation (EU) 2018/1807 bans member-state rules that confine data to one country, unless public security justifies them, as the EUR-Lex summary explains.

So in Europe, keeping AI data in Europe is usually a company's own choice, made through the providers it picks. Data localisation laws are a bigger factor for companies that also operate outside the EU.

Does the EU Data Act keep data in Europe?

The Data Act, which applies from 12 September 2025, doesn't require data to stay in Europe. Its Article 32 obliges cloud and other data processing providers to take technical, legal and organisational measures against third-country government access to non-personal data held in the EU where that access would conflict with EU or national law. Germany's Federal Network Agency sums it up: access is legitimate where a mutual legal assistance treaty allows it, and providers must generally tell customers about a third-country request (Bundesnetzagentur). Personal data stays under the GDPR.

The Data Act also makes it easier to switch cloud providers: from 12 January 2027, providers may no longer charge for the switching process (Article 29). That helps sovereignty in practice, because a service you can leave is a service that can't hold your data hostage.

Does an EU region of a US cloud give you data sovereignty?

No. An EU region of a US cloud gives you data residency: the servers are in Europe. The provider is still a US company, and US law, including the CLOUD Act, follows the company rather than the server. EU regulators have said so in writing, and a US provider has said so under oath.

An EU region still has value: it can help with the GDPR and with latency. It just doesn't answer the sovereignty question. The facts below are the reasons why.

What does the US CLOUD Act say?

The CLOUD Act, enacted on 23 March 2018, obliges a US provider of communication or computing services to disclose data in its "possession, custody, or control" under US legal process, "regardless of whether" the data "is located within or outside of the United States" (18 U.S.C. § 2713). A cloud region in Frankfurt or Paris is outside the United States, so it is covered.

The US Department of Justice's own CLOUD Act FAQ (April 2019) adds two points. US jurisdiction "is not limited to U.S. corporations, U.S. headquartered companies, or companies owned by U.S. persons": a foreign company with enough US contacts can be reached too. And whether a US company controls data held by its foreign subsidiary "is a fact-dependent inquiry", so an EU subsidiary of a US group is not automatically out of reach.

Can a US provider refuse a CLOUD Act order?

Only in narrow cases. A provider can ask a US court to quash an order when the customer is not a US person and doesn't live in the US, and when disclosure would risk breaking the laws of a "qualifying foreign government", which means a country with a CLOUD Act executive agreement with the US (18 U.S.C. § 2703(h)). Outside those cases, a valid order has to be followed.

Microsoft France said as much under oath. At a French Senate inquiry on 10 June 2025, its director of public and legal affairs was asked whether he could guarantee that French citizens' data entrusted to Microsoft through UGAP, the French public purchasing agency, would never be handed over following a US government order without the explicit agreement of the French authorities. His answer: "Non, je ne peux pas le garantir" ("No, I cannot guarantee it"), adding that it had never happened yet. Microsoft said it contractually commits to resisting unfounded requests, and on a well-founded US order its director said: "Lorsque nous sommes obligés de les donner, nous les donnons" ("When we are obliged to hand it over, we hand it over"), according to the Sénat record.

What do EU regulators say about US providers in the EU?

The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) concluded in a joint assessment of the CLOUD Act on 10 July 2019 that, unless a CLOUD Act warrant is recognised under an international agreement, "the lawfulness of such processing cannot be ascertained". Article 48 of the GDPR recognises a foreign court order only when it rests on an international agreement such as a mutual legal assistance treaty, without prejudice to the other transfer grounds in Chapter V. A US provider in the EU can be caught between a US order and the GDPR, and its customers inherit that conflict.

After 22 supervisory authorities investigated cloud use by public bodies, the EDPB reported on 17 January 2023 that "the sole use of a CSP that is part of a multinational group subject to third country laws may result in the concerned third country laws also applying to data stored in the EEA" (EDPB cloud enforcement report). The same report quotes a real cloud contract clause: the provider "will not transfer Customer Data from Customer's selected Region(s) except as necessary to provide the Services initiated by Customer, or as necessary to comply with the law or binding order of a governmental body." That is data residency with an exit for foreign orders.

The EDPB's Guidelines 05/2021, adopted on 14 February 2023, draw the consequence for your contracts. Under Article 28(1) GDPR you may only use processors that give sufficient guarantees, and a processor's reliability "may be in doubt if the processor is subject to third country legislation which may prevent it from fulfilling its obligations as a processor". The same guidelines treat remote access from outside the EEA, for example for support, as a transfer (Example 11).

Doesn't the EU-US Data Privacy Framework solve this?

No. The Data Privacy Framework, adopted on 10 July 2023, is a GDPR transfer tool: it lets personal data flow to certified US companies. It doesn't change which law binds a US provider. Its two predecessors were struck down by the Court of Justice, Safe Harbor in 2015 (C-362/14) and Privacy Shield in 2020 (C-311/18), both over US authorities' access to Europeans' data. The framework survived a first challenge in the General Court on 3 September 2025 (T-553/23), and the appeal (C-703/25 P) was pending when this page was reviewed.

What the framework means for your GDPR paperwork is on our page on GDPR-compliant AI.

What about "sovereign cloud" offerings from US providers?

US providers now sell clouds run by EU staff. AWS made its European Sovereign Cloud generally available on 15 January 2026, with a first region in Brandenburg, run by "a new parent company and three local subsidiaries incorporated in Germany" and "operated exclusively by EU residents", according to Amazon's announcement. That is a real step up from a standard region for teams that need AWS services. It is still AWS's cloud: AWS set up that structure and makes the binding customer commitments for it (AWS FAQ), and the US Department of Justice calls a parent's control over a subsidiary's data a fact-dependent question. For AI traffic, you can avoid the question entirely by using providers that are European companies.

What does data sovereignty mean for AI APIs?

For an AI API, data sovereignty means every company that sees your prompts and outputs is subject only to European law, and every place they are processed is in Europe, including fallbacks. An AI request passes through more hands than a file in storage, and prompts often carry a company's most sensitive data: contracts, source code, customer messages, strategy.

Three things make AI different from storage:

• Encryption doesn't cover inference. Customer-held keys protect stored data, but a model can only answer a prompt it can read, so the prompt and the answer exist in readable form inside the provider's systems. The provider's jurisdiction matters more for AI than for storage.
• Fallbacks can leave quietly. A gateway that fails over to "any provider" can move a request to a US company or out of the EU when one provider is down. The Commission's framework asks for "no fallback to third countries" for that reason.
• Models are a dependency too. A closed model you can only reach through one US vendor's API ties you to that vendor's terms, which can change without you. European models, and open-weight models served by several European companies, let you switch without leaving Europe.

Gateways count as a layer. How this plays out for one well-known router with an EU endpoint is on our page about the European alternative to OpenRouter.

The European way: an EU company, EU providers, EU processing

The European way to data sovereignty for AI is to keep every layer European: a European company as your processor, AI providers headquartered in the EU, and processing in the EEA. Then the CLOUD Act question doesn't arise for your AI traffic, and your DPO reviews one contract under European law. EUrouter is built for that: one OpenAI-compatible API, EU-hosted on every plan, and European companies only with one setting.

A European company, with its router in Amsterdam

EUrouter B.V. is a Dutch company in Amsterdam, and its terms and DPA are governed by Dutch law. The router runs on Scaleway, a French provider, in Amsterdam. Section 5 of the EUrouter DPA commits EUrouter to processing personal data only within the EEA, with no transfer outside it unless you authorise it in writing.

Section 4 of the EUrouter DPA covers requests from authorities: EUrouter discloses personal data only on your written instruction or an order from a judicial or administrative authority, tells you within 5 business days where the law allows, and gives you a reasonable opportunity to respond before it discloses, unless the law requires otherwise.

Residency by default, sovereignty with one setting

Every EUrouter request goes only to providers configured with EU-hosted endpoints, by default, on every plan from Free upwards (routing docs, pricing). That is data residency for all your AI traffic, with no special endpoint to remember.

For sovereignty at the provider layer, EUrouter is explicit about who is who. On 27 October 2026, 15 of the 17 providers in the EUrouter catalog were headquartered in the EU, among them Mistral AI, Scaleway, OVHcloud, IONOS, Nebul and Berget AI (providers). The other two, AWS Bedrock and Microsoft Foundry, are US companies that serve models such as Claude and GPT from EU configurations: residency, not sovereignty. Set eu_owned: true on a request, or once for your whole account as a routing rule, and EUrouter routes only to EEA-headquartered providers. Fallbacks are picked from the same filtered list, so a provider outage never sends a request to a US company. data_residency pins a country, such as de or fr.

On the same date, 101 of the 154 models in the catalog ran on at least one EU-headquartered provider. OpenAI's open-weight gpt-oss-120b, for example, ran on eight of them.

European models on European providers

Models from European labs, Mistral AI, Aleph Alpha and the Swiss AI Initiative, served by European companies, with live prices:

Every model, with its providers and prices, is in the EUrouter model catalog.

No prompts kept, no training

EUrouter applies a zero-retention policy to the content of API requests and responses by default and keeps only metadata such as timestamps, model identifiers and token counts for billing (EUrouter DPA, section 10). EUrouter doesn't use API data to train models and doesn't sell it. On 27 October 2026 all 17 providers were listed with no prompt retention and no training on your data. zdr: true and data_collection: "deny" turn both into hard rules per request.

One contract, two lines of code

With EUrouter you sign one DPA under Dutch law, and the AI providers are sub-processors under it, each listed with the country where it processes data. Your developers change two lines in an OpenAI SDK client: the base URL becomes https://api.eurouter.info/api/v1 and the key becomes an EUrouter key (quickstart). Teams in sectors with stricter rules can see how this works for law firms or for a GDPR-compliant RAG chatbot.

What to check for data sovereignty in your AI stack

1. Name every company in the chain. List the router or gateway, each model provider and the cloud under it, with each one's headquarters and parent company. EUrouter: the sub-processor list in the DPA names each provider with its country, and providers shows headquarters.
2. Ask which law each one answers to. A US parent brings the CLOUD Act, whatever the region. EUrouter: EUrouter B.V. is Dutch, its terms and DPA are governed by Dutch law, and eu_owned: true keeps US-headquartered providers out.
3. Check where inference runs, including fallbacks. EUrouter: EU-hosted endpoints only, on every plan; fallbacks come from the same filtered list; data_residency pins a country.
4. Find out what is kept after the request. Retention, abuse-monitoring logs and training all count. EUrouter: no request or response content kept by default (DPA section 10); zdr: true and data_collection: "deny" enforce it.
5. Read the clause on authority requests. Look for notice, a chance to object, and a reference to Article 48 GDPR, and watch for clauses that let data leave your region "to comply with the law or binding order of a governmental body". EUrouter: DPA section 4 gives notice within 5 business days where the law allows and a reasonable opportunity to respond.
6. Check support and remote access. Remote access from outside the EEA is a transfer under EDPB Guidelines 05/2021. EUrouter: customer API data is processed only in the EEA (DPA section 5).
7. Plan your exit. Prefer open standards and models you can get from more than one European provider. EUrouter: OpenAI-compatible, so switching is the base URL and the key, and many models run on several EU providers.
8. Write it down. Record the decision in your DPIA or transfer assessment. The GDPR steps are on our page on GDPR-compliant AI, and more explainers are in Learn.

Start with sovereign AI in Europe

Create a free account, point your OpenAI SDK at https://api.eurouter.info/api/v1, set eu_owned: true, and your next request runs on European companies in Europe, on the Free plan too. Create a free account, compare plans, read the routing docs, or talk to us about your DPA review.