AI sovereignty: what it actually means

Why the word has become useless

”Sovereign” has been applied to so many opposing products, by so many actors who disagree, that it hardly means anything anymore. An AI platform that calls itself “sovereign” can equally: host its servers in France, host its servers with a French actor that hosts in Ireland, run French models, run American models behind a French facade.

Here are seven criteria, in the order we evaluate them with our sensitive clients (accounting firms, local governments, mid-market companies with industrial secrets). None stands alone. The seven together draw a real sovereignty level.

1 · Physical hosting

The question: where are the disks my data sits on? Not the owning company, not the country of headquarters — the town where the machines are.

A genuinely sovereign AI platform should give you the datacenter addresses on request. If the answer is vague or multi-country “depending on availability,” it isn’t sovereign.

2 · The host’s jurisdiction

The US Cloud Act applies to companies under US jurisdiction, regardless of where their servers are. If your host is a French subsidiary of a US group, your data can be requisitioned by US justice.

The only serious safeguard today: a host with majority European ownership, or a SecNumCloud qualification (which requires legal watertightness verified by ANSSI).

3 · Origin of the models

A generative AI model is trained in a country, on a dataset, by a company. All of this leaves traces: biases, implicit editorial choices, language proficiency, cultural blind spots.

”Model sovereignty” doesn’t mean “French model at all costs.” It means: you know which model runs, you can switch it out, and your data is never used to train this model or any other.

4 · Outbound flows

When your assistant answers, where do the requests go? Many “French” platforms quietly call a foreign API for generation.

Ask for the list of outbound flows per request, with geographic destination. If they refuse, that’s an answer.

5 · Audit logs

Sovereign means auditable. You must be able, at any moment, to produce: who asked which question, to which assistant, on which sources, with which model, from which IP.

If the platform can’t tell you, it can’t tell a judge either. Bad news in both cases.

6 · Reversibility

You’re leaving the platform tomorrow. What do you get back, in what format, in how long?

The healthy rule: export in open formats (PDF, Markdown, JSON), retrieval within 7 days, definitive deletion within 30 days, certificate to back it up. If any of the four is missing, sovereignty is a marketing promise.

7 · Contract law

In case of dispute, who decides? A platform whose T&Cs designate a Dublin court for a French public-sector client has a sovereignty problem.

A clean contract specifies French law + French court for private actors, and the competent administrative court for public bodies.