Digital sovereignty for companies that use AI: who controls your AI?

What is digital sovereignty?

Digital sovereignty is the ability of a company or a country to decide for itself how its digital systems run: which law governs them, who can change the terms, and whether it can leave. For a European company, digital sovereignty means that no foreign government and no foreign vendor decides whether its software, cloud and AI keep working.

The European Commission describes the goal as the ability "to retain control over infrastructure, data, assets and technology systems under Union and national jurisdiction", which it calls "an imperative policy objective" in its proposal for a Cloud and AI Development Act of 3 June 2026 (COM(2026) 502, recital 46).

EUrouter's view is plain: in today's climate, the United States is not a dependable partner for European data, or for the systems that run on it. That is about law, not people. US law follows US companies wherever their servers are, US sanctions can forbid a US company to serve you, and a US vendor's terms can change without you having a say. A European company that runs its AI on a US vendor has handed those three decisions to someone else.

The Commission's own figures show how far the dependence goes. According to the same proposal (June 2026), "three non-EU hyperscalers control over 70% of the European cloud market", and the share of EU providers fell from 29% in 2017 to 15% in 2022. The Commission warns that this dependence "exposes European users to the risks related to operational discontinuity, particularly in scenarios where unilateral decisions by third-country actors could disrupt service provision".

EUrouter exists so a European company can use AI without that dependency: one OpenAI-compatible API, run by a Dutch company, that routes only to providers in Europe, 15 of 17 of them headquartered in the EU (providers, 28 October 2026).

How is digital sovereignty different from data sovereignty?

Data sovereignty asks whose law can reach your data. Digital sovereignty asks the wider question: who decides whether your systems keep running, on what terms, and whether you can leave. Data sovereignty is one part of digital sovereignty.

Where data sits, what the CLOUD Act says about it and what EU regulators have said about US providers in the EU are covered on our page on data sovereignty for AI. This page is about the dependency itself.

What does digital sovereignty mean for a company that uses AI?

For a company that uses AI, digital sovereignty means five things are decided under European law and by the company itself: who can reach its prompts, who can switch the service off, who owns the provider, who can change the terms and price, and how fast it can leave. AI raises the stakes, because prompts carry contracts, source code, customer messages and strategy, and because AI quickly becomes part of how a company works every day.

Can US law reach a European company's AI provider?

Yes, when the provider is a US company. The CLOUD Act obliges US providers to disclose data in their "possession, custody, or control", "regardless of whether" it "is located within or outside of the United States" (18 U.S.C. § 2713). An EU region doesn't change that, because the law binds the company, not the server.

The detail, including the US Department of Justice's view on subsidiaries and what Microsoft France told the French Senate under oath, is on our page on data sovereignty for AI. For digital sovereignty the lesson is broader: a provider's legal home decides which government can give it orders, and handing over data is only one kind of order.

The legal ground under transatlantic data flows has also given way twice. The EU Court of Justice struck down Safe Harbor in 2015 (C-362/14) and Privacy Shield in 2020 (C-311/18), both over US authorities' access to Europeans' data. A company whose AI depends on the current framework depends on a decision it can't influence. What the current EU-US Data Privacy Framework means for your GDPR paperwork is on our page on GDPR-compliant AI.

Can a US provider cut off a European company?

Yes, if the US government orders it to. The International Emergency Economic Powers Act (IEEPA) lets the US President "prevent or prohibit" any "transactions involving, any property in which any foreign country or a national thereof has any interest" by anyone "subject to the jurisdiction of the United States" (50 U.S.C. § 1702). Sanctions programmes built on IEEPA forbid US companies to provide services to the people and organisations they name.

This has already reached an institution in the Netherlands. On 6 February 2025 the US President signed Executive Order 14203, imposing sanctions on the International Criminal Court, which sits in The Hague. The order prohibits "the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of" anyone it blocks, and it defines a United States person to include "a foreign branch, subsidiary, or employee" of a US entity (EO 14203, 90 FR 9369). On 13 February 2025, the US Treasury's Office of Foreign Assets Control added the court's chief prosecutor to its sanctions list, with an address in The Hague (OFAC).

Most European companies will never be named in a sanctions order. The point is who holds the switch. When a US company runs your AI, a decision in Washington, made for reasons that have nothing to do with you, can stop the service, and under an order like EO 14203 even the provider's EU subsidiary is bound. Microsoft acknowledged the risk on 30 April 2025, when it committed to contest in court any order "to suspend or cease cloud operations in Europe" and to keep backup copies of its code in Switzerland (Microsoft). A promise to go to court is not the same as a service that no foreign order can reach.

What does lock-in to one AI vendor cost?

Lock-in costs you the ability to say no. When a model is only available through one vendor's API, that vendor decides the price, the terms, which model versions stay online and where it serves, and leaving means rewriting and retesting your product. Switching cost is the price of the sovereignty you haven't secured yet.

EU law already expects many companies to plan their exit from a supplier:

• Financial entities. DORA, which applies since 17 January 2025, requires "exit strategies" for ICT services that support critical or important functions, with exit plans that are "comprehensive, documented" and "sufficiently tested", so the entity can leave without "disruption to their business activities" (Regulation (EU) 2022/2554, Article 28(8)).
• Essential and important entities. NIS2 requires "supply chain security" measures that take into account "the vulnerabilities specific to each direct supplier and service provider" (Directive (EU) 2022/2555, Article 21).
• Every cloud customer. The Data Act says that from 12 January 2027, providers of data processing services "shall not impose any switching charges" (Regulation (EU) 2023/2854, Article 29). That lowers the bill for leaving, but no contract rule can make a model that lives on one vendor's API available anywhere else.

The fix for AI lock-in is technical as much as legal: an API that many providers speak, models whose weights are published, and more than one European company able to serve each model. In EUrouter's catalog on 28 October 2026, 103 of 156 models are served by at least one EU-headquartered provider, and 40 by two or more. gpt-oss-120b, an open-weight model published under the Apache 2.0 licence (model card), runs on 8 EU-headquartered providers (GET /api/v1/models).

Is a US provider's sovereign cloud enough?

Not for digital sovereignty. US providers now sell European "sovereign" offerings run by EU staff, which can help with data residency and day-to-day operations. The European Commission's assessment of them is blunt: those versions "do not address the core sovereignty issues allowing for the extraterritorial reach of third-country laws and the possible degradation or disruption of the service" (COM(2026) 502, recital 48).

The proposed Cloud and AI Development Act would give public bodies one EU framework to rate cloud and AI services against four "Union assurance levels", with the highest levels for the most sensitive work. It is a proposal from 3 June 2026 and still has to be agreed by the European Parliament and the Council. How one US sovereign cloud is structured is described on our page on data sovereignty for AI.

What is sovereign AI?

Sovereign AI is AI that a country or a company can run, govern and replace under its own law, without depending on a foreign government or vendor. For governments, sovereign AI means compute, data centres and models of their own; the Commission's proposal aims to at least triple the EU's data centre capacity by 2030. For a company, sovereign AI is smaller and achievable today: models served by European companies, under European law, through an interface it can move.

Sovereign AI doesn't have to mean only European models. An open-weight model from any lab can be part of a sovereign setup once European companies serve it under European law, because its published weights stay usable under their licence. European models are a real option too: Mistral alone has 23 models in EUrouter's catalog (28 October 2026). These European models are available today, with live prices:

The European way: AI no foreign government can switch off

The European way to digital sovereignty for AI is to keep every company in the chain European and every interface open: a European router, European providers, models you can run on more than one of them, and an API your code doesn't have to be rewritten to leave. EUrouter makes that the default, on every plan.

• A European company under European law. EUrouter B.V. is based in Amsterdam, and its terms and DPA are governed by Dutch law.
• Processing in the EEA only. The EUrouter DPA (section 5) commits EUrouter to process personal data "exclusively within the European Economic Area", and the router runs on Scaleway in Amsterdam (DPA).
• European providers, enforced per request. 15 of the 17 providers in the EUrouter catalog are headquartered in the EU (28 October 2026, providers). The other two, AWS Bedrock and Microsoft Foundry, are US companies serving from EU regions. Setting eu_owned: true in a request, or in a routing rule set as your API keys' default, excludes them (routing rules).
• No single point of failure. When one provider fails, EUrouter automatically retries the same model on another provider, and the models list names a second model in case the first can't answer.
• Easy to leave, including us. EUrouter is OpenAI-compatible: switching to it is the base URL and the key, and so is switching away.
• No prompts kept. By default, EUrouter doesn't store prompts or outputs after they are processed (privacy policy).

This request tries a European model first, falls back to an open-weight model, and only uses EU-headquartered providers:

from openai import OpenAI

client = OpenAI(
    base_url="https://api.eurouter.ai/api/v1",
    api_key="YOUR_EUROUTER_API_KEY",
)

response = client.chat.completions.create(
    model="mistral-small-3.2-24b",
    messages=[{"role": "user", "content": "Summarise our supplier exit plan in three bullet points."}],
    extra_body={
        "models": ["mistral-small-3.2-24b", "gpt-oss-120b"],
        "provider": {"eu_owned": True},
    },
)

print(response.choices[0].message.content)

The models list and the provider settings are described in the routing docs, and every model's providers are listed on models.

What should a company check for digital sovereignty in AI?

Start with an AI dependency register: one row per AI service, and these seven checks for each. EUrouter's answer follows each item.

1. Name the company and its parent. Write down who runs each AI service and who owns that company. EUrouter: EUrouter B.V., Amsterdam, with its providers listed in the DPA.
2. Name the law it answers to. Note which government can give the provider orders. EUrouter: Dutch law, and eu_owned: true keeps every provider EU-headquartered.
3. Ask who can cut it off. Check whether a foreign sanctions order or the vendor's own terms could stop the service. EUrouter: with eu_owned: true, no US company is in the request path.
4. Find out where the model exists. A model on one vendor's API is a lock-in; a model on several providers is a choice. EUrouter: each model's providers are listed on models.
5. Write and test an exit plan. DORA requires one from financial entities; every company that relies on AI benefits from one. EUrouter: provider fallbacks, the models list, and an OpenAI-compatible API.
6. Read the contract. Check the DPA, the governing law and how you hear about new sub-processors. EUrouter: Dutch law, and the DPA says customers are informed of sub-processor changes by email.
7. Check where data is processed, fallbacks included. EUrouter: EEA only, on every plan, as described on our page on data sovereignty for AI.

Start with AI you control

Digital sovereignty is easiest to build before a dependency sets in. EUrouter gives your developers one OpenAI-compatible API and gives your legal team a European company, European providers and a Dutch-law DPA. It is EU-hosted on every plan, Free included, with no special endpoint to remember.

Start free, read the routing docs, or contact us for a DPA review.