Sovereign AI in Europe: What It Means for Enterprises, the EU Programmes Behind It and How to Run Sovereign AI Agents

Sovereign AI in Europe means running AI on terms that European law and European operators control: the data, model weights, runtime and the people with access stay under EU jurisdiction, and no foreign authority or supplier can compel access or switch the service off. For an enterprise it is a property of a specific deployment, not a vendor label. The EU is funding supply through AI Factories, an AI gigafactories tender that closes on 12 November 2026 and the proposed Cloud and AI Development Act, but each buyer still has to evidence sovereignty system by system.

This is the European companion to our definition of sovereign AI and the comparison of sovereign and private AI. It covers what changed in EU policy, the cloud market and the law up to November 2026, and then what sovereignty demands of AI agents, which act on systems rather than only reading data.

Four kinds of sovereignty

Buyers often ask for “sovereign AI” when they mean one of four narrower things. Naming which one a requirement is about makes vendor answers comparable.

Residency is the weakest of the four and the easiest to buy. The procurement wording that separates “stored here” from “controlled here” is covered in data sovereignty versus data residency for AI procurement, and sector exposure in our review of 2026 data sovereignty risks.

What the EU is building: programmes and their status in November 2026

Most of the EU’s AI sovereignty work targets supply: more compute, more usable data and more European providers. Several items are still announcements or proposals, so the status column matters more than the headline figures.

Governments are pushing in the same direction. At the Summit on European Digital Sovereignty in Berlin on 18 November 2025, France and Germany asked the Commission to define the highest protection standards for the most sensitive data, including safeguards against the effects of non-EU extraterritorial legislation, and set up a joint taskforce to define a European digital service and sovereignty indicators for cloud, AI and cybersecurity. German Chancellor Friedrich Merz said companies had pledged more than €12 billion of investment in key technologies.

For an enterprise these programmes matter in three practical ways: more EU-based compute that can host inference and fine-tuning, public procurement that increasingly prefers European suppliers, and a scoring framework that may become the reference against which sovereignty claims are tested.

Hyperscaler sovereign offers: what they add and what remains

All three US hyperscalers now sell sovereign variants in Europe, and their designs differ in who operates the service and what happens if it is cut off from the parent.

• AWS European Sovereign Cloud. Generally available since 15 January 2026, with its first region in Brandenburg. AWS describes it as physically and logically separate from other AWS Regions, operated exclusively by EU residents, governed through a new parent company and three German subsidiaries, and able to keep operating if communication with the rest of the world is cut. It launched with more than 90 services, and sovereign Local Zones are planned for Belgium, the Netherlands and Portugal.
• Microsoft. Microsoft completed its EU Data Boundary in February 2025. Its progress report of 29 April 2026 says its Digital Resilience Commitment, including a pledge to contest in court any government order to suspend or cease cloud operations in Europe, is now legally binding in contracts with European national governments and the Commission. It also describes Data Guardian, under which remote engineer access to systems holding European customer data is approved and monitored by staff residing in Europe and logged in a tamper-evident ledger, and sovereign private cloud options that run AI models with limited or no connectivity.
• Google Cloud. Google offers a Data Boundary in its public cloud, Google Cloud Dedicated run by independent local partners, and Google Distributed Cloud, whose air-gapped version Google says cannot be remotely accessed or shut down by Google. In France, S3NS, a Thales subsidiary, announced on 17 December 2025 that ANSSI had granted its PREMI3NS offer SecNumCloud 3.2 qualification, which S3NS says covers immunity from non-European extraterritorial laws. In May 2026 Thales and Google Cloud announced a Thales-owned German entity to run a similar region near Berlin, in preview, with general availability targeted for the end of 2026.

What these offers do not change: where the ultimate parent is a US company, the group remains within reach of US law, and the commitments above are enforced through contracts and courts rather than made technically impossible. The further operation moves towards an EU-controlled partner or your own premises, the smaller that residual exposure becomes. The workload-by-workload trade-off is set out in sovereign cloud compared with on-premises AI.

National capacity is growing beside them. Deutsche Telekom opened its Industrial AI Cloud in Munich on 4 February 2026 with nearly 10,000 NVIDIA Blackwell GPUs, and public administrations have their own requirements, covered in on-premises AI for public sector sovereignty. European compute still runs largely on accelerators designed in the US, a technological dependency that no contract removes.

The legal drivers

The DORA list shows how the EU now handles dependence on large providers: through oversight, concentration-risk rules and exit strategies, not by excluding non-EU firms. For financial entities, the guide to DORA and AI covers what that means for AI systems, and the AI Act duties for autonomous systems are covered in how the EU AI Act applies to AI agents.

European open-weight models and their licences

Holding the weights is the technological core of sovereign AI: a model you possess cannot be withdrawn, repriced or silently changed. Europe now has several capable open-weight families, but “open” covers several different licences.

Licences were read on each model’s Hugging Face page on 6 November 2026. Open weights settle where a model runs and who can change it. They do not settle what data it was trained on, how it behaves on your documents or whether its licence fits your business, so evaluate each candidate on your own tasks. Sizing and serving for Mistral’s family are covered in running Mistral models on your own hardware, language coverage in private retrieval across European languages, and in-country model serving on the sovereign LLM page.

What sovereign AI agents require

Agents raise the bar because they act. A chatbot that answers from documents mostly raises data questions; an agent that files, approves or changes records also raises questions of control and continuity. Five requirements cover most of the ground:

1. Models you control. Weights held in your environment and pinned to a version, with any external model endpoint treated as an explicit, approved exception.
2. An in-jurisdiction runtime. Agent execution, retrieval indexes, tool calls and secrets all stay inside the boundary, including the MCP servers and HTTP tools the agents call. A web search or SaaS tool can quietly send data out.
3. No foreign-controlled control plane. The platform should start, run and update without reaching a supplier’s licence server, telemetry endpoint or orchestration service, with updates delivered as artefacts you inspect before installing.
4. Audit evidence held in jurisdiction. Traces, approvals and decision records stored where you can produce them for a supervisor, under retention rules you set.
5. EU-based operations and support. Your staff or an EU partner run the system, and any vendor support session is approved by you, time-limited and logged.

Add the controls every governed agent needs anyway: identity from your own directory, least-privilege tool permissions, human approval for consequential actions and a quick way to stop an agent. Retrieval follows the same rules, as described on the sovereign RAG page, and the control set is described under sovereign AI governance.

Decision table: which level of sovereignty fits which workload

Most organisations use more than one row. A common pattern keeps agents that act on regulated data on-premises or in an EU-controlled environment and allows public cloud regions for non-sensitive work. The deployment options themselves are compared in the guide to AI agent deployment models.

Choosing a sovereign AI agent platform in Europe

Buyers often ask which sovereign AI agent platforms are available in Europe. Lists go out of date quickly and vendors describe themselves generously, so score candidates against criteria and ask for evidence on each:

• Deployment. On-premises, private or sovereign cloud and air-gapped, all supported by the vendor with the same features.
• Independence. Runs with no outbound connection; licensing that does not depend on a vendor server; telemetry that can be switched off.
• Models. A choice of model per agent, including the European open-weight models above, served locally.
• Evidence. Per-agent execution records, approvals and decision records stored in your environment and exportable.
• Access. Sign-in through your directory, role-based tool permissions, and support access that you approve and that is logged.
• Jurisdiction. The vendor’s legal entity and parent, and where its support staff work.
• Exit. Export of agent definitions, workflows and logs in usable formats. For hosted components, the Data Act’s ban on switching charges from January 2027 helps.
• Scoring. The Commission’s Cloud Sovereignty Framework criteria as a baseline, extended for agents.

The architecture behind these criteria is laid out on our sovereign AI agent platform page.

How VDF AI fits

VDF AI can run in your own data centre, a private cloud or VPC, a sovereign cloud or a fully air-gapped network, as well as in VDF’s managed VDF AI Cloud. In the self-managed modes, agents, Networks, models and execution records sit in the environment you choose. VDF AI Router applies allow, deny and pin lists before any model call, returns the reason and candidate list for each routing decision, and in air-gap mode routes to local models only. In VDF AI Agents, each agent can use a different model, including Mistral or other open-weight models served through Ollama or a compatible endpoint, with tools granted per role from an MCP-powered registry.

The governance layer registers every agent, Network and model with an owner, purpose, risk class and version, keeps a per-agent audit log and execution trace, and stores a cryptographically durable record of each execution in the Vault. Decision receipts bind prompt, sources, model, tools and outcome together, a kill switch stops an agent, a Network or a model, and evidence packs for the EU AI Act or a sector audit come from those records. Controls are mapped to the EU AI Act, DORA, NIS2, GDPR and ISO 42001, which means the platform supports those obligations rather than discharging them. On-premises sign-in uses Microsoft Entra ID natively, with Entra security groups mapped to roles, while Okta, Keycloak, generic SAML or OIDC and LDAP connect through an SSO-aware reverse proxy.

Two sovereignty questions remain yours whichever platform you pick: the provenance of the models you choose and the supply chain of the hardware they run on.