European sovereign AI: what it means in practice
Sovereign AI is four separate questions: the building, the operator, the weights and the values. What Europe can answer today, and what you can do this quarter.
Sovereign AI is not one property. It is four questions stacked on top of each other: where the hardware sits, which state can compel the company operating it, who trained the model, and whose assumptions the model carries. Europe can answer the first well, the second with caveats, and the third and fourth only partly. Anyone selling you all four in one word is selling you an ambition.
That is worth saying plainly before any product enters the conversation, including ours. The useful version of this debate is not "European or American". It is: which layer of the stack does this particular workload actually need, and what does it cost to move that layer?
What sovereign AI actually means
The word arrived from the compute debate, where it had a precise meaning: a state should be able to run critical systems without another state's permission. Applied to AI, it stretched to cover everything from datacentre postcodes to the political leanings of a chatbot, and lost most of its usefulness on the way.
Break it back into parts and each one becomes checkable.
Sovereignty is not a badge on a landing page. It is four questions with four different answers, and the honest providers tell you which ones they answer.
The building is geography: which country the hardware sits in. The operator is jurisdiction: which legal system binds the company running that hardware. The weights are provenance: who trained the model, on what data, under which licence. The values are behaviour: what the model says, refuses, and quietly gets wrong about your part of the world.
Who can supply each layer in Europe today
| Layer | The question | Europe today |
|---|---|---|
| The building | Where does the hardware sit? | Solved. European capacity is real and bookable |
| The operator | Which state can compel the operator? | Available for inference, harder for hosting, databases and payments |
| The weights | Who trained the model? | Thin and improving, with a compute gap being built out now |
| The values | What will the model say and refuse? | Partly, and mostly through documentation rather than training |
The layers get harder as you go up, and the price of each goes up with it. Renting European compute is a procurement decision. Training a competitive frontier model in Europe is a multi-year industrial project, which is exactly what the current wave of EU funding is for.
Where does the hardware physically sit?
- What Europe can supply today
- Solved. European datacentre capacity is real, bookable and growing.
- What Union AI does
- All AI inference runs on infrastructure inside the European Union.
One green dot out of four. Any provider claiming all four today is describing an ambition, not a stack you can buy.
Are there European LLMs worth using?
Yes, and the honest picture is a young field rather than a finished one. It splits into two kinds of effort.
The first is commercial. European labs ship open-weight models you can download and run yourself, and their smaller models are genuinely competitive for everyday work. This is the part of the European stack that already works in production today.
The second is public. OpenEuroLLM is a consortium of European universities, HPC centres and companies, funded through the Digital Europe Programme, building open foundation models that cover the EU's official languages and publish their data, code and evaluation alongside the weights. That last part matters more than the model scores: a model whose training data and evaluations are public is a model you can audit, and almost nothing at the frontier is auditable today.
Underneath both sits compute. The Commission's AI gigafactories programme is mobilising €20 billion through the InvestAI facility for large-scale training capacity in Europe, and the informal call for interest drew 77 proposals across 16 member states and 60 sites, with construction of the first site expected from 2027. Whether that closes the capability gap is an open question. It does mean the answer in 2029 will not be the answer today, which is a reason to keep your stack portable rather than to wait.
Can a model be trained on European values?
Partly, and the phrase deserves more scrutiny than it usually gets. "Trained on European values" is doing three separate jobs, and only two of them are checkable.
Language is a value, and it is measurable
A model that handles Dutch, Finnish, Greek and Portuguese as well as it handles English is a different product for European users than one that treats them as afterthoughts. Language coverage is testable in an afternoon: run your own prompts, in your own languages, and compare. This is the single most useful test in the whole sovereignty debate, and almost nobody runs it before buying.
Refusal behaviour reveals the training
Some open-weight models are trained under legal systems with their own sensitivities, and they duck factual questions about politics or history that a European user would consider entirely ordinary. We treat that as a defect rather than a safety feature. When our system detects that kind of refusal in the first sentence of a response, it cancels the answer and runs the question again on a model without that blind spot, at most once per request, and tells you it happened in the X-EU-Routed header. What we do not do is route around genuine safety refusals: those stay refused, because routing until a model complies is an automated jailbreak.
Everything else is documentation, not training
The rest of what people mean by values, that a model is fair, balanced and appropriate, is not something you can verify from a marketing page. What you can verify is whether the provider publishes the model, the licence, the system prompt and the measured refusal rate. We publish all four on our AI transparency page, including the parts that make us look worse.
Does data safety require a European model?
No, and conflating the two costs teams real money. Where a model was trained and where your prompt is processed are independent facts.
Weights are a file. Download an open-weight model, run it on European hardware, and your prompt goes to that hardware and comes back, whoever trained it. What travels with the weights is behaviour, not data flow. That is why our stack can be honest about running mostly non-European models while still processing every request inside the European Union, and why the request path matters more for data protection than the model's origin story.
The four data-safety questions worth asking any provider, European or not: where is inference processed, how long are prompts retained, are they used for training, and which parties in the chain have a parent company outside the EU. Ours are answered on the subprocessors page, including the awkward ones.
What you can actually do this quarter
Sovereignty as a purchasing decision fails, because nothing on the market clears all four layers. Sovereignty as a sequence of small moves works. In rough order of payoff:
- Classify the workloads before the vendors. Most teams have one slice of genuinely sensitive traffic and a large majority that is ordinary. Knowing the ratio changes which trade-offs are worth paying for.
- Move the sensitive slice first. Customer contracts, HR files, patient notes, unreleased code. Leave the summarising of public web pages where it is.
- Ask for the subprocessor list and the training clause in writing. Not a sales call. A list with regions and legal entities, plus a search for the word "train" in the terms.
- Keep the interface boring. An OpenAI-compatible API is worth more than any sovereignty claim, because it makes moving cheap. Portability is the only form of leverage that survives a vendor changing its mind. Ours is documented in the API reference, and what a switch actually involves is in switching in three lines.
- Log per-request evidence. A header that names the tier, the token counts and the cost turns a claim into an audit trail.
- Re-run the test in six months. The European model landscape is moving faster than any procurement cycle. Assumptions from last year are stale.
None of that requires a rebuild, and all of it survives whichever way the market goes.
Where we fit, and where we do not
Union AI is a European service running open-weight models, with all AI inference on infrastructure inside the European Union, prepaid in euros and priced per token. We cover the bottom layer completely, most of the operator layer, and we are open about the two above it.
Our models are open weight under Apache 2.0 and MIT, and most of them were not trained in Europe. The only European-trained model in our stack today is the Mistral model we fall back to on the cheapest tier when the primary one fails. We would rather write that sentence than let the word sovereign do the work for us.
How that stacks up against the other three ways of buying AI in Europe, including the rows where we lose, is in European AI providers compared.
So the pitch is narrow on purpose. If you want your prompts processed in Europe, under a European provider, on models whose behaviour is documented and whose bill is predictable, that exists today and you can start on it this week. If you want a European frontier model trained on European data, that is being built, with public money and a published timeline, and neither we nor anyone else can sell it to you yet.
Frequently asked questions
What is sovereign AI?
Sovereign AI is the idea that a country or union can run AI systems it controls, on its own terms. In practice it splits into four questions: where the hardware sits, which state can compel the operator, who trained the model, and whose values the model reflects. Most vendors answer one of the four and use the word for all of them.
Do I need a European LLM to comply with the EU AI Act?
No. The AI Act regulates how AI systems are built, documented and presented to people, not where the model was trained. A US or Chinese open-weight model can be used compliantly, and a European model can be used non-compliantly. Compliance is about your obligations as a provider or deployer, not the passport of the weights.
Are open-weight models the same as open source?
No, and the difference matters. Open weight means you can download and run the model yourself, usually under a licence like Apache 2.0 or MIT. Open source in the fuller sense would also mean published training data and reproducible training code, which most open-weight releases do not provide.
Can I use a Chinese open-weight model and still keep data in Europe?
Yes. Weights are a file. Once you download a model and run it on European infrastructure, your prompts go to that hardware and nowhere else, whoever trained the model. What travels with the weights is not your data but the model's behaviour, including any topics it was trained to avoid.
Does running a model in Europe make my data safe?
It removes one class of risk and leaves others. It means your prompts are processed under European infrastructure rather than sent abroad, but it says nothing about retention, training on your inputs, access controls, or whether the operator has a parent company outside the EU. Ask about all four separately.
What does it mean for a model to be trained on European values?
In practice it means three checkable things: that it handles European languages well, that it answers factual questions about politics and history rather than avoiding them, and that its training data and refusal behaviour are documented. It is not a slogan you can verify, so treat it as a set of tests you run rather than a label you trust.
Which EU projects are training European language models?
OpenEuroLLM is the most visible: a consortium of European universities, HPC centres and companies, funded through the Digital Europe Programme, building open models that cover the EU's official languages and publish their data and evaluation alongside the weights. Underneath it, the Commission's AI gigafactories programme is mobilising 20 billion euros through the InvestAI facility for the training capacity those models need.