European AI and sovereign AI: where does your data live, and what do you need to arrange?

The short answer. Sovereign AI tangles up three questions: where your data is stored, where the model processes it and which jurisdiction your provider falls under. Storing data in Europe with a US provider settles the first two, not the third. That is no reason to avoid US models, but it is a reason to choose per use case: business-grade models with processing in the EU where possible, a European provider or your own open-weight model where the data is genuinely sensitive, and a layer of your own that decides which data goes to which model. The GDPR does not prohibit transfers outside Europe, but it sets conditions for them. The EU AI Act sets no requirements on where your data is kept.

This piece is written for organisations with 20 to 250 employees and is based on the providers' and regulators' own documentation.

What sovereign AI and European AI mean in practice

European AI sounds like a single property, but it is four. Sovereign AI means making a deliberate choice on each of them.

• Data residency: where your conversations, documents and outputs are stored.
• Processing location: where the language model (LLM) actually computes its answer. That can be a different country from where the data is stored.
• Jurisdiction: which law the provider is subject to, regardless of where its servers are.
• Control over the model: do you use a model through a provider's service, or an open-weight model you can run yourself?

Jurisdiction brings in the US CLOUD Act. That 2018 law requires US providers of communication and cloud services to preserve or disclose data in their possession, custody or control when lawfully required to, regardless of whether that data is located inside or outside the United States. The GDPR, in Article 48, says an order from a court or authority outside the EU is only recognised if it is based on an international agreement, such as a mutual legal assistance treaty. The two rules pull in different directions. As a customer, you establish whether that is a relevant risk for your data: the assessment for work instructions differs from the one for health data.

The four realistic options

1. US models with storage and processing in the EU

The large US providers offer European options, but not on every plan and not for every component.

• OpenAI (ChatGPT): new ChatGPT Enterprise and Edu customers can have conversations and files stored in Europe (EEA and Switzerland), and eligible customers can also have model inference run there. Authentication, routing and extracting text from uploaded files can still happen outside the region, and data sent to external services through integrations or web search falls outside it. More on the plans in ChatGPT for business: Business or Enterprise.
• OpenAI (API): data sent through the API has not been used to train models since 1 March 2023, unless you opt in. Storage and processing in Europe are available to eligible customers, with additional arrangements on monitoring and retention.
• Microsoft: within the EU Data Boundary, Microsoft stores and processes customer data for services including Microsoft 365 and Azure in the EU and EFTA countries, with limited, documented exceptions. With Copilot, traffic from EU users stays within that boundary, except for the Anthropic models Microsoft offers as a subprocessor; those are currently excluded. If you build on models in Microsoft Foundry, an EU Data Zone keeps processing within that boundary, while a global deployment can run in any Azure region. See also Microsoft Copilot or an AIOS layer.
• Anthropic (Claude): on Anthropic's own API you choose between global processing and processing in the US, and storage is in the US. That API offers no European region. Through Amazon Bedrock or Google Cloud, the endpoint you choose determines the region.

The upside: models your people already know, on familiar business terms. The downside: the jurisdiction question remains, and the European options often sit in the more expensive plans or need an extra agreement.

2. A European model provider

A well-known example is Mistral AI, a French company with its registered office in Paris. Mistral hosts data in the European Union by default, unless you deliberately use its US API endpoint. Depending on the feature, data can be transferred temporarily to subprocessors outside the EU, with standard contractual clauses as the safeguard.

Do check training, though. On the Enterprise version of Mistral's chat assistant, training on your data is off by default. For the API, you set the opt-out yourself in the admin panel, separately from the chat assistant's setting. European does not mean everything is configured correctly by default. Your data and your provider fall under European law; quality is something you test per task, as with any model.

3. Open-weight models, self-hosted or with a European host

With an open-weight model, the maker publishes the model weights, so you can run it on your own servers or with a host of your choice. Mistral offers open-weight models alongside its commercial ones, some under the Apache 2.0 licence. This is what people mean by on-premise AI or a private GPT: your own chat environment where no data goes to an external model provider.

You get the most control, and the most work: compute, updates, security and keeping an eye on quality. It often fits best for a single, well-defined use case with highly sensitive data.

4. Hybrid: sensitive data stays in your own layer

The fourth option combines the other three. Your documents, permissions and logs stay in your own environment, and per task you decide which model may see what. With RAG, your own layer first retrieves the relevant passages and sends only those to the model. A public document can go to the strongest model you have; a personnel file stays with a model in the EU or your own.

That needs your systems connected (system integration), your data in order with an owner and permissions per source (data foundation) and a knowledge base that follows your existing permissions (AI knowledge management). Together that is what we call an AIOS: a layer on your own data that can work alongside ChatGPT, Copilot or another model. Your choice of model is then separate from where your knowledge and integrations live.

The options side by side

• US model with EU storage: data in the EU for what the provider covers, US jurisdiction, familiar models, little to manage.
• European provider: data in the EU by default, European jurisdiction, test quality per task, little to manage.
• Open-weight, self-hosted: data wherever you put it, no external model provider, the most to manage.
• Hybrid with your own layer: sensitive data in your own environment, a suitable model per task, set-up needed up front.

Costs are driven by different things on each route. On the first two you pay per user or per use, and European storage or processing is sometimes only available on the top plans or costs extra. When self-hosting, you pay for compute that is there even when nobody uses it, plus the management. In a hybrid set-up, most of the cost is in connecting and setting up.

What the GDPR and the AI Act require, and what they do not

The GDPR

• Data processing agreement. If an AI provider processes personal data on your behalf, it is your processor and you put a data processing agreement in place (Article 28 GDPR). You remain responsible, including for what you outsource.
• Transfers outside the EEA. Transferring personal data to a country outside the European Economic Area is only allowed if that country offers adequate protection or with a transfer tool, such as standard contractual clauses. For the US there is the Data Privacy Framework: if the US organisation participates and the specific product is covered, the transfer is allowed without another transfer tool. If it does not participate, you use standard contractual clauses, with additional measures such as encryption and pseudonymisation where needed, following the EDPB's recommendations.
• DPIA. If processing is likely to result in a high privacy risk, you carry out a data protection impact assessment beforehand. The Dutch Data Protection Authority's rule of thumb: two or more of nine criteria. New technology is one of them; sensitive data and data about vulnerable people, such as employees or patients, are others.

What the GDPR does not require: that all your data is kept in Europe, or that you only use European providers. It requires a valid basis for any transfer. The GDPR also covers personal data only; confidentiality of other business data is something you arrange in your contract with the provider. More in business data and AI: getting privacy and the GDPR right.

The AI Act

The AI Act governs what you do with AI, not where your data is kept. For most organisations that deploy AI, this is what applies:

• AI literacy (Article 4). Has applied since 2 February 2025. Since 27 July 2026 a lighter text has applied through the Digital Omnibus on AI (Regulation (EU) 2026/1744): you take measures to support the AI literacy of your people, but you do not have to guarantee a particular level.
• Transparency. Since 2 August 2026, it must be clear when customers are talking to your AI or seeing realistic AI-generated images.
• High risk. The heavy requirements for high-risk AI, such as AI in recruitment or credit assessment, apply from 2 December 2027, and for AI in products from 2 August 2028.

What the AI Act does not require: a European model, European servers or a model of your own. A short AI policy setting out the approved tools and the data that must never go in is, however, the place to record your choices. It also helps against shadow AI: people using personal accounts because there is no official route. See also our page on AI governance.

This article is not legal advice; for a specific use case involving sensitive data, have a lawyer review it.

How Innoworks approaches it

We do not start with a provider, but with what is already running. In an AI audit we map which AI tools are in use at your organisation, officially and unofficially, and what risk comes with them. From there you decide per use case which route fits.

When we build, we work with business AI models that do not use your data for training, choose processing within the EU wherever possible and record that in a data processing agreement. Access follows the permissions you already have: anyone who may not open a document will not get an answer from it through AI either.

Frequently asked questions

Can I use ChatGPT or Copilot within the GDPR?

Yes, provided you arrange it properly: a business plan, a data processing agreement, a valid basis for any transfer to the US and agreements on which data may go in. On ChatGPT Business, OpenAI does not train on your workspace data. With Copilot, prompts, responses and data accessed through Microsoft Graph are not used to train the underlying models.

What is a private GPT, and is on-premise AI safer?

A private GPT is your own chat environment, often running an open-weight model on your own servers. Your data then does not go to an external model provider. It is only safer if you manage servers, updates and access at least as well as a large provider does.

Do I need a DPIA for an AI use case?

Not always, but you do if the processing is likely to carry a high privacy risk. AI can count as new technology, one of the nine criteria. If a second criterion applies, such as sensitive data or employee data, a DPIA is needed under the Dutch Data Protection Authority's rule of thumb.

Where do you start?

With an overview of which AI is already in use, and with which data. That is also where an AI audit starts.