AI costs & infrastructure
3 min read
I see “sovereign AI” popping up in a lot of conversations I have with execs right now. Yet, when asked what they mean by that, I get a different answer every time. So let me define it, because the word is doing a lot of work and most of it is wrong.
Three questions, not a product
Sovereign AI is not a product you buy. It’s the answer to three questions:
Where does your data sit
Where does the AI model actually run
Whose laws can reach it
And no, choosing the “EU region” of a US cloud provider does not make you sovereign. If that provider is a US company, US law can still reach the data, even when the servers are in Frankfurt. Where the data sits is one question. Who controls it is another. A lot of companies only check the first one.
That second question is the one that catches people out in a procurement review. The data residency box is easy to tick, and it is often the only thing anyone looks at.
The three places you can land
In practice there are three places you can land.
A public AI service like OpenAI or Anthropic. This is typically the easiest option, providing the best models at the lowest cost. But your data passes through a US company, and US law can reach it. For anything sensitive, this doesn’t clear the bar.
A pay-as-you-go service run inside the EU. So that means a European company, European data centres, European law, and a contract that says your prompts aren’t read or kept. You share infrastructure with other customers, but the data stays in-jurisdiction and no foreign law reaches it. For most companies, this is already sovereign. It satisfies GDPR, the EU AI Act, and most enterprise security reviews.
A dedicated setup: same European jurisdiction, but the hardware is reserved for you alone.
Where the confusion sits
Here’s where I see execs get confused. They mix up two and three. The pay-as-you-go EU service is already sovereign. The dedicated setup doesn’t add sovereignty on top. It adds isolation. And isolation is the part you pay extra for.
Isolation is worth buying for its own reasons. It gives you predictable performance and a cleaner answer when an auditor asks who else runs on that hardware. Those are real, and they are a separate conversation from jurisdiction.
Do you have a sovereign requirement at all?
So the question any exec needs to ask is simple. Does my setup actually have a sovereign requirement at all? Is this a sensitive workload or not? And if it is, what premium am I willing to pay for dedicated infrastructure?
Please beware, the gap isn’t small. Pay-as-you-go might cost a mid-market company tens of euros a month. A dedicated setup runs around €1,000 a month, fixed. Both are sovereign.
It also helps to ask which workloads carry the requirement, instead of applying it to everything. Most companies have a small set of genuinely sensitive processes and a long tail that could run anywhere. Treating the whole estate as sensitive is how the bill gets large without anyone being able to say why.
In some cases that premium is worth paying. Think of healthcare, legal, certain regulated sectors. When the requirement is real, the €1,000 isn’t necessarily an overspend. It might well be it’s the price of meeting an obligation you can point to.
Paying €1,000 a month for an obligation you don’t have is just waste.
So before you buy anything: figure out which requirement you’re actually under, and match the spend to that. Curious how others are drawing that line.
KEEP READING