AI-assisted PathPatron illustration, developed under human art direction.
This is the companion to From sovereignty strategy to a real AI setup. That briefing shows how a 25-person advisory firm can build a bounded research assistant: it searches only the client material a consultant may see, prepares a cited briefing and hands it to a human reviewer.
This article answers the next question: where should that service operate, and what can the firm honestly promise a client about it?
A national operating boundary can be a valid strategic promise. A German firm may choose to keep its most confidential client work operated in Germany even where the law would permit a broader route. It may do so because of risk appetite, resilience, procurement preference or a clear commercial message: your material is processed, administered and recoverable here. The same logic can apply in France, elsewhere in Europe or the UK.
The mistake is not choosing a country. The mistake is treating a country label as proof that the boundary exists. “Hosted in Germany” does not answer who holds administrator access, where backups go, whether support can inspect material or who restores the service after a failure.
Why we name providers — and why the names come with a date
While we were drafting this article, one of our own examples changed underneath us. We had cited Aleph Alpha as the German model provider for a national route. On 24 April 2026, Canadian AI company Cohere announced it would acquire Aleph Alpha, creating a transatlantic company in which Cohere’s shareholders hold roughly 90%.
That is the whole lesson of this article in one event. A provider’s nationality is a snapshot. Ownership changes, offerings get renamed, qualifications get granted and withdrawn. So this article separates two layers. The routes, tests and decision plan below are deliberately name-free — they will still be correct in three years. The market snapshots are dated September 2026 and exist for one purpose: each named provider illustrates a question you should be able to ask any vendor. When the names change, the questions won’t.
Start with one real job, not a country label
The advisory firm has one bounded use case: a consultant selects a permitted client folder, asks for a meeting brief or contract comparison and receives a cited draft. A human checks and sends the result. The firm must decide:
- Which client material may enter the assistant?
- Where are the model, document search, access rules and backups operated?
- Who can administer, support, update and recover the service?
- Which external route, if any, is permitted for lower-risk work?
Those answers form the operating boundary. Country choice comes next. The four routes below are not a market ranking; they are practical designs a leader can explore.
Route 1: Germany — make a national operating promise
When this route fits: A German client wants confidential work handled under a German operating boundary, or the firm wants that boundary as a voluntary strategic commitment.
What the firm builds: Start with one local or firm-controlled German deployment. The approved model, client library, permission-aware search, administrator accounts and encrypted backup all remain under the firm’s German operation. Consultants sign in through normal identity controls; the assistant can draft from permitted material but cannot send messages or change business systems. A named business owner decides which work enters. A named technical operator handles access reviews, updates and recovery.
What the firm can say: “For this defined confidential workflow, the service is operated in Germany. We control access decisions, backups and change approval.” That is clearer than claiming every component is German or that a local server removes all supply-chain risk.
Prove it first: try to retrieve a client folder through an unauthorised account; remove a departing user and confirm access disappears; restore the service from backup and record who performed each step.
Market snapshot — September 2026. German or German-anchored cloud capacity exists: STACKIT, operated by Schwarz Digits (the technology arm of the Schwarz Group), positions itself as a German alternative to the US hyperscalers, and BSI C5 gives you a vocabulary for questioning any cloud component’s controls — though it never certifies your retrieval rules or AI workflow. The model layer is where the verification lesson lives: Aleph Alpha, long presented as Germany’s sovereign model company, agreed in April 2026 to be acquired by Canada’s Cohere, and had already shifted from building its own frontier models to operating a deployment platform (PhariaAI) for public agencies and regulated industries. Neither fact makes it unusable — the deal is backed by both governments and runs on STACKIT — but it means the honest procurement question is no longer “is this provider German?” It is: “Which legal entity signs my contract, who owns it today, and what happens to my terms if that changes?” BSI C5 · STACKIT · Cohere–Aleph Alpha deal analysis (Futurum)
Route 2: France — use a qualified-cloud component without pretending the whole system is qualified
When this route fits: A French client or procurement context needs a stronger French assurance route, but the firm cannot or should not run every component on a small local machine.
What the firm builds: Keep the most sensitive client library, permission model and control logic in the firm’s defined boundary. Create a separate, classified route for material that may use an external French or European compute service—for example, a de-identified research task or an approved document set. The assistant returns a draft to the same human reviewer; the external component does not receive unrestricted access to the client library.
What the firm can say: “This named workload uses a specified service under a defined French assurance arrangement; sensitive client material remains on our controlled route.” It cannot say “our AI is SecNumCloud” merely because one cloud component has a qualification.
Prove it first: attempt to route a sensitive folder externally; it should be refused. Identify the precise legal entity and service covered by the qualification, then map every component outside that scope: model, search index, identity, prompts, logs, interfaces and approvals.
Market snapshot — September 2026. France is the clearest illustration that a qualification covers an offering, at a date, in a scope — never a company in general. OUTSCALE (a Dassault Systèmes subsidiary) was the first public cloud to hold SecNumCloud 3.2, granted in December 2023 for a specific region; that precision, not the logo, is what makes the claim usable. And the qualified list moves: on 1 September 2026, ANSSI qualified OVHcloud’s public-cloud offering and Numspot’s IaaS, and roughly a dozen further applications are in progress. On the model side, Mistral illustrates a different boundary: testing a French model for an approved task is a component decision — it decides nothing about which documents may be searched, who approves an answer or who recovers the service. The question these examples teach: “Show me the exact qualified offering, its scope and its date — and list every component of my workflow that sits outside it.” ANSSI: SecNumCloud · OUTSCALE certifications · OVHcloud SecNumCloud announcement · Mistral
Route 3: Europe — use a controlled regional hybrid when national operation is not the promise
When this route fits: The firm needs more capacity, resilience or language coverage than one national pilot can provide, but wants a European operating and supplier route rather than unrestricted global AI use.
What the firm builds: Define two lanes. Lane one remains the confidential route: the local or firm-controlled client library, permissions, evaluation set and human review. Lane two is a European regional route for explicitly approved lower-risk material, peak work or a tested model capability. The classification rule—not a user’s memory—decides which lane a request may use.
What the firm can say: “Our confidential client route remains controlled; a separate European route handles only material we have explicitly classified for it.” This is different from “everything stays in one country,” but it may be a stronger operating choice than an undocumented external service.
Prove it first: try to send a confidential folder through the regional lane; it must be blocked. Compare a small approved test set across models without changing permissions or review rules. Prove the firm can move to another model or provider without rebuilding its document interface and evaluation evidence.
Market snapshot — September 2026. The European model landscape is moving fast enough that “wait and see” and “test now” are both wrong; the right posture is a portable evaluation set you can re-run as options mature. GPT-NL, the Dutch national model, completed pre-training and has been in feasibility pilots with public-sector organisations since February 2026, with broader commercial roll-out planned for the second half of the year — it has moved from “watch” to “testable.” OpenEuroLLM, a consortium of around twenty European research institutions, companies and EuroHPC centres building openly licensed models for all EU official languages, is the initiative to track for the model layer over the next two years. On infrastructure, evroc launched its European sovereign cloud platform in July 2026 — young enough that your Week 3 recovery-and-support tests matter more here than anywhere else, which is precisely why we name it. The question this route teaches: “If this provider or model disappeared in twelve months, what would I have to rebuild — and what would survive?” GPT-NL · GPT-NL pilot status (Computer Weekly) · OpenEuroLLM · evroc
Route 4: United Kingdom — make a deliberate UK choice, not an accidental EU claim
When this route fits: A UK firm or client wants its confidential research service operated under a UK boundary and is prepared to make the associated jurisdictional and transfer decisions explicitly.
What the firm builds: The same bounded assistant operates with UK-held access decisions, administration, backups and recovery. The firm applies the NCSC Cloud Security Principles to its own service as well as any supplier: identity, administrative access, data, separation, governance, secure operations and incident management. A separate EU route, if needed, is assessed as a separate design—not assumed from a UK contract.
What the firm can say: “This workload is operated under a UK boundary, with named people responsible for access, recovery and external dependencies.” It should not market that as an EU-operating promise or assume every onward provider shares the same boundary.
Prove it first: list every entity and location able to store, process, support, monitor or restore material. Test an incident: who can suspend access, recover the service and notify the client? Review whether an EU client need requires a different route rather than a contractual explanation after the fact.
Market snapshot — September 2026. The UK shows that a national flag on a website tells you little about a provider’s economics. Civo, a UK cloud provider, announced a UK-sovereign full-stack AI partnership with data-centre operator Era4 in June 2026 — a plausible fit for a firm that needs GPU-backed capacity under UK law. Nscale is also UK-headquartered and markets sovereign-grade infrastructure, but its business in 2026 is dominated by hyperscale contracts: an agreement with Microsoft for roughly 200,000 NVIDIA GPUs across Europe and the US, alongside a Stargate UK initiative with OpenAI whose Norwegian sibling project OpenAI subsequently stepped back from, with Microsoft taking the capacity. Neither fact disqualifies either company; the point is that “UK provider” and “UK-anchored dependency chain” are different claims. The question this route teaches: “Who are this provider’s largest customers and investors — and would my workload matter to them in a crisis?” NCSC Cloud Security Principles · Civo–Era4 announcement · Nscale–Microsoft contract · OpenAI’s Stargate Norway step-back (CNBC)
How to choose the route
| If the firm wants to promise… | Start with… | Prove before promising it… |
|---|---|---|
| “Our defined confidential service is operated in Germany.” | Route 1: local or firm-controlled German operation | Permission enforcement, leaver removal and a tested restore |
| “We use a qualified French component for this classified workload.” | Route 2: controlled split between sensitive and approved material | The exact qualification scope and the external-route block |
| “We keep sensitive work controlled, with a separate European route for approved work.” | Route 3: two explicit lanes and a classification rule | Sensitive material cannot cross lanes; the model can be replaced cleanly |
| “This service is operated under a UK boundary.” | Route 4: UK controls plus NCSC-style operating discipline | Every entity and location with access, support or recovery power |
The choice is not between “sovereign” and “not sovereign.” It is between different boundaries, each with a different client promise, operating burden and remaining dependency.
The honest counterargument: when not to run this yourself
Before the four-week plan, name the objection your CTO — or your common sense — will raise. For a 25-person firm, self-operating a national boundary is not free. Access reviews, patching, tested restores and someone answerable at 7 a.m. after a failure are real recurring work. A poorly operated “sovereign” deployment can carry more practical risk than a well-configured major cloud region with strong contracts, encryption and access logging.
Two signals tell you self-operation is wrong for you: nobody in the firm can be named as the technical operator with real hours allocated, or the Week 3 recovery test below fails twice. In either case, the honest move is a narrower promise — a well-governed European cloud route with documented controls — rather than a national promise you cannot operate. A boundary you cannot staff is a liability, not a commitment.
A four-week route-selection plan
Week 1 — choose the promise before the provider. Pick one confidential research task: for example, preparing a cited client meeting brief from an approved folder. Decide what the firm wants to be able to promise: German operation, a qualified French component, a controlled European hybrid or a UK boundary. Name the business owner, technical operator and the material that must never leave the confidential route. Making Sense of Sovereign AI helps frame that strategic choice.
Week 2 — build the smallest route that can prove the claim. Set up one model, one approved document collection, real sign-in and a human reviewer. For a national route, keep the first service under that national operation. For a hybrid route, create the two lanes and make the classification rule explicit. Do not connect email, calendars or business systems for this first test. The Monday Morning Supplier Problem is the useful reminder to start with a recognisable piece of work rather than a technology wish list.
Week 3 — test the boundary, not only the answer quality. Attempt an unauthorised retrieval, remove an account, test a failed update and restore from backup. For a hybrid route, try to send a confidential folder externally. Record where every administrator, support contact, log and backup sits. Before You Ask AI for Sources, Decide What It Is Allowed to Know provides the information-boundary lens.
Week 4 — decide whether the route is credible. Compare answer usefulness, evidence quality, response time, operating effort, recovery results and the client promise the firm can now support honestly. Only now open the market snapshots above and assess the providers or qualifications that could strengthen the chosen route — asking each vendor the question its snapshot teaches. Scale, add an explicitly classified external lane, or stop. Transformation Journey: From Pilot to Scale to Sustain gives the decision-gate perspective.
The leadership takeaway
Choose the boundary first. Then select providers, models and qualifications that help you operate it. Finally, test the boundary before you promise it to a client.
For the 25-person advisory firm, the practical first step is unchanged in every route: choose one confidential workflow, keep a human accountable for the output and prove access control plus recovery. And carry the four questions from the snapshots into every vendor conversation: which entity and who owns it; which exact offering is qualified; what survives if the provider disappears; and who really pays this provider’s bills. Those questions will outlive every name in this article.
Primary sources
- European Parliamentary Research Service, Digital sovereignty for Europe
- European Union, General Data Protection Regulation
- European Data Protection Board, Recommendations on supplementary transfer measures
- BSI C5 · ANSSI: SecNumCloud · NCSC Cloud Security Principles
Editorial note: the market snapshots in this article reflect September 2026 and will age; the routes, tests and questions are designed not to. Treat every provider claim as a due-diligence input, and verify the actual legal entity, service scope, support access, subcontractors and data path before procurement.