Sovereign AI: enterprise architecture and control

Short answer: choose enterprise sovereign AI by deciding which controls you need over data, access, models, operations and provider exit. European hosting or downloadable weights do not settle the question. Map the whole system, request evidence, compare options and test constraints before scaling. The decision should remain explainable to both the business sponsor and the people operating it.

Working definition: sovereign AI. A system whose conditions of use, data processing and operation an organisation can understand, decide and verify against its stated requirements. This editorial definition is neither an official qualification nor a certification.

The useful question is not simply “which European model should we buy?”. It is “which dependencies can this use case accept, which must we control, and how will we demonstrate that control?”.

This guide is for executives, CIOs and CTOs translating an intention into architecture and procurement decisions. It offers a method, a decision matrix and an illustrative industrial scenario. It is not legal advice: applicable obligations, contracts and qualifications require review by competent professionals.

Start with the task, not the label

Define a specific use before comparing suppliers. An assistant summarising public documents and an agent preparing a confidential commercial file do not have identical constraints. The second may also reach tools, produce traces and transmit excerpts that were not in the user's original question.

The CNIL, France's data protection authority, recommends starting from concrete needs, governing uses and selecting a deployment mode appropriate to the task and data. Its FAQ distinguishes on-premises systems, remote infrastructure and API access. CNIL, FAQ published 18 July 2024, reviewed 29 October 2026, in French

Our starting point is a one-page use-case sheet: expected outcome, users, necessary data, permitted actions and excluded uses. Name the sponsor, operator and person authorised to stop the service. This prevents a comparison between architectures that solve different problems.

Think of equipping a workshop. The country of origin of a machine does not tell you who holds the keys, where workpieces travel or who repairs it. For AI, examine the premises, access, flows and responsibilities around the model in the same way. A slogan is not an operating boundary.

Separate five questions that are often combined

We propose separating location, access, technical control, contractual arrangements and operational autonomy. This is an Elia Studio scoping framework, not a regulatory ranking of providers.

Visual summary of the HTML table retained above; each dimension requires separate evidence. Illustrative editorial framework, not certification.

Meeting one criterion does not automatically offset a blocker elsewhere. Excellent answers do not make a prohibited data destination acceptable. A local infrastructure is not useful if nobody can maintain its components.

For each requirement, distinguish mandatory constraints, preferences and open decisions. This keeps discussions explicit. An economic compromise should not be presented as a legal constraint; brand preference should not masquerade as proof of control. Record who is entitled to decide rather than letting each supplier define the decision criteria.

Map the complete system and its derived data

The boundary does not end at the language model. ANSSI, France's cybersecurity agency, treats the system as a collection of components and recommends considering training, additional and usage data, including prompts and responses. Its guide also examines interconnections and responsibilities throughout the lifecycle. ANSSI, guide published 29 April 2024, reviewed 29 October 2026, PDF in French

Trace at least the source document, text extraction, indexing, retrieval, request construction, inference, response, tool calls, logging, backup and deletion. Inference means running the model to produce a response. Vector representations are derived data used for retrieval; do not leave them outside the inventory.

Include development and test environments. If support reproduces an incident by copying a case into a ticketing tool, that copy belongs in the analysis. Ask what support can see and what it can download, including under an exceptional-access procedure.

The business-facing map should explain which information crosses each boundary, why and to whom. A detailed technical diagram can follow. An arrow with no owner or retention rule is an unresolved question, not an implicitly accepted assumption. Keep that distinction visible in the decision record.

Illustrative inventory of boundaries to examine. Flows between these components must then be documented and verified.

Why European hosting does not complete the analysis

Data residency is one decision dimension. We recommend checking inference, storage, backup, administration and support locations separately. A commercial region name should not become shorthand for every operation in a service.

For external infrastructure, the CNIL highlights contracts, responsibility boundaries and authorised access. It also discusses governing transfers outside the European Union when these are involved. Assess the actual arrangement rather than drawing a conclusion from a region selector. CNIL, FAQ published 18 July 2024, reviewed 29 October 2026, in French

Prepare a sheet for each service: received data, purpose, declared location, retention, possible reuse and exceptional access. Have legal and contractual points validated. Architecture translates the resulting requirements into configuration and tests; it does not replace the assessment.

Where a hosting qualification is required for the project, request its reference and exact scope. Do not infer qualification of the entire solution from the hosting company's name. We recommend connecting the purchased offer, its components and options to the evidence, then documenting what remains outside scope. Do not describe a requirement as satisfied while that connection is unresolved.

Why available weights do not guarantee control

An open-weight model makes its parameters available under specified conditions. Read the actual licence, identify the version and check the intended use. The CNIL recommends reviewing licensing and system documentation as part of selection. CNIL, FAQ published 18 July 2024, reviewed 29 October 2026, in French

Separate access to weights, contractual rights, required resources and surrounding services. Downloading weights does not install an on-call team or an update procedure. Nor does it prove that every peripheral component works without remote services.

A limited, documented example: Mistral states that its self-hosted AI Suite sends web searches to its cloud rather than running them in the cluster. This concerns that feature and the documentation reviewed on this date, not every Mistral deployment option. Mistral documentation, reviewed 29 October 2026

The design lesson is to test real dependencies: web search, document recognition, monitoring, licence management, updates and fallback services. Local deployment is a property to verify component by component, not a promise to extend automatically to the entire application. If a feature is not necessary, do not activate it merely because it is available.

Compare deployment options on the same use case

We recommend comparing a managed API, a dedicated or private service, and operation on infrastructure you control. Commercial names vary: ask what is shared, isolated and administered by each party.

No row is a universal recommendation. The CNIL discusses on-premises benefits and costs, and safeguards to examine for cloud and API deployments. The choice depends on needs and data. CNIL, FAQ published 18 July 2024, reviewed 29 October 2026, in French

Evaluate options using the same questions, authorised documents and business criteria. Compare quality, total time, exceptions, complete cost and operating capacity. A lower per-request price may require more human review. Reserved infrastructure can be appropriate for one use without being right for every activity in the company.

Keep exclusions equal too. If one demonstration uses public material while another uses restricted operational files, its quality score does not support the same decision. The comparison record must explain the scope of evidence before anyone interprets a headline result.

The Elia Studio decision matrix

This matrix is an editorial working proposal. It does not certify providers or produce a legal score. Its purpose is to make decisions explainable and evidence retrievable.

Complete each row with dated evidence or a clearly named gap. Avoid labels such as “good”, “European” or “enterprise” without a verifiable reference. Distinguish documentation, observed configuration and an executed test: they are different levels of confirmation.

Start the decision review with blockers. An unknown criterion that could alter data authorisation should be resolved before the corresponding pilot opens. Other gaps can become assigned actions with an owner and a review condition. Do not hide uncertainty behind an average score, and do not let a supplier's overall rating erase a specific unacceptable dependency.

Illustrative industrial case: a document assistant

Consider a fictional team that wants to find reports, compare versions and prepare summaries. Some documents are public; others are restricted to one team. This is not a customer account, and no quantitative improvement is claimed.

The initial scope is bounded: retrieve authorised documents and answer with references. External sending, document modification and binding decisions are excluded. The business team prepares representative questions, including unanswerable cases and contradictory versions.

One candidate architecture places authentication and access rules before retrieval. Retrieved passages go to a model authorised for that data category. Logs retain only what the validated support policy requires. Web search is not enabled by default.

Hosting variants are compared within that identical scope. A destination failing a blocking constraint is not used with those documents, even if it gives stronger answers on other tests. If a document-extraction component externalises pages, that flow enters the comparison alongside inference.

The pilot is not trying to prove an abstract sovereignty label. It must show that rules work, evidence is available and business users receive usable answers. The final decision can be deployment, a smaller scope, corrective work or a stop. A narrower but dependable assistant can be a better initial decision than an impressive configuration the organisation cannot authorise or operate.

Keep authorisation outside the model

Choosing a processing location does not automatically authorise actions. An agent reading a report and one sending a reply need distinct tools and rights. Our AI agent architecture guide explains the separation of model, tool gateway and execution.

ANSSI recommends limiting interconnections to operational needs and controlling privileged access. Its guide also highlights additional-data and need-to-know concerns. These controls remain necessary around the model. ANSSI, guide published 29 April 2024, reviewed 29 October 2026, PDF in French

We recommend explicit tests: reading an unassigned case, requesting an export, encountering malicious instructions in a document, attempting support access and performing an out-of-scope action. A prompt asking the model to follow a rule is not sufficient. Application code and target systems need a means to enforce it.

For document assistants, RAG vs GraphRAG depends on the questions and evidence to retrieve. A graph does not remove the need to control derived data, summaries and extracted relationships. The model's sovereignty posture does not replace access-control design for the surrounding system.

Prepare operations, cost and provider exit

The person selecting a model is not necessarily the person called during an outage. Name the operator, update owner and support path. Specify what happens when a remote service fails, a budget is reached or a model change reduces quality.

Compare compute, indexing, storage, tools, human review, maintenance and retries. Our guide to full AI automation ROI distinguishes freed capacity from observed financial savings. A token price is not the complete cost of the service.

Test exit before it becomes urgent. Export a small authorised scope: rules, schemas, document references, evaluation sets and the parameters needed to reconstruct the flow. Replay a task on an alternative. Record manual work, contractual limits and output differences without promising perfect portability.

Operational autonomy should remain proportionate. Running everything yourself can shift dependency to one indispensable person or an unmaintained infrastructure. The useful compromise is one the company can fund, explain and operate over time, with documented responsibilities. Ask who can perform recovery when the original project team is unavailable, not only whether that team can demonstrate it today.

A decision path with six deliverables

1. Scope: use-case sheet, users and exclusions.
2. Map: data, flows, dependencies and administrators.
3. Requirements: blockers, preferences and unknowns.
4. Comparison: options and evidence, without an opaque score.
5. Pilot: business evaluation, control tests and recovery.
6. Operations: owner, budget, change monitoring and tested exit.

This is a proposed method, not a schedule or delivery-time promise. Unverified items remain visible in the decision record. Write down the events that trigger reassessment: new data source, tool, audience, provider or allocation of responsibilities.

It complements the AI agents POC-to-production roadmap. Both approaches seek an operable system rather than an isolated demonstration or assumed compliance. The acceptance conversation should end with named conditions and evidence, not a general declaration that the architecture is “sovereign enough”.

Frame a roadmap with Elia Studio

Elia Studio offers sovereign AI roadmaps and tailored agents. Start with a real use case and explicit constraints and responsibilities. The useful deliverable is a reasoned decision connecting business needs, the information system, risks, technical options and operating conditions.

Contact Elia Studio to frame the work. A useful discussion starts with the data involved, what the system must do and what the organisation needs to retain under its control.

Sources reviewed on 29 October 2026. CNIL and ANSSI sources include their publication dates; provider documentation applies to the feature and review date stated. This guide is not legal advice or a compliance attestation.