ZetrixwebResidency and sovereignty are not the same
Data residency is about where data is stored and processed. Sovereignty is broader: who owns and controls the provider, which legal systems can reach the data, who holds the encryption keys, and who operates the service. A workload can sit in an EU region and still raise sovereignty questions for some customers, particularly public bodies.
The Commission's Cloud and AI Development Act proposal would introduce assurance levels for sovereign cloud, but it is not law. For now the requirement comes from your customers and regulators, which differ widely.
The realistic options
There are four broad options. Use a major provider's EU region with strong controls over keys and access. Use an EU-headquartered cloud provider. Run in your own or a customer's private infrastructure. Or self-host open-weight models on infrastructure you control, which gives the most control but also the most operating burden and may mean a gap in capability compared with frontier hosted models.
Hybrid arrangements are common: sensitive processing on controlled infrastructure and less sensitive workloads on hosted services.
| Option | Control | Capability access | Operating burden |
|---|---|---|---|
| Hyperscaler EU region | Medium, depends on key and access controls | Highest | Low |
| EU-headquartered provider | Higher on ownership and jurisdiction | Varies by provider | Low to medium |
| Private or customer infrastructure | High | Depends on what you can run | High |
| Self-hosted open-weight models | Highest | May lag frontier models | Highest |
A decision framework
Classify workloads by data sensitivity and by what the feature needs from a model. Map customer requirements to the controls they imply. Then pick the least burdensome option that satisfies them for each workload, rather than moving everything to the strictest option.
Keep the model behind a thin adapter and infrastructure reproducible so a workload can move. That also reduces exposure to a single provider's policy or pricing change, and aligns with the cloud switching rules arriving in January 2027.
Deciding where to run AI features for EU customers? Talk to us about a hosting decision review.
Key takeaways
- Residency is where data sits; sovereignty adds ownership, jurisdiction, key control, and operations.
- Options range from hyperscaler EU regions to self-hosted open-weight models, trading control against capability and operating burden.
- Classify workloads and match each to the least burdensome option that meets customer requirements.
- Keep adapters thin and infrastructure reproducible so workloads can move.