Sovereign AI · Mittelstand · SMEs

Sovereign AI for companies and SMEs

Sovereign AI means: you decide about your data, access, operation and location yourself. You do not depend on the prices, terms and jurisdictions of a single provider. For the Mittelstand and for SMEs this is not a matter of principle but a practical one: which data may go where, and who controls the technology? We put it in context and build the right solution with you — in person, from Cologne and Weimar.

Book tech sparring (30 min, free) Local AI for companies

What does sovereign AI mean?

“Digital sovereignty” describes the ability to make self-determined decisions about digital technology and data. Applied to AI, it means: you know where your data is, who can access it, who runs the technology and whether you can switch provider or model without rebuilding everything. Four things belong to it:

Data sovereignty

You control the entire path of your data. Nothing flows unnoticed into third parties’ training data.

Access sovereignty

You decide who may use the AI and who can see requests and documents.

Operational sovereignty

No lock-in: you can switch models and software and keep running the technology yourself.

Location and jurisdiction

You know where data is processed and which law the operator is subject to.

Sovereignty is not self-sufficiency. You do not have to run everything yourself. It makes sense to set the protection level per application: sensitive things stay under your control, non-critical things may keep running via cloud services.

Why this matters for the Mittelstand

Five levels of sovereignty in AI

Sovereignty is not a yes-or-no question. There are gradations. Which one fits depends on the protection needs of your data.

Levels of sovereignty in AI at a glance
LevelControlDependenceEffort
1. AI service of a US providerLow. Data and operation with the provider.High.Very low.
2. US provider with an EU data centreLocation in the EU. The group remains a US company, the CLOUD Act may under certain circumstances still apply.High.Low.
3. European provider or EU cloudLocation and jurisdiction in Europe. Operation with the provider.Medium.Low to medium.
4. Private cloud or own server in a data centreHigh. You or a service provider of your choice run open models.Low to medium.Medium.
5. Local AI in your own premises (on-premise)Very high. Data does not leave the building.Low.Medium. Setup by us, operation with you.

Higher is not always better. For marketing copy, level 1 or 2 is often enough. For contracts, personnel, customer or health data, levels 4 or 5 pay off. We help you classify your applications.

GDPR, EU AI Act and CLOUD Act: how they fit together

GDPR

You need a legal basis, must define the purpose, inform data subjects and protect data. If you pass data to an external service, data processing agreements and possibly third-country transfers come in. With local processing, passing data to third parties largely falls away.

EU AI Act

Since 2 February 2025, Article 4 requires measures for the AI literacy of staff, since the AI Omnibus (in force since 27 July 2026) without a guarantee of a specific level. High-risk obligations apply later (Annex III from 2 December 2027).

CLOUD Act and location

The US law may under certain circumstances oblige US providers to hand over data even if it is stored in Europe. Location alone is therefore no proof of sovereignty.

This is not legal advice. For binding statements, please consult your legal counsel or your data protection officer.

Open and European models

Sovereignty depends not only on hardware but also on the model. Open models (open weights) can be run locally, inspected and swapped. They include models from Europe, for example from Mistral AI, and models from Alibaba (Qwen), Google (Gemma) or IBM (Granite). We check licence, origin and the requirements of your customers case by case together with you. What matters: you are not tied to one model and can switch when circumstances change.

Checklist: how sovereign is your AI use today?

  1. Data: What data do employees enter into AI services? Which of it is confidential or personal?
  2. Protection needs: Which applications must stay under your control, which may go to the cloud?
  3. Operator: Who runs the services, which group do they belong to and which law are they subject to?
  4. Switching: Can you switch provider or model within a reasonable time? How do you export your data?
  5. Rules and skills: Is there an AI policy? Is staff trained (Article 4 AI Act)?
  6. Operation: Who keeps technology, access and updates up to date?

If you cannot answer several points, an AI competence check is a good start. Feel free to request one from us.

Sovereign AI for SMEs: a realistic start

  1. Classify: collect applications and define protection needs (30 minutes of tech sparring, free of charge).
  2. Start small: one concrete use case as a pilot project, for example searching your own documents.
  3. Think hybrid: sensitive things local, non-critical things still via cloud. Expand step by step.
  4. Enable: training for users, decision-makers and developers, documentable under Article 4 AI Act.

Current configurations and prices: AI offers on the home page. BAFA consulting funding can cover up to 80 % in the eastern German states; applications are possible until 31 December 2026.

Sovereign AI for medical, dental and veterinary practices

Practices process particularly sensitive data and are bound by professional secrecy. That speaks for keeping AI data in-house.

Limits: We are not talking about AI for diagnosis or therapy. Such systems often fall under medical device law and may count as high-risk systems under the AI Act. We do not give legal or medical-device advice. Please clarify professional and data protection questions with your chamber, your legal counsel and your data protection officer. We take care of technical assessment, setup and training.

How we support you

Assessment & strategy call

Applications, protection needs, level of sovereignty, funding. Honest and without sales pressure.

Workshops, prototypes, training

Pilot projects and documentable training for users, decision-makers and developers.

AI boxes

Ready-configured local AI on Apple Silicon or NVIDIA DGX Spark with consulting and onboarding.

You will find technical details on the page Local AI for companies and offers in the AI Campaign Months 2026. Our location in Weimar: AI consulting in Weimar and Thuringia.

Frequently asked questions about sovereign AI

What is sovereign AI?
Sovereign AI is AI where you decide about data, access, operation and location yourself — and do not depend on the terms of a single provider. It includes data sovereignty, access sovereignty, operational sovereignty and a known jurisdiction. Sovereign does not mean self-sufficient: non-critical tasks can still run via cloud services.
What is the difference between sovereign AI and local AI?
Local AI describes a technology: the AI runs on hardware in your own premises. Sovereign AI describes a goal: you keep control. Local AI is the strongest way to get there, but not the only one. Depending on protection needs, a private cloud or a European provider can also be sovereign enough. More on the technology: Local AI for companies.
Is a data centre in the EU enough for AI to be sovereign?
Not automatically. Data location is one building block. If the provider belongs to a US group, the US CLOUD Act may under certain circumstances also reach data stored in Europe. So besides location, the question of who operates the service and which law it is subject to matters.
Is sovereign AI automatically GDPR-compliant?
No. It makes compliance easier because you control data and access better. You still need to clarify the legal basis, purpose limitation, informing data subjects and technical safeguards. We do not give legal advice, but we are happy to work with your data protection officer.
What does the EU AI Act require of companies that use AI?
Since 2 February 2025, companies that use AI must take measures under Article 4 for the AI literacy of their staff. Since the AI Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026), they do not have to guarantee a specific level of competence. Obligations for high-risk systems apply later (Annex III from 2 December 2027). Whether your use falls under them depends on the use case.
How can SMEs realistically start with sovereign AI?
Small and hybrid: first clarify which data is sensitive, then run a pilot project with one concrete use case on your own hardware. Non-critical tasks can stay with cloud services for now. A first tech sparring session (30 minutes) is free of charge. Current prices for AI boxes are on the home page.
Can medical, dental and veterinary practices use AI?
In principle yes, for organisational and writing tasks such as drafts of documentation, summaries or practice organisation. Patient data and professional secrets require particular care (Art. 9 GDPR, section 203 of the German Criminal Code). Local processing in the practice keeps the circle of people involved small. Medical decisions remain with humans, and AI for diagnosis or therapy often falls under medical device law. Please clarify your individual case with your professional chamber, your legal counsel and your data protection officer.
Which models are suitable for sovereign AI?
Open models (open weights) that you can run locally and swap, for example from Mistral AI (France), Alibaba (Qwen), Google (Gemma) or IBM (Granite). We check licence and origin with you case by case. What makes it sovereign is that you can switch models.
Is there funding?
Possibly. BAFA consulting funding covers up to 80 % in the eastern German states and 50 % in the western ones. Applications are possible until 31 December 2026; continuation afterwards is open. The German Qualifizierungschancengesetz (QCG) may apply to employee training.

Arrange a call

30 minutes, free of charge: we put your AI use in context, show suitable levels of sovereignty and tell you honestly what is worthwhile for you. In person, from Cologne and Weimar.

Book tech sparring