Sovereign AI
What is a sovereign AI platform?
The short answer
A sovereign AI platform is software that lets an organisation run, manage and audit AI models on infrastructure it controls, under the law of its own jurisdiction. Prompts, documents and outputs never leave that infrastructure, and no outside provider can access them or switch the service off.
The word "sovereign" describes who is in control. With a sovereign AI platform, the organisation decides where the models run, who can use them, and what gets logged. It does not depend on a cloud provider's contract to keep that control.
A sovereign AI platform is not a model. It is the layer around the models: deployment, access control, monitoring and audit, so that open-weight models can be used in production by many teams at once.
Sovereign AI platform vs sovereign cloud
The two terms sound similar but describe different kinds of control. A sovereign cloud promises sovereignty by contract. A sovereign AI platform delivers it by architecture.
Sovereign cloud | Sovereign AI platform | |
|---|---|---|
Where AI runs | In a provider's data centre, often in an EU region | On servers the organisation owns or controls |
Who operates it | The provider | The organisation itself |
What protects the data | Contracts, certifications and region settings | The fact that data never leaves the organisation's network |
Foreign legal access | Depends on the provider's home country | No outside provider holds the data |
Can be switched off from outside | Yes, by the provider | No |
The difference matters most for providers based outside the EU. The US CLOUD Act of 2018 allows US authorities to require US-based providers to hand over data in their control, even when it is stored in another country (US Department of Justice). An EU data centre run by a US company therefore does not take the data out of US jurisdiction.
A sovereign AI platform avoids that question. If the data never reaches a provider, no provider can be ordered to disclose it.
What a sovereign AI platform includes
A sovereign AI platform combines six building blocks. Together they give teams a cloud-like AI experience while everything stays inside the organisation.
Infrastructure under your control. Models run on the organisation's own servers or in a facility it controls. No data is sent to an external AI provider.
Open-weight models. The organisation chooses and hosts the models itself, so it can inspect them, keep them, and change them without asking a vendor.
Model orchestration. The platform deploys models across one or more GPU servers, balances requests between them, and adds capacity by adding servers.
A standard API. An OpenAI-compatible API lets existing applications and tools switch to the internal models by changing one base URL and key.
Access control. Role-based access, single sign-on and API keys decide which people and applications may use which models.
Audit and monitoring. The platform records who did what and when, so the organisation can show regulators and auditors how AI is used.
One more property separates a truly sovereign platform from a merely private one: its source code can be inspected. If the organisation cannot see what the software does, it has to trust the vendor again.
Who needs a sovereign AI platform
Any organisation that cannot legally or contractually send its data to an external AI service needs one. These organisations are not against the cloud. They are blocked from it by law, professional duty or trade secrets.
Sector | Why data cannot leave | Rules that apply |
|---|---|---|
Banks and insurers | Banking secrecy, strict outsourcing rules | GDPR, DORA (Regulation (EU) 2022/2554) |
Hospitals and healthcare | Patient data is among the most protected data there is | GDPR (special categories of data) |
Law firms | Professional confidentiality covers the entire client file | GDPR, national professional rules |
Media | Journalistic source protection | GDPR, press and media law |
Public sector | Data residency and full traceability of decisions | GDPR, NIS2 (Directive (EU) 2022/2555), national rules |
Manufacturers | Trade secrets and production data | Trade secret law, contracts |
The EU AI Act (Regulation (EU) 2024/1689) adds documentation and transparency duties on top. A platform with a built-in audit trail makes those duties easier to meet, because the evidence is collected as the AI is used.
How to check if a platform is really sovereign
Many products call themselves sovereign. Seven questions show whether a platform actually is.
Does any data leave our network during normal use? The answer should be no, including prompts, outputs, logs and telemetry.
Can it run without an internet connection to the vendor? A sovereign platform keeps working if the vendor disappears.
Who can be legally ordered to hand over our data? If the answer includes any outside provider, the platform is not sovereign.
Can we inspect the source code? Open or source-available code lets your security team verify what runs.
Can we choose and change the models ourselves? You should not be locked into one vendor's models.
Is there an audit trail we control? Logs should stay on your infrastructure and be exportable for auditors.
Does access control connect to our identity system? Single sign-on and roles should come from your own directory, not a separate vendor account.
Where Xinity fits
Xinity is an open-source sovereign AI platform built in Vienna. It runs entirely on the organisation's own hardware and gives teams a cloud experience on their own premises.
Runs where the data lives: dashboard, API gateway, model nodes and databases all run inside your infrastructure, with zero data egress.
Works with existing tools: an OpenAI-compatible API, so applications built for the OpenAI SDK switch by changing the base URL.
Controls access: role-based access per organisation, single sign-on via OIDC, passkeys and two-factor authentication.
Keeps an audit trail: security-relevant actions are recorded automatically and can be exported for auditors.
Scales by adding servers: new GPU machines join as nodes, and one instance can serve several organisations with tenant isolation.
Can be inspected: the full source code is public on GitHub.
Xinity is in production at regulated organisations, including media companies, manufacturers and public institutions.
Frequently asked questions
What is a sovereign AI platform?
A sovereign AI platform is software for running, managing and auditing AI models on infrastructure an organisation controls, under its own jurisdiction. Data never leaves that infrastructure.
What is the difference between sovereign AI and sovereign cloud?
Sovereign cloud keeps data in a provider's data centre and protects it by contract. A sovereign AI platform runs on the organisation's own servers, so no provider holds the data at all.
Is an EU data centre enough for sovereignty?
Not always. Under the US CLOUD Act, US-based providers can be required to hand over data they control, even when it is stored in the EU (US Department of Justice).
Does a sovereign AI platform include its own AI models?
Usually not. It runs open-weight models that the organisation selects and hosts. The platform is the layer that deploys, secures and audits them.
Who needs a sovereign AI platform?
Organisations that cannot send data to external AI services: banks, insurers, hospitals, law firms, media companies, public institutions and manufacturers with trade secrets.
Can existing AI applications run on a sovereign AI platform?
Yes, if the platform offers an OpenAI-compatible API. Applications then switch by changing the base URL and API key.
AI declaration: This article was drafted with the help of AI and reviewed by the Xinity team.