Insights — Data and compliance
Sovereignty and AI: the real question is not “where are the servers”, but “who can do what”.
Sovereignty is often reduced to the hosting region. That is part of the subject, and rarely the decisive part. What matters: who processes your data, for what purpose, for how long, and what they can do with it without your agreement.
01 — The problem
A supplier can host in Europe and process your data elsewhere in its chain.
Hosting in a European data centre says nothing about the rest: support may sit outside the European Union, technical logs may be replicated elsewhere, and the processor may itself use further subcontractors without your knowledge.
For an AI project the question becomes even more concrete: are your documents used to train a model? Are your questions retained? Can an operator read them? And if the supplier changes its terms, do you have a way out?
01The four questions that genuinely matter
We ask them systematically, and we require a written answer. A vague answer is a negative answer.
- Are your data used to train or improve a model, even aggregated or anonymised?
- Where are requests processed, and where are technical logs stored?
- Who can access the content, for what reason, and with what trace?
- What happens the day you leave: what export, in what format, within what delay?
02GDPR remains the baseline; the EU AI Act adds duties depending on use
GDPR does not change because a project uses artificial intelligence: you need a legal basis, a determined purpose, a retention period and information for the people concerned. That is the foundation, and it is already enough to rule out most bad ideas.
The European AI Act adds duties graded by risk level: transparency when a person interacts with a machine, disclosure when content is generated, and stronger requirements as soon as a system touches employment, credit, health or safety. The right method is not to anticipate everything, but to classify your use case and derive the real obligations.
03What we put in place by default
Our platforms are designed in Europe, with defaults that reduce the risk surface — and that the client can audit.
It is not a label or a certification: it is a set of verifiable technical decisions, documented in the architecture handover.
- Processing and storage in the European Union by default, transfers documented and limited
- No client data used to train a model, with written supplier commitment
- Minimisation: only useful excerpts are sent to the model, never a whole folder
- Logging of requests and access, retained for a period defined with the client
- Multi-model gateway: change supplier without rewriting the application
- Encryption in transit and at rest, with client-managed keys where required
04Reversibility, the final test of sovereignty
An architecture is only sovereign if you can leave it. We therefore treat reversibility as a design requirement, not an end-of-contract clause.
In practice: the application never talks to a model directly, it talks to a gateway you control; search indexes belong to you and are rebuilt from your documents; and the architecture documentation lets a third party take over the whole system without us.
Sovereignty you can verify: identifiable data, bounded access, an interchangeable model.
02 — Common questions
What management asks us on this topic
Do we need a model hosted in France?
No. What counts is the actual processing, not the flag on the data centre: where requests are executed, where logs are kept, who can access them and under what rules. For sensitive use we host the model ourselves; for everyday use, a European supplier with written commitments is often enough.
Are we compliant if we use AI to answer our customers?
You first need a legal basis and clear information for the people concerned, then a check that the use case is not in a high-risk category. For an internal document assistant or writing assistance, the frame is reasonable provided you log, minimise, and keep human validation on committing answers.
What happens if the supplier changes its terms?
That is exactly what the gateway is for: the application is tied to no single supplier. Changing model becomes an operational decision, not a rewrite project. We contractually plan notice and a switch procedure to another model or to internal hosting.
Do you want to know where your AI project really stands?
We review your use cases, your suppliers and your written commitments, then hand over a ranked list of points to fix, with the cost of each.