Sovereign AI describes the ability to build, run and control AI systems under your own jurisdiction, without depending on infrastructure, models or legal regimes controlled elsewhere. In Europe the term covers everything from keeping data in EU data centres to training models on European hardware. For speech recognition, the practical questions are who trains the model, who operates it, which laws can reach the audio, and whether the model handles European languages well.
Key takeaways
- Sovereignty is layered: hardware, cloud operations, inference software, model and data. Few organisations control every layer, so it is a question of degree.
- Data residency is the weakest form. It fixes location but not jurisdiction or control.
- Operational sovereignty, meaning who runs the system and who can compel access, is what most regulated buyers actually need.
- EU policy has moved from cloud federation (Gaia-X) to compute (EuroHPC AI Factories) and data rules (the Data Act).
- For speech, sovereignty also means language: models trained mostly on English serve smaller European languages less well.
What sovereignty means in practice#
There is no legal definition of sovereign AI. The phrase is used by governments to describe industrial policy, by cloud providers to describe product tiers, and by buyers to describe a requirement. A useful way to reason about it is to split an AI service into layers and ask, for each one, who controls it and under which law.
These layers support three commonly used levels:
| Level | What it guarantees | What it does not |
|---|---|---|
| Data residency | Data is stored and processed in the EU | Protection from foreign disclosure laws that apply to the operator |
| Operational sovereignty | An EU entity operates the service, with EU staff and EU law | Independence from foreign technology suppliers |
| Technological sovereignty | Models and software are developed and controlled in the EU | Independence in hardware, which remains global |
The distinction between the first two levels is the one that matters most in procurement. Data residency explains why an EU region operated by a non-EU company can still be subject to foreign law, such as the US CLOUD Act.
Why it matters for speech AI#
- Sensitive content. Speech carries health information, legal advice, financial instructions and government business. These are the sectors where sovereignty requirements appear first in tenders.
- Language. Global models are trained mostly on English. Performance on Dutch, Polish or Swedish depends on how much effort went into those languages, which is partly a question of where the model is built and for whom. See speech recognition for European languages.
- Continuity. A service embedded in clinical documentation or emergency call handling must keep running if a foreign supplier changes terms, exits a market or is subject to sanctions or export controls.
- Auditability. Obligations under the EU AI Act and sector regulators are easier to meet when the model developer is reachable under the same legal system.
European policy#
EU initiatives on digital sovereignty have shifted focus over time:
- Gaia-X, launched by France and Germany in 2020, set out to define a federated European data infrastructure with common rules for trust and interoperability.
- EuroHPC Joint Undertaking pools EU and member state funding for supercomputers. Since 2024 it has selected AI Factories that give European start-ups and researchers access to compute for training models.
- InvestAI, announced by the Commission in February 2025, aims to mobilise €200 billion for AI, including a fund for large-scale "AI gigafactories".
- The European Chips Act, Regulation (EU) 2023/1781, supports semiconductor design and manufacturing capacity in the EU.
- The Data Act, Regulation (EU) 2023/2854, applies from 12 September 2025. Among other things it requires cloud providers to make switching between providers possible, reducing lock-in.
At national level, France's SecNumCloud qualification, run by the national cybersecurity agency ANSSI, includes requirements intended to protect qualified cloud services from non-EU laws. A European cloud certification scheme under the Cybersecurity Act (EUCS) has been under negotiation for several years, with sovereignty requirements among the most contested points.
Routes to sovereignty#
Buy from a European provider#
A provider incorporated and operating in the EU, running its own model on EU infrastructure, gives operational sovereignty without the customer running anything. The customer should still check sub-processors, since a European vendor hosting on a non-EU cloud inherits that cloud's jurisdiction.
Run the model yourself#
On-premise deployment gives the strongest operational control, because audio never leaves your perimeter. It does not change where the model was developed.
Use open weights#
Open-weight models such as Whisper can be run anywhere, which provides operational sovereignty even though the model was developed elsewhere. The trade-off is that you are responsible for serving, updating and adapting the model, and you cannot influence its training.
Trade-offs#
Sovereignty has costs. The largest models and most mature platforms are mostly built outside Europe, and restricting choice to EU providers can mean fewer features or less scale. Full technological sovereignty is not currently achievable for anyone in Europe because GPU supply is global. The realistic goal for most organisations is to remove dependencies that create legal exposure or continuity risk for their most sensitive workloads, while accepting global supply chains where the risk is low.
Buyers should also watch for loose use of the term. Marketing that says "sovereign" may mean any of the three levels above. Ask which one.
How Reson8 approaches this#
Reson8 is built by Resonate Labs B.V., founded in Amsterdam in 2025. It trains its own speech recognition model, Resonant-1, and serves it with its own inference engine, Violin, on EU GPU infrastructure. The model covers nine European languages in depth: Dutch, English, French, German, Italian, Polish, Portuguese, Spanish and Swedish. That is far fewer than the broadest global models cover. Customers who need the model inside their own perimeter can use on-premise or VPC deployment on enterprise plans. Like almost all GPU inference, the service depends on hardware designed outside Europe.
Common questions#
Is an EU region of a US cloud provider sovereign?
It provides data residency. Whether it provides operational sovereignty depends on who operates it and whether foreign disclosure laws apply to that operator. Several providers have announced EU-operated offerings to address this; assess each on its terms.
Does the AI Act require sovereign AI?
No. The AI Act regulates how AI systems are built and used, not where their providers are based. Non-EU providers can place systems on the EU market if they meet its requirements.
Are open-weight models sovereign?
They give you control over operation, since you can run them on your own infrastructure. They do not give you control over training data or future versions.
This article is general information, not legal advice.
References#
- Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act). EUR-Lex.
- Regulation (EU) 2023/1781 establishing a framework of measures for strengthening Europe's semiconductor ecosystem (Chips Act). EUR-Lex.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act). EUR-Lex.
- EuroHPC Joint Undertaking. AI Factories. EuroHPC JU.
- ANSSI. SecNumCloud qualification framework. ANSSI.
- Radford, A. et al. (2022). Robust Speech Recognition via Large-Scale Weak Supervision (Whisper). arXiv:2212.04356.