September 2026 Summaries

AI sovereignty is presented as broader than EU data residency, encompassing organizational control over data, models, infrastructure, governance, and legal exposure throughout an AI system’s lifecycle. The proposed evaluation framework examines five areas: whether all data and encryption keys remain under the customer’s jurisdiction; support for self-hosted, on-premises, or air-gapped deployment; the ability to switch models, providers, and components without rebuilding applications; traceable audit logs, access controls, and limits on agent actions; and whether the operational core is genuinely open source and inspectable. The discussion links these capabilities to demonstrating, rather than automatically achieving, compliance with the EU AI Act, whose phased obligations include existing transparency, prohibited-practice, and general-purpose model requirements, while many high-risk system obligations have been deferred to 2027 or 2028. It contrasts hosted hyperscaler, sovereign-cloud, and model-API options with self-hosted open-source and enterprise platforms, noting that greater operational control typically requires organizations to manage infrastructure and GPU capacity themselves. Examples involving the European Commission, NTT DATA, HPE, and deepset’s Haystack platform illustrate self-hosted deployments aimed at public-sector and regulated uses, while the concluding checklist emphasizes jurisdictional control, portability, auditability, and independence from a single vendor.