The right question is not what the AI can do
Claude Fable is impressive. I say that without irony. Anthropic's latest generation is one of the most powerful AI models ever built. That is exactly why I am writing this piece. Because the better a US AI becomes, the greater the temptation to build your own core business on it. And the more costly the day on which access disappears.
Most decision-makers assess AI like a software licence. Does it work? What does it cost? Can it be set up in compliance with data protection law? Those are the wrong questions. The right one is: who can switch this service off, and how quickly?
Four levers, all of which sit in Washington
A US provider is subject to US law, regardless of where its servers are located and what your contract says. Access to an American AI depends on several levers, all of which sit in Washington:
- Export controls. Advanced AI is increasingly regarded as a controlled technology. A rule change can exclude user groups, industries or regions overnight.
- Sanctions. The listing of a country, a company or a sector obliges every US provider to discontinue the service immediately. Without warning, without a notice period.
- Executive orders. The US President can restrict the export and provision of technology by order. Such orders take effect in hours, not quarters.
- CLOUD Act. US authorities can access data controlled by a US company, even on European servers.
None of these levers needs your consent. None of them is in your service level agreement. And none of them can be averted before a German court.
Not a theoretical risk
The most common objection is that this is a theoretical risk. It is not. For years, the US has used technology as a geopolitical instrument, from chip export controls and the exclusion of entire companies from the US technology ecosystem to sanctions listings at short notice. The pattern is stable: first a service becomes indispensable, then the dependence becomes a means of pressure.
For a European company, the key insight is not whether you are the next target. It is that the decision does not lie with you, and that it can be made within a time frame in which you cannot respond.
When contract and law collide
A service level agreement governs what the provider owes you. It does not govern what the provider owes its home state. If the two collide, the law wins. Every time.
A US provider that has to choose between a breach of contract towards a European customer and a breach of the law towards the US government will choose the breach of contract. Your damages clause is then a consolation prize, not protection.
This is not an accusation against Anthropic or any individual provider. It is simply how jurisdiction works. You cannot buy sovereignty by contract. You build it into the architecture.
AI is no longer a toy
As long as AI was a toy in marketing, the risk was manageable. That is over. AI is moving into the core business, into document creation, into email processing, into research, into the automation of workflows. Precisely where an outage is not annoying but existential.
Imagine that your office suite, your mailbox assistant and your process automation run on a US AI, and access is blocked one Tuesday morning. No ticket system in the world will bring it back, because the cause lies not in a data centre but in a regulation. Your business comes to a standstill, and you have no leverage.
The good news: the compromise does not exist
You do not have to choose between good AI and sovereign AI. At Nexoria, the platform runs on German servers with a European AI model from Mistral, without US subprocessors in the critical path. In concrete terms, this means: there is no switch in Washington that can turn off your documents, your emails or your research. Data sovereignty remains in the European Union, and the legal basis is the General Data Protection Regulation, not the CLOUD Act.
And we go further. With offline availability, your core tools keep working even if the external connection drops out completely. Availability that no one from outside can switch off is not a convenience. It is business continuity.
Five questions for every AI provider
- 1.Which law is the provider subject to, and can that law force it to cut me off?
- 2.Does my data leave the European Union, technically or legally, at any step?
- 3.What happens to my business if the service can no longer be reached tomorrow morning? And how quickly could that happen?
- 4.Does my contract protect me against a government order in the provider's home country?
- 5.Does my core business keep running if the external connection drops out?
Anyone who answers these five questions honestly does not end up asking which US model is the best. They end up asking how much control they want to keep over their own company.
Sovereignty does not mean going without
Claude Fable is a great model. But a great model that another state can switch off in minutes is not a foundation. It is a risk with a pleasant interface.
Digital sovereignty does not mean doing without the best AI. It means making sure that no one from outside can pull the plug.
- Christian Klever is CTO and Co-Founder of Nexoria Systems, Caan Grueneberg is CEO and Co-Founder.