The dependency that has long existed
Ask yourself for a moment whose infrastructure your company runs on: emails, documents, spreadsheets, calendars, file storage and video conferences. In many European companies, these services come from Microsoft, Amazon or Google. The data centres may be in Frankfurt or Dublin, but the operators still belong to groups headquartered in the USA.
For years, companies and public authorities have concentrated their infrastructure with a few US hyperscalers because it was convenient and well integrated. As a result, part of the control over their own data and processes lies with providers that are subject to US law. Today, this dependency is the status quo.
With artificial intelligence, the same decision is now coming up again, this time not for storage but for knowledge work itself.
A structural question
The question concerns every provider in your company's critical path that is subject to a legal system outside the EU. Anyone who recognises a concentration risk with one provider should check for it with all of them. This is not about the quality of a model, but about control and dependency.
What contracts govern and what they do not
Many companies rely on their contract: enterprise agreement, service level agreement, data processing clauses, a data centre in the EU. A private-law contract binds the provider, but not the government of the country in which it is based, and it is subject to that country's public law.
One example is the US CLOUD Act: under 18 U.S. Code Section 2713, providers subject to US law must comply with orders from public authorities to preserve or disclose data that is in their possession or under their control, regardless of whether it is stored in the USA or abroad. A data centre in Frankfurt does not change this power as long as the operator is subject to US law.
The European Court of Justice's Schrems rulings exposed the conflict between the EU's level of data protection and the access powers of US authorities. The Court therefore declared two transatlantic data protection agreements invalid. In addition to the contract, you should therefore also check which law each provider in your workplace is subject to.
Why the whole workplace matters
The risk cannot be limited to a single tool. The leverage lies not with a product, but with the legal system to which a provider is subject, and it covers every component of that provider, from Office to cloud to AI.
If access to a provider's services were restricted, it would not only affect the AI model, but also the Office in which texts are created, the cloud in which they are stored, the email service and video conferencing. If Office, cloud and AI are with providers under the same legal system, these dependencies are concentrated.
What would be affected then is not a single tool, but the ability of the entire company to work. With cloud and Office, this dependency already exists. Anyone who now also places the AI layer, the heart of future value creation, with the same US providers deepens it all the way into decision-making processes, knowledge work and confidential communication. That is why it is worth considering Office and cloud as well when introducing AI.
Sovereignty is not an ideology, it is risk management
At this point, the accusation is often made that this is anti-American or hostile to technology. The opposite is true. US technology is powerful, and the companies mentioned build outstanding products. That is not the point. It is about a sober business question: do you want your company's ability to act to depend on decisions that are made in a foreign capital and over which you have zero influence?
With physical goods, it is common practice to spread the supply chain across several suppliers and jurisdictions. The same basic rule applies to digital infrastructure. Digital sovereignty is therefore not a political stance, but simply risk management: the ability to remain operational under all circumstances. A powerful tool is worthless if a third party decides on its availability. Control beats convenience as soon as an emergency occurs.
Nexoria: understanding data flows and providers
This is exactly where Nexoria comes in. For the assessment of our platform, we name the individual processing steps and their providers. File storage and search must be distinguished from AI answer generation as well as from additional services and activated integrations.
- Files and search in Germany. Backend, databases, knowledge index and local models for embeddings and semantic search run on servers in Germany.
- Answers from France. Mistral AI processes the content required for AI answer generation in France. Under the individual data processing agreement, the data transmitted by Nexoria is not used for model training.
- Check other services separately. Technical error monitoring via Sentry, optional email integrations and the telephone connection via Telnyx for the VoiceBot are listed under Security with their data flows.
- Optional external AI. ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these integrations. When connected, shared content is transferred to the respective provider. That provider's terms, processing locations and settings apply.
- One shared workplace. Doc, Calc and Slides for documents, spreadsheets and presentations, Mail for communication, Drive for files and the knowledge base, and Meet for video conferencing are part of the Nexoria product family. The data flows depend on the functions used in each case.
- Offline availability. As a native application, core functions remain available even when the external connection is interrupted. A connection is required to use external AI services.
This division makes the services involved verifiable. It is no guarantee that all functions will remain available regardless of external providers or legal and technical changes.
The decision is due now
With cloud and Office, the dependency already exists; with AI, you are making the decision now. The AI layer is only just being built. In these months, every company is deciding on what foundation its future value creation will rest. This decision is not purely an IT question, but a strategic choice about who will control your digital core in future: you yourself, or a legal system in which you have no part.
Sovereignty comes from an architecture whose data flows and providers you know and can verify. Sovereign AI and a sovereign Office, both from Europe, both in your hands.
Ready for the next step? Get to know Nexoria in a personal demo: files and search in Germany, AI answer generation by Mistral AI in France.
- Christian Klever is CTO and Co-Founder of Nexoria Systems, Caan Grueneberg is CEO and Co-Founder.