Two worlds of AI
Updated on 23 September 2026: the sections on models, performance and open-weight offerings no longer contain outdated model comparisons, statements about OpenAI are based on its own documentation, and the optionally connectable AI providers have been added. On 4 September 2026, the section “No training on customer data” was split by offering and based on the contractual terms applicable in each case.
Paris-based Mistral AI develops language models and offers them as an API service and as open-weight models. What the difference from OpenAI means for European companies.
The story of modern AI is currently being written by very different players. Two of them are the focus of this article: OpenAI, founded in 2015 in San Francisco, and Mistral AI, founded in 2023 in Paris, with its headquarters in the EU.
Both offer their models via API services. Mistral also regularly publishes open-weight models, which companies can host and control themselves. According to Mistral's model overview, these now also include the flagship Mistral Large 3 (Mistral: Models Overview, retrieved on 23 September 2026).
For European companies, this distinction is far more than a technical detail. It affects which legal system governs the processing of your business data and how much control you retain over your AI infrastructure.
Mistral AI: founded in Paris
Mistral AI was founded in May 2023 by Arthur Mensch, Guillaume Lample and Timothée Lacroix (three researchers who had previously worked at Meta AI (FAIR) and Google DeepMind). The company is a French Société par actions simplifiée (SAS) with its registered office in Paris (Mistral AI: Legal Notice). This means that the GDPR, the EU AI Act and French data protection law apply to Mistral.
For Nexoria: answer generation by Nex uses Mistral AI, with processing in France. This information describes the Nexoria configuration. Which regions and conditions apply to other Mistral offerings is set out in the respective contract.
OpenAI is a company headquartered in the US. For providers subject to US law, the US CLOUD Act (18 U.S.C. § 2713) applies: US authorities can order the disclosure of data, regardless of where it is stored. At the same time, OpenAI describes European data residency for eligible customers, with product-specific requirements (OpenAI: Introducing data residency in Europe, checked on 19 September 2026). For the assessment, storage location and applicable law therefore have to be considered together.
With a European provider, the CLOUD Act question arises differently. Whether it has a US connection through group companies, infrastructure or subcontractors should still be part of the review. For the overall processing of a platform, the other services involved also matter. We list the other services involved at Nexoria under Security and in the processing register .
No training on customer data
One of the most important questions when using AI services is: What happens to the data I send to the model? Are my business data, contracts, customer names and internal documents used to improve the model?
The data that Nexoria transmits to Mistral AI is not used for model training. The exclusion is agreed in the data processing agreement between Nexoria and Mistral AI. This operator information was confirmed on 9 September 2026 and refers to Nexoria's individual contract with Mistral AI. It is not a general statement about all Mistral AI offerings. Details on the contractual basis and status can be found under Nexoria at a glance.
With OpenAI, too, the rules differ depending on the offering. According to its own documentation, OpenAI does not use content from its business offerings and the API for model training by default, unless customers explicitly share data for this purpose (OpenAI: Business data privacy, security, and compliance, checked on 19 September 2026). Personal ChatGPT accounts have their own settings. In addition, an exclusion from training does not automatically mean that no data is stored. Retention periods must be checked separately for each service. How to check the data flows, training and retention of a service is described in the article Shadow AI: What matters when choosing an AI provider.
This distinction is essential for companies. If employees use personal accounts instead of the approved services, the settings of those accounts apply, not those of your company contract. With Mistral, too, the service used and the applicable contractual terms determine what applies. The statement about Nexoria refers to the individual contract with Mistral AI: at Nexoria, the training exclusion is agreed in the data processing agreement with Mistral AI.
Performance: compare models on your own use case
A common concern when switching to European AI models: do you have to compromise on performance? There is no universal answer, because both providers change their model offerings at short intervals. Leaderboards and benchmarks are therefore snapshots.
In the Chatbot Arena, now LMArena, users blindly rate two model answers against each other, and the leaderboard is produced using an Elo system. It is a useful reference point, but each placement only applies to the day on which you look it up.
For an in-house comparison, these points matter most:
- Multilingual capability: Test the models with your own texts in German and in the other languages you need.
- Context window: Check how much text a model can process per request and whether that is enough for your documents. This information can be found in each provider's model documentation.
- Function calling and structured outputs: Mistral documents function calling and structured outputs for its models (Mistral documentation: Function Calling, retrieved on 23 September 2026). This is crucial for connecting to your own tools.
- Everyday tasks: Document analysis, email drafts, knowledge management and reports can be compared using a small dataset of your own.
Performance is therefore a question you answer with your own examples. The legal framework can be clarified in advance.
The legal difference
Even if OpenAI and Mistral offered identical models with identical performance, there would still be a legal difference. And it is decisive for European companies.
OpenAI is a US company headquartered in San Francisco, California. This means:
- CLOUD Act (18 U.S.C. § 2713): US authorities can demand data from US providers by means of an order, even if the servers are located outside the US.
- FISA Section 702: The provision (50 U.S.C. § 1881a) allows US authorities to require providers of electronic communication services to assist in the surveillance of non-US persons outside the US.
Mistral AI is a French Société par actions simplifiée headquartered in Paris. This means:
- GDPR as binding law: Mistral is subject to the GDPR not as a contractual commitment but as mandatory law, enforced by the CNIL (French data protection authority) and the national supervisory authorities of the EU.
- EU AI Act: As a European company, Mistral must comply with the EU AI Act, with transparency obligations, risk classification and documentation requirements that only apply to US companies if they operate in the EU.
- US law only with a US connection: The disclosure obligation under the CLOUD Act and the duties to cooperate under FISA Section 702 are aimed at providers that are subject to US law. Whether a European provider has a US connection through group companies, infrastructure or subcontractors is part of the review.
In practice, this means: a contractual commitment from a US provider does not override the disclosure obligation under US law. With a European provider without a US connection, this question does not arise in the same form.
Open weight: transparency instead of a black box
Besides the legal dimension, there is another difference: the degree of transparency.
With models that are only offered as an API service, the weights and architecture details cannot be inspected. Companies cannot trace how the model works internally, which data went into its training or how decisions are reached. The only access is via the provider's API.
Mistral takes a hybrid approach. The company regularly publishes open-weight models, whose weights can be freely downloaded and used. These include, among others:
- Mistral 7B: the company's first model, from 2023
- Mixtral 8x7B: a mixture-of-experts model
- Mistral Large 3, Mistral Small 4 and the Ministral series: released under the Apache 2.0 licence according to Mistral's model overview (retrieved on 23 September 2026)
For companies, open-weight models mean:
- Self-hosting possible: You can run the model on your own infrastructure, in your own data centre, on your own server. The data does not leave your network. No API call to an external service, no third party in the processing chain.
- Full control: You decide which version of the model is used, when updates are installed and how the model is configured. No provider can roll out an update overnight that changes how your model behaves.
- Auditability: The model weights can be inspected. Security researchers and auditors can examine the model for bias, security vulnerabilities or undesirable behaviour, which is not possible with API-only models.
- Independence: No vendor lock-in. If Mistral triples its prices or discontinues the service tomorrow, you already have the model weights on your server. Your AI infrastructure keeps working.
For document embeddings and semantic search, Nexoria uses local models on its own servers in Germany. The final answers are generated via the Mistral API with processing in France. Under the individual data processing agreement, the data transmitted by Nexoria is not used for model training. ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these integrations. When an integration is used, shared content is transmitted to the respective provider. Its terms, processing locations and settings are decisive. Other services and enabled integrations are described separately under Security .