Data sovereignty, AI model dependency

An EU cloud region gives companies control over where their data is processed. It does not establish whether they can switch the AI model they use. In an Accenture survey, 60 per cent of organisations applied sovereignty or location requirements to data, while only 22 per cent applied them to AI models. IT leaders should therefore build model switching into their architecture and contracts early.

Key takeaways

The control gap between data and model

A company can process data in an EU region while depending on a single model provider. Factors such as the available model versions, the interface and the ability to redirect requests to another model then become decisive. Data location alone does not answer these questions.

The Accenture survey of 1,928 executives from July and August 2025 shows the levels at which the surveyed organisations apply sovereignty or location requirements: 60 per cent cite data, 46 per cent infrastructure and 22 per cent AI models. The figures show the extent of such requirements in the sample. On their own, they establish neither the actual security of the systems in use nor how easily they can be replaced.

For AI applications with access to tools and business processes, the assessment should therefore also cover the model and its integration: Who determines the model version? What data goes to the service? Which functions depend on a provider-specific interface?

The switching path starts with architecture

A dedicated interface layer can decouple applications from individual model APIs. This allows prompt templates, tool permissions and logs to be managed in a targeted way. Even then, switching is a project: models differ in their output formats and behaviour. A replacement must be tested for quality and failure modes using representative tasks.

Practical evidence is therefore essential for an exit plan. This includes an alternative model or operating method, documented dependencies and a test covering data migration, permissions and the continuation of the business process. For locally operated models, companies must also check provenance, licence terms and control over the entire runtime environment.

Cloud contracts must account for switching

The Data Act sets out switching rules for covered data processing services. Among other things, the contract must provide for a notice period of no more than two months before the switching process begins. When a customer switches, the contract generally ends after the process has been successfully completed. The contract review should also establish which data and digital assets can be exported.

From 12 January 2027, providers will no longer be allowed to levy switching charges. Until then, the regulation limits such charges during the transition period to the relevant costs. This does not automatically eliminate all work for the customer: companies should plan in particular for their own adaptations and tests of the target system.

Financial entities need an exit plan

For financial entities, DORA requires management of ICT third-party risk. If an ICT service supports critical or important functions, the financial entity must have an exit strategy. Exit plans must be comprehensively documented, adequately tested and regularly reviewed.

Whether an AI service supports such a function depends on its particular use. Looking at the cloud location in isolation is insufficient for this decision. Companies should also establish which processes depend on the model and its other service providers.

In addition, transparency obligations under the AI Act have applied to certain AI systems since August 2026. The European Commission gives 2 December 2027 as the date for requirements applicable to certain stand-alone high-risk AI systems. The obligations that apply depend on the system, its intended purpose and the company’s role.

Frequently Asked Questions

Image source: AI-generated (November 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.