A Data Centre in Frankfurt Doesn’t Make Your AI Sovereign

“The data stays in Germany.”

In conversations about AI, that sentence is often meant to settle the question. For me, it’s where the conversation starts.

Of course location matters. Especially when public authorities or companies handle sensitive information. But an address in Frankfurt tells you very little about who actually controls a system.

Who can access it? Who decides which model runs? Who installs updates? And what happens if the provider changes its terms tomorrow?

Those questions are harder to answer than where the servers sit. They also tell us much more about how independent we really are.

Who holds the keys?

A system can run in Germany and still depend on a company whose decisions the customer has little influence over.

It might need a regular connection to an external service. Only the provider might be able to update the model. You might be able to export your data while the workflows, connections and analysis you spent years building remain trapped in its software.

During normal operations, these dependencies are easy to overlook. Everyone wants things to work. Support responds. Bills get paid. The next update arrives.

Things get interesting when interests diverge.

A provider raises prices sharply. Discontinues a product. Gets acquired. Or decides to change how it serves certain customers.

That’s when you find out how much control the customer actually has.

I want to know how we get out

Anyone buying an AI system should ask for as much detail about leaving as they do about getting started.

Can we replace the model without rebuilding the entire application? Can we get our data back in a usable format? Can we take our configurations and processing workflows with us? Who could take over operations?

And practically: how long would it take?

If switching is theoretically possible but requires two years of work and another multimillion-euro budget, the dependency is very real.

For me, a credible exit plan belongs in every serious purchasing decision. It doesn’t need to cover every eventuality. But someone should have thought it through before the organisation commits for years.

Europe doesn’t have to build everything itself

I don’t believe we need to recreate every technical component in Europe. We will continue working with international partners. That makes sense and, in many areas, is necessary.

But we should know where we depend on them and what those dependencies could mean.

If a tool for drafting ad copy goes down, you can usually work around it. An application that a security agency relies on in daily operations requires a different standard.

You need to know who has access, who approves changes and how operations continue when something fails. Even the ability to keep using a proven version can be critical.

A European logo answers these questions no better than a German server address. I would judge a European provider by exactly the same standard: how much control does it actually give its customers?

Settle this before signing

These requirements belong in product selection, contracts and acceptance testing.

A data export can be demonstrated. A model replacement can be tested. Access permissions can be inspected. Specific people can be made responsible for keeping operations running during an outage.

That takes time. It forces providers to be precise. And it may mean an impressive demo isn’t enough to win the contract.

I’m comfortable with that.

If we want to use AI for important work in Europe, we also need the ability to assess it, operate it and replace it when necessary. Otherwise, we are buying systems whose terms will remain in someone else’s hands.

A data centre in Frankfurt is a good start.

My next question would be: Can we keep working if the provider says no tomorrow?