How to understand AI Sovereignty in EU

When European boards talk about “AI sovereignty,” they are usually wrestling with a quieter, more practical anxiety: not where the tin sits, but who can compel access, who can read the logs, and how easy it will be to unwind a choice when the world shifts. Compliance is a threshold, not a destination; it tells you whether you may proceed, not whether you are in control. The sharper conversation is about jurisdiction layered over routing, about telemetry as much as inference, and about exit paths that don’t break the product. In that light, choosing between Claude on Bedrock and GPT on Azure is less about model poetry and more about plumbing you would be comfortable defending to a regulator and explaining to a customer.

On AWS, Anthropic’s Claude through Bedrock is a good example of EU residency done with a clear spine: deploy via Ireland or Stockholm and requests stay within a single region; pick Frankfurt or Paris and you’ll use the EU cross‑region inference profile, keeping data within the EU geography even if it moves between EU regions. In all those Bedrock paths, providers don’t train on your data by default, which gets many organisations to a defensible place today and tighter still with the announced AWS European Sovereign Cloud. By contrast, GPT isn’t offered natively on Bedrock; if you call OpenAI’s own API from AWS, the default global routing can take data outside the EU, though eligible Enterprise and API customers can now enable EU data residency via an in‑region project setting rather than a one‑off deal. The nuance with “Claude on Foundry” is architectural: today it runs on Anthropic‑managed infrastructure rather than Azure’s EU regions, so the residency guarantees you get with Bedrock don’t yet extend to that path, with EU‑native Foundry inference on Anthropic’s 2026 roadmap. The lesson is simple and often overlooked—your sovereignty posture is the sum of your routing choices, not the brand printed on the model card.

On Microsoft Azure, GPT is the first‑class citizen: Azure OpenAI can be deployed in EU regions within Microsoft’s EU Data Boundary, with content not used for training and options to suppress or keep logs in‑region, especially when paired with customer‑managed keys, private networking, and EU‑only support paths. But an EU region label alone isn’t enough—a “Global” or “Worldwide Standard” deployment can still route data outside the bloc for processing or logging; a Data Zone or in‑region deployment is what actually pins residency. It’s also worth keeping jurisdiction in view: a US‑headquartered provider operating in Europe strengthens EU controls, but it still sits within the ambit of US law. Claude is beginning to appear in Azure’s model catalog, yet coverage and operational parity vary by region—and EU‑native inference isn’t live—so this is one to test rather than assume. In the end, this isn’t a referendum on virtue; it’s a choice about clearer jurisdiction, cleaner plumbing, and reversibility—can you show precisely where the data flows, who can touch it, and how you would switch suppliers next year without breaking the business?