How does Sovera support NIS2 compliance?

NIS2 asks essential and important entities to manage supply-chain risk, control access, and evidence what happened during an incident. Sovera's agentic framework gives you role-based approvals, segregation of duties, rollback, and an audit trail for every investigative action, delivered by an EU-domiciled provider.

How does Sovera fit DORA ICT third-party risk requirements?

DORA asks financial entities to understand and limit concentration risk across their ICT providers. Sovera runs inference on its own GPUs in its own EU data center, with no hyperscaler in the model-serving or customer-data path, so your MDR provider doesn't add another dependency on the same few US clouds.

Where is my data stored and processed under GDPR?

Customer data is processed and stored under EU jurisdiction, in a data center located and operated within the EU. It doesn't transit or get cached on any US cloud service, at any point.

What's the difference between data residency and data sovereignty?

Data residency only tells you where a server sits. Data sovereignty is about who owns and operates the infrastructure, which laws govern it, and who controls the AI acting on your data. An EU region on a US-headquartered cloud gives you residency. Sovera is built for sovereignty.

Is every layer of Sovera's AI sovereign?

No, and we'd rather tell you than have an auditor find out. The model weights and fine-tuning come from Mistral, an EU company, and GPU silicon is a US supply-chain dependency every vendor shares. Inference, data processing, the agentic framework, the facility, and the company itself are fully under Sovera's control in the EU.

Sovereignty

Who watches the watchmen?

Most “sovereign AI” vendors won't tell you where their claims end. We will. Sovera is sovereign MDR built in Europe: open-weight AI on our own GPUs, in our own EU data center, with no hyperscaler in the path. It's the only kind of data sovereignty claim that survives NIS2, DORA, and GDPR scrutiny, and the only kind worth building a SOC on.

Map of the EU inside a ring of EU stars, with security data flowing from Sovera's Copenhagen hub to EU cities and an outbound path blocked at the EU border

GDPR

Customer data is processed and stored under EU jurisdiction. It never transits or gets cached on a US cloud service, at any point.

NIS2

Role-based approvals, segregation of duties, and a full audit trail for every investigative action. Mapped to NIS2 access-control requirements.

DORA

An EU-domiciled ICT provider with no hyperscaler in the inference path. Less concentration risk in your third-party register.

EU jurisdiction

Copenhagen HQ, EU legal entity, Sovera-owned infrastructure. Legal domicile and governance sit fully in the EU.

Why it matters

Why sovereignty claims are under scrutiny

A 2026 Tech Policy Press / AI Now Institute analysis found that most European “sovereign AI” claims collapse under scrutiny: proprietary US models bundled with hyperscaler contracts, or inference capacity that subsidizes the same US labs it was meant to counter. Sovera is built differently. Analysts call it compute sovereignty: owning the critical inference infrastructure rather than renting access to it. It's a narrower, harder claim than “we use a European model.” It's also the one that matters for NIS2 and DORA-regulated buyers.

Compute sovereignty

An open-weight Mistral model served on Sovera-owned GPUs, inside a Sovera-controlled EU data center. We own the inference path. We don't rent it.

No hyperscaler in the path

No hyperscaler sits in the model-serving or customer-data path. Your data never leaves infrastructure Sovera owns and operates.

Every action auditable

An agentic framework with built-in authentication, segregation of duties, and approval controls. Every investigative action leaves an audit trail.

Typical “sovereign AI”

Proprietary US model behind a European brand

Hyperscaler in the inference and data path

EU region on a US-headquartered cloud

Telemetry cached on US cloud services

Black-box agent actions with no approval trail

Sovera

Open-weight Mistral model from France

Our own GPUs in our own EU data center

Copenhagen HQ and EU legal entity

Data processed and stored under EU jurisdiction

Approvals, rollback, and a full audit trail

The sovereignty stack, layer by layer

We could call all of this “sovereign.” We won't. Here's exactly what Sovera controls, what we don't, and what it means for your GDPR, NIS2, and DORA obligations.

Stack layer

Sovera controls

Status

What this means for you

Model weights & architecture

Open-weight Mistral model

Partial

Built on an open-weight model from Mistral (France/EU), not a proprietary US model. Sovera doesn't control the original training data or pre-training compute.

Fine-tuning & adaptation

Mistral-controlled

Partial

Handled by Mistral, an EU company, but not by Sovera.

Prompt optimization

Sovera-built, in-house

Sovereign

A proprietary pipeline built and owned by Sovera, tuned to improve accuracy in agent-driven security investigations.

Agentic framework: governance & audit

Sovera-built, in-house

Sovereign

Role-based control over who can generate a report, approve findings, or isolate a host, with full rollback. Maps directly to NIS2 and DORA access-control and auditability requirements.

Inference & model serving

Own GPUs, own data center

Sovereign

No hyperscaler in the inference path. Your data never leaves infrastructure Sovera owns and operates.

Physical hardware (GPUs)

Owned, not rented

Partial

The hardware is ours. The silicon itself is a US supply-chain dependency shared by every vendor in the industry, not a Sovera-specific gap.

Data center & facility

EU-located, Sovera/partner-operated

Sovereign

Located and operated within the EU. Jurisdiction and physical access control both stay on European soil.

Customer data processing & storage

EU jurisdiction

Sovereign

The core GDPR, NIS2, and DORA guarantee: your data doesn't transit or get cached on any US cloud service, at any point.

Corporate structure & jurisdiction

Copenhagen HQ, EU entity

Sovereign

Legal domicile and governance sit fully in the EU, meeting NIS2 and DORA procurement requirements that offshore vendors can't.

Free ebook

Your tools are making decisions. Who's checking the decisions?

Sovereign infrastructure answers where your data lives. Governing the AI that acts on it is the other half. Our field guide, New Processes for the AI-Driven SOC, covers the five shifts behind an AI-native SOC, including why governance has to move outside the model.

Get the free ebook →

Questions compliance teams ask

Let's put it to the test.

No hyperscaler path, EU jurisdiction, a full audit trail, and radical transparency. Want to see how sovereign MDR fits your environment? Let's start with a conversation, not a claim.

Talk to us