A French model called through an operator subject to foreign law remains exposed to that law. An open model run on your own infrastructure greatly reduces your dependence and exposure, without solving everything.
An AI agent’s sovereignty cannot be read from its model’s flag. It is decided by its architecture: where it runs, which law applies to whoever operates it, who can access what it sees, and whether you can change it tomorrow.
In France, the debate often boils down to one question: “French model or American model?”. It is a good question, but not a sufficient one. For an SME that entrusts its emails, quotes or CRM to an agent, what matters is knowing who can, legally and in practice, access what the agent sees. And whether it can take back control.
The six layers of sovereignty
An agent can be under control at one layer and dependent at another. The model’s nationality is only the first.
| Layer | The question to ask | What strengthens control |
|---|---|---|
| 1. The model’s origin | Who trained it, on what data, with what choices? | An identified publisher, published documentation |
| 2. Weights and licence | Can the model be downloaded? What does the licence allow? | Weights available and a licence that permits your use, hosting and modification |
| 3. Place of execution | Where does it run when the agent is working? | Your servers, or a hosting provider you choose |
| 4. The operator’s law | Which entity operates the service, who controls it, who are its subcontractors, who holds the encryption keys? | Exposure to foreign laws analysed and knowingly accepted |
| 5. Data, logs and memory | Where do they go, who can read them, how long are they kept? | Restricted access, encryption, defined retention and deletion |
| 6. Reversibility | Can you change model or provider without rebuilding everything? | Rules kept outside the model, standard formats and APIs, exportable data, skills in-house or at a partner |
No single layer is enough. In-house hosting reduces dependence, but leaves dependence on hardware, updates, third-party components and teams. Nor does it, on its own, guarantee security or compliance.
Weight availability tells you whether you can download the model. The licence tells you what you are allowed to do with it. Openness as defined by the Open Source Initiative goes further: its Open Source AI Definition 1.0, published in October 2024, also requires a complete description of the training data and publication of the code used. A model can therefore have downloadable weights under a permissive licence without being “open source” in the OSI sense. For an SME, the practical question remains: does the licence cover my use, hosting and modification?
Five families of models, none perfect
Each family has its strengths and blind spots. The right choice depends on your data, not on a preference in principle.
| Family | Examples | Strengths | Points to watch |
|---|---|---|---|
| French models | Mistral AI, LightOn | Legal and linguistic proximity (for French companies); according to Mistral, most of its open models are under Apache 2.0 | Some Mistral models have a modified MIT licence (commercial licence above $20M in monthly revenue): check model by model. And through which platform do you use it? |
| European models | OpenEuroLLM (20 organisations, launched in February 2025) | Open approach, European languages | An ongoing research project, not yet a proven offering; being European does not automatically make a model compliant with the AI Act |
| Open weights, American publishers | gpt-oss from OpenAI (Apache 2.0, August 2025), Meta’s Llama | Can run on your own infrastructure, outside the publisher’s online service | Open weights do not mean reproducible training; the Llama licence includes usage restrictions and Llama does not meet the OSI Definition 1.0, according to the published analysis |
| Open weights, Chinese publishers | DeepSeek-R1 (MIT), Qwen3 (Apache 2.0) | Permissive licences, wide adoption | Provenance and training bias to be assessed; the “distilled” variants of DeepSeek-R1 inherit the licence of their base model (Qwen or Llama) |
| American online services | The major assistants and APIs from OpenAI, Google, Anthropic… | Easy to plug in, contractual commitments for enterprise offerings | The operator is subject to US law, even when processing takes place in Europe: exposure to be analysed according to your data |
The DeepSeek case shows why you need to distinguish between the online service and the model. On 30 January 2025, the Italian data protection authority ordered an urgent limitation on the processing of Italian users’ data by the DeepSeek chatbot and opened an investigation. It found insufficient the response of the two Chinese companies, which claimed they did not operate in Italy and were not subject to European law.
That decision targeted the online service, not the downloadable model. Run on your servers, the model no longer depends on that service. You still need to check that the surrounding application, its extensions and its tools do not themselves send data outside.
A server in France is not enough
On 10 June 2025, before a French Senate committee of inquiry, representatives of Microsoft France were questioned under oath. The record reports three things that must be read together.
According to Microsoft, since January 2025 and under a contractual guarantee, the data of its European customers, logs included, does not leave the EU.
Microsoft says it analyses the validity of every request from US authorities and rejects unfounded ones. But “when we are obliged to hand it over, we hand it over”.
Can it guarantee that French citizens’ data would never be transmitted without the agreement of the French authorities? “No, I cannot guarantee that, but, once again, it has never happened yet.”
This answer does not reflect bad faith: it describes a legal reality. The CLOUD Act, a 2018 US law, allows US authorities to require, through a legal procedure, that a provider subject to their jurisdiction produce data in its possession or under its control, including data stored outside the United States. This does not mean your data is transmitted automatically. It means that an exposure exists, and that it depends on the law applicable to the operator, not just on the data centre’s address.
Three reference points to frame the debate:
- The EU–US transfer framework is under appeal. On 3 September 2025, the General Court of the European Union dismissed the action brought by French MP Philippe Latombe against the Data Privacy Framework. He lodged an appeal on 31 October 2025 before the Court of Justice (case C-703/25 P). This framework governs certain transfers to certified US companies; it does not, on its own, settle the question of government access.
- The French State has announced a migration. The health data of the Health Data Hub platform, hosted on Microsoft Azure, is due to migrate to a SecNumCloud-qualified host. The stated objective is a first complete copy of the main database by the end of 2026. That is a timetable, not a completed migration, and it shows that reversibility planned after the fact takes years.
- SecNumCloud also targets extraterritorial laws. According to ANSSI (the French cybersecurity agency), this qualification helps identify cloud offerings designed to protect sensitive data “against the cybercriminal threat and the application of extraterritorial laws”. It applies to a specific offering and “does not prejudge the level of security” of hosted customers’ services. Offerings built on American technology can obtain it, such as S3NS (Thales and Google) in December 2025, which is debated. It is a benchmark for sensitive data, not an obligation for every SME.
The point is not to accuse any country. It is to know, for each type of data, which risk you accept.
A simple grid: start from the data, not the model
The right question is not “which model is sovereign?” but “what will the agent see?”. This grid is a first sort, not a legal rule: the GDPR does not prohibit a foreign service in principle; it requires an analysis of roles, purposes, security, processors and transfers. And a local model can also process data in a non-compliant way.
| What the agent handles | Examples | Preferred options | Only after analysis |
|---|---|---|---|
| Public data | Monitoring, content already published, product documentation | All families, including online services | — |
| Routine internal data | Meeting notes, procedures, sales drafts | Online service under an enterprise contract, with no reuse for training; or a hosted open model | Free personal accounts, consumer apps |
| Personal data | CRM, HR, client files, emails | Open model hosted by you or by a European host; logs and memory under your control | A service where you do not know where requests and logs go, or who accesses them |
| Strategic or regulated data | Health, defence, trade secrets, sensitive public procurement | Open model on your infrastructure, or a SecNumCloud-qualified host; sector-specific requirements | An operator exposed to an extraterritorial law, unless analysis of the contract, data control and technical measures concludes that the risk is acceptable |
- The agent’s logs and memory are data in their own right, often more sensitive than the requests: define who accesses them, how long they are kept, how they are encrypted and deleted.
- The agent’s rules must not live in the model (what it may do, what requires validation): this is one of the conditions for being able to change it.
Our choice at Invaist
The above applies to any SME. What follows is our choice as a company. At Invaist, we favour open source models deployed on our clients’ infrastructure. In our view, this is what gives an SME the most control over layers 3 to 6: where the agent runs, who operates it, where the data goes, and the freedom to switch.
Above all, we build our agents so that the model is replaceable. The agent’s permissions, the list of actions that require human validation, the logs and the emergency stop live in the architecture, not in the model. This follows directly from our article It’s not AI that makes an agent safe, it’s its architecture : what makes an agent safe also helps make it controllable.
Our architectural goal: the agent’s data and rules remain under the company’s control, and it can change engine without rebuilding everything. This goal is checked project by project, including for connectors, monitoring tools and any outgoing calls.
At Invaist, this is our starting principle: the agent executes, the human decides.
Sources
- French Senate – hearing of Microsoft France, 10 June 2025 (in French)
- LexisNexis – CLOUD Act and GDPR (in French)
- Le Club des juristes – the EU General Court upholds the Data Privacy Framework (in French)
- Digital Policy Alert – appeal C-703/25 P
- Next – Health Data Hub and SecNumCloud, February 2026 (in French)
- ANSSI – cloud and SecNumCloud (in French)
- Next – S3NS SecNumCloud-qualified, December 2025 (in French)
- Garante privacy – DeepSeek press release, 30 January 2025
- Next – the OSI’s Open Source AI Definition 1.0 (in French)
- Mistral AI – open model licences
- Presse-citron – launch of OpenEuroLLM (in French)
- YourStory – release of gpt-oss
- Hugging Face – DeepSeek-R1 model card
- Hugging Face – Qwen3-32B model card