A sovereign AI is an artificial intelligence deployed on infrastructure you control end to end: your data doesn't pass through a third party's servers, you aren't locked into a subscription whose terms change overnight, and you can check what the software does. For an SME, this isn't a luxury reserved for large groups, it's a risk-management decision. This guide explains what the term really covers, why it matters especially for a small business, and how we approach it at Scarlet Wolf.
The word is used everywhere, often wrongly. Sovereign AI isn't a European flag on a brochure. It rests on three concrete conditions:
An honest clarification, because it often goes unsaid: sovereignty covers the application and your data, not necessarily the language model itself. You can plug in models that run locally on your own machine, or cloud models with your own keys. In the second case, the request goes out to the model provider, but the application, the history and your knowledge base stay with you. The choice is yours, depending on your confidentiality and budget constraints.
Large groups have lawyers to negotiate SaaS contracts, security teams to watch the data flows, and budgets to absorb an incident. An SME often has none of that, while it's the one with the most to lose if customer data leaks or access to a now-central tool is cut off.
This point deserves its own discussion. In short, three risks come up.
Your data can train the model. Under the terms of some platforms, what your teams type can be used to improve the global model. Your internal information then feeds a system you no longer oversee.
Legal sovereignty is uncertain. A service operated under US law stays subject to the CLOUD Act, even when hosted in Europe. Many discover this too late, and we broke it down in why "hosted in Europe" isn't enough. Compliance with the GDPR, for its part, plays out in how you use the tool, as we explain in cloud assistants and the GDPR.
Dependency creates a discontinuity risk. A price change, an acquisition, a service shutdown, and the tool your organisation depends on can disappear or double in price without notice.
The sovereign approach, deployed on your premises, neutralises these three points at the root: no reuse of your data, no foreign order with any hold, and an instance that keeps running whatever happens to its publisher.
Our guarantees aren't checkboxes on a brochure, they follow from the architecture:
The product that carries all this today, Gungnir, runs in production, on our side and with its first users.
Sovereignty doesn't mean generic AI. One SME doesn't have the same workflows as another, and a genuinely useful assistant is one that knows your context. You feed the AI with your own documents (procedures, files, customer base), which it indexes and searches in your environment to answer from your sources rather than generic knowledge. That makes it an AI personalised to your business, without those documents leaving your infrastructure. The memory side is detailed in why your AI assistant forgets everything between conversations.
Most AI pitches promise the tool does everything. Our first sentence to a client is the opposite: here is what the AI does well, here are its current limits, and here are the cases where we advise against using it. It's a rare stance in a market where marketing often outruns the technical reality. It's also the most solid over time: a client who knows exactly what they're buying stays a client.
Scarlet Wolf isn't a single product but three projects, at very different stages it would be dishonest to conflate:
An AI deployed on infrastructure you control, where your data stays with you and the code is verifiable. It stands against cloud AI, where your data is processed on a provider's servers, subject to its own terms and national law.
No, it's the opposite. An SME doesn't have the lawyers or security teams of a large group to frame a cloud AI, while it has just as much to lose. A solution built to be sovereign from the start brings those guarantees within reach.
The install is designed to be simple (one server, one command). For an SME without a technical team, deployment support is part of the offer. The goal isn't to turn you into a system administrator.
It's source-available, under the BSL licence: the code is public and auditable, with a switch to an open licence planned in time. So you can check what the software does, which is the heart of the sovereignty promise.
Yes. The assistant is model-agnostic: you can plug in open models (such as Llama or Mistral) run locally via Ollama, or cloud models with your own key. Open source models running locally are the most sovereign option, since nothing leaves your server.
Yes. You build a knowledge base from your files (procedures, records, documentation), which the assistant searches to answer from your own sources. That's what makes it an AI personalised to your business, without sending those documents to a third party.
