Most European companies approach data sovereignty as a legal obligation. They read the GDPR, they configure their AWS region to eu-west-1, they sign a Data Processing Agreement, and they consider the matter closed.

This is the wrong frame.

Data sovereignty is a competitive strategy. The companies that understand this in the next 24 months will be structurally harder to displace. The ones that don't will spend a decade paying rent to infrastructure they don't own, for models they can't audit, at prices set by someone else.

I am not making a political argument. I am American. I spent ten years in US big tech — Uber, HERE Technologies. I understand how the hyperscalers work because I built systems on top of them at scale. What I'm making is an engineering and economic argument.

The Real Cost of Renting Intelligence

OpenAI's GPT-4o costs $0.0025 per 1,000 input tokens at the time of writing. Claude costs $0.015 per 1,000 tokens for Sonnet. These numbers look small until you multiply them.

A company processing 500,000 support tickets per year, each requiring a 2,000-token context window, is spending between $2,500 and $15,000 per year on inference alone — before you account for output tokens, retries, rate limits, and the engineering time to manage API versioning as providers deprecate models under you.

Now add the cost of not owning your training data. When you run inference through a third-party API, your production data — the edge cases, the domain-specific language, the failure modes specific to your product — goes into a black box you don't control. You cannot fine-tune on it easily. You cannot audit what the model learned. You cannot port your improvements to a different provider when the pricing changes.

This is a form of vendor lock-in that most companies don't recognize until they are already locked.

What Self-Hosted Inference Actually Looks Like

I run production AI inference for two iOS applications on a single machine: an AMD Ryzen 7 PRO NUC with 28GB of RAM and an NVMe drive. The applications serve real users. The inference runs locally via ONNX Runtime. There is no AWS bill for this workload. There is no per-token cost. There is no API key to rotate.

Here is what the architecture looks like:

Mobile app (React Native / iOS)
    ↓
Cloudflare Tunnel (zero-config TLS, DDoS protection)
    ↓
FastAPI on port 8000 (uvicorn, async)
    ↓
ONNX Runtime inference (320n.onnx / 640m.onnx models)
    ↓
Result returned in < 200ms

The model runs in-process. No network hop to a GPU cluster. No cold start latency. No token budget to manage. The 320n model handles 10 requests per second comfortably on this hardware. The 640m model — more accurate, slower — handles 3 to 4. For most European startups at Series A to C, this is more than sufficient for production workloads.

The infrastructure is managed via Ansible playbooks checked into git. Deployments happen through GitHub Actions over a Tailscale VPN. Configuration drift is impossible because nothing is configured manually. A new team member can reproduce the entire environment from scratch in 45 minutes.

This is not a research prototype. It runs in production today.

The GDPR Argument Is Weaker Than You Think

Companies frequently cite GDPR as the primary reason for data sovereignty. This is backwards.

GDPR compliance via an American hyperscaler requires trusting that the Standard Contractual Clauses your legal team signed will hold up under Schrems III — assuming there is a Schrems III. It requires trusting that the EU-US Data Privacy Framework will remain intact through the next political cycle. It requires trusting that the provider's subprocessors — the CDN, the logging pipeline, the fraud detection system — are equally compliant.

Self-hosted inference eliminates this trust surface. When inference runs on hardware you own, in a data center you control, the data never leaves your jurisdiction. There are no SCCs to negotiate because there is no transfer to a third country. The GDPR question becomes simple: where is the data processed? On your machines. Full stop.

This is not an argument against cloud infrastructure in general. It is an argument that AI inference — the layer where your most sensitive data is processed and where the most valuable patterns are learned — deserves serious consideration as something you own rather than rent.

The EU Moment Is Real

GAIA-X, SPRIND, the EU AI Act, the European Data Spaces initiative, the European Chips Act. There is genuine political will — backed by meaningful capital — for European digital infrastructure independence. This is not a protest; it is an industrial policy.

The EU AI Act in particular creates real asymmetry. High-risk AI systems — which include AI used in hiring, credit, healthcare, law enforcement, and critical infrastructure — face requirements around transparency, auditability, and human oversight that are significantly easier to satisfy if you own the model. When a regulator asks you to explain why your system made a decision, "I used the API and don't have access to the weights" is not an acceptable answer for a high-risk application.

For the Berlin CTO at a Series A fintech: if you are anywhere near credit scoring, fraud detection, or automated financial decisions, you are in the high-risk category. Owning your model is not optional. The question is whether you start now, when you have time to build it properly, or later, when a regulator has already flagged you.

The Leave-Behind Philosophy

When Westover Labs works with a client, the engagement ends. That is by design.

Most AI consultants leave behind a dependency — a SaaS integration, a managed service, a retainer. The client cannot modify the system without going back to the consultant. The system cannot adapt without a contract renewal. The value created is not owned; it is leased.

The alternative is infrastructure as code: Ansible playbooks that reproduce the entire stack, GitHub Actions workflows that automate deployment, knowledge graphs built on PostgreSQL with pgvector that preserve every architectural decision in a queryable form. When the engagement ends, the client owns all of it. No vendor lock-in. No ongoing fees. No single point of failure in the form of a consultant's calendar.

A knowledge graph that remembers why a decision was made is worth more than documentation that describes what was decided. The former is queryable by the AI systems that will maintain and extend the infrastructure. The latter goes stale the moment it is written.

This is what data sovereignty means at the infrastructure level: you own the system, the data it has learned from, and the institutional memory of how it was built.

The Practical Starting Point

If you are a Berlin CTO considering whether to build or buy your AI infrastructure, the question is not "cloud versus self-hosted." Most mature architectures use both. The question is which layer you own.

Own the inference layer for any workload that processes sensitive data or where latency and cost matter at scale. Own the fine-tuning pipeline for any domain where off-the-shelf models underperform. Own the evaluation framework so you can detect model drift without depending on the provider's dashboard.

Use managed services for commodity workloads where the data is not sensitive and the cost is genuinely lower than operating it yourself. Blob storage, email delivery, DNS — these are not where the AI value is created, and they are not where the strategic risk lives.

The minimum viable sovereignty stack:

  • ONNX Runtime for inference — runs anywhere, no license fees, fully reproducible
  • PostgreSQL with pgvector for semantic search and knowledge storage
  • Ansible for infrastructure automation — your setup is reproducible from scratch by any engineer
  • Cloudflare Tunnels for secure external access without exposing infrastructure directly
  • Self-hosted GitHub Actions runners for CI/CD that never sends your code to a third party

None of this requires a dedicated AI team. A competent infrastructure engineer can operate it. A three-month engagement can design and build it. The ongoing maintenance cost is low because the architecture is simple and the components are stable.

The Honest Summary

You can rent intelligence from US hyperscalers indefinitely. The service works, the APIs are well-documented, and the marginal cost is low for small workloads.

But you are not building a small workload. You are building a company. The data you collect in the next five years will determine what models you can train. The models you can train will determine what products you can build. The products you can build will determine whether you are a market leader or a market participant.

Sovereignty is not a compliance checkbox. It is the decision about whether your most valuable strategic assets — your data, your models, your inference pipeline — are owned by you or by someone else.

The infrastructure to own them is not expensive, not exotic, and not particularly difficult to build. What it requires is the decision to build it.