A sovereign AI avatar is a real-time interactive AI avatar that a regulated institution can run without personal data leaving a network or jurisdiction it controls. Its provider is not one that a non-EU state can legally compel.
In short
We have not found an EU legal instrument that defines sovereign in this context. So the useful test is not a label. It is three questions, about legal control, data residency and operational control. Avatars make those questions harder than text interfaces do, because an avatar can see a face and hear a voice. Under the EU AI Act that is biometric data even when nobody is being identified.
Many vendors in this market use the word sovereign. As at October 2026 we have not found one that publishes a definition of it. That absence is what makes the term hard to act on in a procurement conversation.
This article gives a working definition and the three tests behind it. It sets out why an AI avatar is a harder case than a text-only interface. It also gives a way to check a sovereignty claim rather than believe it.
This article describes our reading of published law and guidance. It is not legal advice, and every institution should confirm its own position with its own counsel.
Sovereign AI avatar: the definition
A sovereign AI avatar is a real-time interactive AI avatar that a regulated institution can run without personal data leaving a network or jurisdiction it controls. Its provider is not one that a non-EU state can legally compel. It has to meet three conditions at once.
Legal control
A sovereign AI avatar has a provider established and controlled in the EU. No non-EU state can then compel disclosure or interruption of service through the provider’s parent company or place of incorporation.
Data residency
A sovereign AI avatar keeps personal data inside the institution’s own network, or inside a jurisdiction the institution has chosen. The boundary is enforced technically, not promised contractually.
Operational control
A sovereign AI avatar leaves the institution deciding who can access the running system, which components it uses, and when it changes. Nobody outside can shut it down, update it, or reach into it without the institution acting.
An AI avatar that meets only the data residency test is a data residency product, not a sovereign AI avatar. That is a real thing and often enough. It is not the same claim.
Is there an official definition? The short answer
We have not found one. EU law uses the phrase digital sovereignty without defining it.[1][2] The EUCS cloud certification scheme is still a candidate.[3][4] The Cloud and AI Development Act proposed in June 2026 is still a proposal.[5]
There is no definition, but there is a scale. The Commission’s Cloud Sovereignty Framework grades a service on five Sovereign European Assurance Levels, SEAL-0 to SEAL-4.[6] In April 2026 the Commission used SEAL-2 as the eligibility floor for its own sovereign cloud contracts.[7] Germany’s federal cyber security office, the BSI, has built testable criteria on the same framework. They are called C3A, short for Criteria enabling Cloud Computing Autonomy, and they include an annual disconnection test and EU-only personnel.[8] None of it certifies a vendor as sovereign. That is why the three tests above and the six questions below matter more than the label.
We set out each instrument, the five SEAL levels and the four C3A criteria worth reading in full in a companion article. It is called Sovereign AI Avatars: The EU Criteria That Decide.
What exists in the EU today, and what each one actually is
None of the four certifies a vendor as sovereign. Two can be used to measure a claim.
Status as at 20 October 2026.
Why avatars are a harder case than text-only interfaces
A chatbot can be sovereign with a data centre. An avatar can see a face and hear a voice. When it does, the AI Act counts that as biometric data even when nobody is being identified. Article 3(34) drops the identification qualifier that GDPR Article 4(14) keeps.[9][10] The Commission’s guidelines point out the difference explicitly.[11]
From there, each capability you add changes what the avatar legally is. Conversing brings the Article 50 duties to tell people they are talking to an AI and to mark generated content. Inferring emotion from a face or voice is prohibited in workplaces and schools under Article 5(1)(f), and high-risk elsewhere.[9] Recognising a returning person by face or voice, rather than by a login, moves the processing into GDPR Article 9.[10]
The full analysis is in a companion article, Sovereign AI Avatars and Biometric Data Under the EU AI Act. It sets the two definitions side by side and walks through the capability ladder.
Same question, two different answers
Why a sovereign chatbot is an infrastructure question and a sovereign avatar is also a biometrics question.
Text chatbot
It reads typed text
What decides whether it is sovereignInfrastructure. Where inference runs, who controls the provider, and who can reach the system. There is no sensor in the loop, so there is no biometric question and no AI Act biometric provision to check.
AI avatar
It can also see a face and hear a voice
What decides whether it is sovereignInfrastructure, plus biometrics. The same three, then three more: biometric data under AI Act Art. 3(34), the emotion inference ban in Art. 5(1)(f), and GDPR Art. 9 if it recognises people.
What a sovereign AI avatar is not
Four claims that sound like sovereignty and are not.
Four claims that sound like sovereignty
What a buyer hears, and what each claim actually establishes.
“Your data stays in an EU data centre”
What it establishesData residency. The provider’s jurisdiction still decides who can compel it, wherever the server sits.
“We will contest any government request”
What it establishesA promise to argue, not an ability to refuse. A provider cannot contract out of its own country’s law.
“We hold HDS, C5 and ISO 27001”
What it establishesSector and security certifications. None of them certifies sovereignty, and non-EU providers hold them too.
“It is self-hosted”
What it establishesAsk what still calls home. Updates, licensing, telemetry and remote support are separate channels from inference.
An EU data centre operated by a non-EU-controlled provider
Section 2713 of title 18 of the US Code was added by the CLOUD Act in March 2018.[12] It applies to a provider of electronic communication service or remote computing service. The provider must comply with obligations to preserve, back up or disclose the contents of a communication and any record pertaining to a customer. That applies to anything within the provider’s possession, custody or control, wherever the information is located.
Section 2713 itself creates no new collection authority. It extends existing obligations, and the operative test is the provider’s possession, custody or control. That is why corporate structure matters alongside server location.
The clearest statement of the practical position came from a provider. On 10 June 2025 a French Senate commission of inquiry heard Anton Carniaux, director of public and legal affairs at Microsoft France. The lead senator on the inquiry, its rapporteur, asked him for a guarantee under oath. The question concerned the data of French citizens entrusted to Microsoft through the UGAP purchasing body. Could he guarantee that it would never be transmitted without the explicit agreement of the French authorities, following an injunction from the US government? His answer, in the committee record:[13]
« Non, je ne peux pas le garantir, mais, encore une fois, cela ne s’est encore jamais produit. »
No, I cannot guarantee it, but, once again, that has never yet happened.
Read the sentence rather than the headlines about it. He did not concede that access had occurred. He declined to guarantee that it could not, in answer to a question narrowed to a US government injunction and to one procurement channel.
Vincent Strubel, director general of the French cybersecurity agency ANSSI, gave evidence to the same Senate inquiry on 28 May 2025. On the value of a contractual promise not to comply, the report records him saying this:[14]
« Un prestataire américain, ou chinois d’ailleurs, qui promettrait de ne jamais communiquer vos données à une autorité de son pays […] vous promettrait en fait d’aller en prison à votre place. »
An American provider, or a Chinese one for that matter, who promised never to hand your data to an authority of its own country would in fact be promising to go to prison in your place.
Summarising his evidence, the rapporteur wrote that against extraterritorial legislation there exist neither effective technical nor effective contractual countermeasures. That is the rapporteur’s formulation rather than a quotation from ANSSI.
Sovereignty is not a legal test, and a data protection officer will not accept it as one. The instrument that governs compulsion from outside the EU is Chapter V of the GDPR, and in particular Article 48. Under it, a third country judgment or authority decision requiring a transfer is only recognisable on one basis. That basis is an international agreement, such as a mutual legal assistance treaty.
Standard contractual clauses and adequacy sit in the same chapter, and transfer impact assessments follow from the Court’s reading of it. Sovereignty is a useful way to describe the risk. Chapter V is where you have to document your answer to it.
A commitment to contest rather than refuse
Microsoft’s European Digital Commitments include a Digital Resilience Promise.[15] It is made to European government customers and for relevant European public-sector contexts. The promise is to contest any order to suspend or cease cloud operations in Europe. That is a meaningful commitment and it is not the same as an inability to comply. We have not identified a major non-EU provider that claims immunity from its home jurisdiction. Read what is actually claimed.
A sector certification mistaken for a sovereignty certification
France’s Hébergeur de Données de Santé certification is a security and compliance requirement, not a jurisdiction test. Microsoft holds one, on a certificate issued in October 2025.[16][17] Germany’s BSI C5 is an attestation of information security. Which of these a health buyer actually needs is a separate question. We will cover it in a companion article on the certifications EU hospitals ask for.
Self-hosted that still calls home for the part that matters
Inference is the step where the model produces its answer. A deployment where the interface runs locally and inference runs elsewhere is a hosted service with a local front end.
And one thing it is not, which people assume it is: a quality compromise
The standing objection to any sovereign deployment is that you give up the best models to get it. That objection was strong two years ago. It has weakened, and there is now a published number for how much.
Epoch AI maintains the Epoch Capabilities Index, an aggregate measure of model capability. Epoch published the finding on 29 May 2026.[18] Since January 2026, it says, the most capable open-weight models have lagged frontier closed models. Open-weight means the model weights are published, so an institution can run the model on its own hardware. The average lag is four months, or 8 index points.
Read that carefully in both directions, because people quote it carelessly in both. Four months is not parity. On any given day the best closed model is better. If your use case genuinely needs the frontier, a sovereign deployment costs you something real.
What four months does mean is that the gap is now a release cycle rather than a generation. A release cycle is a thing a procurement timetable can absorb. It is also an average over one measured period, and an aggregate index rather than a score on your task. So treat it as the shape of the trade-off and not as a promise about any particular model.
For a real-time avatar specifically, the language model is usually not the binding constraint anyway. Latency, the speech and rendering pipeline, and the quality of the retrieval over your own content decide whether a conversation feels right. A four-month-old model in a well-built pipeline beats a frontier model behind an inference hop you cannot control. That is a statement about engineering rather than about sovereignty.
Six questions to test a sovereignty claim
Not one of them asks a vendor whether it is sovereign.
- 1
Which legal entity are we contracting with, where is it incorporated, and who is its ultimate parent?
This is the jurisdiction question, and server location cannot answer it. A provider is reachable by the law of the country where it or its parent is incorporated, wherever the data sits. Ask for the contracting entity, its country of incorporation and its ultimate owner, in writing.
- 2
Which SEAL level would you claim, and what stops you claiming the next one up?
Against the EU Cloud Sovereignty Framework, the Commission’s five-level scale from SEAL-0 to SEAL-4. The first half of the question gets you a number. The second half gets you the specific dependency that stops the vendor claiming the next level, which is the fact you actually need.
- 3
Where does inference execute, in each deployment mode you offer?
Inference is the part every vendor names. Ask separately about transcripts, session logs, prompt caches, vector stores, backups and support snapshots, because those are where personal data accumulates. A diagram per deployment mode is a better answer than a sentence.
- 4
Which channels leave our network, what do they carry, and can each one be disabled?
Update, telemetry, licensing and remote support are not part of the inference path, and they are the channels most often left open. Germany’s C3A criterion SOV-4-09 applies the same idea to cloud providers. It asks for an annual disconnection test rather than an assurance. Ask for the list, and ask which channels can be closed without the system stopping.
- 5
Does the system infer emotion or intention from face or voice, and can that be excluded from the build we receive?
Ask for the answer in writing. A configuration setting and a build exclusion are different answers. For a workplace or education deployment the difference matters. Article 5(1)(f) bites on placing on the market and putting into service as well as on use. In plain terms, it covers supplying the system and switching it on, not only using it. A vendor who can show the capability is absent from the build can show the prohibition does not apply.
- 6
Does the system identify or re-identify a person from their face or voice, as opposed to an authenticated session identifier?
This is the question, not whether it remembers people. Recognising a person by face or voice is Article 9 processing on the European Data Protection Board’s reading. It needs explicit consent, with a non-biometric alternative on offer. A login, a card tap or a session token is ordinary Article 6 processing, however personal the greeting feels.
Where sovereign AI avatars matter outside healthcare
The same three tests apply wherever an institution is regulated and the conversation is with a member of the public. AI avatars in healthcare are where buyers ask the questions most sharply today.
The word sovereign is European, but the rules are not. Saudi Arabia, Qatar, Turkiye, South Korea, Japan, Australia and the United States all restrict where certain systems may run. In several of those places the binding requirement reaches the people who operate the system rather than only the servers. We have set out ten of those regimes, instrument by instrument, in a companion article on where AI systems can legally run.
One area needs a specific warning. Workplace settings and education institutions are where emotion inference from face or voice is prohibited rather than merely regulated.[9] On the Commission’s reading, workplace reaches job candidates during selection and hiring, and education reaches candidates during admissions.[11] Worker management is a separate matter. The AI Act lists it in Annex III as a high-risk use, rather than as part of the prohibition’s scope.
An avatar intended for those settings should be able to show that it does not infer emotion, not merely that it does not display it.
Where the same three tests get asked
Five settings where the conversation is with a member of the public.
Where RAVATAR fits
RAVATAR builds real-time interactive AI avatars and holograms for regulated environments. Here is how the platform answers the three tests.
Legal control: a Cyprus company
RAVATAR is incorporated and headquartered in Cyprus, an EU member state since 2004 and part of the euro area. It is owned by its founder, and customers contract with the Cyprus company.
That answers the first test in three ways. EU law binds the company directly. The GDPR and the AI Act apply to it as they apply to the institutions it serves.[9][10] No parent or place of incorporation outside the EU gives a non-EU authority a way to compel it.
Its supervisory authority is an EU data protection authority in the European Data Protection Board. And a judgment from any member state court is enforceable in Cyprus without a separate procedure.[21] For a hospital in Germany or a ministry in France, that is a counterparty inside its own legal order.
Data residency: four deployment modes
RAVATAR supports four deployment modes: on-premise, the institution’s private cloud, EU sovereign cloud, and global public cloud. The strictest form of on-premise is edge deployment. All inference runs on a single compact device, on its own CPU, GPU and neural processing unit, with no external computer and no cloud dependency. That also allows an air-gapped installation, with no network connection at all. We announced that configuration with Intel in June 2026. For a specific configuration we will set out every outbound channel, what it carries, and whether it can be disabled.
Four deployment modes, and where inference runs in each
Which tests each mode answers on its own, before anyone asks a question. Most control first.
On-Premise
Local models on your servers, or on a single edge device
Inference never leaves your own network.
Nobody outside can reach in unless you allow it.
Private Cloud
Local models in your own cloud tenancy
Local models run inside your own tenancy.
Depends on who holds the keys to the tenancy.
EU Sovereign Cloud
A European provider’s cloud, graded on the SEAL scale
EU hosting is given. The SEAL level grades it.
Depends on the SEAL level and the contract.
Global Public Cloud
A non-EU provider’s cloud, in any region
A region can be chosen. The law cannot.
The provider keeps access to the system.
The on-premise and edge builds are described above. The deployment steps are in the local deployment guide.
Operational control: pluggable models
The language model, speech recognition and speech synthesis layers are pluggable rather than fixed, and which ones run depends on the deployment mode.
In the on-premise and private cloud modes, the platform deploys local models. Language, speech recognition and speech synthesis all run inside the institution’s own environment, and no inference request leaves it. That is what lets those two modes answer the residency and control tests by construction. It is also where the four-month gap between open-weight and frontier models, discussed above, comes in. There it is the relevant trade-off rather than a reason to stay in the cloud.
In the cloud modes, the customer chooses the language model in Genesis AI Avatar Studio from Google Gemini, OpenAI and Azure OpenAI. It can also bring its own through its own API key, including fine-tuned models. Voice runs on Google Text-to-Speech or ElevenLabs. In one public-sector deployment the language model layer is the customer’s own Azure AI agents. In every mode the institution decides which components run, and where. The options are set out in the Studio documentation.
Emotion: within the AI Act
Emotion inference from face or voice is a regulated capability, and any such capability follows the AI Act. For workplace and education deployments it is left out of the build, since Article 5(1)(f) prohibits it there. Elsewhere it is offered only where the Annex III high-risk obligations are met. That includes the duty under Article 50(3) of the deployer, the institution using the system, to inform people exposed to it.[9] The detail is in our companion article on biometric data under the AI Act.
Put the six sovereignty questions from section 05 to us for your own configuration. Ask us in writing and we will answer in writing.
A note on sector regimes
The three tests in this article are the general case. Every regulated sector layers its own requirements on top, and they are usually the ones that decide a procurement.
Financial services is the clearest example. DORA, Regulation (EU) 2022/2554, brings contractual requirements.[19] They have nothing to do with sovereignty and everything to do with whether a supplier is usable at all. Service level descriptions with quantitative targets. Rights of access, inspection and audit for the institution and its supervisor. Exit strategies. And a register of information naming every subcontractor supporting a critical or important function.
The EBA guidelines on outsourcing add pre-contract due diligence and consent rights over sub-outsourcing.[20] They are being replaced by the EBA’s September 2026 guidelines on third-party risk, which leave ICT services already covered by DORA to DORA. A vendor answering the six questions above and nothing else is not answerable to a bank.
Healthcare has its own set, which we cover in a companion article on patient-facing AI in EU hospitals. Education, public sector and utilities each have theirs. If your sector regime is the binding constraint, start there rather than with sovereignty, and treat the three tests as a filter you apply afterwards.
Testing a sovereignty claim in front of you?
The six questions work on any vendor. We are glad to answer them for a specific configuration, in writing.
Start a conversationFrequently asked questions
What is a sovereign AI avatar?
A sovereign AI avatar is a real-time interactive AI avatar that a regulated institution can run without personal data leaving a network or jurisdiction it controls. Its provider is not one that a non-EU state can legally compel. It has to pass three tests at once: legal control, data residency with a technically enforced boundary, and operational control by the institution.
Is there an official EU definition of sovereign AI?
We have not found one. EU law uses the phrase digital sovereignty without defining it. There is no definition, but there is a scale. The Commission’s five-level SEAL scale was used in April 2026 to screen its own sovereign cloud bidders. Germany’s C3A criteria build testable checks on the same framework. We set out both in a companion article, Sovereign AI Avatars: The EU Criteria That Decide.
Is an EU data centre enough to make an AI avatar sovereign?
No. Data residency and jurisdiction are different questions. The US CLOUD Act extends disclosure obligations to data a provider controls wherever it is stored. So the provider’s corporate structure matters as much as the server’s location. In June 2025 Microsoft France gave evidence under oath to the French Senate. It said it could not guarantee French citizens’ data would never be transmitted following a US government injunction.
Why is an AI avatar harder to make sovereign than a chatbot?
Because it has sensors. A chatbot’s sovereignty is settled by where it runs and who controls the provider. An avatar can also see a face and hear a voice, which the EU AI Act counts as biometric data even when nobody is identified. That brings the Article 50 disclosure duties and the ban on emotion inference in workplaces and schools. It also brings GDPR Article 9 if it recognises people by face or voice.
Sources
Every legal statement in this article is traceable to one of these. Where a source carries a caveat, the caveat is reproduced in the text.
- Decision (EU) 2022/2481 establishing the Digital Decade Policy Programme 2030. Uses digital sovereignty in an open manner without defining it. eur-lex.europa.eu
- European Commission Joint Research Centre, Open but Not Powerless: Towards a Common Understanding of EU Digital Sovereignty, JRC144908, 2025. publications.jrc.ec.europa.eu
- ENISA, candidate European Cybersecurity Certification Scheme for Cloud Services (EUCS), published for consultation December 2020. enisa.europa.eu
- European Commission, Cybersecurity Package questions and answers, 20 January 2026. Source for the current EUCS position. digital-strategy.ec.europa.eu
- European Commission, Proposal for a Cloud and AI Development Act, 3 June 2026, procedure 2026/0138(COD). digital-strategy.ec.europa.eu
- European Commission, EU Cloud Sovereignty Framework, version 1.2.1, October 2025, defining SEAL-0 to SEAL-4. commission.europa.eu
- European Commission, Commission advances cloud sovereignty through strategic procurement, 17 April 2026. Source for the 180 million euro ceiling over six years, the SEAL-2 eligibility floor and the four awards with their SEAL levels. commission.europa.eu
- BSI, C3A, Criteria enabling Cloud Computing Autonomy, version 1.0 of 27 April 2026, including SOV-1-03, SOV-1-04, SOV-2-03, SOV-4-01, SOV-4-02, SOV-4-09 and SOV-6-01. bsi.bund.de, direct PDF and landing page
- Regulation (EU) 2024/1689 (EU AI Act), Articles 3(34), 3(39), 5(1)(f), 5(1)(g), 50, Recital 18 and Annex III. eur-lex.europa.eu
- Regulation (EU) 2016/679 (GDPR), Articles 4(14), 6, 9, 48, Chapter V and Recital 51. eur-lex.europa.eu
- European Commission, Guidelines on prohibited artificial intelligence practices, C(2025) 5052 final, 29 July 2025. Source for the biometric definition footnote, the broad reading of workplace, and the smiling versus happy example. digital-strategy.ec.europa.eu
- 18 U.S.C. 2713, added by the CLOUD Act, Pub. L. 115-141, 23 March 2018. law.cornell.edu
- French Senate, commission of inquiry on public procurement, hearing of Microsoft France, 10 June 2025. Committee record. senat.fr
- French Senate report No. 830 (2024-2025), tome I, 8 July 2025, recording the evidence of Vincent Strubel, director general of ANSSI, given on 28 May 2025. senat.fr
- Microsoft, European Digital Commitments, including the Digital Resilience Promise. learn.microsoft.com
- Microsoft, HDS certification offering for France, certificate issued October 2025. Cited to show that HDS is held by non-EU providers. learn.microsoft.com
- Code de la santé publique, Article L.1111-8, the legal basis for HDS certification. legifrance.gouv.fr
- Epoch AI, the gap between open and closed models on the Epoch Capabilities Index, published 29 May 2026. Source for the four month and 8 index point lag since January 2026. epoch.ai
- Regulation (EU) 2022/2554 (DORA), including Articles 28 and 30 on contractual arrangements with ICT third-party service providers. eur-lex.europa.eu
- European Banking Authority, Guidelines on outsourcing arrangements, EBA/GL/2019/02, and Guidelines on the sound management of third-party risk, EBA/GL/2026/09, final report of 18 September 2026, which replace them for non-ICT services. eba.europa.eu
- Regulation (EU) No 1215/2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (Brussels I recast), Article 36 on recognition and Article 39 on enforcement without any declaration of enforceability. eur-lex.europa.eu
