AI Sovereignty Check

How sovereign is your AI?

Twelve questions. Five minutes. No email. No tracking. You'll find out which phase of the AI journey your company is in today — and which next step moves you forward fastest.

Anonymous & local. Your result never leaves your browser.

Four areas that determine AI sovereignty.

Data control

Where does your data live, who has access?

Model sovereignty

Which AI do you use, who controls it?

Economics

What does it cost long-term, who profits?

Compliance & resilience

How safe are you regulatorily and technically?

Section 1 of 4

01 · Data control

Where does your data live, who has access?

1.1 Where are your company documents processed when you use AI?

Entirely in our own network (local) Partly local, partly cloud (e.g. Microsoft 365) Entirely in a US provider's cloud We don't know exactly

1.2 Who can technically access your data when it is used for AI requests?

Only authorized employees of our company Also the AI provider, contractually limited Also the AI provider and potentially US authorities (CLOUD Act) We haven't checked this

1.3 Do you have a written guarantee that your data will not be used for model training?

Yes, contractually guaranteed (or technically excluded) Yes, in the provider's terms No, that's the provider's default setting We don't know

Please answer all questions to continue.

Section 2 of 4

02 · Model sovereignty

Which AI do you use, who controls it?

2.1 Which AI models does your company primarily use today?

Open-source models, deployed locally Models from European providers (e.g. Mistral, Aleph Alpha) Proprietary models from US providers (OpenAI, Google, Anthropic) A mix — and we're losing track

2.2 What happens if your AI provider doubles their pricing or discontinues the service?

Nothing — we can switch providers without issue It would take effort, but no show-stopper We'd be affected, but we have a plan B We'd have an operational problem with no clear fix

2.3 Can your AI applications continue to work without an internet connection?

Yes, fully Partially — critical functions yes No, without internet everything stops We have never tested this

Please answer all questions to continue.

Section 3 of 4

03 · Economics

What does it cost long-term, who profits?

3.1 How do you currently pay for AI usage?

One-time investment, we own the solution Flat rate, independent of user count Per user per month (cloud license) Per request / token consumption

3.2 Do you have a 5-year cost projection for your AI usage?

Yes, with concrete numbers and scenarios Rough estimate — we know the order of magnitude No, we renew licenses annually as needed We have never calculated it

3.3 Who benefits from the long-term learning effect of your AI usage?

We do — the model learns with our data Both — us and the provider, in a controlled way Mainly the provider — they train on our data We haven't checked this

Please answer all questions to continue.

Section 4 of 4

04 · Compliance & resilience

How safe are you regulatorily and technically?

4.1 Do you have a documented AI compliance strategy for the EU AI Act?

Yes, written down and maintained Yes, internally discussed but not documented No, we're waiting and seeing What is the EU AI Act?

4.2 If your AI provider reported a data incident tomorrow — could you prove which of your data is affected?

Yes, fully documented We'd have a rough overview We'd have to investigate at significant effort We'd have no way to trace it

4.3 How well do you know which AI tools your employees actually use today?

We have a documented overview and clear approvals We roughly know what's used, but without formal rules Individuals use tools on their own; we have no influence We have no overview at all

Please answer all questions to continue.

Your result

0 of 36

A lot is still unclear — and that's normal.

You answered several questions with „We don't know". This is the most common finding in mid-market companies — and no cause for concern. Three ways to gain clarity — pick whichever fits right now.

Choose your next step

Score by area

Methodology: 0–3 points per answer. Maximum 36 points. 0–14 = Phase 1 (Experimenting) · 15–24 = Phase 2 (Structuring) · 25–36 = Phase 3 (Sovereign use).