European AI: what is behind it and when it is the right choice
“European AI” is used as a label, but depending on the provider it means three entirely different things: where the model comes from, where the computing happens and who you sign the contract with. Only one of them settles the data protection question. This page separates the three levels and says what really matters for companies.
Why the question is being asked right now
Until recently, transferring data to the US was a settled matter for most companies. That has changed.
- The basis. Since July 2023, data transfers to the US have relied on the adequacy decision for the EU-US Data Privacy Framework. Its main pillar is the Federal Trade Commission, which is meant to enforce the commitments independently.
- The ruling. On 29 June 2026, the US Supreme Court denied exactly this independence in Trump v. Slaughter – the President may freely remove the commissioners.
- The status. The adequacy decision still applies. But the European Commission is reviewing whether the commitments still hold, and the organisation noyb – the same one that brought down Safe Harbor and Privacy Shield – has announced proceedings. Both predecessors of this agreement lasted about four years each.
In practice this means precaution, not panic: if you are setting up your AI processing anew, do not build it on a foundation that is currently under legal review. If you already run it, know which processing would be affected if the basis fell away.
Three levels that are constantly confused
When a provider writes “European” on its website, it usually means just one of them. For the GDPR, the second and third matter most.
Origin of the model
Who trained the model and where is that company based? This is the level discussed most loudly – and the one that says least in data protection terms. A French model running on American infrastructure does not solve a transfer problem.
Place of processing
In which data centre, in which country are your inputs actually computed? This is the level that matters under Art. 44 et seq. GDPR. It belongs in the contract in writing, not on a marketing page.
Contracting party and access
Who do you sign the data processing agreement with, which law does that company fall under, and who can access the systems? A European subsidiary of a US group can fall under the US CLOUD Act – even with a data centre in Frankfurt.
European AI providers at a glance
Anyone looking for European AI finds three kinds of providers: makers of their own models, cloud providers running open models in European data centres, and platforms that make models from several vendors usable.
| Provider | Seat | Offering | Processing and notes |
|---|---|---|---|
| Mistral AI | Paris, France | Own language models (open and commercial), Le Chat, API | Data stored in the EU by default; the only European provider of large proprietary models in this comparison |
| Aleph Alpha | Heidelberg, Germany | Own models and a platform for enterprises and public administration | Merger with Cohere (Canada) agreed in September 2026, completion subject to regulatory approval; Heidelberg to become a research site |
| STACKIT (Schwarz Group) | Neckarsulm, Germany | AI Model Serving: open models via API | Data centres in Germany |
| IONOS | Montabaur, Germany | AI Model Hub: open models via API | Processing in German data centres |
| T-Systems | Frankfurt, Germany | AI Foundation Services: open models plus brokered models from large vendors | Only the open models run in the T Cloud in Germany |
| Multi-model platforms | e.g. novendix.AI (Schwabach), Langdock (Berlin), meinGPT (Unterhaching), innoGPT (Vechta), DeutschlandGPT (Germering) | Interface, assistants and integrations on top of models from several vendors | Hosting in Germany or the EU depending on the provider; models often from US vendors in EU data centres |
as of 29 October 2026. Sources: provider information; comparison of European LLM APIs by WZ-IT (updated 12 Oct 2026); platform comparison by innFactory AI (October 2026); SiliconANGLE on the Cohere/Aleph Alpha merger (16 Sep 2026). Not a complete market overview.
Sovereignty comes in stages
It is not a yes-or-no question. The stages differ in effort, cost and what they actually secure.
novendix.AI sits at the third stage: processing in data centres within the EU, a German contracting party, several model families to choose from. Which ones is shown on AI models. How novendix.AI compares with Langdock is shown in the Langdock comparison.
How to recognise a robust solution
Six points that must be documented in writing. Where a provider evades, the answer is usually already given.
- Named processing location. Not “in Europe”, but the country and the operator – and the commitment that log data and caches stay there too.
- Data processing agreement under Art. 28 GDPR. With a list of sub-processors and their seats. One sub-processor in a third country turns the whole chain into a third-country transfer.
- No training on your inputs. Excluded by contract, not just switchable in the settings.
- Contracting party and applicable law. Who signs, and is that company subject to access by an authority outside the EU?
- Switchability of the model. The model landscape changes every quarter. A solution tied to one model is a bet.
- Traceability. In an audit you must be able to show who processed what and when – the GDPR requires it, and the EU AI Act additionally requires a classification of the intended use.
How novendix.AI handles these points in detail is on Privacy and security. The obligations under the EU AI Act are covered in the article EU AI Act for SMEs; the checklist for ChatGPT itself is on Using ChatGPT in a GDPR-compliant way.
Frequently asked questions about European AI
What does “European AI” actually mean?
Three different things that are often lumped together: the origin of the model, the place of processing and the seat of the contracting party. For the GDPR, the place of processing and the contracting party are decisive; the origin of the model is secondary.
Is there German AI for businesses?
There are German providers. Aleph Alpha from Heidelberg is the best known; it shifted its focus to software for sovereign AI environments and agreed a merger with the Canadian provider Cohere in September 2026. The more common route is open or European models operated in German data centres with a German contracting party – the set-up most solutions for mid-sized companies use.
Is a data centre in Frankfurt enough?
For the question of processing location, yes; for the question of access, not necessarily. A European subsidiary of a US group can be obliged to hand over data under the US CLOUD Act, regardless of where the servers are. If you want to rule this out, you need a contracting party without this tie.
Is transferring data to the US still allowed?
Yes. As of October 2026, the adequacy decision for the EU-US Data Privacy Framework still applies unchanged. However, on 29 June 2026 the US Supreme Court denied the independence of the Federal Trade Commission, whose oversight underpins the agreement. The European Commission is reviewing the consequences. Companies should know which processing would be affected and prefer the European option for new projects.
Are European models worse?
For the hardest tasks, the American top models are currently ahead. For what actually comes up in everyday business – summarising, drafting, structuring, answering from your own documents – the difference is not noticeable for most tasks. A test on your own tasks is more useful than the question of principle.
What does the EU AI Act require in addition?
The AI Act does not regulate the place of processing but the purpose: companies must assign their AI applications to a risk class, meet transparency obligations and train their staff. This applies regardless of whether the solution is European. Data protection and the AI Act are two separate sets of obligations.
Which European AI providers are there?
In Europe, large proprietary language models are mainly developed by Mistral AI from Paris; Aleph Alpha from Heidelberg agreed a merger with the Canadian provider Cohere in September 2026. Open models in German data centres are offered by STACKIT, IONOS and T-Systems, among others. In addition there are platforms such as novendix.AI that make models from several vendors usable with hosting in Germany or the EU.
Is a European AI provider automatically GDPR-compliant?
No. A European seat makes many things easier, but the DPA, processing location, training exclusion and your internal policy remain decisive. Conversely, a model from a US vendor can be used in compliance with data protection law in an EU data centre.
Test on your own tasks
Ten days free: several model families through one login, processing in the EU, a German contracting party, data processing agreement included.
Your secure AI platform for the Mittelstand. Secure. Intelligent. Integrated. Custom database integration, personally supported.
novendix GmbH · Industriestraße 6 · 91126 Schwabach
Locations: Schwabach · Weißenburg · Nuremberg
A company of the L&S Lange & Schermer Group
