And how long does the supplier keep them?
AI & Governance
Sovereign AI and data sovereignty
We help organizations choose and manage AI tools, with clear rules about where data goes, which data is allowed, how long you keep it, who can access it, and what you’ve agreed with your supplier.
Your data, your rulesYou know where it is.
Working safely with AIWithout prohibiting its use.
Ready for the AI ActAnd for your audits.
Which tool is allowed for what?
example| Tool | Where data goes | Risk | Status |
|---|---|---|---|
| ChatGPT OpenAI | To supplier (US) to turn off training | medium | with conditions |
| Claude Anthropic | To supplier (US) to turn off training | medium | review required |
| Copilot Microsoft | Within your own tenant no training | low | approved |
| Llama / Mistral self-hosted | Stays in your own environment | low | approved |
Get a handle on your data.
Room for innovation.
No surprises.
Room for innovation.
No surprises.
What is data sovereignty?
Data sovereignty means knowing where your business data is stored, who can access it and which laws apply to it—and being able to control all three. It's not about whether your data is stored securely, but about who ultimately controls it.
For a Dutch company, three questions arise:
A server in Frankfurt is subject to European law. The same service with storage in Virginia isn’t, even if the provider is European.
Not just you and your supplier. The supplier's subcontractors too, and in some cases foreign governments.
Are they used to train models? Are they kept after you stop using the service? That’s in the terms, not the sales pitch.
The topic became urgent when AI tools became commonplace. Someone pastes a customer list into a chat window, and that data ends up on a server whose location nobody at the company knows. This isn't a hypothetical risk — it happens at almost every company we visit.
The questions you want to be able to answer
Compare concrete models and deployment options in the AI Model Advisor, including EU processing, self-hosting and provider jurisdiction.
Six questions. If you can answer all six, you’ve got this covered. Our own answers are on the compliance status.
Including your supplier’s subcontractors.
And how do you turn it off — per account or centrally?
Personal data, client files, source code, quotes.
One list, so no one has to guess.
For the AI ActEuropean law that sets requirements for those who develop or use AI. Determines which risk category your application falls into and what you must document for it., for audits and for your customers.
What we take care of
Tool policy
Selection criteria, approved tools, default settings and a list of what is and isn't allowed.
Data classification
Clear information classes, with guidelines for each class: what can go where.
Use case matrix
Which tool for which purpose, with alternatives and a route for exceptions.
Supplier check
Where the data is stored, who the subcontractors are, and what the data processing agreement says.
Access arrangements
Roles and permissions, two-step verification, and the fewest possible permissions per person.
Logging and review
Use and audit logs, periodic reviews, and an incident response process.
From standalone AI tools to policy
1Take inventoryWe map which AI tools are being used — including tools nobody has disclosed.
2AssessWe classify your data and assess the tools for risk, data flows and terms.
3Create policyWe draw up guidelines and default settings that work in practice.
4EnterWe communicate, train and support implementation with clear ground rules.
5Keep trackWe review periodically and adapt to new risks and opportunities.
Policy choices for AI tools
An example matrix. Use it as a starting point — the right choice depends on your data, your goals, and your industry.
| Aspect | Public AI e.g. ChatGPT Free | Business AI with opt-out | Internal copilots e.g. M365 Copilot | Self-hosted Llama, Mistral |
|---|---|---|---|---|
| Data leaves the organisation | yes | according to the agreement | no, within Microsoft | no |
| Used for training | yes, unless you opt out | no | no | no |
| Storage location | US or unknown | US or EU, your choice | EU, depending on your tenant | Your own environment |
| Suitable for | Public and internal information | Public and internal information | Also confidential information | Also highly confidential information |
| Governance effort | low | medium | medium | high |
The most common mistake. Ban AI completely. Then your people will use it at home on their own accounts, with company data, and you'll have no visibility at all. Better to designate one approved tool and configure it properly.
For everyone in the organization
SMEs and teams
Practical rules to get started with AI quickly, without IT complexity.
Executive team and management
Control over risks, readiness for legislation, and the confidence to keep innovating.
IT and security
Technically robust, clear checks, fewer exceptions to manage.
Investors and due diligence
Demonstrable governance and lower compliance risks when growing or acquiring.
Take the first step toward data-sovereign AI today.
The free online Frisse blik shows where you stand on data and AI, including how you compare with your industry.
Free online scanPractical and confidentialTailored advice
Ask this site
Ask your question about AI, the AI Act, integrations or digitalization. The answer comes from the pages of this site, with references to where it can be found.
The way it works now
- The appointment is in one colleague's mailbox
- Data is manually retyped from one system to another
- The person who knows is on vacation
- No one can see afterwards why this decision was made
As it is
- The agreement is stored with the client, findable for everyone
- Once entered, information flows through to the rest
- Work continues, even if someone is absent
- Every decision has a source, an owner, and a date
drag with your finger
What if Peter leaves?
Two out of five rules on this page disappear. That's how it feels when knowledge isn't part of the company.
What is your next step?
Free self-assessmentTwelve click questions, three minutes, immediate score and your biggest risk.
Fresh LookBusiness case, benchmark and priority. Settled once we build after this.
What it costsFixed price per package, no price per user, no hourly billing.
From the fieldWhat changed at companies that started with this.
Also good to know: frequently asked questions · security and data · terms and conditions · partners · research and figures · templates · what's changing · where you start
Related solution
This page supports a concrete next step.