If your business uses AI tools, ask yourself this: where is your data going, who controls the model, and could you switch providers without losing everything you have built?
These questions are at the heart of what experts call “AI sovereignty” — and for Irish businesses operating under GDPR and European data rules, the answers matter more than you might think.
Rachad Alao, vice president of product engineering at AI company Cohere, spoke about this at VB Transform 2026. Alao, who previously led responsible AI teams at Google and Meta, argued that AI sovereignty means more than just downloading an open model or running software behind a firewall. It means having tight control over where your data lives, which jurisdiction it falls under, and every layer of the technology stack from the hardware up.
“It is important to have very tight control on where the data resides, have tight control on the AI,” Alao said. He added that AI operations should take place in jurisdictions an organisation understands or directly controls.
Why this matters for Irish businesses
European data protection rules mean that Irish businesses are responsible for customer data even when it is processed by a third-party AI tool. If you use an AI customer service chatbot and customer data ends up on servers outside the EU, you could be in breach of GDPR — regardless of what the AI provider’s terms and conditions say.
This is not a theoretical concern. Several Irish businesses have already received data protection queries about their use of cloud-based AI tools. The Irish Data Protection Commission has been active on this issue, and the European Data Protection Board has issued guidance on AI and data protection that all EU member states are expected to enforce.
The second concern is vendor lock-in. Many AI platforms make it easy to start using them but difficult to leave. You build integrations, train the model on your data, and tailor it to your business — then discover that switching to a competitor means starting from scratch. This is a particular risk for businesses that invest heavily in customising AI tools to their specific workflows.
What full-stack control actually looks like
Alao described AI sovereignty as control over the entire stack: the GPUs and cloud infrastructure, the governance systems that route requests among models, and the connectors and agent frameworks that act on your business data. For a small business, this does not mean buying your own servers. It means choosing providers that offer clear data residency options, transparent model deployment locations, and the ability to export your data and configurations if you decide to switch.
Some AI providers now offer EU-specific instances where all data processing stays within Europe. Others offer dedicated deployment options for businesses with strict compliance requirements. The key is to ask the question before you sign up, not after you are locked in.
Practical steps for this week
Start by reviewing the AI tools you already use. Where does each one store and process your data? Can you get a straight answer from the provider? Look for tools that offer EU-based data processing as a standard option, not as an expensive add-on.
Read the data processing agreement carefully. Make sure it covers GDPR compliance and gives you clear rights over your data. Pay particular attention to clauses about sub-processing — some providers pass data to third-party services without explicitly telling you.
And think about what would happen if you needed to switch providers tomorrow. Could you take your trained models, your configurations, and your data with you? If the answer is no, that is a risk worth addressing now rather than later.
AI sovereignty is not just a concern for large corporations. For any business that handles customer data, it is quickly becoming a basic requirement.