Anyone looking to implement AI in their company today usually has two options: using U.S. services like ChatGPT or Claude directly—or a U.S. cloud provider like Microsoft or Amazon AWS that is GDPR-compliant and has servers in Frankfurt. Both approaches have one thing in common: they offer less sovereignty than they appear to. In this guest post, Jürgen Weber, founder of weber.cloud in Balingen and a member of the Baden-Württemberg AI Alliance, explains why digital sovereignty isn’t determined by certifications, but rather in the engine room and through corporate structures.
Digital sovereignty has become a buzzword. Every provider is championing it. But if you take a closer look, you’ll quickly realize that there’s often a gap between the promise and reality. This gap is particularly dangerous when it comes to AI. After all, the true value only emerges when a company feeds its most critical internal data into an AI model—financial figures, design knowledge, patents, and the internal quality management manual. This is precisely the kind of data we don’t want to see fall into the wrong hands.
The CLOUD Act: The Blind Spot in German AI Strategies
Many companies assume that their data is GDPR-compliant and protected from access by third parties if the provider hosts it in Frankfurt or at another location in Germany. This is a fallacy. All U.S. providers are subject to the so-called “CLOUD Act.” This law allows U.S. authorities to access data processed by U.S. companies—regardless of the server’s location. Microsoft France publicly confirmed this a few months ago. This is highly unusual, as U.S. law prohibits the affected companies from even discussing the fact that they are required to hand over data.
For German companies, this means one thing above all else: The “Hosted in Germany” label on a U.S. cloud service does not protect against access by foreign authorities. For web-only applications, this was tolerable for a long time. But for AI, which is intended to process a company’s entire knowledge base, it poses a serious business risk.
AI only truly provides a decisive competitive advantage when all critical business data is fed into the system. But that is precisely the kind of data that does not belong in a U.S. cloud.
Open-Weight Models from China: How They Work Technically
This brings us to a question that many of our customers ask: If not a U.S. cloud, then what? One serious option is freely available AI models from China. With Qwen, Kimi, and DeepSeek, very powerful models have been released that are nearly on par with the top U.S. models in terms of quality. The technological gap is now only two to three months.
But doesn't "Chinese model" automatically mean "data flowing to China"? No. This is precisely where the crucial detail lies:
- The models are published as open-weight files, meaning they are freely available for download.
- We download them and run them in our professional cloud data center in Balingen.
- Firewalls and other security measures ensure that no data leaves our data center for China or anywhere else.
There is no connection between customer data and the model developers. The models run in an isolated environment. Anyone accessing our infrastructure communicates exclusively with servers in Baden-Württemberg. And as a 100% German, owner-managed company, the CLOUD Act does not apply to us.
Why It's Worth Looking to China
When it comes to AI, the German business community looks almost exclusively to Silicon Valley. For years, that approach was justified—but today, it’s too narrow. The turning point came with the Chinese startup DeepSeek: With a fraction of the funding available to major U.S. players, it released a language model of comparable quality. The key takeaway: Competitive AI doesn’t need data centers costing billions.
China is pursuing a clear strategy. Instead of proprietary premium products, it is releasing high-quality models as open-weight options. For European providers, this opens up a genuine third option alongside U.S. hyperscalers and in-house development: using high-performance models without being tied to a U.S. corporation.
The Cost of Sovereignty in Practice
Providing AI hosting in Germany is no easy task. A kilowatt-hour of electricity costs weber.cloud about 30 cents from Balingen’s municipal utility—compared to an average of about 8 U.S. cents in the U.S. In particularly cost-effective data center locations in the U.S., the price drops below 5 cents. Subsidies for AI infrastructure, such as those amounting to billions in the U.S., are virtually nonexistent in Germany.
So sovereignty inevitably comes at a slightly higher price. But the alternative—complete dependence on a handful of U.S. corporations, whose pricing models reliably tighten as soon as customers are deeply integrated—is more expensive in the long run. And it cannot be controlled politically.
Why the question can't wait
The world is changing at a pace that renders any traditional development plan obsolete. Anyone who uses AI today is also deciding who will have access to their company’s knowledge in the long term. This issue is personally important to me: I don’t want to have to explain to my daughter one day why Germany fell asleep at the wheel during the crucial phase of digitalization. In my little glass cube in Balingen, I’m doing what I can—and working to ensure that digital sovereignty is more than just a label.
About the author
Jürgen Weber is the founder and CEO of weber.cloud in Balingen. The owner-managed company has been operating its own data center for over two decades and is one of the few German providers with a fully sovereign infrastructure—ranging from an autonomous Internet system to its own fiber-optic links and hardware. Since 2013, weber.cloud has also been building an infrastructure connecting Europe and China. Today, the company is the market leader in making European web applications available in China and operates its own sovereign AI cloud based on freely available models. weber.cloud is a member of the Baden-Württemberg AI Alliance.