Sovereign AI: your data hosted in France, GDPR and the EU AI Act
A data processing agreement (DPA) signed with the contract, data hosted in France by default, no model training on your data and a record of processing activities. Our answers, question by question.
Data sovereignty, a pillar of Bonne Idée
We integrate AI for commercial court registries, public and ministerial officers with strict confidentiality requirements. An AI project run for an SME or a mid-sized company gets the same guarantees. On every project from the AI practice, four commitments hold:
- a data processing agreement (DPA), signed with the contract;
- data hosted in France by default, or on your own infrastructure when the sensitivity of the data requires it;
- no model training on your data: we only select plans whose contract rules it out;
- a record of processing activities: which data, which tool, for what purpose.
These choices are decided in writing during the two-week scoping, before anything is built. If you don’t yet know which use of AI to go with, the Consulting practice’s AI audit asks the same questions before putting figures on your use cases. For CoBIos, our own product, hosting is chosen before the pilot, in an environment the firm controls.
Sovereign AI: what the term means for a business
AI is sovereign when you know where the model runs, where your data is stored and which law applies to whoever hosts it.
A language model receives the text you send it. If it is hosted by a provider, that text leaves your company. If it is installed on your own infrastructure, nothing leaves.
Where the data is hosted does not settle everything. The US CLOUD Act allows United States authorities, as part of legal proceedings, to compel a provider subject to US law to hand over the data it holds, including when that data is stored in Europe. For a document covered by professional secrecy, the law applicable to the provider is checked before the model is chosen.
Three hosting levels, depending on what your documents contain
The level is chosen by document type, during the two-week scoping.
A model hosted by a provider
For anything that contains nothing sensitive: standard letters, product sheets, internal procedures. A business-tier plan, selected for its contract terms, is suitable.
A model hosted in France
For anything that contains personal or confidential data: client names, amounts, contracts. Identifying details are masked before the text is sent to the model, or the document is processed by a model hosted in France.
A model installed in-house
For anything that must never leave: documents covered by professional secrecy, health data, documents that a contract clause forbids you to pass on. An open model is installed on your own infrastructure. This option costs more to run. It is also the principle behind BIA, our sovereign AI workspace, run locally.
A single page sums up these choices: for each type of document, where it goes, to whom and under what conditions.
Our sovereign AI references
Commercial court registries, and our AI agent for the accounting and legal professions.
Your data on an AI project, question by question
You remain the controller of your processing activities. Bonne Idée acts as a processor for what it builds and operates for you. A data processing agreement (DPA) is signed with the contract, and every processing activity we carry out for you is entered in a record: which data, which tool, for what purpose.
In France by default, or on your own infrastructure when the sensitivity of the data requires it: this is decided and costed during the two-week scoping, before anything is built.
No. We only select plans whose contract excludes training on your data. We check these terms before choosing a model, we write them into the scoping, and we check them again when the provider changes them.
It depends on the task. After scoping, a benchmark compares open models and hosted models on your real examples, and we then select the one that gives the best result at an acceptable cost.
In most cases, your company is the deployer of the AI systems it uses. For most SME uses, that means knowing which systems you use and what for, and taking measures to develop the AI literacy of the people who use them. That is what Article 4 of the EU AI Act requires, applicable since February 2025 and rewritten in July 2026 by Regulation (EU) 2026/1744: real measures, with no guaranteed level of AI literacy. Text checked on EUR-Lex on October 6, 2026. We inventory your uses and assess the risk level of each one during scoping.
Human review is built in wherever a mistake is costly. Quality is measured on a set of questions written with you, and the model version is frozen, then retested before any update.
Yes, for everything we build for you: the code, the accounts, the model access keys and the data are in your name. You own your intelligence, and if we stop working together, another team takes over without starting from scratch. CoBIos, our product, follows the rules described on its own page.
A question about your data before an AI project?
A free first call, by video: what can leave, what must stay in-house, and what that changes for the project.
Book a call