Loading the catalogue…
How Stav grades sovereignty
We made sovereignty a graded scale. Every inference endpoint on Stav resolves to a level from L0 to L4 — answering, in order: where your inference runs, who runs it, who owns them, and whether anyone outside Europe holds strings. The level travels with every request you make.
Each question is a rung on the ladder. To reach a rung, a provider must answer that question — and every question below it — with evidence. A provider that answers none of them is L0.
The five rungs
Operated under a non-EU/EEA legal system. No EU/EEA guarantees, and marked plainly, never hidden.
Typical exampleA commercial AI API served from the US.
Your data is processed and stored in the EU/EEA, or in a country with a GDPR adequacy decision.
Typical exampleA US provider serving from a European datacenter. The building is in Europe — the company is not.
The service is operated from Europe, with certified security and a transparent supply chain.
Typical exampleA service run by an EU team, with its non-EU parent kept legally and technically at arm’s length.
The company running your inference is owned and controlled in Europe. Nobody outside can give it orders.
Typical exampleA European cloud company serving models from its own datacenters.
Full control of the whole stack. Nobody outside Europe can interfere with any part of it.
Typical exampleA European-owned provider running open-weight models on its own hardware and software.
A provider we have not graded yet shows as Not yet assessed. That is a data-quality state, not a rung — we treat it as unproven, not as sovereign.
01How we classify
The level is Stav’s own assessment. It is not a certificate, and a provider cannot buy a better grade.
We grade from facts we track for every provider: where the servers are, which law applies to the operator, exposure to the US CLOUD Act and FISA 702, published certifications, and data-residency commitments. Each rung is a checklist. A provider gets the highest rung where it meets every point. If we don’t know something, it counts as not met.
Where we have graded a provider, its page shows the full checklist: which points are met, which we have not established, and the source behind each one — national business registries for ownership, the operator’s own published certificates and contracts for the rest. Points we have not researched are shown as unknown rather than as failures.
02The coming EU legislation
Our ladder follows the EU Cloud and AI Development Act (CADA), proposed by the European Commission on 3 June 2026. CADA defines four assurance levels for sovereign cloud. They measure control, not just location: an “EU region” of a US cloud only reaches the first level, because US law still applies to the operator. Public-sector buyers are expected to require a level when they procure; official recognition needs a Member-State audit.
CADA is a proposal, not law. Negotiations run through late 2026, and the final text is unlikely before 2028. The criteria can still change — that is why our grades are versioned. Two choices are our own: we read “Union” as EU/EEA (Stav is Norwegian), and we added L0 so every endpoint gets a level instead of hiding the non-sovereign ones.
Stav sovereignty levels are Stav’s indicative self-assessment of where an operator would qualify under the proposed EU Cloud and AI Development Act. They are not an official Member-State or EUCS recognition. CADA is a European Commission proposal (June 2026); criteria may change.
03In the product
The level is not a marketing label. The platform routes, logs, and enforces on it:
X-Stav-Sovereignty-Level header is on every API response, and every request is logged with the level it was served at and the criteria version in force.Browse providers by level, or see the model catalogue for what each level can serve.