Sovereignty is moving from buzzword to buying criterion. The European Commission’s proposed Cloud and AI Development Act (CADA) would set assurance levels for the cloud and AI services public authorities buy, defining where data should live and who can access it. Parts of it could reach private entities too.

GitLab submitted its own comment on CADA because we share the goal of strengthening Europe’s digital sovereignty and security. We believe this important work should prioritize customer control, portability, interoperability, provider diversity, and risk-based safeguards. You can also view GitLab's submission on the European Commission's Have Your Say portal.

But regulation is only one lever. Many vendor conversations still don’t address sovereignty with enough depth. If this is a priority for your organization, here are ten questions I’d put to any software vendor, GitLab included. Use them as a simple assessment to confirm if a vendor takes sovereignty seriously:

10 questions to ask your vendors

1. Which layers of the stack do you operate yourself?

This question gets at ownership and accountability. A cloud provider and a software vendor control different risks, and a good vendor can help its customers appropriately distinguish between the controls it operates from those it inherits from the infrastructure beneath it.

2. Can I choose where and how the software runs?

Look for a vendor that offers flexibility around how you handle your data and architecture. Sovereignty needs to vary by workload, and the architecture should be able to meet your requirements. For example, self-managed deployments let you run software on your own infrastructure, whether on-premises, in a private cloud, or in a hybrid setup, so your data stays within boundaries you define.

3. Can I choose the AI models I use, and change them later?

Frontier models change fast, and your vendor should not lock you to one. Look for platforms that are model agnostic and draw on a diverse set of models and hosts. That gives your business the flexibility to use the best model for each use case as new ones are released. Open-weight models can often run in your own environment while offering strong price-performance.

4. Does my data train anyone’s model?

Data is valuable for training AI models, so ask for an official written policy around model training and request it includes sub-processors too. Consider it a great sign if the vendor can confidently point to resources that affirm they do not train generative AI models on your data and restrict AI model sub-processors from using both model inputs and outputs for training.

5. What data leaves my region, and why?

Personal data of identifiable users remains subject to regional regulations, like GDPR, regardless of its origin. However, some data and operational signals need to cross boundaries to keep service secure and available. The right vendor offers local hosting and can otherwise explain what types of data cross borders and justify why.

6. Who can reach my data, and from where?

Ask which roles can reach your infrastructure and customer data, from which regions, and under what safeguards. A vendor that offers deployment options with customer-managed encryption keys and private network connectivity adds further control over that access.

7. How do you handle data and risk classifications?

Ask how the vendor classifies different data and what governance mechanisms and incident response activities are in place to handle policy violations and security incidents. A clear classification approach also feeds data protection impact assessments.

8. Which independent audits cover the service I am buying?

Attestations such as SOC 2 Type II and ISO/IEC 27001 let a vendor prove its own layer separately from the infrastructure provider’s assessment. Check that the report scope covers the application you will actually use.

9. Can you match controls to the sensitivity of each workload?

Regulated industries require finer-grain policy controls. Ask whether the vendor lets you set the level of assurance workload by workload. This approach helps your team tune controls to the sensitivity of its function and data so you have speed with control.

10. What does leaving your ecosystem look like?

Portability and interoperability are sovereignty features. Ask how the platform connects to the other tools and models you use and how you would export your projects and history. The format of data exports is important; exports often yield datasets that are complex, poorly structured, or intentionally obfuscated, making them difficult to process without technical restructuring. A vendor confident in its product welcomes easy exports and open integrations.

Sovereignty helps organizations embrace flexibility

No vendor will give perfect answers on all ten of these questions, and requirements will continue to evolve, but the architecture you choose should be poised to absorb changes resiliently.

Teams get the most from AI when they can decide what their organization controls and how. That’s why GitLab believes customers should be able to choose which models they use and where they run. Take these ten questions into your next vendor conversation and see which vendors take sovereignty as seriously as you do.

If you’d like to see how GitLab measures up (we do!), review how we handle customer data and infrastructure in our AI Transparency Center.