Most organisations do not decide to put their AI on the bottom rung of the Sovereignty Ladder. They accumulate their way there: a pilot on one API, a proof of concept on another, a subscription that quietly became infrastructure. This is the checklist we use to find out how exposed a stack really is.

A system is Exposed when the models and the data both run in a third-party cloud under foreign jurisdiction. The provider holds the keys, the logs and the off-switch. For a prototype that is fine. It becomes a problem when nobody can say, in writing, what happens if that vendor changes its terms, its prices or its mind.

Five checks

  • Where do the weights live? Can anyone in your organisation run inference without the vendor?
  • Who holds the logs? Request a full export of your own logs and see what comes back.
  • Whose law applies? EU-region hosting is not EU jurisdiction. Trace the corporate chain of every processor in your DPA and note the first non-EU link.
  • How far have the terms drifted? List what changed in pricing, limits and models over the last twelve months, and what notice you got.
  • What would an exit cost? In engineering time, against your real integration surface. If an exit has never been rehearsed, the honest estimate is "unknown", the most expensive number in procurement.

Run honestly, the checks give you a defensible position on the Sovereignty Ladder and a shortlist of dependencies ranked by blast radius. The surprise is rarely the headline model API. It is the embedding service, the OCR step, the monitoring tool. We publish no aggregate figures yet; when we have enough audits to report numbers that mean something, they will appear here with the method.

Climbing off the bottom rung

Contain the data path: know what leaves your perimeter and stop what does not need to. Then move the weights: open-weight models on infrastructure you control turn the provider from a dependency into a choice. EU hosting and a better DPA move you one rung, not four. Inventory, contain, then re-platform, with the exit designed before it is needed.

Exposure is rarely a decision. It is an accumulation. The fix starts with an inventory, not a migration.

Want a quick estimate of where you stand? The two-minute self-check places you on the ladder, and the requirements check turns that into a specification. If the answer is that the stack has to move, private AI is what moving looks like.