Every field is source-linked and dated.See the rubric behind the grades.

How we grade
Sovereign AI Registry
ExploreBlogGov accessCertsCountries

Footer

Sovereign AI Registry

The compliance registry for AI vendors. Data residency, training defaults, retention, subprocessors and EU AI Act posture — one row per vendor, product and deployment, every claim linked to its source.

Registry

  • Explore vendors
  • Deployment models
  • Categories
  • Countries

Compliance

  • Gov access exposure
  • EU AI Act roles
  • Certifications

Resources

  • FAQ
  • Methodology
Built with ShipMore·Build yours →

© 2026 Sovereign AI Registry. All rights reserved.

The registry • open full view

Can your company actually use this AI vendor?

Sort by governance grade. Filter by deployment model, EU AI Act role, or government-access exposure. Searching and filtering is free.

Browse

Browse by deployment model

From a fully hosted API to an air-gapped install on your own hardware. Each option opens its own page.

Hosted API68Self-hosted weights6On-premise6Private VPC2
What we check

The questions your legal team will ask anyway

Six things that decide whether a vendor clears review — researched once, so you don't read forty pages of policy per vendor.

Governance grade
A single A–F letter covering residency, retention, training defaults and how well each claim is evidenced. Free on every record.
Data residency
Which regions a vendor can genuinely pin your data to — and whose infrastructure it actually runs on.
Government access exposure
Whether the US CLOUD Act reaches the data, whether PRC law does, or whether neither applies. Stated plainly, not buried.
Training defaults
Whether your prompts train the model out of the box, and whether opting out is a real switch or a support ticket.
Retention and zero-retention
How long inputs and outputs are kept, the exceptions nobody advertises, and who qualifies for zero data retention.
Evidence trail
Every field carries a source link, how the claim was established, and the date somebody last checked it.
Recently verified

Latest entries in the registry

The most recently checked vendor offerings.

Read AI · Sep 2026

RARead AI meeting assistant

Sovereignty grade F (24/100). No EU residency. Read AI, United States.

meeting-ai
Governance Grade
F
Fathom · Aug 2026

FAFathom AI notetaker

Sovereignty grade D (35/100). No EU residency. Fathom, United States.

meeting-ai
Governance Grade
D
Granola · Sep 2026

GAGranola AI notepad

Sovereignty grade D (30/100). No EU residency. Granola, United States.

meeting-ai
Governance Grade
D
Fireflies.ai · Sep 2026

FNFireflies.ai notetaker

Sovereignty grade D (40/100). No EU residency; no training on your data. Fireflies.ai, United States.

meeting-ai
Governance Grade
D
Otter.ai · Sep 2026

OBOtter Business

Sovereignty grade D (35/100). No EU residency; no training on your data. Otter.ai, United States.

meeting-ai
Governance Grade
D
AssemblyAI · Sep 2026

ASAssemblyAI speech-to-text API

Sovereignty grade C+ (55/100). EU region selectable; no training on your data. AssemblyAI, United States.

meeting-ai
Governance Grade
C
Browse

Browse by government-access exposure

The axis most vendor comparisons skip: who, legally, can reach into the data.

US CLOUD Act44No non-EU government access27Mixed jurisdiction9PRC National Intelligence Law2
Browse

Browse by headquarters country

Often the first question procurement asks, and the one that decides which contract template you use.

United States45Germany9France7Switzerland5Singapore3Israel2United Kingdom2China2Netherlands2

From the blog

Analysis and explainers on AI vendor sovereignty, grounded in the registry's own audits.

See all articles
Line diagram: a contract document connects to a roster card. Lines fan out from the roster to server buildings, some inside a dashed boundary and some outside it. One line ends at a blank card with nothing attached to it.
Sep 7, 2026Analysis

A DPA is not a sub-processor list

A DPA sets the rules, a sub-processor list names who is bound by them. Of 83 audited AI vendors, 69 publish a DPA and 13 disclose no sub-processors.

MR

Marta Reinders

Compliance analyst @ Sovereign AI Registry

A bar diagram of seven columns on a baseline. Three short columns are capped by a solid horizontal bar drawn across their tops. Four taller columns rise past that bar and reach a dashed horizontal line near the top of the frame.
Aug 31, 2026Analysis

Three ceilings that cap an AI vendor's sovereignty grade

Across 83 audited AI vendors, CLOUD Act exposure caps the sovereignty score at 66, undisclosed sub-processors at 54, and non-EU-only residency at 54.

MR

Marta Reinders

Compliance analyst @ Sovereign AI Registry

Three stacked horizontal bars on a shared axis. The top bar is short and positioned to the right, the bottom bar is short and positioned to the left, and the middle bar is long enough to overlap both. A single vertical line crosses all three near the centre.
Aug 17, 2026Analysis

Pass, conditional, fail: how to read the procurement verdict

The registry grades every vendor twice. 43 of 83 records are conditional, and that band runs from 32 to 96. How to turn a verdict into a yes or a no.

MR

Marta Reinders

Compliance analyst @ Sovereign AI Registry

FAQ

Questions worth answering up front

A letter from A to F summarising where a vendor stores data, how long it keeps it, whether it trains on your inputs, who can legally compel access, and how well each of those claims is evidenced. The grade and the EU procurement verdict are free on every record.

Policy watch

Get told when a vendor quietly changes its terms

Retention windows shorten, training defaults flip, residency options appear and disappear. We track the changes and send only the ones that would alter a procurement decision.

No spam, ever. Unsubscribe anytime. Read our privacy policy

Many vendor offerings · checked data points each

Check it before procurement does

Search by residency, training default and jurisdiction. Every claim links to the source it came from.

Browse all vendors