Every field is source-linked and dated.See the rubric behind the grades.

How we grade
Sovereign AI Registry
ExploreBlogGov accessCertsCountries

Footer

Sovereign AI Registry

The compliance registry for AI vendors. Data residency, training defaults, retention, subprocessors and EU AI Act posture — one row per vendor, product and deployment, every claim linked to its source.

Registry

  • Explore vendors
  • Deployment models
  • Categories
  • Countries

Compliance

  • Gov access exposure
  • EU AI Act roles
  • Certifications

Resources

  • FAQ
  • Methodology
Built with ShipMore·Build yours →

© 2026 Sovereign AI Registry. All rights reserved.

  1. Explore
  2. Llama API
LA

Llama API

Sovereignty grade D (36/100). No EU residency; no training on your data; self-hostable. Meta, United States.

Category
foundation-model
Categories
Foundation model
EU AI Act role
GPAI with systemic risk
Deployments
Hosted API
Government access exposure
US CLOUD Act
Countries
United States

Details

Deployment
hosted
Hq Country
United States
Hq City
Menlo Park
Ownership
public
Founded
2004
Training Default
never
Residency Options
US (no EU/regional residency evidenced for the hosted API)
Gov Access Exposure
us-cloud-act
Eu Ai Act Role
gpai-systemic
Self Host Option
Yes
Retention Default
unknown — Llama API legal pages are client-rendered and could not be verified; no retention duration published.
Retention Exceptions
unknown for the API. Separately, Meta trains on EU users' PUBLIC Facebook/Instagram posts + Meta AI interactions on a legitimate-interest (opt-out) basis — contested by regulators.
Subprocessors
Meta / partner inference infra (e.g. Cerebras, Groq — US)
Transfer Mechanism
none-stated
Eu Procurement Ready
fail
Eu Procurement Reason
No EU data residency for the hosted API; API-level DPA, retention, ZDR and certifications are unverifiable (legal pages are SPAs). Meta was the only major lab to REFUSE the EU AI Act GPAI Code of Practice (2025-07-18), and its EU consumer-post training resumed under a contested legitimate-interest basis. The durable sovereign path is self-hosting the open weights.
Last Policy Change
2025-07-18T00:00:00.000Z
Change Summary
Meta declined to sign the EU AI Act GPAI Code of Practice, citing legal overreach — the only major lab to refuse.
Prior Value
No public stance on the Code; EU training paused 2024 after Irish DPC + noyb complaints, resumed Apr 2025 with an opt-out form.
Training Evidence Url
ai.meta.com/blog/llamacon-llama-news
Training Claim Basis
stated
Training Confidence
high
Residency Evidence Url
techcrunch.com/2025/04/29/meta-previews-an-api-for-its-llama-ai-models
Residency Claim Basis
inferred
Residency Confidence
medium
Retention Evidence Url
ai.developer.meta.com/legal/terms-of-service
Retention Claim Basis
inferred
Retention Confidence
low
Subprocessors Evidence Url
techcrunch.com/2025/04/29/meta-previews-an-api-for-its-llama-ai-models
Subprocessors Claim Basis
inferred
Subprocessors Confidence
low
Residency Class
non-eu-only
Portability / Exit Path
open-weights-restricted
Subprocessor Jurisdiction
non-eu

Change history

  1. Aug 3, 2026Governance Grade

    C → D

At a glance
Governance Grade
D
Governance Score
36
EC SOV-2 Legal & Jurisdictional (0-4)
0
EC SOV-3 Data & AI (0-4)
1
Website

Similar

Read AI · Sep 2026

RARead AI meeting assistant

Sovereignty grade F (24/100). No EU residency. Read AI, United States.

meeting-ai
Governance Grade
F
Fathom · Aug 2026

FAFathom AI notetaker

Sovereignty grade D (35/100). No EU residency. Fathom, United States.

meeting-ai
Governance Grade
D
Granola · Sep 2026

GAGranola AI notepad

Sovereignty grade D (30/100). No EU residency. Granola, United States.

meeting-ai
Governance Grade
D

More Categories

  • Coding assistant15
  • meeting-ai13
  • Sovereign host13
  • Inference host13
  • SaaS-embedded11
  • Foundation model11
  • Cloud platform7

More EU AI Act role

  • Deployer59
  • General-purpose AI (GPAI)10
  • provider9
  • GPAI with systemic risk5

More Deployments

  • Hosted API68
  • Self-hosted weights6
  • On-premise6
  • Private VPC2

More Government access exposure

  • US CLOUD Act44
  • No non-EU government access27
  • Mixed jurisdiction9
  • PRC National Intelligence Law2

More Countries

  • United States45
  • Germany9
  • France7
  • Switzerland5
  • Singapore3
  • Israel2
  • United Kingdom2
  • China2
  • Netherlands2