A practical guide for CIOs
Sooner or later, the board asks whether the company's AI is sovereign. The question is difficult to answer in one word. A more useful question is: could we leave?
Imagine that your AI provider doubles its prices, changes its contract terms or suffers a prolonged outage. Could you move a business-critical workload to another provider without losing the quality, security or continuity your business needs? How long would the move take? What would it cost?
The answers reveal where the limits of your freedom of choice lie. They also show where to start. The sovereignty debate usually begins at the bottom of the stack: which country the data centre is in and who owns the cloud. In my view, the lock-in that grows fastest sits at the top, in bundled licences and in prompts, agents and tests built for one model. That is also where it is cheapest to fix.
My colleague Muhammad Waseem wrote after World Summit AI that sovereignty means the ability to operate: compute, energy, skills and the freedom to switch suppliers decide whether an AI service survives beyond its pilot. In my view, that takes more than an exit plan, but the option to leave is a practical place to start.
This is the exact thing we aim to solve in
Applications
In July 2026, the US list price of Microsoft 365 E3 with Teams rose from 36 to 39 dollars per user per month. The pricing of the separate Copilot product was not part of this change. For some customers paying in euros, a currency adjustment made earlier the same year may, depending on the contract, have offset much of the increase.
The lesson is simple, look at the bill. AI features can be included in a broader service bundle whose price can change. When renewing a contract, ask what you are actually paying for, which features you could give up and what moving the work elsewhere would take in practice.
Models
From 12 January 2027, the EU Data Act prohibits providers of in-scope data processing services from charging fees for switching providers. That removes one barrier. It does not remove the technical work of switching models.
Prompts may need to be rewritten. Integrations may stop working. An alternative model may give different answers or use tools differently. Even a model developed close to your country can depend on technology made elsewhere. In example Finland's Poro 2 models were built on Meta's Llama 3.1.
Put model calls behind an interface under your own control. Maintain a test set that reflects real use cases. Every now and then, run the tests for critical workloads on an alternative model as well.
Cloud services
Location matters, but it is only part of the picture. A cloud service operating in the EU may belong to a company headquartered elsewhere. It also matters which company you actually contract with, who controls the encryption keys and which legal obligations apply to the service.
Alternatives exist. In April 2026 the European Commission picked OVHcloud, STACKIT and Scaleway, among others, for its own sovereign cloud. In Finland, Verda offers GPU capacity, and Telia offers a service based on Verda's platform from its Helsinki data centre.
For sensitive workloads, ask who actually controls the service and the data. Then define in advance what an alternative provider must be able to deliver, before the need to switch.
Hardware
Owning hardware can give an organisation more control. It also brings costs, operational work and the risk that the capacity you buy sits underused. There is no single token volume at which self-hosting can generally be said to become cheaper than an API.
Start by measuring actual usage for one quarter. Then compare the costs of an API, rented GPU capacity and your own hardware. Include staff, maintenance and electricity in the calculation, and make sure every option meets the same performance requirements.
Energy
A short answer and a long reasoning task do not use the same amount of energy. Microsoft researchers estimate that a typical query uses about 0.31 watt-hours under modelled conditions, while a much longer reasoning scenario used about 13 times more. These are estimates, not measurements from your own system.
Energy matters most when you plan where a workload could move. Capacity depends on power, and power is getting scarce. Finland is drafting rules that would push large data centres down the grid connection queue. Before you need to switch, ask alternative providers for site-level energy data and confirmed capacity. The EU's data-centre labels, due from August 2027, will make that comparison easier.
Test the exit plan in practice
Choose one business-critical AI service. Name a person responsible for its exit plan.
Ask them to identify an alternative and estimate the time and cost of moving. Find out what can be moved or exported from the current service and what would have to be rebuilt. Above all, agree on the tests the replacement must pass before the business can rely on it.
For one service, a 60-day transition may be acceptable. Another may need to be running again within a few hours. The right target depends on what an outage would cost, what kind of SLAs the service has and how the down time would impact your users.
No organisation can remove every dependency in its AI stack. But it can know where the dependencies are. It can decide which ones it accepts. And it can test whether the option to leave is real.
This blog was written as part of MAISA (Managed AI-powered Software Innovations) project, funded by Business Finland. MAISA brings together Finnish universities and software companies to study how generative AI can be used across whole organisations, not just by individual developers. Our research covers topics such as AI sovereignty and how organisations manage their AI dependencies.
