# Choosing an EU AI inference provider: a scorecard *A Sluis guide for platform, procurement and security teams. Last checked 23 September 2026.* There is now a real choice of European providers for running AI models, from Mistral's own platform to model services from European cloud providers. They differ far more than their marketing suggests. This guide gives you seven criteria to score them on, the evidence to ask for under each, a snapshot of recent market events worth knowing, and a two-week test plan. ## In short - Score providers on **seven separate criteria**. Do not add them up into one number: a provider that is strong on control and weak on capability suits a different use than the reverse. - **Ask for evidence, not claims.** A certification counts when you have seen the certificate and its scope. A region counts when failover is in the contract. - **Missing information is a result.** Score "no evidence provided" as zero and record it. How much a provider documents publicly says a lot about how it will behave as a supplier. - The market moved in 2026. Aleph Alpha was reported to have been sold to Canada's Cohere, AWS launched a separately run European cloud, and France made SecNumCloud mandatory for much of its public sector. Check ownership and certification at every renewal. - **Test with your own prompts** before you sign. Latency from your region, tool-calling reliability and error rates vary more between providers than model benchmarks suggest. ## The seven criteria Score each from 0 to 4. The descriptions below define 0, 2 and 4; use 1 and 3 for positions in between. ### 1. Jurisdiction and control Who signs the contract, who owns it, and which governments can compel it. - **0** Contracting entity outside the EU, and no EU entity available. - **2** EU contracting entity with a non-EU parent. - **4** EU-incorporated and EU-controlled, with no non-EU control or veto rights, confirmed by public ownership records or a qualification that checks it, such as SecNumCloud. *Ask for:* the contracting entity and its registration number, the ownership chain, and the provider's policy on government requests. ### 2. Data handling What the provider does with your prompts and outputs. - **0** Content used for training by default, with no contractual opt-out. - **2** No training on your content; retention stated; sub-processors listed. - **4** No training; zero retention available without a bespoke enterprise agreement; a full sub-processor list with advance notice of changes; a DPA you can sign without negotiation. *Ask for:* the DPA, the sub-processor list, and the retention period for inputs, outputs, logs and abuse-monitoring copies. ### 3. Assurance Independent checks on the service you will use. - **0** No relevant certification. - **2** ISO 27001 with the AI service in scope. - **4** ISO 27001 plus a national or EU scheme covering the AI service, such as BSI C5 or SecNumCloud, and an AI management system certification such as ISO 42001. *Ask for:* the certificates and their scope statements. A certificate for the company's corporate IT does not cover the AI service. ### 4. Capability What the service can actually do. Check the live model list rather than launch announcements: model names and versions, context length, open-weight or proprietary, and support for tool calling, structured output, streaming, embeddings, vision, batch processing and fine-tuning. Score against what your use cases need, not against the longest list. ### 5. Operations Whether you can run production on it. - **0** No SLA and no public status page. - **2** A published SLA and a status page. - **4** An SLA with service credits, a status page with incident history, documented rate limits, reserved capacity available, and failover that stays in the EU. *Ask for:* the SLA, twelve months of incident history, and the rate limits for your tier. ### 6. Durability Whether the provider will still be there, and still be the same company, in three years. Look at funding, revenue disclosures where available, ownership changes in the last two years, and change-of-control terms in the contract. Score the risk, not the size: a small, profitable, stable provider can score higher than a larger one in the middle of a sale. ### 7. Transparency How much of the above is documented publicly, without a sales call. - **0** Most answers only under NDA or not at all. - **2** Pricing, models and DPA public; certifications and sub-processors on request. - **4** Pricing, models, DPA, sub-processors, certificates, SLA and incident history all public. This criterion is the best predictor we know of how a provider will behave when something goes wrong. ## Weighting by use | Use | Weight most heavily | Weight least | |---|---|---| | Internal chat assistant, no sensitive data | 4 Capability, 5 Operations, 2 Data handling | 1 Jurisdiction | | Customer-facing product feature | 5 Operations, 4 Capability, 6 Durability | 3 Assurance | | Processing customer or employee personal data | 2 Data handling, 1 Jurisdiction, 3 Assurance | 4 Capability | | Public sector or regulated sector | 1 Jurisdiction, 3 Assurance, 2 Data handling | none | ## The market in 2026: events to know These are facts to verify in your own due diligence, not scores. Where a fact comes from a company announcement or press reporting, we say so. | Provider or initiative | What happened | Source | |---|---|---| | Mistral AI | Paris-based model developer operating its own platform. Reported to be building its own compute at Bruyères-le-Châtel, with the first phase running from mid-2026, and to have expanded its partnership with Microsoft in July 2026 | Press reporting | | Aleph Alpha | Reported acquisition by Cohere, a Canadian company, in April 2026. Infrastructure reported to remain in Germany | Press reporting | | Scaleway | Cloud provider owned by the French Iliad group, offering hosted open-weight models. Reported to have been selected in October 2025 as an infrastructure provider for the ECB's digital euro | Press reporting | | OVHcloud AI Endpoints | French cloud provider's model service, advertised with zero retention and a catalogue of open-weight models | OVHcloud | | IONOS AI Model Hub | German cloud provider's model service, advertised with BSI C5 | IONOS | | AWS European Sovereign Cloud | Separate AWS partition in Brandenburg, generally available since 15 January 2026, operated by a German subsidiary with EU-resident staff | AWS | | EUROPA consortium | Selected by the European Commission in June 2026 to build an open-source frontier model covering all 24 official EU languages | European Commission | ## A two-week test 1. **Pick three real tasks** from your intended use, with 20 to 50 real prompts each. Pseudonymise them first. 2. **Run them against each shortlisted provider** through the same interface, so the only variable is the provider. 3. **Measure** median and 95th-percentile latency from your own region, error and timeout rates, and for agents, how often tool calls come back valid. 4. **Judge quality blind.** Have the people who do the task rate outputs without knowing which provider produced them. 5. **Price it** at your expected monthly volume, including any reserved-capacity or enterprise fees. 6. **Check the failure path.** Ask what happens when the region is full, and whether any traffic leaves the EU. ## Checklist - [ ] Shortlist scored on all seven criteria, with evidence filed for each score - [ ] "No evidence provided" recorded as zero, not left blank - [ ] Weighting agreed for the intended use before scoring - [ ] Ownership and certification scope confirmed at source - [ ] Two-week test run with real, pseudonymised prompts - [ ] Failover and retention confirmed in the signed contract - [ ] Scores reviewed at renewal and after any ownership change ## Sources - [European Commission, AI Act policy page, for the Frontier AI Grand Challenge and the EUROPA consortium](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) - [AWS, *AWS launches AWS European Sovereign Cloud and announces expansion across Europe*, January 2026](https://press.aboutamazon.com/aws/2026/1/aws-launches-aws-european-sovereign-cloud-and-announces-expansion-across-europe) - OVHcloud and IONOS product pages for their model services. - Mistral, Aleph Alpha and Scaleway items are taken from press reporting in 2025 and 2026. We have not seen primary filings for the transaction terms and do not repeat reported prices or valuations.