Data Residency and Digital Sovereignty for AI

Data residency is a key consideration when adopting AI in enterprise environments. It refers to where data is stored and processed, and how this aligns with regulatory and organizational requirements.

In SAP Business AI, data residency is not defined by a single rule. Instead, it depends on how an AI scenario is designed and deployed.

For example:

1. In embedded AI scenarios, processing occurs directly within the SAP application, meaning data remains within the system boundary.
2. In side-by-side AI scenarios, processing takes place on SAP Business Technology Platform (BTP).
3. In generative AI scenarios, requests are routed through SAP-managed services such as the Generative AI Hub. Processing may occur on SAP-managed infrastructure or approved external model providers, depending on the use case and configuration.

This architectural flexibility allows organizations to choose how and where data is processed, based on sensitivity, compliance requirements, and business needs.

To understand SAP’s approach, it is important to distinguish between two related concepts:

Data sovereignty

Focuses on how data is stored, processed, and governed under local laws and regulations.

Digital sovereignty

Takes a broader view, including control over data, operations, technical architecture, and legal jurisdiction.

Digital sovereignty for AI enables organizations to use AI while maintaining control over where data is processed, who can access it, and how AI systems are operated, while aligning with regional and industry regulations.

SAP supports digital sovereignty for AI through different implementation options, depending on customer requirements:

• Locally hosted AI with sovereign capabilities, where data, models, and AI execution remain in the customer’s region. This helps reduce cross-border data exposure and supports regional compliance needs.
• SAP Sovereign Cloud, designed for advanced requirements, providing sovereignty across data, legal, operational, and technical dimensions.

This layered approach allows organizations to adopt AI while maintaining the level of control, compliance, and operational governance required for their specific context.

For European customers, SAP provides the EU AI Cloud, which offers a dedicated environment for building and running AI in compliance with European regulations.

Key characteristics include:

• AI infrastructure hosted within Europe
• Designed to support GDPR requirements and alignment with the EU AI Act
• Governed access to AI models from SAP and trusted partners
• Strong data protection measures, including encryption and access controls

A central principle is that customer data remains within the European environment. SAP does not use customer data to train third-party models.

This setup enables organizations to use advanced AI capabilities while meeting strict data protection and sovereignty requirements.

AI introduces additional considerations for data residency because it involves processing across multiple layers, including applications, platforms, and AI models.

As a result, organizations need clarity on:

• Where data is processed during inference
• Whether data leaves a defined system or regional boundary
• How external services are governed and controlled

SAP addresses these needs through:

• Regional deployment options for AI services (subject to availability)
• Architectural patterns that define where processing takes place and how data flows
• Governed access layers, such as SAP Generative AI Hub, which enforce policy controls and manage how data is routed to AI models

This ensures that data handling remains aligned with both technical and regulatory requirements.

Data residency and sovereignty are essential considerations when adopting AI in enterprise environments.

In SAP Business AI, where data is processed depends on the selected architecture pattern, ranging from in-application processing to platform-based and generative AI scenarios.

SAP supports these requirements through:

• Flexible architecture patterns that control data movement
• Locally hosted AI with sovereign capabilities for in-region processing and control
• SAP Sovereign Cloud for full sovereignty across legal, operational, technical, and data dimensions
• Regionally governed AI environments such as the EU AI Cloud

Together, these capabilities enable organizations to adopt AI while maintaining control over where data resides, how it is processed, and how it complies with applicable regulations.