Sovence · Built in Luxembourg for Europe
Map AI dependencies. Navigate sovereignty and compliance.
Sovence helps you map how AI is used or planned across your organisation, from workflows, models and providers to data and dependencies. Together, we identify requirements, compare practical options and define a roadmap for each use case.
From assessment to action
What Sovence provides
Sovence adapts the assessment to your use case, sector and constraints. You see what applies, which dependencies matter and which actions offer the strongest practical path forward.
Context-specific assessment
Your client, sector, data and use case shape the analysis. You receive a decision for your situation, not a generic governance or maturity score.
Compliance grounded in facts
Connect applicable duties to the actual workflow, data, provider, organisational role and evidence. The result supports review without claiming legal certification.
Sovereignty you can act on
See where control sits across providers, jurisdiction, data, models, infrastructure, skills and exit options, then decide which dependencies you can accept.
Prioritised action plan
Compare feasible options against capability, cost, risk and implementation effort. Turn the chosen path into actions, owners, sequence and exit conditions.
The right balance depends on your use case.
For each use case, Sovence examines the provider, deployment, data location, access, internal capabilities and exit options before determining the appropriate balance between provider reliance and organisational control.
Example criticality: low → very high. This is separate from who operates the system.
- 1Low · Marketing copy assistant, public data, provider-hosted, lower switching effort
- 2Moderate · Support chatbot, customer data, provider-hosted with enterprise safeguards
- 3High · Document extraction, confidential documents, controlled data flow, tested fallback
- 4Very high · HR screening, candidate data, consequential employment decisions, human oversight
Criticality reflects data sensitivity, decision consequence, applicable duties and reversibility, not hosting location alone. The full assessment records the evidence for each dimension.
Different from a generic governance checklist: one use case at a time, evidence separated from assumptions, compliance and sovereignty assessed together, and recommendations tied to owners and exit conditions.
Governance frameworks set the requirements. Sovence helps you apply them to concrete AI use cases and deployment options. Together, we compare alternatives, separate evidence from assumptions and assess exit options.
Decisions you can explain and justify
Sound familiar?
If any of these questions sound familiar, Sovence can help you turn them into concrete decisions.
“A client just sent us an AI questionnaire.”
Your regulated clients may require you to document how you use AI, handle data and manage the associated risks.
“Do we actually know which AI tools our teams are using?”
Shadow AI, personal accounts and embedded AI can remain invisible. Start by establishing what your teams use, where they use it and with which data.
“Can we control how our AI costs will evolve?”
Your AI costs can grow through usage, model choices and provider repricing. Check your usage, spending limits and contract terms to understand how much costs could increase.
“Which of our AI uses are actually affected by the AI Act?”
The obligations that apply depend on what your AI does, how you use it and your role. Your inventory should connect those facts to the relevant obligations and dates.
Why now
Current as of August 2026
Three clocks are already running.
Changes in the law, client requests and supplier terms can each affect how you use AI. Check which of these changes requires action from your organisation.
1 · AI Act
- Since 2 Feb 2025: rules on prohibited AI practices (Article 5) apply.
- Since 2 Aug 2026: Article 50 transparency obligations apply to specified AI interactions and generated or manipulated content.
- From 2 Dec 2027: obligations for certain Annex III high-risk systems apply, including recruitment, credit and essential-service uses. Product-embedded high-risk systems follow from 2 Aug 2028.
2 · Existing duties and clients
- Already applicable: AI processing involving personal data may fall within the GDPR.
- Already arriving: regulated clients are asking suppliers to document their AI use, controls and evidence.
- Already relevant: professional secrecy, confidentiality and employee-representation requirements may constrain how particular AI uses are deployed.
3 · Providers and contracts
- On the provider’s calendar: price revisions, quota changes, model deprecations and terms updates.
- At renewal: an opportunity to negotiate price protection, exit rights and reversibility.
- Over time: workflows, integrations, evaluations and accumulated know-how can make switching providers progressively harder.
Collect the evidence once, then use it across regulatory, client and provider decisions.
Method
A structured approach to making AI choices.
We help you move from an incomplete picture of AI use to explicit choices about deployment, governance and acceptable dependencies, then turn those choices into a practical roadmap.
Map how AI is or will be used.
Describe the workflow, people, systems, models and providers involved, including uses that may not yet be recorded or centrally known.
Map the data and dependencies.
Identify what data enters your use case, where it is processed or stored, who may access or reuse it, and which providers, infrastructure, models and internal capabilities it depends on.
Determine which requirements apply.
Identify the legal, contractual, security, operational and strategic requirements relevant to your use case. Separate mandatory obligations from your organisation’s choices and preferences.
Compare technical and organisational options.
Compare suppliers, hosting arrangements, data safeguards and staff responsibilities. Explain the costs, risks and advantages of each option.
Agree the next steps and when to review them.
Set out the tasks, who will carry them out, what comes first and when to reconsider the choice. Reassess when your use case, requirements, technology or market changes.
Illustrative comparison
One AI assistant. Three contexts. Three different deployment choices.
Compare the data, main risk, operational priority, hosting direction and essential controls. These are illustrative directions, not recommendations for a specific organisation.
| What changes | Marketing assistantStartup · website and campaign content | Document assistantLaw firm · confidential client documents | Administrative assistantMinistry · citizen and administrative data |
|---|---|---|---|
| Criticality | Marketing assistantLow | Document assistantHigh | Administrative assistantVery high |
| Data | Marketing assistantPublic content | Document assistantConfidential client documents | Administrative assistantSensitive citizen and administrative data |
| Main risk | Marketing assistantIncorrect or weak copy that can be detected and reworked | Document assistantDisclosure or breach of professional secrecy | Administrative assistantHarm to rights, services or public trust |
| Priority | Marketing assistantCapability and cost | Document assistantProtection of client documents and the laws governing access | Administrative assistantControl over data access and operation of the service |
| Hosting direction | Marketing assistantProvider-hosted | Document assistantEU-hosted enterprise service | Administrative assistantHosting within the country or on infrastructure managed by the organisation |
| Essential controls | Marketing assistantExclude sensitive data · easy export | Document assistantDocuments are not reused for training · switching arrangements have been tested | Administrative assistantRecord who accesses the system · staff review its outputs |
Why these directions differReasoning for all three examplesShow reasoningHide reasoning
Marketing assistant
The assistant drafts website pages and campaign text. An external service may suit this task when errors are easy to review, sensitive data is excluded and prompts or content can be moved without interrupting the team’s work.
Document assistant
An external service may also suit confidential documents, provided its terms and safeguards meet the organisation’s needs. Check contractual terms, processing location and access, training reuse, security controls and professional-secrecy requirements. Check how documents, saved prompts and connections to other software would transfer to a replacement service.
Administrative assistant
The ministry may choose, or be required, to keep some data out of a general-purpose external service, specify where data is processed and record who accesses it and how it is used. For tasks involving sensitive data, investigate a dedicated service or infrastructure managed by the organisation.
A hosting location alone does not establish who can access your data or how much control you retain. Check the contract, data access and reuse, separation from other customers, staff supervision and arrangements for leaving the service.
Deep dive
Compliance defines what you must do. Sovereignty determines which dependencies you can accept and which options you preserve.
They overlap, but one does not substitute for the other. A compliant deployment can still create dependencies that are difficult to reverse; a highly sovereign deployment can still fail to meet applicable obligations and performance objectives.
Identify what is mandatory
Determine the legal, contractual, security and sector-specific requirements that constrain your use case.
Assess your room to act
Examine provider dependence, jurisdiction and exposure to third-country laws, data location and access, AI model and infrastructure choices, internal capabilities, and exit options.
Decide which dependencies to accept
Determine where provider reliance is acceptable, where you need alternatives or internal capabilities, and which capabilities you need to retain.
Start with what is known
Can you answer these eleven questions about your organisation’s AI use?
Focus on what happens in practice, not only what your policy says. Every “we don’t know” reveals an evidence gap and a useful starting point for your review.
01Which AI tools are actually“Actually” includes shadow AI: tools or personal accounts employees use for work without formal employer approval. in use, including the AI already embedded in your existing software and tools not centrally managed?
02Who uses them, in which workflows?
03With which types of data, such as client, personal or confidential data?
04Are they being used through organisational accounts and contracts, personal accounts, or both?
05Where is the data processed, and under which jurisdiction? And who can access it?
06Can the data and prompts be retained or reused, for instance for model training?
07Which decisions in your organisation already rely on AI output and what could happen if that output is wrong?
08What human review or override actually takes place before AI outputs are used?
09Could your provider change the price, the model, the quotas or the access terms, and what would you do?
10Could your data, prompts, agents and workflows move to another provider at an acceptable cost and within an acceptable time frame?
11Have you mapped applicable GDPR and EU AI Act requirements, and considered how the proposed CADA could affect cloud and sovereignty requirements?
Runs entirely in your browser. Nothing is recorded or sent anywhere unless you later choose to attach your summary to a beta request below.
Available in private beta
Start with one AI use case.
We help you map its data and dependencies, identify requirements, compare technical and organisational options, and define a practical roadmap. You do not need a complete inventory or a fully specified use case.
Available now
- A structured map of a concrete AI use case: workflows, actors, systems, data, providers and dependencies.
- A formal statement of the current state and the requirements relevant to the decision.
- An evidence-backed gap list separating known facts, assumptions and unknowns.
- A comparison of practical response options against your priorities and constraints.
- An auditable assessment report giving implementation teams and legal advisers a structured factual basis for their work.
Current boundaries
- The private beta combines software supported by direct review with Sovence’s founders.
- It does not provide legal advice, certify compliance or make automated legal or risk decisions.
- Results depend on the evidence available and remain open to client review.
- Suitability is assessed in context; no provider or architecture is rejected by label alone.
How to start
- Contact us at any stage: discovery, inventory, procurement, architecture, governance or review.
- A high-level description is enough for the first conversation.
- We agree what to examine, who needs to take part and how to share sensitive information.
- Make uncertainty visible. Undiscovered unknowns can expose decisions to avoidable risk; identifying and recording them is both part of the work and a core assessment outcome.
Talk to us about one AI use case
Tell us what you are trying to understand or decide. We will reply to discuss what the current beta can address and agree a useful starting point.
Keep this first message non-confidential. We will agree how to handle sensitive information before you share it.