For most companies in Switzerland, Germany and Austria, sovereign AI is not a chip problem. It is a data and jurisdiction problem. Answer four questions to locate your binding constraint and see whether controlling it wins you an advantage or simply costs you one.
Two axes decide the exposure: how tightly you are regulated, and how sensitive the data your AI would touch. Together they set which layer of the stack you cannot let anyone else switch off, and whether building for that layer is worth doing.
Sovereignty is not owning the stack. It is knowing which layer someone else could switch off, and whether your regulator lets them.
The same diagnostic, pre-run for each DACH country. Every map lists the four sectors Auron focuses on first (banking, insurance, pharma and MedTech), then that country's key industries. Binding layer is the part of the stack that governs the decision, almost never the chip.
| Industry | Binding layer | Exposure | Posture | Commercial implication |
|---|---|---|---|---|
| Banking & wealthFocus | Data + jurisdiction | Secrecy vs. CLOUD Act reach | Moat | Sovereign hosted model becomes a sales requirement; FINMA Guidance 08/2024 expects AI inventory, explainability and outsourcing control. |
| Insurance / re-insFocus | Data + models | Actuarial and health data | Moat | Model provenance and residency become governance line items; reinsurers hit residency hardest. |
| Pharma / life sciFocus | Data + IP | Trial data trained in cannot be recovered | Moat | On premises inference as IP defence; the EU AI Act applies wherever products reach the EU market. |
| MedtechFocus | Applications + data | Swissmedic / MDR outputs | Moat | Sovereign clinical AI is the market access gate; EU bound devices also need AI Act conformity. |
| Machinery & engineering | Compute + models | Design IP; export oriented | Tax | Tax at home; EU bound machines with AI safety functions face the EU Machinery Regulation from 20 January 2027. |
| Food & consumer | Data + apps | Consumer data (nDSG / GDPR) | Tax | Standard governance suffices; sovereignty is manageable, not a differentiator. |
| Commodities trading | Models + compute | Commercial confidentiality | Tax | Free to use best in class foreign models; exposure is competitive, not compliance. |
| Public sector | Full stack | Citizen data, by mandate | Moat | Critical workloads hosted domestically; the open Apertus model gives an inspectable national option. |
| Telco / infra | Infrastructure | Critical infrastructure | Sells it | Sovereignty is a revenue line: Swisscom offers Apertus on its AI platform to regulated sectors. |
| Banking & wealthFocus | Resilience + jurisdiction | DORA third party risk; CLOUD Act | Moat ≠ CH | BaFin treats AI as an ICT asset under DORA: exit plans and provider concentration make the sovereignty case. Credit scoring AI is high risk from 2 December 2027. |
| Insurance / re-insFocus | Models + governance | Life and health pricing is high risk | Moat ≠ CH | AI for life and health risk assessment and pricing is high risk from 2 December 2027, on top of DORA. Sovereignty becomes a licence to operate. |
| Pharma / life sciFocus | Data + IP | Trial data trained in cannot be recovered | Moat | Same logic as Switzerland; the AI Act applies directly to EU operations. |
| MedtechFocus | Applications + conformity | MDR plus AI Act for embedded AI | Moat | AI in medical devices is high risk under the AI Act from 2 August 2028; conformity drives architecture. |
| Automotive | Data + IP | Vehicle design IP; connected vehicle data | Moat DE key sector | Engineering IP trained into a foreign model does not come back; sovereign industrial compute such as the Munich Industrial AI Cloud targets design to robotics workloads. |
| Machinery & engineering | Applications + conformity | AI safety components; design IP | Lean moat ≠ CH | The EU Machinery Regulation from 20 January 2027 and AI Act rules from 2 August 2028 make AI safety functions a conformity question. Control the jurisdiction of that layer. |
| Chemicals | Data + IP | Formulation and process data | Moat DE key sector | Formulations and process parameters are trade secrets; keep training and inference on controlled infrastructure. |
| Electrical & electronics | Data + IP | Product and circuit design IP | Moat DE key sector | Design data is the core asset; use sovereign or on premises inference for engineering work, foreign models for the rest. |
| Food & consumer | Data + apps | Consumer data (GDPR) | Tax | Standard governance suffices; AI Act transparency duties apply to customer facing chatbots. |
| Banking & wealthFocus | Resilience + jurisdiction | DORA third party risk; CLOUD Act | Moat ≠ CH | DORA governs AI as ICT; the FMA is market surveillance authority for high risk AI in financial institutions. Credit scoring AI is high risk from 2 December 2027. |
| Insurance / re-insFocus | Models + governance | Life and health pricing is high risk | Moat ≠ CH | AI for life and health risk assessment and pricing is high risk from 2 December 2027, supervised by the FMA. Sovereignty becomes a licence to operate. |
| Pharma / life sciFocus | Data + IP | Trial data trained in cannot be recovered | Moat | Same logic as Switzerland; the AI Act applies directly to EU operations. |
| MedtechFocus | Applications + conformity | MDR plus AI Act for embedded AI | Moat | AI in medical devices is high risk under the AI Act from 2 August 2028; conformity drives architecture. |
| Machinery & engineering | Applications + conformity | AI safety components; design IP | Lean moat ≠ CH | Mechanical and steel engineering face the EU Machinery Regulation from 20 January 2027 and AI Act rules from 2 August 2028. Control the jurisdiction of the safety layer. |
| Automotive | Data + IP | Supplier design IP | Moat AT key sector | Component and system design IP is the exposure; on premises or Austrian hosted inference protects it. |
| Chemicals & plastics | Data + IP | Formulation and process data | Moat AT key sector | Formulations and process parameters are trade secrets; keep training and inference on controlled infrastructure. |
| Electrical & electronics | Data + IP | Product and circuit design IP | Moat AT key sector | Design data is the core asset; sovereign options include A1 Exoscale and STACKIT, which runs data centres in Austria. |
| Food & consumer | Data + apps | Consumer data (GDPR / DSG) | Tax | Standard governance suffices; AI Act transparency duties apply to customer facing chatbots. |
| Wood, pulp & paper | Models + compute | Operational process data | Tax AT key sector | Low sensitivity data; best in class foreign models are the rational choice, with standard GDPR governance. |
≠ CH the answer or its driver differs from Switzerland DE key sector AT key sector a key industry with no row in the Swiss map
Part of the Sovereign Stack series. The diagnostic applies the layer by layer argument in The Case for Sovereignty. More in Insights.
Diagnostic for orientation, not compliance advice. Regulatory references are current as of September 2026: FINMA Guidance 08/2024; BaFin guidance on ICT risks of AI (December 2025); the EU AI Act as amended by Regulation (EU) 2026/1744, with Annex III high risk duties from 2 December 2027 and Annex I duties from 2 August 2028; Germany's KI-MIG (in force 29 July 2026); the EU Machinery Regulation from 20 January 2027. Key industries follow published national overviews: for Germany the automotive, mechanical engineering, chemical and electrical industries plus food (deutschland.de, Statista); for Austria the sectors listed by Advantage Austria (WKO). Named providers are examples, not endorsements. The CLOUD Act interaction is fact specific and warrants case by case legal review. The chip layer remains a foreign dependency at national level and is not solvable at company level.