AI Sovereignty in SMEs: Strategy Before Tool Purchase

More than half of German companies are now using AI. According to current figures from the ifo Institute, it's already 54.5 percent. For SMEs, the task is shifting: it's about the quality of implementation and control over it. This is exactly what AI sovereignty in SMEs describes: steering AI according to your own goals, data, and rules, without being at the mercy of a single provider.

How quickly dependence can become tangible was recently demonstrated: on the instructions of the US government, a major provider blocked its most powerful AI model for users outside the USA. Bitkom immediately warned of Europe's digital dependence. For medium-sized companies, this was a stress test with a warning.

Why AI Sovereignty Becomes a Strategic Question

Availability has become a political variable. An administrative act in Washington can render a productively used model unusable overnight, without notice and without consultation.

The numbers show how significant the leverage is. According to the current Bitkom Cloud Report, 71 percent of German companies source their cloud services from the USA, 85 percent consider this dependency too high, and 91 percent would prefer to rely on German providers. Sovereignty does not mean autarky. No one has to switch to purely European models tomorrow. However, every company should know which processes would be impacted if a provider fails, and how quickly a change is possible.

The Real Risk: Tool-Driven Actionism

In many consulting discussions, we see the same pattern. Companies purchase licenses for AI tools before they have a strategy. Three consequences regularly arise:

• Data Silos. Information is scattered across individual tools and cannot be shared.
• Security Risks. Sensitive company data ends up unfiltered in public models.
• Frustrated Teams. Without a clear goal, AI acts as a threat, and acceptance decreases.

AI sovereignty is not created by the latest plugin. It arises from a sequence: first the strategy, then the tool.

Six Building Blocks for a Sovereign AI Strategy

The 6Rocks framework organizes the transformation along six building blocks, the six Rocks:

1. Strategy. Where does AI provide the greatest leverage? Use cases with real ROI instead of mere play.
2. Governance. How do we use AI in a legally compliant way? Clear guidelines, risk classes, protection of intellectual property.
3. Organization. How do we bring the team along? AI transformation is largely change management.
4. Data. Do we have the data foundation? Without clean data, no reliable AI.
5. Technology. Which infrastructure fits our IT landscape, and does it remain interchangeable?
6. Iteration. How do we learn? Sovereignty is an ongoing process, not a one-time project.

For sovereignty, Rock 4 (Data & Architecture) and Rock 2 (Governance) are particularly crucial. Building applications against an interchangeable model endpoint instead of being tied to a single provider makes a switch a matter of hours instead of weeks.

What Consulting You Really Need

Not every need requires strategic AI consulting. If you want to train a team in a specific tool, the tool provider is often a better and more cost-effective choice. A purely integration-related question belongs to the IT systems house, an isolated legal question to the specialized data protection officer. Strategic AI transformation consulting is worthwhile when AI is to be introduced across departments and along a clear strategy. This is exactly where 6Rocks comes in.

What You Should Do Specifically

1. This Week: List all AI tools already in use in your company, including the departments and the data entered.
2. Strategy First: Identify the two to three use cases with the greatest leverage and the lowest risk.
3. Check Dependencies: For each business-critical process, clarify which second provider could take it over.
4. Clarify Data Sovereignty: Determine which data may leave a model and which must remain in-house.
5. Keep Architecture Portable: Build new applications so that a model change is possible without re-engineering.

AI sovereignty is the prerequisite for deploying AI with speed and confidence. Waiting means falling behind at the current pace.