Only 6% of European businesses place digital sovereignty at the centre of their transformation strategy. For the majority, the topic surfaces only when an external constraint or a concrete problem forces their hand: a ransomware attack, a vendor announcing it is shutting down, a client asking where their data is stored. For an Italian professional firm or SME, however, the stakes are high from the very first day a cloud or AI tool is adopted.
This article addresses the questions that firm owners and SME managers ask us most often: where does client data actually end up, what does it truly mean to control data rather than simply entrust it to whoever hosts it, what concrete risks are involved, and how to build a sound security posture — regardless of which tools you choose.
- Only 6% of European businesses base their transformation strategy on digital sovereignty principles (source: Kyndryl Modernization Report).
- Hosting data on an Italian server does not equal data control: what matters is also who has access, under what rights, and what happens in the event of an outage.
- 62% of European organisations plan to increase their use of cloud solutions with greater data-location control over the next twelve months.
- For a professional firm, losing control of client data can result in a breach of professional confidentiality and GDPR sanctions.
- Digital sovereignty is not just about compliance: it is operational resilience — the ability to keep working even if a vendor fails, is acquired, or suspends its service.
- Building data governance before adopting AI tools is the decision that reduces costs, risks and complexity in the long run.
In this article
- What digital sovereignty really means for a firm or an SME
- Italian server = protected data? The myth debunked
- What you risk if your AI vendor goes down or is acquired
- Ransomware and the cloud: the risk does not disappear, it changes shape
- Regulatory obligations: GDPR, AI Act and Italian Law 132/2025
- How to choose an AI vendor that genuinely respects data sovereignty
- The Ovia view
- Frequently asked questions
What digital sovereignty really means for a firm or an SME
Digital sovereignty is the ability to control your own data: knowing where it is held, who can access it, how it is processed, and what happens if the vendor hosting it ceases to operate. It is not simply a geographical question.
According to the Kyndryl Modernization Report, 65% of European organisations approach the topic reactively: 37% only when external requirements intervene, and 25% primarily as a compliance obligation. A mere 6% have made it a guiding principle for designing their own infrastructure.
For an accountant, a solicitor or a labour consultant, this distinction is far from academic. The data they handle — income records, contracts, asset positions, legal disputes — is covered by professional confidentiality and subject to the GDPR. Having no control over where that data resides and who can access it exposes the professional to disciplinary, civil and criminal risks, regardless of who actually caused the incident.
The starting point is not choosing the right vendor, but knowing what you want to control and why — and only then assessing which tools and architectures make that possible.
Italian server = protected data? The myth debunked
The answer is no. The geographical location of the server is a necessary condition in certain regulatory contexts, but it is not sufficient to guarantee data sovereignty.
Consider a real-world scenario: a firm adopts a SaaS (Software as a Service, i.e. an application used over the internet) tool that declares it hosts data in European data centres. But who administers those servers? Under which legislation must the vendor respond to any access requests from foreign authorities? What does the contract say if the vendor is acquired by a non-European group? What happens if the company ceases trading or suspends the service without notice?
Data sovereignty is measured across at least four dimensions: location (where the data is physically held), access (who can view it and under what rights), portability (can you export and migrate it if you change vendor?) and continuity (can you access your data even if the vendor has a problem?). An Italian server that answers negatively on three of these four questions offers far weaker protection than it appears.
For firms and SMEs, the practical question is: *if this vendor closed or suspended its service tomorrow, could I keep working? Would I still have access to my clients' data in a usable format?* If the answer is uncertain, the issue is not GDPR — it is operational continuity.
What is not enough
Location onlyWhat you actually need
Real controlWhat you risk if your AI vendor goes down or is acquired
The AI tools market is evolving rapidly: mergers, acquisitions, product shutdowns and policy changes are commonplace. For a professional firm, dependence on a single vendor with no exit clauses is a concrete operational risk — not a remote eventuality.
The risks materialise on three levels. The first is loss of access to data: if the vendor suspends the service or modifies its terms, you may be unable to retrieve documents, communication history or processed data. The second is service continuity: a firm that has automated email management, document collection or deadline tracking on a single tool finds itself operationally paralysed. The third is professional liability: as a professional, you are the data controller for your clients' data — you cannot delegate that responsibility to a technology vendor.
This topic is explored in depth in our article on AI vendor lock-in risks, where we explain how to build an exit strategy before adopting any tool.
The tension between innovation and sovereignty is real: businesses must modernise their systems to adopt AI, but they must do so while guaranteeing data control, compliance and technological autonomy. Treating these two objectives as separate — innovation first, security later — is the choice that generates the greatest costs.
- You do not know in which country your vendor's servers are located or under which legislation they operate.
- The contract contains no data portability clauses or notification provisions in the event of an acquisition or service closure.
- You have no independent copy of the data processed by the AI tool (backup held outside the vendor's system).
- Your firm could not operate for more than 24 hours if this tool became inaccessible.
Ransomware and the cloud: the risk does not disappear, it changes shape
Using cloud tools does not eliminate the ransomware risk — it transforms it. An attack that encrypts local data is visible and immediate. An attack that compromises the access credentials of a cloud service, on the other hand, can go unnoticed for weeks, during which data is silently exfiltrated or corrupted.
For a professional firm handling sensitive data, ransomware is not merely a technical problem: it is an operational shutdown with immediate consequences for clients, tax or legal deadlines, and reputation. Recovering data, when possible at all, takes time — and in the meantime the firm is at a standstill.
Effective defence operates across three levels that must coexist: prevention (strong credentials, two-factor authentication, minimum necessary access for every tool), detection (knowing in real time who is accessing what and from where) and recovery (verified backups, stored in a separate system and tested periodically — not merely declared).
The critical point for SMEs and firms is the backup itself: many cloud tools offer built-in backup functions, but if the vendor suffers the attack, that backup is compromised alongside the data. You always need at least one independent copy, held in a system that is not connected to the main environment.
PreventionFirst line
Two-factor authentication on all cloud tools. Principle of least privilege: every team member accesses only what they need. Unique passwords managed with a password manager.
DetectionSecond line
Active and monitored access logs. Alerts for anomalous access (unusual hours, unknown devices). Periodic review of authorised users on every tool.
RecoveryThird line
Backup independent of the main system, tested at least once per quarter. Documented restoration procedure: who does what, in what order, within what timeframe.
Regulatory obligations: GDPR, AI Act and Italian Law 132/2025
For an Italian professional firm, digital sovereignty is not just good practice: it is a legal obligation. The GDPR requires the data controller (the firm) to ensure that personal data is processed with appropriate technical and organisational measures. This includes knowing where the data is held, who processes it and under what safeguards — even when third-party tools are used.
The AI Act, now progressively in force, introduces specific obligations for those using AI systems in professional contexts: transparency about the use of automated tools, human oversight of outputs, and documentation of decisions. This is not a future concern: some provisions are already operative in 2025–2026. We covered this in detail in our article on the AI Act for professional firms and Italian SMEs.
Italian Law 132/2025 has introduced an obligation for Italian professionals to inform clients whenever an output is produced or assisted by an AI system. Failure to do so exposes the firm to challenges regarding the validity of the work product and to disciplinary liability.
Taken together, the regulatory framework points in the same direction: you cannot use AI tools without first deciding how to govern the data those tools process. Compliance is not an additional cost — it is the precondition for using the tools sustainably.
Minimum compliance checklist for firms and SMEs using AI tools
- ✓Up-to-date records of processing activitiesIncludes all AI and cloud tools in use, with details of the vendor, data location and legal basis for processing.
- ✓DPA signed with every vendorA Data Processing Agreement must be signed with every vendor that processes data on behalf of the firm.
- ✓Updated client privacy noticeClients are aware that the firm uses AI tools and which of their data is processed by those systems (obligation reinforced by Italian Law 132/2025).
- ✕Documented exit procedureA written procedure exists for migrating data out of every cloud tool in use, with defined timescales and responsibilities.
- ✕Verified independent backupA backup of critical data exists in a system separate from the main vendor and has been tested within the last 90 days.
- ✕Human oversight of AI outputsA procedure exists defining who reviews outputs generated by AI tools before they are used or sent to clients.
How to choose an AI vendor that genuinely respects data sovereignty
Choosing an AI vendor is not simply a matter of evaluating features. For a professional firm or SME handling sensitive data, the questions to ask before signing the contract are specific and non-negotiable.
The first concerns location and jurisdiction: is the data held in the EU? Is the vendor subject exclusively to European legislation, or also to non-EU regulations that could compel it to share data with foreign authorities? The second concerns portability: can you export all your data in an open format at any time, at no additional cost and without depending on the vendor's availability? The third concerns continuity: what happens to your data if the vendor is acquired, changes its terms of service, or shuts down? Does the contract specify this?
A solid vendor answers these questions clearly — and the answers are in the contract, not just in the marketing material. If the answers are vague or the relevant clauses are absent, that is a signal not to be ignored.
On a practical level, the growing complexity of cloud architectures — with data spread across public clouds, private infrastructure and multiple services — makes it even more important to have an overall picture before adding new tools. Every new tool is a new perimeter to govern: more uncoordinated tools mean more points of vulnerability and greater difficulty in responding to an incident.
Questions to ask every AI vendor before signing
- ✓Where is the data physically held?The vendor must specify the country and the specific data centre, not simply 'in Europe'.
- ✓Which jurisdiction is the vendor subject to?A vendor with a registered office outside the EU may be compelled to share data with foreign authorities even if the servers are in Europe.
- ✓Can I export all my data at any time?Portability must be contractually guaranteed, in an open format and at no additional cost.
- ✕What happens to my data if the service is discontinued?The contract must specify post-closure retention periods and the method of data return.
- ✕Who within the vendor organisation can access my data?Verifiable access logs and a list of authorised roles must exist.
Ovia's perspective: sovereignty is designed, not purchased
Working every day with Italian professional firms and SMEs, we frequently see the same pattern: the AI tool is chosen for its features, and the data question is dealt with afterwards — once a problem has already arisen. This order needs to be reversed.
At Ovia, we build automation systems starting from a precise mapping of data: what information the firm handles, where it must reside, who may access it, and what happens in the event of an incident or outage. Only after this analysis do we choose the tools. It is an approach that requires more work upfront, but avoids building on fragile foundations.
Concretely, this means the systems we deliver — from document management to operational CRM — are designed with portability clauses, independent backups and documented exit procedures. Not because this is a value-added extra: because it is the minimum condition for using AI responsibly in an Italian professional context.
Frequently asked questions
Where does my clients' data actually end up when I use AI tools?
It depends on the vendor and the contract. In many cases, data passes through servers managed by non-European companies, even if the interface is in Italian. Before using any AI tool, check the contract (or the terms of service) to find out where the data is held, who can access it, and which legislation the vendor is subject to. If this information is unavailable or vague, that is a risk signal.
What does digital sovereignty mean for an SME or a professional firm?
It means having operational control over your own data: knowing where it is held, who can access it, being able to export it at any time, and continuing to work even if a vendor has a problem. It is not solely a technical or regulatory matter — it is a condition of operational resilience that must be built before adopting AI tools, not after.
Is hosting data on an Italian server enough to protect it?
No. Geographical location is one of the four dimensions of data sovereignty, not the only one. What also matters is who administers those servers and under which legislation, whether you can export your data in an open format, what happens in the event of a vendor acquisition, and whether you have an independent backup. An Italian server managed by a company subject to non-European law does not offer the same guarantees as a European vendor with a robust contract.
What are the risks if my AI vendor suspends the service or is acquired?
The risk is threefold: loss of access to data, operational shutdown of the firm, and professional liability towards clients. As the data controller, you are responsible for your clients' data regardless of who hosts it. This is why every contract with an AI vendor must include portability clauses, notification provisions in the event of an acquisition, and a data-return procedure.
How do I protect myself from ransomware if I use cloud tools?
The cloud does not eliminate the ransomware risk, it transforms it: an attack can compromise the access credentials of a cloud service and go unnoticed for weeks. Effective defence requires two-factor authentication on all tools, monitored access logs, and — above all — a backup that is independent of the vendor's system and tested periodically. If the backup is internal to the system under attack, it is not a useful backup.
What obligations do I have as a professional regarding data location and control?
The GDPR requires you to ensure that client data is processed with adequate measures, even when third-party tools are used. This includes signing a Data Processing Agreement (DPA) with every vendor, updating the records of processing activities, and informing clients. Italian Law 132/2025 adds the obligation to inform clients when an output is produced or assisted by an AI system.
How do I choose an AI vendor that genuinely respects privacy and the GDPR?
Ask at least five questions before signing: where the data is physically held, which jurisdiction the vendor is subject to, whether you can export your data in an open format at any time, what happens to your data if the service is discontinued, and who within the vendor organisation can access your data. The answers must be in the contract, not in the marketing material. A reputable vendor answers all five questions clearly.
Conclusion
Digital sovereignty is not a topic reserved for large corporations or public bodies. For a professional firm handling clients' income records, contracts and assets, or an SME managing sensitive commercial data, it is a daily operational condition. And it must be built before adopting AI tools — not as a response to a problem that has already occurred.
The fact that only 6% of European businesses treat it as a guiding principle is not a statistical curiosity: it is a description of a widespread vulnerability. Those who instead start from data governance — knowing where their data is held, who controls it and what happens in the event of a problem — turn a regulatory constraint into a genuine competitive advantage.
The concrete step to take today is not to change vendor or invest in costly infrastructure. It is to answer the questions in this checklist honestly: do you know where your clients' data is held? Do you have a tested independent backup? Does your contract with AI vendors include portability clauses? If the answer to even one of these questions is uncertain, that is where you start.
Ovia systems for this topic
Tailor-made solutions that solve exactly the problem discussed in this article.
Ovia CRM
Ovia CRM is designed to operate with data that is localised and governed according to the firm's own rules: deadlines, documents and client communications remain under the professional's control, with backup and portability procedures defined from the outset.
Discover CRMDocumentsOvia Documents
Ovia Documents automates the collection and verification of client documents while keeping the full history of every submission within a system governed by the firm, reducing dependence on third-party cloud tools for case management.
Discover DocumentsEmailOvia Inbox
Ovia Inbox manages the firm's email and certified electronic mail (PEC) with defined access rules, ensuring that client data does not pass through non-compliant systems: every message is recognised, assigned and archived in accordance with professional confidentiality obligations.
Discover InboxSources
- Sovranità digitale, solo il 6% delle imprese europee la mette al centro della trasformazione — Key4biz
- Sovranità dei dati: localizzazione geografica e strategie di backup per grandi organizzazioni — AI4Business
- Ransomware su scala industriale: come costruire una difesa efficace — Agenda Digitale
- Cyber security e agentic AI: perché il costo dei token diventa un rischio operativo — Cybersecurity360
An article by the Ovia editorial team, written with the support of artificial intelligence tools from the sources cited, which remain the property of their respective authors. Translated from the Italian original. This information is for general guidance and does not constitute legal or tax advice. Corrections: oviaitalia@gmail.com.