The audit is deliberately boring. Each engagement runs through the same six dimensions, in the same order, against the institution's own mandate rather than a generic maturity ladder. The output is a one-page institutional position, defensible in front of a regulator, a board, and — increasingly — a court.
The framework is published below in full. There is no gated download, no maturity score, no quadrant. The value sits in the conversation that follows when an institution honestly answers the six questions.
The six dimensions of AI governance and sovereignty
Governance
Who signs for this system, under which legal instrument, and how is that authority delegated when they are not in the room?
OutputA one-page accountability map naming the data controller, the model owner, the operational override authority and the escalation chain.
Data lineage
Which data produced this output, and can an independent party reproduce the result with the same inputs?
OutputA reproducibility statement covering training, fine-tuning, retrieval and prompt context, with the parts that are not reproducible explicitly named.
Model risk
What does silent degradation look like for this system, and how is it detected before a citizen, a counterparty or a regulator detects it?
OutputA model-risk register with named failure modes, monitoring signals, thresholds and the human action each threshold triggers.
Third-party dependencies
Which providers, in which jurisdictions, are required for this system to function on a Tuesday afternoon?
OutputA dependency inventory with each provider classified by criticality, substitutability, and the contractual instrument that governs the relationship.
Sovereign infrastructure
Which legal regime can compel disclosure, modification or interruption of the data and weights involved?
OutputA sovereign-exposure statement naming the jurisdictions in scope and the foreseeable changes the institution should pre-position against.
Recovery posture
If the largest single dependency disappeared on Monday, what is the institution's operating position on Friday, and on the Friday after?
OutputA recovery posture document with a declared substitution window, an exercised continuity scenario and the named individuals responsible for executing it.
Where to start
"Hosted in Europe" is where the conversation begins. For public institutions, it cannot be where it ends.
Before the full audit, three questions usually reveal the most. They sit within dimensions 04, 05 and 06.
Where is the data?
Residency describes where data is stored and processed. "Europe" also needs precision: it is broader than the EU, and not every European country falls under the same legal framework.
Backups, disaster recovery sites and support access deserve scrutiny alongside the primary hosting location.
Relates to: 04 Third-party dependencies
Which laws can reach it?
An EU region operated by a US hyperscaler remains subject to applicable EU law. Foreign disclosure obligations may also apply, depending on jurisdiction and the provider's possession, custody or control of the data.
Location alone does not establish exclusive EU jurisdiction.
Relates to: 05 Sovereign infrastructure
Who owns it, who controls access, and can we leave?
Data belonging to a European organisation can still face jurisdictional exposure through its hosting provider. A European-owned provider also requires assessment of its corporate structure, subcontractors and operational dependencies.
Ownership, access and legal exposure are distinct questions, and procurement criteria should treat them separately. An exit is only real once it has been tested within an agreed time and budget.
Relates to: 04 Third-party dependencies and 06 Recovery posture
Bring three questions to your next cloud or AI procurement or review:
- Which entities and jurisdictions can reach our data?
- Who can access readable data, including through support?
- Have we tested an exit within an agreed time and budget?
European reference models by dimension
Each dimension of the audit can be read alongside instruments and models published by or through the European Commission. The audit does not replace them. It prepares the institution to answer them with evidence.
The audit does not score institutions. Where a procurement applies the Commission's Sovereignty Effectiveness Assurance Levels (SEAL), the audit prepares the evidence those levels require.
| Dimension | Reference models and acts |
|---|---|
| 01 Governance |
|
| 02 Data lineage |
|
| 03 Model risk |
|
| 04 Third-party dependencies |
|
| 05 Sovereign infrastructure |
|
| 06 Recovery posture |
|
01 Governance
- Regulation (EU) 2024/1689 (AI Act): roles and obligations of providers and deployers of AI systems.
- EU Model Contractual Clauses for the procurement of AI (MCC-AI), updated 5 March 2025: template clauses for public buyers, in a High-Risk and a Light version, published through the European Commission's Public Buyers Community.
02 Data lineage
- Regulation (EU) 2024/1689 (AI Act), Article 10: data and data governance for high-risk AI systems.
- MCC-AI, updated 5 March 2025: contractual clauses on data sets and documentation for procured AI systems.
03 Model risk
- Regulation (EU) 2024/1689 (AI Act), Article 9: risk management system for high-risk AI systems.
- Regulation (EU) 2024/1689 (AI Act), Article 72: post-market monitoring.
04 Third-party dependencies
- Commission Implementing Decision (EU) 2021/914: standard contractual clauses for transfers of personal data to third countries.
- Commission Recommendation on non-binding standard contractual clauses for cloud computing contracts under Article 41 of the Data Act, 19 November 2025.
- Directive (EU) 2022/2555 (NIS2): supply chain security.
- Regulation (EU) 2022/2554 (DORA): ICT third-party risk for financial entities.
05 Sovereign infrastructure
- European Commission Cloud Sovereignty Framework (DG DIGIT), version 1.2.1, October 2025: eight sovereignty objectives and Sovereignty Effectiveness Assurance Levels SEAL-0 to SEAL-4, used in Commission cloud procurement.
- Commission Implementing Decision C(2023) 4745 of 10 July 2023: adequacy decision for the EU-US Data Privacy Framework.
- Regulation (EU) 2016/679 (GDPR), Chapter V: transfers of personal data to third countries.
06 Recovery posture
- Regulation (EU) 2023/2854 (Data Act): switching between data processing services. From 12 January 2027, switching charges are prohibited for covered services.
- Commission Recommendation of 19 November 2025 (Data Act, Article 41): standard contractual clauses including switching and termination of cloud computing services.
- Directive (EU) 2022/2555 (NIS2): business continuity and crisis management.
The MCC-AI and the Data Act standard contractual clauses are non-binding and voluntary. Their use and adaptation depend on the procuring institution.
What the audit is not
- Not a maturity score. Maturity ladders rank institutions against each other; mandates are not comparable.
- Not a vendor selection. Substitutability is a property of the institution, not of the vendor list.
- Not a one-off audit. The output is a posture the institution carries forward, re-exercised on a declared cadence.
Engagement shape
Six to ten weeks, on-site at the institution's anchor jurisdiction. Conducted by the principal personally. Deliverables are written in the register the institution will use to defend them. The framework above is the entire scope; nothing is reserved.
Legal reference points
The audit is conducted against the institution's own mandate. These instruments frequently shape that mandate for European public-mission institutions.
- Regulation (EU) 2016/679 (GDPR), Chapter V: rules on transfers of personal data to third countries.
- CJEU, Case C-311/18 (Schrems II), judgment of 16 July 2020: invalidated the EU-US Privacy Shield. Standard contractual clauses remained valid, but protection must be effective in practice. The judgment concerned international transfers of personal data. It did not introduce a blanket ban on US cloud providers.
- EDPB Recommendations 01/2020: supplementary measures for transfer tools.
- Regulation (EU) 2023/2854 (Data Act): from 12 January 2027, switching charges, including switching-related data egress charges, are prohibited for covered services. Migration engineering and internal effort can still cost money.
- Directive (EU) 2022/2555 (NIS2): cybersecurity risk management, including supply chain security.
- Regulation (EU) 2022/2554 (DORA): ICT risk and third-party risk for financial entities.
- Regulation (EU) 2024/1689 (AI Act): obligations for AI systems placed on the market or put into service in the EU.
These references provide orientation. They do not constitute legal advice for any specific situation.
Reference this framework
The UberConsul Resilience Audit is published in full and may be used freely, without registration. When you use or adapt it in procurement documents, audits, board papers or publications, please reference it as follows.
Kotitsas, V. (2026). The UberConsul Resilience Audit: Framework v1. UberConsul, Frankfurt am Main. https://uberconsul.com/methodology
Questions about the framework or its application? Book a time.
Framework v1 · Last updated 30 September 2026
UberConsul Resilience Audit · Framework v1 · Frankfurt am Main.