Sovereign AI Coding Stack for Utilities
Since 26 July 2026 the weights of the strongest open model have been public on Hugging Face. For utilities and grid operators that changes the calculation. Not because of the benchmarks, but because NIS2 has applied without a transition period since 6 December 2025, which turned the software supply chain question from a preference into something you have to prove.
Utilities can run AI coding agents without handing source code to a US cloud. What makes it work is separating three layers: the tool on your own machine, an inference provider with a known jurisdiction, and model weights that are freely available. Kimi K3, DeepSeek V4 Pro and GLM-5.2 have been on Hugging Face under MIT-style licenses since July 2026, with DeepSeek reaching 80.6 percent on SWE-bench Verified. The pressure comes from regulation: Germany's NIS2 Implementation Act has applied without a transition period since 6 December 2025 and now covers roughly 29,500 entities instead of about 4,500.
The tool and the model are no longer the same choice
The coding agent and the model behind it have become two separate decisions. The tool runs the loop of file access, tool calls and session handling. The model thinks. Separate the two and you can answer the data question without giving up the tool.
It used to work differently. Picking a tool meant picking a model vendor, and every conversation about data residency ended at whether you were willing to drop the whole tool. That coupling is gone.
OpenCode shows how far this now goes: terminal, desktop app and IDE extension all reach the same agent loop, models come from more than 75 providers, including a local Ollama instance. Switching costs you one line of configuration.
More than 60,000 open-source repositories used the file as of May 2026. Codex CLI, GitHub Copilot, Cursor, Windsurf, Zed and JetBrains Junie read it natively, and Claude Code does too now. Unspectacular, and that is exactly why it matters: the project rules live in the repository, not in a vendor account.
For a utility that is the exit option every outsourcing contract demands and hardly any of them actually has.
The stack in three layers
A sovereign AI coding stack has three layers, and each one raises its own audit question. Answer only one and you have skipped the other two. That is the most common failure in practice, when a procurement process focuses on the model and walks straight past the operator.
The top layer, the harness, runs on the developer's machine. What counts here is the telemetry the tool reports home and whether it works without an account at the vendor. The middle layer is the inference provider, and that is where the real decision sits: who runs the GPUs, in which country they stand, which law governs the company, whether there is a data processing agreement. The bottom layer is the model weights with their license and their origin.
Only when all three layers are settled does the sentence "our source code stays in the EU" carry weight. One layer on its own does not answer the question, however good it sounds.
Why utilities need to look now
The trigger is liability, not enthusiasm for technology. Since Germany's NIS2 Implementation Act the duties of care apply with no transition period, and they reach far more companies than the old IT security law did. If you build software for grid operations, metering or billing, or have it built, you need to be able to show where that code goes.
Then there is the sector-specific layer. The IT security catalogue under Section 11 (1a) and (1b) EnWG, built on ISO/IEC 27001 and 27019 since 2015, is being replaced by new catalogues under Section 5c EnWG. As of March 2026 the Bundesnetzagentur had not published the final drafts. Awkward, because the duty already applies while the yardstick is still being negotiated.
The resilience requirements are new: business impact analysis, continuity planning, crisis communication. For systems classified as critical there is no risk tolerance left. Anyone who has already worked through IEC 62443 and the Cyber Resilience Act for OT security in energy plants knows the mindset. It now reaches the development environment too.
The European picture
Demand for European alternatives has risen measurably and stopped being a matter of principle. Companies are willing to accept downsides for data staying in their own country. And the regulatory frame for AI models got sharper a few days ago.
The Bitkom Cloud Report 2026 surveyed 603 companies with 20 or more employees in spring. 85 percent consider Germany too dependent on US cloud providers, up from 78 the year before. 71 percent use US providers, but only 8 percent prefer them. That gap between use and preference is the real number in the report.
Source: Bitkom Cloud Report 2026, telephone survey of 603 companies with 20 or more employees, 17 June 2026
That jump from 42 to a planned 69 percent for cloud AI services lands squarely in the area where sovereignty matters. And since 2 August 2026 the European Commission can actively enforce the obligations for general-purpose AI models, with information requests, model access and, in the last resort, recall. The sanction range reaches 15 million euros or 3 percent of global annual revenue.
There are enough EU-based providers with a data processing agreement by now: IONOS, STACKIT, Scaleway, OVHcloud, Nebius and Mistral among them. The "there is no alternative" argument does not hold in 2026. What the debate around cloud sovereignty in Europe shows: the difference is rarely technical, almost always contractual.
Where private does not mean sovereign
This is where the thinking goes wrong most often. A provider promising not to store prompts solves a data protection problem. Not a sovereignty problem. Sovereignty is a question of legal system, not of retention policy.
Venice makes a good example because the offer is described honestly. In private mode, open models run without storing request or response, on Venice-controlled GPUs or with zero-retention partners. In anonymised mode, requests go on to OpenAI, Anthropic, Google or xAI, who then process them. Two very different things under one roof.
Venice's API documentation says nothing about jurisdiction, retention periods, GDPR compliance or data processing. For a private project that is fine. For a NIS2 audit trail it is not enough.
Data in an EU region of a US company is EU-resident and still reachable under the CLOUD Act. For the audit trail the operator's seat counts, not the location of the disk.
The same caution applies on the model side, with a different sign. The weights of Kimi K3, DeepSeek V4 Pro and GLM-5.2 come from China. The licenses are permissive, the politics are not. In late July 2026 the US administration was weighing targeted bans on individual Chinese models rather than a blanket one, while Beijing is in talks with Alibaba, ByteDance and Zhipu about export controls on open weights. Two governments trying to restrict the same tool for opposite reasons.
A model you have downloaded cannot be switched off. That is exactly where the hedge against both scenarios sits.
The core argument for open weightsChallenges and risks
The self-hosting that open weights make possible in theory is out of reach for most utilities in practice. That moves the sovereignty question from the model to the operator and makes provider selection the decision that actually matters. A look at the hardware explains why.
| Model | Parameters | License | Self-hosting |
|---|---|---|---|
| Kimi K3 | 2.8T total, 16 of 896 experts active | Modified MIT | around 594 GB download, 8 H100 minimum |
| DeepSeek V4 Pro | 1.6T total, 49B active | MIT | requirements comparable to K3 |
| GLM-5.2 | 744B total, around 40B active | MIT | more than 1 TB VRAM in BF16 |
All three carry a one million token context window. The compute behind that only pays off at high, steady throughput. A utility with a two-digit development team rarely gets there, and the question of whether local AI models on your own hardware are worth it usually answers itself with no at this model size.
Changing the model changes response behaviour and tool use. Swap the provider and you need a regression check for your own agent workflows. Otherwise the risk just moves rather than shrinking.
Quality gaps remain. Security assessments place Chinese open models behind Western frontier models on cybersecurity tasks, which matters for security-relevant code. And the consultation draft for the new EnWG catalogues deliberately leaves out procurement and supply chain security. That relieves nobody: the NIS2 duty to document stands, much as it does for the data obligations under the Data Act for energy utilities.
What utilities should do now
This decision cannot wait, because the development teams are already using AI tools. Without a rule you get shadow IT, and that is harder to explain in an audit than a choice someone made on purpose. So the entry point is not the model.
The stack in four steps
-
Classify the code
Split repositories by protection need. Control room and metering systems, billing and customer data on one side, web presence and internal tools on the other. That list takes an afternoon and decides everything that follows.
-
Audit the provider instead of trusting the promise
Ask in writing for jurisdiction, a data processing agreement, a statement on training from inputs, and the retention periods. If one of them is missing, the provider is out for protected code. No discussion.
-
Keep the harness portable
Put project rules in AGENTS.md and keep the file free of vendor-specific configuration. That is your exit option, and it costs you nothing to set up.
-
Rehearse the switch once
Pick a model for daily work and run the provider switch deliberately once, before you need it under pressure. A switch nobody has tested is not an exit option, it is a statement of intent.
Four more things belong on the list. Find out which AI coding tools are actually in use in the building, private accounts included. Write a short policy with two classes, allowed and blocked, rather than a rulebook nobody reads. Put the AI coding stack into the NIS2 supply chain assessment. And check whether your existing framework agreements, for instance through municipal groups such as Thüga, already include a suitable inference option. An agreement you already have beats a new tender.
What you are assessing is the provider and the operating mode, not one model. The model you pick today will be replaced within six months. The contract will not.
Further Reading
Frequently Asked Questions
A sovereign AI coding stack combines three separately swappable layers: a coding agent that runs locally, an inference provider with a known jurisdiction and a data processing agreement, and model weights under a license that permits self-hosting. Only once all three layers are settled does the claim hold that source code and prompts never leave the EU.
There is no blanket ban. Germany's NIS2 Implementation Act has required measures matching the current technical standard, plus a documented view of the supply chain, since 6 December 2025. In practice: code from control room, metering and billing systems belongs only with a provider whose jurisdiction, retention periods and training practice are settled contractually. For non-critical code the bar is lower.
No. Private inference describes that prompts and responses are not stored. Sovereignty describes which legal system governs the operator. A US company with servers in Frankfurt processes data inside the EU and stays reachable under the CLOUD Act. For a NIS2 audit trail, the operator's seat and the data processing agreement count, not the promise to keep no logs.
Three models lead the open field, all with a one million token context window. Kimi K3 from Moonshot AI carries 2.8 trillion parameters and sits around 57 points on the Artificial Analysis Intelligence Index. DeepSeek V4 Pro reaches 80.6 percent on SWE-bench Verified. GLM-5.2 from Zhipu AI has 744 billion parameters, roughly 40 billion of them active, and is MIT-licensed on Hugging Face.
Usually not. Kimi K3 weighs roughly 594 gigabytes as an MXFP4 download and needs at least eight H100 accelerators, GLM-5.2 in BF16 more than a terabyte of VRAM. Those costs only pay off at high, steady throughput. A team with a two-digit developer count rarely gets there. That moves the sovereignty question from the model to the provider.
AGENTS.md is a plain Markdown file holding project rules for coding agents, with no schema and no required fields. OpenAI published the format in August 2025 and handed it to the Linux Foundation's Agentic AI Foundation in late 2025. Codex CLI, GitHub Copilot, Cursor, Windsurf, Zed, OpenCode and now Claude Code all read it. Keeping your rules there instead of in vendor-specific configuration means you can change tools without rewriting them.