Made in Germany, owned in Delaware: What the Langdock case reveals about your AI

This month a story went around the AI industry that sounds technical at first glance and, on a second look, concerns every management team. The Swiss lawyer Martin Steiger went public with the fact that an AI service widely perceived as German - Langdock, with around 33,000 users across more than 7,000 companies - is wholly owned by an American parent company based in Delaware.

Let's say it up front, because it matters: this is not a scandal. A US parent company is nothing unusual for internationally funded start-ups - in this case a standard requirement from the investors. And Steiger, too, is explicitly not out to paint "the US as the villain" but to make a point about transparency: a service that is perceived as German should disclose who controls it.

The case is interesting nonetheless - because it exposes a thinking error we hear again and again in conversations with companies. One observer put it well: Langdock isn't a scandal, Langdock is a mirror. The case doesn't show that a vendor did something wrong. It shows that we all ask the same question far too rarely.

The Two Questions That Get Confused

When it comes to AI and data, the discussion usually settles quickly with three sentences: "The servers are in Europe." "They don't train on our data." "The service is GDPR-compliant." All three matter. And none of them answers the real question.

Because these are two different things. Compliance answers whether the data processing is organized cleanly in legal terms - contracts, hosting location, records of processing. Control asks something harder: who actually owns the vendor - and who decides when it gets sold tomorrow, relocates its headquarters, raises prices, or changes access?

An entry in the commercial register doesn't answer that. Nor does a data center in the EU. Both can be entirely clean while the decision-making power sits somewhere else entirely.

Why the Server Location Isn't the Whole Answer

That "stored in Europe" and "under European control" are not the same thing is something even Microsoft had to admit publicly in 2025. Before the French Senate, the company was asked under oath whether it could guarantee that data stored in the EU would be kept from US authorities. The answer was no - it could not guarantee it.

The reason is the ownership and legal chain behind it. Steiger frames this carefully in legal terms for the Langdock case: a US parent alone does not mean an automatic outflow of data to the US. What matters is whether the parent company can legally or technically compel the subsidiary to hand over access to user data - the "possession, custody, or control" criteria. That is exactly why the ownership question is not a formality but the core: it decides who has the upper hand when it counts.

Sovereignty Doesn't Mean Doing Without - and Here It Gets Honest

This is where the debate often tips into the unrealistic: "sovereign" gets equated with "just no US vendor, no US model anymore." That sounds consistent, but it's usually expensive, technically demanding, and costs exactly the quality you introduce AI for in the first place. The industry association Bitkom puts it well: sovereignty means self-determination, not autarky - the ability to choose between alternatives, not the obligation to build everything yourself.

And because we don't want to fool anyone: this applies to us too. visibus also uses leading AI models, many of which come from the US and are accessed through an interface. Anyone who claims that this dependency simply disappears with them is setting exactly the trap this is all about. The honest question isn't "does someone use US models?" - it's "do you keep control and the choice?"

What Are the Alternatives to Langdock?

We hear this question more often since the case became public. An honest answer doesn't start with a list but with the two questions above: who owns the vendor, and how quickly could you get out? Measured against those, the market falls into three groups.

• The big platforms: Microsoft 365 Copilot and ChatGPT Enterprise. Contractually sound, with a data processing agreement and European options, but a single US corporation decides on models, prices and roadmap. If you already work deep inside Microsoft 365, this is the most convenient entry.
• European vendors with their own models: Mistral from France, for example. Ownership and location in Europe, but a model catalogue from a single source; whether the quality is enough is decided task by task.
• Platforms with a dedicated instance per company that connect several models and keep history, files and accounts with the customer. visibus Chat belongs here, with an instance in Switzerland or Germany. Both countries have further providers of this kind, and the same two questions work on all of them.

Langdock itself remains an option if the answers work for you. What matters is that you know them before you sign.

Where visibus Actually Takes a Different Approach

That's exactly where visibus Chat comes in - starting with us, not just with the model:

• With the vendor. visibus is a Swiss GmbH in the hands of its founders, with no foreign parent company that could sell, relocate, or change access tomorrow. That's the question the Langdock case raises - and we answer it about ourselves first.
• With the environment. Your instance runs in the EU or Switzerland, separated per customer and with no training on your data, contractually agreed. We evaluate usage and budget in aggregate - the conversations themselves are yours.
• With the power to switch. Which model does the computing today is secondary. What matters is that you're not tied to a single provider that can change prices, access, or availability overnight. The models are interchangeable - a strong model for quality today, a European one or, on request, a local one as a fallback lane.
• With the infrastructure, if needed. Anyone who wants full authority over operations runs visibus Chat on their own environment.

That doesn't make the individual AI call to a US model "sovereign" - that would be exactly the mislabeling game the Langdock case exposes. But it shifts control to where you actually need it: to ownership, location, data storage, and the freedom to switch at any time.

The Test for Your AI Vendor

If you ask only two questions of your AI tool, ask these: Who owns the vendor behind it - and how quickly could we get out again if we had to?

The answer isn't in the privacy notice. It's in the ownership and the architecture. An EU label is a good start. It just isn't the whole answer.

These questions can be answered - best of all on a concrete use case from your own company. We'd be glad to show you how visibus Chat solves it: who owns what, where your data sits, and how quickly you could switch models. Write to us and we'll look at it together.