Keeping inference in one EU region is a meaningful technical control. It is still only one layer of sovereignty, alongside operators, metadata, credentials, logs, providers and the law that applies to the workload.
AWS European Sovereign Cloud Gemma 4 availability brings the first open-weight model family to Amazon Bedrock in the sovereign region eusc-de-east-1. AWS offers three instruction-tuned variants through the next-generation bedrock-mantle endpoint, using in-region inference rather than global cross-region routing.
Three Gemma 4 choices are available
| Model ID | Architecture | Context | Likely starting point |
|---|---|---|---|
google.gemma-4-31b-it | 30.7B dense | 256K | Reasoning-heavy and coding-heavy work. |
google.gemma-4-26b-a4b-it | 25.2B total, 3.8B active MoE | 256K | Higher-throughput and cost-sensitive workloads. |
google.gemma-4-e2b-it | 5.1B total, 2.3B effective PLE | 128K | Latency-sensitive and multimodal classification work. |
AWS says all three support built-in reasoning, native function calling and text-plus-image input. Model openness makes the weights and license more inspectable, but Bedrock is still a managed inference service. The operator, networking, logging and storage behavior come from the service contract rather than from the Apache 2.0 model license.
The inference path stays in eusc-de-east-1
All Bedrock inference requests in the AWS European Sovereign Cloud use in-region inference in eusc-de-east-1. Global cross-region inference is not available there. AWS also says customer-created metadata, including roles, permissions, resource labels and configurations, remains in the EU.
The endpoint is bedrock-mantle, with OpenAI-compatible Responses and Chat Completions APIs. That can reduce application migration work, but compatibility does not make the data path identical to another provider. Teams should inspect authentication, supported fields, stateful storage and error semantics.
Sovereignty is six separate questions
| Boundary | Question to answer | Evidence to keep |
|---|---|---|
| Model openness | Can the organization inspect and independently evaluate the weights and license? | Exact model ID, license, model card and evaluation version. |
| Content residency | Where do prompts, images, responses and stored conversation state remain? | Endpoint, region, store setting and architecture diagram. |
| Metadata residency | Where are roles, projects, labels, usage and configuration stored? | Service documentation and account configuration. |
| Operator residency | Who can operate or support the underlying service? | Current AWS sovereign-cloud operating commitment and support terms. |
| Legal control | Which entity, contract and jurisdiction govern the service? | Signed agreement, data-processing terms and legal assessment. |
| Workload compliance | Does this specific use satisfy sector, purpose and retention rules? | Risk assessment, approvals, tests and continuing controls. |
A positive answer to one row does not automatically satisfy the others. Open weights can run in a non-sovereign environment. A sovereign region can serve a closed model. Data can remain in-region while a long-lived credential or copied log creates a different risk.
Default privacy controls still need verification
AWS describes a zero operator access model for inference data and zero data retention by default. It says prompts and responses are encrypted in transit and are not shared with the model provider by default. The post also notes that limited retention can apply to certain models for abuse detection, so the exact model and current documentation belong in the release review.
- Set
store=falsewhen the application does not need server-managed conversation state. - Confirm whether abuse-detection retention applies to the selected model.
- Do not copy prompts into application logs unless policy explicitly allows it.
- Separate production projects from experiments and restrict model IDs with IAM.
- Prefer auto-refreshing short-term credentials over long-lived keys.
Build an auditor-ready evidence packet
- Record the exact
bedrock-mantlebase URL andeusc-de-east-1region. - Capture the Bedrock project ID and narrowly scoped IAM policy.
- Use a short-term key and record its maximum lifetime.
- Make one test request with a unique marker and locate the CloudTrail event.
- Confirm that CloudWatch alarms detect an unusual request spike.
- Verify the response
storebehavior and any retained application copy. - Document model-provider sharing, abuse-detection and support-access terms.
- Record the model ID, context, evaluation set and approval owner.
- Test credential revocation and project isolation before production.
- Re-run the evidence check after every service or model revision.
OpenAI compatibility reduces code changes, not governance work
Applications can use OpenAI Python or TypeScript SDK patterns by changing the base URL and credential handling. That simplifies transport migration. It does not mean every parameter, tool-call response, error, stateful conversation or retention behavior is identical. Run contract tests against both APIs before switching traffic.
Our AWS LLM latency and caching guide explains why routing and prefix behavior need their own tests. The Mistral and Samsung sovereign AI analysis provides another example of separating model choice from operational control.
The practical verdict
Gemma 4 on AWS European Sovereign Cloud gives European teams a managed open-weight option with an in-region endpoint, EU-resident operations, metadata residency, audit logs and short-term authentication. Those are concrete controls. They support a compliance case; they do not certify the workload. The right release gate is an evidence packet that joins region, model, IAM, retention, logging and legal requirements.
Primary source
Checked September 19, 2026. Service architecture and operating commitments come from AWS. Organizations must evaluate their own regulatory and contractual requirements.
