Europe's public models reached Workers AI, but access still starts with a request form

THE SIGNAL IN ONE SENTENCE

A model can be open enough to download, public enough to have universities and national computing centers behind it, and still be inconvenient enough that most software teams never use it. That is the practical gap Cloudflare is trying to close with two European models. On October 1, the company said EuroLLM and Switzerland's Apertus are coming to Workers AI, its managed inference platform. Developers can request access now. That last sentence carries more weight than the launch language around it. The models are not simply waiting in every account with a public price and a copyable API call. Cloudflare says users can request access. Its announcement does not publish approval criteria, waiting times, quotas, prices, service regions, latency targets or a service-level agreement for either model. So the news is useful, but specific. Two public-interest European model projects are gaining another path into ordinary application development. They are not becoming universally available on Workers AI today, and putting them on the network of a United States company does not settle every question about European sovereignty. EuroLLM is a multilingual project created by a consortium that includes Instituto Superior Técnico, the University of Edinburgh, Instituto de Telecomunicações, Université Paris-Saclay, Unbabel, Sorbonne University, Naver Labs and the University of Amsterdam. Its official site says the current 22-billion-parameter model was trained on more than four trillion tokens across 35 languages, including all 24 official languages of the European Union. The project received support from Horizon Europe, the European Research Council and EuroHPC, and trained on the MareNostrum 5 supercomputer in Barcelona. The project describes EuroLLM as open source and makes model releases available through Hugging Face. It also says EuroLLM performs strongly on language tasks. Those performance statements come from the project itself. Cloudflare repeats the consortium's claim that EuroLLM outperforms other open-weight models of comparable size on European multilingual benchmarks and translation. That is a reason to test the model, not an independent verdict. Apertus takes the openness argument further. It was developed by ETH Zurich, EPFL and the Swiss National Supercomputing Centre as part of the Swiss AI Initiative. The Apertus project says its architecture, weights, training data, code, methods and alignment principles are documented and reproducible. The releases use the Apache 2.0 license. The project's documentation says the original model family was trained on more than 15 trillion tokens across more than 1,500 languages, with 40 percent of the material in languages other than English. Its current public materials describe 8-billion and 70-billion-parameter models, plus smaller versions intended for constrained hardware. The latest 1.5 release adds image understanding, experimental audio processing, stronger tool use, a reasoning mode and a longer context window. Cloudflare's announcement describes Apertus as trained on the Alps supercomputer at the Swiss National Supercomputing Centre, a system with more than 10,000 NVIDIA GH200 chips. It also highlights measures intended to respect data opt-outs, remove personal information and reduce memorization. These are design measures and documentation claims, not a blanket legal certificate for every use of the model. Neither model began existing because Cloudflare listed it. EuroLLM was already downloadable. Apertus already had self-hosted and third-party inference options, including Swiss providers and a public-interest utility. The fresh event is distribution. Workers AI can place the models behind the same operational surface that developers already use for other hosted models. That surface matters more than it sounds. A weight file is not a product endpoint. Someone must provision accelerators, install a serving engine, choose quantization settings, manage model versions, batch requests, measure latency, authenticate users, absorb traffic spikes, track cost and replace a failed machine. An open model gives you the right to run an engine. It does not hand you an airport. Managed inference provides some of that airport. A developer can send a request through an API instead of building a cluster. An organization can test a European model beside other options without first buying hardware. A small language technology company can evaluate whether a model understands its customers before committing to a private deployment. A public agency can prototype a translation assistant while its security and procurement teams work out what production requires. That is why deployment plumbing can be a sovereignty tool. If European models are hard to call, they remain research artifacts while easier foreign models become the default. An accessible API lets more teams discover where a local model is good enough, where it is better and where it still needs work. Usage can create bug reports, language evaluations, fine-tunes, deployment recipes and a larger group of people capable of operating the models. But convenience and sovereignty are not synonyms. A useful sovereignty test has at least seven layers. Who controls the model artifacts? Can the organization inspect the architecture and training documentation? Where does inference happen? Which legal entity operates the service? Who can see prompts, outputs and logs? Can the model version be pinned and moved elsewhere? What happens when the provider changes price, policy or availability? EuroLLM and Apertus improve the first two layers. Apertus in particular publishes unusually broad material for rebuilding and studying the system. Cloudflare can improve the operational layer by making inference easier. Yet a request-gated endpoint on an American provider leaves the jurisdiction, data location, logging, contract and exit questions to be answered in the actual service terms. Cloudflare argues that sovereignty should mean choice rather than isolation. There is sense in that framing. A country does not become more independent by locking every public service into one domestic vendor that cannot be replaced. Real control includes the ability to switch providers, run the model locally and preserve application behavior when a contract ends. Open models can make that exit more credible. If an application uses Apertus through a hosted API, the operator can in principle download the same family of weights and deploy it through a Swiss provider or its own infrastructure. In practice, portability depends on details. Providers may expose different versions, quantizations, context limits, tool formats and safety layers. The same prompt can behave differently when the serving stack changes. That means buyers should test the exit before celebrating it. Export the prompts, retrieval settings and evaluation set. Record the precise model identifier. Run a representative workload through a second host. Measure accuracy, latency, cost and safety behavior. An exit plan that has never been rehearsed is a slogan wearing sensible shoes. Language coverage deserves the same practical treatment. Supporting 35 or 1,500 languages does not mean equal performance in every one. A model may translate well in a high-resource pair and stumble on local law, dialect, names or cultural context. Tokenization can make some languages more expensive because the same sentence becomes more tokens. Training representation, benchmark quality and human evaluation vary dramatically. The right test is not whether a language appears on a list. It is whether speakers can complete the work that matters. Can a municipal employee summarize a regulation without changing its meaning? Can a doctor draft a plain-language explanation and preserve every medical caution? Can a school create material in a regional language without inventing facts? Can a translator see sources, uncertainty and terminology choices? Public agencies should build evaluations with native speakers, domain experts and people who use the service. They should publish results by language and task instead of averaging everything into one flattering score. A model that is excellent in twelve languages and weak in eleven others may still be useful. Hiding the difference is what makes it dangerous. There are immediate applications worth testing. European institutions can compare multilingual summarization and translation without routing every experiment through a closed model. Archives can improve search across historical collections. Researchers can study open training and alignment methods. Small companies can prototype local-language support. Schools can explore tools that run on smaller hardware. Governments can build public-service assistants whose model layer has a credible path to inspection or replacement. The caution rises with the stakes. A hosted model should not make final decisions about benefits, immigration, policing, health or employment because its passport looks reassuring. Open weights do not eliminate hallucinations. A European training project does not automatically understand every European law. A Swiss model is not a substitute for Swiss data hosting. An API connection is not an audit. Organizations should also ask Cloudflare several ordinary questions before moving from experiment to production. Which EuroLLM and Apertus versions are offered? In which data centers can each model run? Are prompts or outputs retained? Can customers opt out of logging? What are the token prices and concurrency limits? What happens during a model update? Can a customer pin a version? What is the incident process? Is dedicated or regional capacity available? How quickly can a customer export its workload to another host? None of those questions diminish the achievement of the model builders. They are the questions that turn a research release into public infrastructure. The most interesting part of this launch is not that a cloud catalog gained two names. It is that the path from publicly supported research to ordinary software is getting shorter. A university consortium can train a multilingual model on European supercomputing. Swiss public institutions can publish an unusually transparent model family. A global platform can make them easier to test. A local operator can still choose to run them elsewhere. That chain is more resilient than a world in which one laboratory owns the model, the API, the evaluation and the escape hatch. It is also unfinished. Request-based access limits who can try the Workers AI path today. Missing prices and service details prevent a serious comparison. Provider ownership and processing location remain part of sovereignty, even when the model itself is open. The plain signal is that sovereign AI becomes useful when people can deploy it, not merely admire it. EuroLLM and Apertus are gaining practical distribution without surrendering the possibility of other hosts. That is progress. The sovereignty claim will become credible when access is routine, terms are visible, language performance is independently measured and switching providers works on an ordinary Tuesday.