Germany put Haystack agents on a sovereign cloud. Sovereignty needs an exit test

THE SIGNAL IN ONE SENTENCE

Digital sovereignty is easy to admire while everything is working. The cloud is in the approved jurisdiction. The vendor contract is signed. The models answer questions. The dashboard is green. Somebody has put the word sovereign on a slide and everyone gets to go home early. The honest test begins when an organisation decides to leave. On October 15, Berlin-based deepset and Schwarz Digits announced that the Haystack Enterprise Platform is available on STACKIT for European public administrations and organisations in public security and defence. The offering combines three layers. STACKIT provides cloud infrastructure operated in Germany and Austria. Codesphere provides what the companies describe as a vendor-neutral, portable multi-cloud runtime. deepset provides the application and orchestration layer for AI assistants, agents and document-based workflows through Haystack Enterprise Platform. Together, the partners call this the Sovereign Platform & AI Stack. There is substance behind the architecture. Haystack Enterprise Platform is built on the Apache 2.0-licensed Haystack framework. deepset says customers can select and replace models, data sources, tools and other components. The enterprise layer adds monitoring, evaluation, tracing of agent steps and access controls. STACKIT says its cloud services operate in Germany and Austria and points to ISO/IEC 27001 certification and a BSI C5 Type 2 attestation. Those are useful ingredients for a government agency trying to move an AI project from a pilot into daily work. They are not, by themselves, proof of sovereignty. The plain signal is that sovereignty needs an exit test. Can the organisation move the application to another acceptable environment without losing its data, evidence, security posture or ability to serve the public? Can it replace a model without rebuilding every workflow? Can it recover its encryption keys and revoke the old operator's access? Can investigators still read the logs after the contract ends? If nobody has rehearsed those steps, portability remains an architectural promise. Start with the full dependency map. An AI agent is not one portable container. It is a chain of models, prompts, tools, indexes, connectors, identity rules, secrets, monitoring systems, evaluation datasets, logs and operating procedures. An application may run on European infrastructure while still depending on an external model endpoint. A model may be replaceable while its prompt format, tool schema or retrieval pipeline quietly binds the application to one vendor. A container may move cleanly while the audit trail stays trapped in a proprietary service. That is how lock-in becomes invisible. It hides between layers. Every public-sector deployment should maintain a machine-readable bill of materials for the whole system. Name the model and version. Name the embedding model, vector store, data connectors, identity provider, runtime, orchestration code, policy engine, observability tools, evaluation suite and every external service. Then mark which pieces are open, portable, replaceable, exportable or contractually recoverable. The distinction matters because Haystack being open source does not automatically make the full enterprise service open or portable. Apache 2.0 access to the underlying framework is valuable. The announcement does not publish the enterprise platform's complete licence terms, deployment recipe, export formats or a verified migration report. An open foundation can reduce lock-in. It cannot erase the proprietary parts assembled around it. Next, test model substitution. deepset says the architecture is model-agnostic. A useful exit exercise would prove that claim on a real workflow. Take one agent used for document research or application review. Freeze its evaluation set. Replace the primary model with an alternative approved model. Re-run the same tasks. Measure answer quality, tool-call reliability, latency, cost, citation behavior, language performance and human correction time. Record everything that had to change. Did prompts require a rewrite? Did tool schemas break? Did safety policies behave differently? Did the new model need another embedding system or a different context strategy? Did monitoring still interpret the traces correctly? The point is not that every model swap should be effortless. The point is to know the real cost and the places where an apparently modular stack has grown roots. Data needs its own exit lane. A public agency should be able to export source documents, metadata, permissions, indexes, feedback, evaluation records and operational state in documented formats. The export should preserve relationships, timestamps and provenance. It should not arrive as a pile of files that technically exists but cannot recreate the service. Sensitive data also needs a deletion receipt. After migration, the former operator should confirm what was deleted, what remains in backups, how long retention lasts and which legal or technical obligation permits any copy to survive. The receiving environment should demonstrate that access rules came across correctly instead of defaulting to a broad administrative role. Keys are even more revealing. Who generates encryption keys? Who stores them? Who can rotate them? Can the agency revoke the provider's access without losing its own data? Are application secrets and service credentials exportable, or must they be reissued? Does the old environment stop accepting them immediately after the cutover? A sovereign system should not require the departing customer to ask the former operator for permission to read its own records. Logs are part of those records. The announcement says Haystack Enterprise Platform can trace every agent step and show which model produced an answer from which data. That could support audit and compliance work. It also creates a continuity obligation. If an agent helped review a benefits application, investigators may need its evidence trail long after the workflow moved. The export therefore needs more than application logs. It should preserve agent identity, model version, retrieved sources, tool calls, access decisions, approvals, outputs, errors and changes to policy. The receiving system must be able to interpret the record. An archive that can only be read by the platform it came from is not an exit. It is a storage fee wearing a trench coat. Operational continuity is the hardest part. Public services cannot always pause for a clean migration weekend. An exit test should rehearse parallel operation, data synchronisation, traffic shifting, rollback and a manual fallback. It should identify which functions can tolerate delay and which require continuous availability. Run the test under ugly conditions. Assume the original provider is available but unhelpful. Assume one export is incomplete. Assume the new environment has different identity tooling. Assume a model behaves differently in German administrative language. Assume an audit begins during the cutover. Assume the organisation needs to reverse the migration. Then measure the boring evidence. How long did export take? What percentage of records migrated with verified checksums? Which permissions changed? How many application functions worked without modification? How many required vendor assistance? How long was the public service degraded? Could the agency reproduce a prior agent decision after the move? Those numbers turn sovereignty from a branding claim into an operating capability. Jurisdiction remains important, but it needs precision too. STACKIT says its cloud services operate in Germany and Austria. That answers part of the location question. Agencies still need to know where each data category is stored and processed, which legal entities can administer the service, where support staff operate, which subprocessors participate and what cross-border access paths exist. Sovereignty is not merely the latitude and longitude of a server. It is control over the people, contracts, credentials, software and decisions that can reach the system. Procurement teams should make the exit test part of acceptance, not a clause saved for the end of the relationship. Before production, the customer and vendors can agree on export formats, documentation, assistance limits, maximum recovery times, deletion evidence and the cost of leaving. They can run a small migration and keep the results with the system's other assurance records. Repeat the exercise after major changes. A platform that was portable at launch can become sticky through convenience. Teams add managed services. Agents accumulate tools. Data volumes grow. Custom policies depend on one dashboard. Staff forget the manual path. The annual exit drill catches that drift. The new stack may be useful for European public institutions. It brings infrastructure, runtime and agent orchestration into one proposed architecture. It gives agencies an open framework beneath the enterprise layer and a way to operate on European cloud infrastructure. It addresses a real problem: public AI pilots often stall because models, data, deployment and governance do not fit together. But the October 15 announcement is a vendor statement. It does not publish an independent sovereignty audit, a complete administrator-access map, a performance comparison, service-level history or the results of an exit exercise. That is not a reason to dismiss the offering. It is a reason to test the exact quality it sells. The best sovereign stack is not the one that makes departure unnecessary. It is the one an institution can leave calmly, completely and without abandoning the public record on the loading dock.