Architecture manifesto · As of 2 August 2026 · 23 sources

Sovereign AI in B2B Commerce.

Five architecture principles for industry and wholesale —
before the EU AI Act takes effect on 2 August 2026.

93 percent of German companies prefer an Artificial Intelligence (AI) vendor from Germany (Bitkom 09/2025). At the same time, German AI brands are being absorbed into North American groups. Sovereignty does not come from brand loyalty. It comes from architecture that outlives any vendor. From Hamburg, for industry and wholesale in the DACH mid-market.

Let's talk Five principles
TL;DR · Five principles, five sentences

An architecture that outlives the model.

  1. 01

    Data class separation

    If you do not know which data which model is allowed to see, you cannot promise sovereignty — the dividing line is architecture, not insurance.

  2. 02

    Tool contract

    AI agents talk to backend systems through a standardised, auditable contract — the Model Context Protocol (MCP). Not directly, not unmonitored.

  3. 03

    Model as the writer

    The model writes the text. The backend decides the number. If you let the model calculate, you have used the tool the wrong way.

  4. 04

    Vendor abstraction

    A vendor switch is a configuration change, not a project — anyone who does not build that in now pays for it during the next market shift.

  5. 05

    Statistics stays the anchor

    For forecasts, stock levels and quantities: classical time-series analysis beats any language model — and you can explain it.

Diagnosis · Three numbers, three drivers

The market wants control.
It is not acting on it yet.

36 percent of German companies use Artificial Intelligence — double the figure from 2024. Bitkom surveyed 604 companies with 20+ employees in summer 2025 (calendar weeks 27 to 32). 93 percent of those same respondents prefer a vendor from Germany. Gartner estimates in January 2026 that 35 percent of all countries will be locked into region-specific AI platforms by 2027. Three numbers, one direction.

EUR 15 m GDPR with teeth — Garante versus OpenAI

The Italian data protection authority Garante issued a fine of 15 million euro against OpenAI on 2 November 2024 — made public on 20 December 2024. The reasoning: processing of personal data without a legal basis under the General Data Protection Regulation (GDPR), missing transparency, inadequate age verification. This is not an outlier. This is a supervisory authority with consequences.

Source: Garante per la protezione dei dati personali · IAPP · Lewis Silkin legal analysis
~29,500 NIS2 — in force in Germany since December 2024

Around 29,500 entities fall under the NIS2 implementation law: risk management, notification obligations, executive liability. If you run AI systems in production and have no documentation of data flows, you have an NIS2 problem — regardless of whether an incident occurs.

Source: NIS2 Implementation Act (NIS2UmsuCG), Federal Ministry of the Interior draft · BSI Annual Situation Report 2024
02/08/2026 EU AI Act Annex III — a narrower B2B hit than expected

The high-risk hit is narrower than expected. HR modules with applicant filtering are in scope. Credit checks on sole traders are in scope. B2B pricing engines for corporate customers are not. Knowing this lets you prepare in a targeted way instead of pulling the handbrake across the board. At the same time: 56 percent of German companies see more disadvantages than advantages in the EU AI Act (Bitkom 2025) — realism toward a regulation that is more expensive in practice than it was advertised to be.

Source: EU AI Act Regulation 2024/1689, Annex III + Art. 99 · Bitkom *Durchbruch bei KI* 09/2025
Architecture skeleton · System-agnostic

Five layers.
Two DMZ boundaries.

A sovereign AI architecture for B2B commerce is not a product. It is an arrangement of components with clear handover rules. Between the customer side and the backend systems sit two Demilitarised Zones (DMZ) — filter zones every data point passes through once. Which commerce platform sits underneath the shop is irrelevant for the AI layer: Spryker, SAP Commerce and Shopware talk to the layer above through the same interface.

  1. Shop system Spryker · SAP Commerce · Shopware · in-house build
  2. Self-service portal B2B order entry · account status · configuration
  3. DMZ ingress · Data Loss Prevention (DLP) · data class check
  4. AI agent · OpenCode Tool orchestration via Model Context Protocol (MCP)
  5. Inference · Ollama open-weights models · Anthropic schema gateway
  6. DMZ egress · MCP server · per-customer authentication
  7. ERP · OMS · PIM Inventory · order management · product data — SAP · Infor · proAlpha

Industry standards for 2026: Anthropic Messages API, Model Context Protocol (with the Linux Foundation since December 2025), LiteLLM gateway. What stays on the DMZ boundary never reaches the model. What comes out runs through the egress filter once more before it leaves the building.

Principle 1 · Data at the DMZ boundary

Three classes.
Three egress rules.

Without this documented, you cannot run a sovereign AI architecture — no matter which model you choose.

  1. FREE

    Public

    Product catalogue, data sheets, marketing texts, public price lists. Any model may see this data — cloud, on-prem, all of it.

    Catalogue · data sheets
    marketing content
  2. STOP

    Trade secret

    Never leaves the building. Inference only on your own hardware or with a DACH hosting provider under a data processing agreement governed by German law.

    Terms · margins
    stock · order history
  3. PSEUDO

    Personal data

    Pseudonymised before reaching the model — the agent only sees tokens. Re-identification happens in the egress filter, right before the answer reaches the customer.

    Real name · contact
    address · IP

Concrete example: A customer asks "Where is order 4711, Müller GmbH, Ms Schmitz?"

  1. 01 · Ingress

    Real name (Ms Schmitz) + company name (Müller GmbH) — class PSEUDO. Order number 4711 — class STOP.

  2. 02 · DLP filter

    Name → token CUSTOMER_A. Company → COMPANY_X. The model sees: "Where is order 4711, COMPANY_X, CUSTOMER_A?"

  3. 03 · Model + tool

    The agent calls the OMS through the tool contract (MCP). The OMS returns status, delivery date, tracking code.

  4. 04 · Egress filter

    Token CUSTOMER_A → "Ms Schmitz", COMPANY_X → "Müller GmbH". Answer reaches the customer with the correct data — the model never saw the real names.

Audit question number one: "Who sent which data to which model?" Without a data class map you cannot answer this question — neither for the CISO nor for the supervisory authority.

What if no data class exists yet?

Then the work starts with an architecture audit, not with model selection. Choosing a model before mapping data classes is the most common reason for compliance rework under time pressure. The order is: document data classes → define egress rules → choose the model. Not in parallel, not in reverse. → Read the architecture audit.

Anchor references: BSI C3A (*Criteria enabling Cloud Computing Autonomy*, 27/04/2026) as the existence anchor. BSI AIC4 (*AI Cloud Service Compliance Criteria Catalogue*) as the control catalogue for cloud AI services.

Principle 2 · Tool contract instead of direct access

Three reasons for the Model Context Protocol (MCP).

Why does an AI agent not talk to the ERP directly? Three reasons — all three practical, not ideological.

  1. Reason 01 · Adapter function

    ERP systems rarely speak REST. SOAP, IDOC, BAPI, JDBC.

    SAP talks IDOC and BAPI. Older OMS systems talk SOAP. PIM systems use JDBC direct connections or flat-file exports. MCP encapsulates this heterogeneity: the agent only knows the tool contract, not the backend technology beneath it. Define the tool once, and you can rebuild the backend without touching the agent.

  2. Reason 02 · Contract stability

    Backends change. The tool contract stays.

    Database schemas migrate. API versions change. The MCP tool contract stays stable. When the backend changes, the MCP server changes — not the agent. Model code stays untouched.

  3. Reason 03 · Audit concentration

    One point, one log file, one trail.

    Every call runs through an MCP server. If you need to meet Annex III documentation obligations or prove NIS2 audit trails, MCP gives you a structural answer — not a manual trace.

MCP specification as of 25 November 2025. In December 2025 Anthropic handed the specification to the Linux Foundation ("Agentic AI Foundation"). MCP is no longer an Anthropic product — it is an industry standard under MIT licence. Server SDKs for Python, Go, Rust, Java.

Is MCP worth using if Anthropic is a US company?

MCP has been with the Linux Foundation since December 2025, MIT licensed. The specification does not belong to Anthropic. An MCP server in Python runs against Llama, Mistral, Qwen and any other provider that implements the Messages API convention. Anthropic's US origin is irrelevant for the tool layer — it only matters if you choose to run Anthropic models on US servers. That is a separate decision.

German authority anchors: heise FAQ Model Context Protocol · Schultze-Melling — *Architecture of modern data compliance* (Medium 2025).

Principle 3 · Data from tools, language from the model

The model writes. The backend decides what is true.

When a tool returns the delivery date from the OMS, the model writes the answer. When the OMS returns nothing, the model writes "no record on file." It does not estimate. It does not interpolate. It does not invent. Hallucination protection is architecture, not a prompting problem. A better-worded prompt will not solve it — the answer is structural: the model only gets the freedom to write when a tool has returned a clean response.

Will a model hallucinate inside this architecture?

Only if the tool returns a dirty response — empty fields, inconsistent data types, error returns without clear semantics. Or if the architecture lets the model calculate: estimate stock cover, project deviations, extrapolate forecasts. That is forbidden. Letting a language model calculate means you picked the wrong tool. The next section explains which tool is responsible for numbers.

Principle 4 · The sovereignty switch

One configuration line.
Claude becomes Llama.

The most important sentence in this section comes from outside. On 24 April 2026, Cohere and Aleph Alpha joined forces — per the official Cohere announcement as a "Germany-Canada sovereign AI venture" with 500 million euro of structured financing from the Schwarz Group. Cohere CEO Aidan Gomez confirmed the architecture argument himself: "Organizations globally are demanding uncompromising control over their AI stack." Anyone who bound their integration directly to the Aleph Alpha API now sits inside a North-America-led group.

This is not a one-off. Between 2023 and 2024 OpenAI renamed and repriced the GPT-4 line several times — GPT-4 → GPT-4 Turbo → GPT-4o. Every change forced developer teams to check integration code, recompute cost, and re-verify behaviour. Anyone bound directly to a proprietary API paid that audit in engineering hours.

Before · Cloud provider direct 
PROVIDER_BASE_URL=https://api.anthropic.com
PROVIDER_MODEL=claude-opus-4-7
PROVIDER_AUTH=ANTHROPIC_API_KEY
After · Local via gateway 
PROVIDER_BASE_URL=http://gateway.dmz/anthropic
PROVIDER_MODEL=llama-3.3-70b
PROVIDER_AUTH=DMZ_INTERNAL_TOKEN

A gateway (LiteLLM, vLLM, or an in-house build) translates the Anthropic Messages API schema into the respective model interface. Open-weights models — Llama, Mistral, Qwen — implement the same convention. The agent code does not change.

On the current legal footing: following the ruling of the General Court of the European Union on 3 September 2025 (Latombe case dismissed, proceedings T-553/23), the EU-US Data Privacy Framework remains in force. It remains structurally unstable nonetheless: noyb is preparing a new complaint, and the ruling expected in Trump v. Slaughter (by July 2026) could trigger another wave.

Vendor abstraction insures against three risks: price changes, ownership changes through acquisitions and mergers, and tightening of compliance. All three have happened in the past 24 months.

When is a vendor switch critical?

Three triggers should make you want the abstraction switched on: first, a price doubling without a performance improvement. Second, a change of ownership that shifts the data protection footing — as with Cohere and Aleph Alpha. Third, a tightening of compliance through new rulings or laws. None of these triggers announce themselves in advance. Vendor abstraction is not an emergency measure — it is architectural hygiene.

Principle 5 · Hybrid pipeline

Three tools.
Three jobs.

None replaces the other.

  1. Statistics

    makes forecasts

    Fast, cheap, explainable. Prophet and NeuralProphet for time-series forecasting — seasonality, trend, holidays. M5 Forecasting Competition (Makridakis 2020/2022): simple statistical methods beat complex neural networks in most business scenarios.

    fast · cheap
    explainable
  2. Rule engine

    does validation

    Deterministic, auditable, audit-ready. Minimum stock thresholds, supplier block lists, approval workflows. No language model, no statistics.

    deterministic
    auditable
  3. Language model

    writes reasoning

    Generative, readable, plain English. Not for truth. For communication.

    generative
    not for truth

Example: demand forecast for wear parts. Six nodes from trigger to human approval — statistics produces the number, the language model writes the reasoning, the human decides.

  1. 01

    Trigger

    Daily scheduler, 06:00. No manual kick-off needed.

    Cron job
  2. 02

    Data fetch

    OMS query through MCP — last 24 months of order history per article.

    Tool call
  3. 03

    Forecast

    Prophet model calculates the 90-day demand — seasonality, trend, holidays. No language model involved.

    Statistics
  4. 04

    Stock-cover check

    Rule engine compares the forecast to current stock — traffic-light status against defined thresholds.

    Rule engine
  5. 05

    Reasoning

    Llama 3.3 local writes a justification for every red item. Context from nodes 3 and 4 only, no direct ERP access — order history never leaves the building.

    Language model
  6. 06

    Human approval

    Procurement gets a short list with reasoning, approves or corrects manually. No auto-ordering.

    Human

Nodes 3 and 4 are not a language model. Node 5 is not a calculator. The separation is the principle. Gartner expects 70 percent AI-based forecasting in large organisations by 2030 (09/2025) and 50 percent agentic SCM features by 2030 (05/2025). If you run a language model for all three jobs, you land statistically in the 95 percent of GenAI projects without measurable return (MIT NANDA 08/2025, methodology partly debated, finding cited by consensus).

When a language model, when classical statistics?

Rule of thumb: statistics where numbers matter. Rule engine where unambiguity matters. Language where communication matters. Do not press everything through a language model — that is the most expensive route to a bad answer. Let a language model calculate stock levels, and you get phrasings that look like numbers. Until they no longer do.

Three anti-patterns from engagements and the wider world

What knocks most builds over.
Anonymised and documented.

  1. Anti-pattern 01 · GDPR without data classes

    Garante versus OpenAI — fine of 15 million euro.

    On 2 November 2024 the Italian data protection authority Garante issued a fine of 15 million euro against OpenAI — made public on 20 December 2024. Three violations: processing of personal data without a legal basis, missing transparency, no age verification. What this means for B2B commerce: sending customer inquiries to a cloud language model without data class separation reproduces the same situation structurally. A note in the system prompt asking the model "please do not use personal data" does not constitute a legal basis.

    Lesson
    Data class separation is architecture, not a prompt instruction
    Violates
    Principle 1 — Data class separation at the DMZ boundary
  2. Anti-pattern 02 · Third-party risk

    Anthropic — contractor incident, 22 January 2024.

    In January 2024 it became known that an error on the side of an external contractor inadvertently leaked customer names and account balances. No fine, reputational damage. The incident is not specific to Anthropic — it is structurally typical for any architecture that hands data to third parties without full visibility on the path.

    Lesson
    Third-party risk is real — the MCP audit trail is harm reduction
    Violates
    Principle 2 — Tool contract with audit concentration
  3. Anti-pattern 03 · Forecast as an LLM call

    Anonymised engagement — industrial wholesale, 2024.

    A DACH wholesale company built a demand forecast for spare parts as a direct language-model call. Order history as context, answer as a number. Two problems at once: the order history contained internal terms — class STOP, sent to a cloud API. And the model produced numbers that looked like forecasts but had no statistical basis. Trade secret breach and unusable forecasts in the same step.

    Lesson
    Statistics for the forecast, language model only for the reasoning, order history stays in the building
    Violates
    Principle 5 — Statistics stays the anchor
To take away

Four heuristics for Monday morning.

No framework, no methodology preamble. Four sentences for the next architecture meeting.

  1. 01

    No data class? Do not start. Without documentation of what is free, what is protected and what is personal, you cannot build a clean AI architecture — and you will end up doing it later under compliance pressure.

  2. 02

    If the model writes a database query, the architecture is wrong. That is the MCP server's job. Not the language model's.

  3. 03

    No vendor switch possible without a project? You are locked in. That is not safety — that is an open risk.

  4. 04

    If a language model is calculating, you have picked the wrong tool. Language models are writers. Numbers come from statistics or the backend.

Synthesis

Run all five principles and you are not in the 95 percent — and a model switch becomes a configuration step.

The five principles are not an ideal state. They are the minimum required for an architecture that still works two years from now — after the next model release, the next acquisition, the next ruling out of Luxembourg. If you want to know where you stand: an architecture audit starts with a conversation.

Read the methodology
Experience & contact

Deep platform expertise.

25 years in IT, 14 of them in B2B commerce. Architecture mandates with large enterprises, building and steering distributed expert teams, vendor-neutral project rescue. Focus areas: platform architecture, project rescue, team operations.

Chris Zepernick

Senior consultant · Hamburg

Where does your AI architecture stand today?

Call Send email
Sources · as of 2026-05-06

23 sources, verified with status marker.

Status: ✓ verbatim verified · ◯ secondary source · ⚠ existence anchor only. Languages 🇩🇪 German · 🇬🇧 English · 🇪🇺 European.

  1. ✓ 🇩🇪 Bitkom: *Durchbruch bei Künstlicher Intelligenz*, press release 15/09/2025; study report *Künstliche Intelligenz in Deutschland* 02/2026, N=604 companies with 20+ staff, fieldwork CW 27–32/2025. bitkom.org
  2. ⚠ 🇬🇧 Gartner: *Predicts 35% of Countries Will Be Locked Into Region-Specific AI Platforms by 2027*, 29/01/2026. gartner.com
  3. ◯ 🇪🇺 Garante: decision against OpenAI Ireland Limited, 02/11/2024, published 20/12/2024, 15 million euro. euronews.com · lewissilkin.com
  4. ✓ 🇩🇪 NIS2 Implementation Act (NIS2UmsuCG), in force December 2024. ~29,500 entities per Federal Ministry of the Interior draft. bmi.bund.de
  5. ✓ 🇪🇺 EU AI Act Regulation (EU) 2024/1689, Annex III + Art. 99 sanctions, effective date 02/08/2026. artificialintelligenceact.eu/annex/3
  6. ✓ 🇩🇪 BSI AIC4 — *AI Cloud Service Compliance Criteria Catalogue*. bsi.bund.de/AIC4
  7. ⚠ 🇩🇪 BSI C3A — *Criteria enabling Cloud Computing Autonomy*, published 27/04/2026 (English edition; German version announced for Q2 2026). bsi.bund.de/C3A
  8. ✓ 🇬🇧 Model Context Protocol (MCP), specification as of 25/11/2025; handover to Linux Foundation ("Agentic AI Foundation") 12/2025. modelcontextprotocol.io
  9. ✓ 🇬🇧 Cohere: *Cohere and Aleph Alpha join forces*, official announcement 24/04/2026. cohere.com
  10. ✓ 🇪🇺 General Court of the EU ruling in case T-553/23 (Latombe v. Commission), 03/09/2025 — case against EU-US Data Privacy Framework dismissed. iapp.org
  11. ✓ 🇪🇺 noyb.eu: *EU-US data transfers — time to prepare for more trouble*, 2025. noyb.eu
  12. ✓ 🇬🇧 OpenAI: pricing history GPT-4 → GPT-4 Turbo → GPT-4o, 2023–2024. openai.com/api/pricing
  13. ✓ 🇬🇧 Makridakis et al.: *The M5 accuracy competition: Results, findings, and conclusions*, International Journal of Forecasting Vol. 38(4), 2022; competition run 2020. sciencedirect.com
  14. ⚠ 🇬🇧 Gartner: *70% of Large Organizations Will Adopt AI-Based Supply Chain Forecasting by 2030*, 16/09/2025. gartner.com
  15. ⚠ 🇬🇧 Gartner: *Half of Supply Chain Management Solutions Will Include Agentic AI by 2030*, 21/05/2025. gartner.com
  16. ◯ 🇬🇧 MIT NANDA: *The GenAI Divide: State of AI in Business 2025*, August 2025 (300 projects, 52 interviews, 153 surveys). PDF (artificialintelligence-news.com)
  17. ◯ 🇬🇧 Anthropic: contractor data leak 22/01/2024, VentureBeat report. venturebeat.com
  18. ✓ 🇩🇪 heise online: *FAQ Model Context Protocol*. heise.de
  19. ✓ 🇩🇪 Schultze-Melling, J.: *Architektur moderner Daten-Compliance — MCP und Code Execution*, Medium 2025. medium.com
  20. ◯ 🇩🇪 Computerwoche: *4 On-Prem-Lösungen für Digitale Souveränität*. computerwoche.de
  21. ✓ 🇩🇪 VDMA: *GenAI im Maschinen- und Anlagenbau*, 2025, N=247 industrial companies DACH. PDF (vdma.eu)
  22. ✓ 🇬🇧 Meta AI: *Llama 3.3 70B*, 12/2024, Apache 2.0 licence. huggingface.co
  23. ✓ 🇬🇧 Prophet (Meta) and NeuralProphet: open-source libraries for time-series forecasting. facebook/prophet · ourownstory/neural_prophet