Mistral Vibe Enterprise: the only major option outside the CLOUD Act

Every large provider now offers European regions. Mistral offers something the others structurally cannot: a European operator. Whether that difference matters to you is the entire review, because on capability the gap has narrowed to the point where it is rarely the deciding factor.

What you can buy

Vibe is the assistant, and the name is new: Mistral retired Le Chat on 28 May 2026 and moved everything under the Vibe brand at the same address, accounts, conversations and subscriptions included. Free tier, Pro at $14.99 a month, Team at $24.99 per user with a $50 monthly minimum, Enterprise on quote with SAML SSO, audit logs and dedicated support.

The rebrand came with a change in ambition. Vibe splits into a Work Mode that connects to Google Workspace, Outlook, SharePoint, Slack and GitHub and runs multi-step tasks against them, and a Code Mode that keeps coding sessions alive in cloud sandboxes. Whether that lands is a question for a later review; for the decision this article is about, it changes nothing.

The API gives access to the model family, with the core models released as open weights under Apache 2.0: Large, Small, the Ministral line, Voxtral for speech.

Self-hosted and air-gapped deployment is the option the others do not have in this form.

Mistral Medium 3.5 runs locally on four GPUs, with a 256,000-token context window.

Which puts a genuinely capable model inside a range a mid-sized company can actually operate

That last row is why this review exists. Everything else on this page is available elsewhere.

The jurisdictional argument, stated precisely

The claim worth understanding is narrow and often overstated in both directions.

US-headquartered providers are subject to the CLOUD Act, which can compel production of data under their control regardless of where it is physically stored. Running in an EU region does not change the company’s jurisdiction.

“Our data centre is in Frankfurt” answers a different question from “who can be compelled to hand this over.” The first is about the data’s location, the second about the operator’s jurisdiction, and only one of them is changed by picking a region.

Mistral is EU-headquartered and therefore outside that particular reach.

What that does not mean: that using a US provider in an EU region is unlawful, or that European law contains no access powers of its own. Transfers to certified US recipients are currently lawful under the EU-US Data Privacy Framework, and most companies operate that way without issue.

What it does mean: if your requirement is written about the operator’s jurisdiction rather than the data’s location, which happens in public-sector tenders, in some regulated sectors, and increasingly in DACH enterprise security reviews, then the EU region of a US provider does not satisfy it and no configuration will make it.

That is a narrow band of requirements. Inside it, there are very few alternatives. Outside it, this is not the reason to choose Mistral.

Where it stands on capability

Good enough for almost all business use, and the honest framing is that “almost all” carries weight. For document summarisation, classification, drafting, extraction and the RAG-shaped work that most companies actually deploy, the difference from a frontier model is not what decides the project outcome.

Where a gap can still show is at the hard end of reasoning and long multi-step agentic work. If your use case sits there, benchmark rather than assume, in either direction.

The more durable advantage is architectural: because the core models are open-weight, choosing Mistral leaves you a fallback that no closed provider offers. If pricing, ownership or terms change, you can run the same weights yourself. That option costs nothing until you use it, and it is the only sovereignty property you actually controlDE (auf Deutsch).

The verification list

Ask which deployment you are buying. Vibe Enterprise on Mistral’s cloud, a private cloud deployment, and a self-hosted install are three different products with three different residency and operational profiles. The word “sovereign” is used across all three.

Confirm retention separately. Residency and retention are independent, and being European does not imply zero retention. It is a contract term wherever you buy, and conflating the two is the standard mistake.

If self-hosting, price the operations. Four GPUs is a real number and it is not the whole number. Somebody updates the model, monitors availability, patches the host and answers when it stops. That is a role, not a task.

Check the sub-processors anyway. European headquarters does not mean European everything. Ask for the list under Article 28 and read where each one runs.

Where we would not use it

As a “European” checkbox with no requirement behind it. If nothing in your contracts or reviews turns on operator jurisdiction, choosing Mistral for the flag is a preference, not a control, and preferences should not drive a platform decision.

Self-hosted, without an owner. The most common failure here is a company that self-hosts for sovereignty and then runs an unpatched model on a machine nobody is responsible for. That is worse on every axis than a hosted European service.

Where the ecosystem matters more than the model. The tooling, integrations and community around the US providers are still deeper. If you are assembling from off-the-shelf parts rather than building, that gap shows up as work.

What we would actually use it for

Two situations. First, where the requirement genuinely names jurisdiction: then it is one of very few real answers. Second, as the small self-hosted model behind a narrow, high-volume task like classification, where the economics are excellent, the operational burden is modest, and the residency question disappears entirely.

For general-purpose work in a company with no jurisdictional requirement, pick on capability and price, keep the model behind your own interface, and revisit when something changes.

Frequently asked questions