Soofi S, the European open model on a single GPU: can you use it yet?

On 10 July 2026 a German consortium filed the technical paper for Soofi S 30B-A3B on arXiv and uploaded the weights to Hugging Face; on 22 July it published the third revision. It is the most capable open model ever to come out of a publicly funded European project, and it runs on a single machine rather than a cluster: to anyone weighing on-premise AI, it looks like the answer to every question about sovereignty. Before it goes into a business case, though, it is worth reading one line on the model card: “This model is not an open release”.

The facts, in order

Who. The SOOFI consortium — “Sovereign Open Source Foundation Models” — is coordinated by the KI Bundesverband with Fraunhofer IAIS, DFKI, TU Darmstadt and hessian.AI, and funded by the German federal economics ministry under IPCEI-CIS: the European project on next generation cloud infrastructure and services approved by the Commission on 5 December 2023, seven Member States, Italy among them, with up to €1.2 billion in public support.
What. A Mamba-2/Transformer hybrid with a Mixture-of-Experts architecture: 31.6 billion total parameters, roughly 3.2 billion activated per token. Fifty-two layers, 128 routed experts plus 2 shared, a context window of up to 1,048,576 tokens. English and German are the primary languages; French, Italian and Spanish are declared with limited coverage.
How. Around 26.68 trillion tokens, from 24 March to 13 May 2026, on up to 512 NVIDIA B200 GPUs for roughly 253,000 GPU-hours, on the German Industrial AI Cloud operated by Deutsche Telekom in Munich. In the paper: an English aggregate of 70.1, German 79.1, HumanEval pass@1 at 73.8%, and a claim of parity with dense models between 14 and 27 billion parameters.
What state it is in. Hugging Face hosts the Base model and three intermediate checkpoints (Instruct, Rhine, Isar), with GGUF and FP8 builds and 2-, 3- and 4-bit quantisations — all behind gated access, all in closed beta. The card promises a future release “openly under a permissive license, without gated access”; the consortium’s own site confirms that no general publication for direct use has happened yet.

The numbers you need to size the hardware

Memory is counted in bytes, not parameters: 31.6 billion parameters weigh roughly 63 GB in BF16, roughly 32 GB in FP8, roughly 16 GB at 4-bit. The 8-bit version fits on a single 48 GB professional GPU with room left for the cache; the 4-bit version fits on a 24 GB card. You do not need a cluster. You need a machine.

With 3.2 billion active parameters, the compute required for each token is that of a small model while the quality is that of a model ten times larger: the same GPU serves more users at once. And the Mamba-2 layers keep the inference cache near-constant as the context grows, where on a classic Transformer a million tokens would blow it far past the memory taken by the weights — for anyone who needs the model to read whole tender documents, manuals or case files, that is the difference between feasible and not.

And the 253,000 B200 GPU-hours it took to build were paid once by the public purse: whoever adopts the model pays only for inference. That, not the saving on an individual token, is the real economics of state-funded open models — a criterion we already saw fail the test in the DeepSeek case.

The line that stops the project: the licence does not exist yet

A model goes into production only if someone can sign off on its use. Today Soofi S has no licence text: the card promises permissive terms and the paper is published under CC-BY 4.0, but the licence of a scientific article is not the licence of the weights. Until that text exists, no legal department approves a deployment, no tender can name the model as an available component, no contract can take on its risks. It is the same mechanism by which a machine without a compliant manual does not get its CE marking: the technical substance is there, the document that makes it usable is not.

Two further conditions are written in plain sight: the Base model has not been instruction-tuned, aligned or safety-tuned, so it does not belong in front of a user; and the three checkpoints are intermediate and subject to change. You get onto the trial partner list by writing to the consortium with your company and your use case, and this is the moment when an operational trial costs little: industrial feedback is exactly what they are looking for.

Why this matters now

The other two routes are narrowing in the same month: the Financial Times reported on 21 July 2026 that China’s commerce ministry is weighing export controls extended to model weights, including those distributed as open weights, while in the United States a de facto ban on Chinese models is being built by indirect means. Chinese weights remain technically excellent and contractually permissive, but their future availability depends on two governments that are not yours; and the commercial European alternative comes with thresholds and conditions inside a contract. A model born out of a European programme, with weights and code promised in the open, is the third route: the one where sovereignty is not a clause someone grants you, but a property of the thing itself.

The benchmark they removed

The uncomfortable part is worth telling too. According to the specialist outlet the-decoder, the consortium found that rephrased questions from the GPQA test set — the Diamond variant in particular — had ended up in the training data, because the public repository for that benchmark did not separate training from evaluation. It removed GPQA from its evaluations and recalculated the results for all sixteen models in the comparison: the rankings did not change. That is the right behaviour, and seeing it declared is rare.

The lesson, though, is not about Soofi S. If a consortium of public research institutes can contaminate a scientific benchmark without noticing, a vendor showing you a leaderboard in a slide deck can do it far more easily. The only proof that counts is an evaluation on your own documents.

What to do, in practice

Do not put Soofi S into a tender or a business case as an available component: today it is a closed beta with no finalised licence. Treat it as a candidate, with a date in the calendar to re-check the release.
If you have a German or English use case involving technical documentation, code or agents, request trial access now: the partner window is open at the moment.
Size the hardware in bytes — roughly 32 GB at 8-bit, roughly 16 GB at 4-bit, plus the cache — and check quality after quantisation on your own data: it degrades differently depending on the task, and public benchmarks will not tell you.
When the weights do come out, archive them: verified hashes, and the version of the configuration and tokeniser. Keep a second candidate from a different jurisdiction, too. The right question for a vendor is not “which model do you use”, but “what does it cost to change it”.

A European open model that runs on a single machine does not solve the sovereignty problem on its own: it moves it to where it has to be solved, which is the architecture. Our approach treats the model as a replaceable component and puts control in the environment it runs in, in two modes: on-premise inside the client’s own infrastructure, or in a dedicated CSIDIA cloud — reserved for a single client, reached over a dedicated VPN, with data centres in Italy and premises staffed by us. In both cases the documents never leave the perimeter and the model can be swapped without rebuilding the system: that, and not the home country of whoever trained the weights, is where sovereign AI is actually measured.

Are you evaluating an open model for a use case with real confidentiality requirements? Let’s talk it through in a thirty-minute session: we put hardware, licences and evaluation criteria on the table before they become a production problem.