Well, they can train in any country they want. It's the inference and data placement that counts for legal purposes

The regulatory concerns are worldwide: the GDPR has restrictions about the territorial location of data, so you cannot move data anywhere else other than EU or "adequate" countries (in practice, the US). Since the real gold is in using data that users submitted to you (ie, GDPR protected), they are kind of stuck in regards to where they can train.

Mistral's stack already heavily relies on American cloud providers and they have tons of American investors, so its sovereignty angle is dubious anyway.