Sovereignty has been weaponised on both sides of the European debate. One camp treats it as protectionism by another name; the other treats it as a procurement checkbox satisfied by a regional cloud sticker. Both miss what operators of critical infrastructure actually need.
Sovereignty is a posture, not a vendor list
For a transmission system operator, a sovereign-cloud sticker on a contract means very little if the model weights, the orchestration layer, the observability stack and the identity provider all terminate in a single non-European jurisdiction. Sovereignty, properly understood, is the demonstrated ability to continue operating when a single dependency is removed — by sanction, by outage, by acquisition, by political reversal, or by the quieter mechanism of a vendor unilaterally re-pricing the contract at renewal.
The right question for a sovereign-AI conversation is therefore not "where is the data?" It is: "on which Monday morning does this institution stop functioning, and what would it take to move that Monday by a year?"
Three tests we apply on every engagement
- Substitution test. If this provider disappeared on Monday, what is the operator's position on Friday? An honest answer is usually a list, not a sentence.
- Jurisdiction test. Which legal regime can compel disclosure, modification or interruption of the data flowing through this system? Is that regime compatible with the institution's mandate, today and under foreseeable changes?
- Continuity test. Can the institution rebuild the workflow on alternative infrastructure within a defined recovery window? "We have a backup" is not a continuity posture; "we exercised a substitution within a 14-day window last quarter" is.
The European stack as competitive advantage
NIS2, DORA and the AI Act are usually read as a compliance burden. Read together, with the institution's mandate at the centre, they produce something else: a structural argument for resilience-by-design that European operators can sell to their boards, their regulators and their counterparts abroad.
The institutions moving first on this are not the largest. They are the ones whose leadership has internalised that resilience is now a posture they will be asked about — by parliaments, by markets, by their own staff — and that the answer must be in writing before the question is asked.
First published March 2026 · Frankfurt am Main.