(Read the full publication on MoreThanDigital) – Conversations about digital sovereignty still tend to focus on narrow questions such as data residency, GDPR compliance, cloud certification schemes and the location of physical servers.
These concerns are important. However, they are not the core issue.
They are symptoms of a much larger structural shift that most countries are still failing to recognise.
For years, I have been telling governments, institutions and economic leaders that the visible problem is rarely the real problem. The regulatory challenges that policymakers often treat as isolated issues are usually manifestations of deeper systemic dynamics. Digital sovereignty is one of the clearest examples of this.
At its core, digital sovereignty is not primarily a technological issue. Rather, it is an economic, geopolitical and industrial question concerning who will build the infrastructure of the future, who will control it and where the value created by it will ultimately accumulate.
Countries that own the infrastructure layer of the AI economy will dominate the next decades in terms of economic leverage, innovation capacity, and strategic autonomy. Those that merely consume that infrastructure risk becoming dependent participants in systems they no longer meaningfully influence.
This is not only a European issue. Outside of the United States and China, most nations are becoming increasingly dependent on foreign-owned digital infrastructure in areas such as the cloud, AI platforms, semiconductors and, increasingly, the operational layers of their economies.
If the diagnosis is wrong, the policy responses will remain superficial. Governments will focus on compliance frameworks while the underlying concentration of power, capital, and technological leverage accelerates elsewhere.
To understand this, it is important to look beyond regulation alone and examine the legal, economic, geopolitical and innovative factors shaping the next phase of digital infrastructure.
The Legal Reality Behind ‘Sovereign’ Cloud Infrastructure
Most discussions begin with the regulatory layer — and often end there.
The European Union has developed one of the world’s most sophisticated regulatory frameworks for data governance and digital resilience. The GDPR, NIS2, DORA, the EU Data Act and the AI Act all reflect a legitimate and increasingly important ambition. Europe wants enforceable rules governing digital infrastructure and data protection.
This regulatory capability could become one of Europe’s long-term strategic strengths.
However, regulation alone cannot solve a deeper structural asymmetry.
The issue is ownership, not merely location.
The US CLOUD Act enables US authorities to compel US-owned companies to provide access to data stored anywhere in the world, including infrastructure located in Europe. Furthermore, FISA Section 702, Executive Order 12333 and National Security Letters extend the reach of American surveillance and intelligence frameworks beyond US territory.
This creates a fundamental tension at the heart of many ‘sovereign cloud’ discussions.
A server located in Frankfurt does not automatically constitute sovereign infrastructure if the legal entity controlling it remains subject to foreign jurisdiction.
This distinction is far more important than is generally acknowledged in public discussions.
This is why many current debates around ‘EU-hosted’ infrastructure risk becoming exercises in compliance theatre rather than achieving genuine sovereignty. Localised infrastructure does not automatically mean localised control.
The challenge is structural, not contractual.
No amount of branding, certification language or marketing terminology can change the fact that ownership determines ultimate control.
The economic extraction layer nobody talks about
While the legal discussion is important, the economic dimension may ultimately matter even more.
The dominant narrative surrounding hyperscaler investment in Europe is straightforward: foreign technology companies invest billions in local data centres, infrastructure expands, and countries benefit from modernisation and digital growth.
At first glance, the numbers appear impressive.
Microsoft, Amazon and Google have collectively invested hundreds of billions in data centre infrastructure and AI-related capital expenditure in recent years. National announcements involving multi-billion-euro investments generate political visibility, positive headlines and the perception of economic progress.
However, the headline figures often obscure the underlying economic mechanics.
Large-scale AI infrastructure creates enormous secondary costs that are often passed on to the host economy in the form of grid expansion, substations, transmission infrastructure, energy pricing pressure, congestion costs and long-term capacity allocation.
The private asset generates returns for foreign shareholders. The public infrastructure burden is distributed across the domestic economy.
At the same time, services running on this infrastructure are sold back to local companies, governments, hospitals, schools and start-ups — often at high margins.
The revenues generated from these services largely flow back into foreign balance sheets, where they are reinvested in additional computing capacity, acquisitions, research and development, talent acquisition and ecosystem dominance.
The mechanism creates a reinforcing cycle:
- Local economies help finance the infrastructure layer
- Foreign providers capture the recurring service revenues
- Those revenues strengthen the providers’ competitive advantage
- Dependency deepens over time
This is not a conspiracy. It is simply an extremely effective economic model.
However, it also means that many countries are effectively co-financing infrastructure systems that increase their own long-term dependency.
The strategic risk that most countries ignore
The geopolitical implications become clearer when operational continuity is tested.
The sanctions imposed on Russia following its invasion of Ukraine demonstrated something historically significant: modern digital infrastructure can be switched off on a large scale.
Cloud services, enterprise platforms, software ecosystems, collaboration tools and security updates were withdrawn or restricted within months. Organisations that were heavily reliant on foreign-controlled technology stacks suddenly realised how much their operational continuity depended on external political alignment.
The debate here is not about whether the sanctions themselves were justified.
The important point is what the event revealed to every other country observing it about structural dependencies.
If critical infrastructure depends on technology controlled by foreign jurisdictions, operational sovereignty becomes conditional.
Under stable geopolitical conditions, this dependency may appear harmless. However, geopolitical conditions do not remain static indefinitely. Strategic interests diverge. Trade conflicts escalate. Governments change. Alliances evolve.
As a result, countries increasingly need to ask themselves a more uncomfortable question:
What would happen if access to critical digital infrastructure were to become politically conditional?
The Quiet Capture of the Startup Ecosystem
Perhaps the least discussed aspect of all is the innovation layer.
Hyperscalers understand that infrastructure dominance begins early. Startup credit programmes are not philanthropic — they are long-term ecosystem acquisition strategies.
AWS, Microsoft and Google provide start-ups with substantial infrastructure credits because they recognise a fundamental truth: initial architectural decisions can be costly and challenging to change later on.
A startup that builds extensively around proprietary infrastructure services is not just choosing a vendor. They gradually inherit an ecosystem, a tooling stack, operational dependencies, engineering habits, APIs, workflows and economic switching costs.
By the time the company scales up, migration often becomes commercially irrational.
The result is not just customer acquisition. It is ecosystem lock-in.
Over time, this determines where future innovation will occur, where expertise will accumulate, and where the next generation of global technology leaders will ultimately establish themselves.
What real digital sovereignty actually requires
Real sovereignty does not mean isolation.
The objective is not to disconnect from global technology ecosystems or create closed economic blocs. This would be both economically destructive and strategically unrealistic.
The goal is optionality.
Countries need the ability to make meaningful choices, maintain leverage, preserve operational continuity and avoid becoming dependent on infrastructure that they neither control nor influence meaningfully.
This requires the following:
- clarity around ownership and jurisdiction, not only data location;
- serious investment in domestic and regional infrastructure capacity;
- procurement policies that allow local ecosystems to scale;
- interoperability and portability standards that reduce lock-in;
- sovereign AI and compute infrastructure treated as strategic assets.
As AI increasingly becomes the operational layer of healthcare, finance, logistics, government, education and industry, infrastructure sovereignty will become inseparable from economic sovereignty itself.
The real question
The central question is not whether data sits inside a national border.
Rather, it is where value accumulates, where leverage concentrates, and who ultimately controls the infrastructure layer of the next economy. It is like owning the water – some things are better not owned by other people as the value extraction could lead to immense consequences and costs to the society.
Europe – just like many other regions, in fact every nation except USA and China – still possess many advantages, including talent, research institutions, industrial capacity, sophisticated enterprises and world-class entrepreneurs.
However, unless these strengths translate into ownership of critical infrastructure layers, much of the value they generate will continue to flow outwards into ecosystems controlled elsewhere.
This is the underlying structural issue in most digital sovereignty debates.
The visible problem is rarely the real problem. The visible problem is usually a symptom of the underlying system.
The system currently being built around AI and cloud infrastructure is moving in a very clear direction: the concentration of capital, capability and strategic leverage in the hands of a small number of infrastructure owners.
