Defining what sovereignty should mean for Europe
Europe wants to lead in technology, particularly AI. But if we are to build category leaders and strengthen our digital economy, we need to be clear about what we mean by tech sovereignty.
The debate has become increasingly urgent as US technology companies attract enormous amounts of capital and dominate the AI landscape. Critics such as Marc Andreessen argue that Europe risks being left behind. Yet Europe’s response must go beyond protecting its markets or insisting that technology be made locally. It needs a more precise definition of sovereignty.
Our argument is simple: sovereignty should be defined primarily by who controls technology, not where it is made.
Physical sovereignty versus operational sovereignty
A common misconception is that sovereignty is an inherent property of physical infrastructure. Under this view, a data centre is sovereign because it sits in Europe or contains European-made equipment. Foreign hardware, by contrast, is assumed to undermine sovereignty.
This confuses the origin of technology with control over its operation.
A server does not become sovereign simply because it is located within European borders. Equally, foreign-made hardware does not automatically make a European service non-sovereign.
Consider Beyond.pl’s AI factory in Poznań. Its infrastructure uses US-origin Nvidia compute and Everpure storage, yet the company argues that its services can be sovereign because the operator is Polish, subject to Polish and EU law, and restricts access to customers’ underlying data.
The example illustrates an important distinction: physical sovereignty concerns where infrastructure is located; operational sovereignty concerns who can access, administer and control it.
The relevant questions are not simply where the box sits, but who can access its data, change its configuration, control its management systems or intervene in its operation.
Location still matters. Data residency, physical security, jurisdiction and supply-chain dependencies all create potential risks. But location alone cannot guarantee control. A European data centre may depend on foreign-controlled management platforms, remote support or proprietary software.
What should sovereignty mean in practice?
A meaningful assessment of operational sovereignty should examine several factors:
- Legal control: which jurisdictions govern the operator and service?
- Administrative control: who manages the infrastructure and holds privileged credentials?
- Data access: who can access customer information, and under what conditions?
- Operational independence: can the service continue if a foreign supplier withdraws support?
- Remote access: can external providers intervene in the infrastructure?
- Supply-chain exposure: what dependencies exist in hardware, software, firmware and support?
- Government compulsion: which authorities could legally compel disclosure or assistance?
- Ownership and governance: who ultimately controls the company and its strategic decisions?
- Auditability: wan the operator demonstrate that its safeguards work?
European incorporation alone is not enough. A company owned by foreign investors may retain strong European operational controls, while its ownership structure could also create strategic dependencies. The actual rights, responsibilities and powers matter more than nationality alone.
Sovereignty is not the same as technological independence
None of this means hardware origin is irrelevant. Dependence on foreign suppliers can expose Europe to export restrictions, supply disruptions and geopolitical pressure.
But operational sovereignty and strategic technology autonomy are different objectives. The former concerns control over a service; the latter concerns Europe’s ability to develop and supply critical technologies independently.
Requiring every component to be European-made would make sovereignty unrealistic in a globally interconnected technology industry. Instead, Europe should strengthen operational control while investing in domestic capabilities where external dependencies pose unacceptable risks.
The way forward
Europe needs a practical, measurable definition of sovereignty that rewards genuine control rather than geographic labels.
Technological sovereignty should mean the demonstrable ability to govern critical systems, protect data, control access and manage dependencies without unacceptable exposure to external intervention.
The box has a location. The service has a sovereignty regime. Confusing the two is the fallacy of inherent sovereignty.