Cloud, Compute and Public Power: Europe’s AI Sovereignty Choice

Executive judgement

European AI sovereignty should mean assured and governable access to critical cloud, compute and software capabilities, not blanket exclusion of external providers; the level of autonomy required must follow the public function at risk.

Key findings

• Compute and cloud capacity are becoming infrastructure for public administration, research and strategic industry.
• Sovereignty is a spectrum of assurance covering location, control, software transparency, portability and recovery.
• Public procurement can aggregate demand and create a market for higher-assurance services.
• Data-centre expansion must be integrated with energy, water, grid and regional planning.

From nationality to assurance

A provider's country of origin is an incomplete measure of operational sovereignty. Public authorities need to know where data is processed, who can compel access, whether software dependencies are transparent, how workloads can be moved and how quickly service can be restored. A tiered assurance framework can reserve demanding conditions for critical public functions while keeping most commercial markets open.

Capacity is a planning problem

The proposed Cloud and AI Development Act recognises that compute expansion depends on permits, land, energy, water, finance and skilled labour. Europe should plan data centres as part of the energy and industrial system, reward efficient designs and avoid local bottlenecks that turn strategic investment into social opposition.

Procurement as strategy

Separate public buyers cannot create sufficient demand for high-assurance European services. Common procurement frameworks can establish portability, security, auditability, open interfaces and incident reporting as market expectations. Support for open-source components and transparent supply chains can reduce lock-in while strengthening European innovation.

Policy recommendations

1. Adopt common assurance tiers based on the criticality of the public function.
2. Aggregate public demand for secure and portable cloud and AI services.
3. Require tested exit, recovery and software-supply-chain plans in critical contracts.
4. Integrate data-centre permitting with grid, water and regional-benefit planning.
5. Measure sovereignty by assured service outcomes rather than provider nationality alone.

Indicators to watch

• Critical workload portability
• EU compute capacity
• Energy and water constraints
• Public procurement concentration

Sources and method

This publication distinguishes verified institutional evidence from CERAX interpretation and forward-looking judgement. Principal public sources:

• European Commission, Cloud and AI Development Act
• European Commission, Strengthening Europe's Tech Sovereignty