Cloud, Compute and Public Power: Europe’s AI Sovereignty Choice

Executive judgement

European AI sovereignty should mean assured and governable access to critical cloud, compute and software capabilities, not blanket exclusion of external providers; the level of autonomy required must follow the public function at risk.

Key findings

• Compute and cloud capacity are becoming infrastructure for public administration, research and strategic industry.
• Sovereignty is a spectrum of assurance covering location, control, software transparency, portability and recovery.
• Public procurement can aggregate demand and create a market for higher-assurance services.
• Data-centre expansion must be integrated with energy, water, grid and regional planning.

From nationality to assurance

A provider’s country of origin is an incomplete measure of operational sovereignty. Public authorities need to know where data is processed, who can compel access, whether software dependencies are transparent, how workloads can be moved and how quickly service can be restored. A tiered assurance framework can reserve demanding conditions for critical public functions while keeping most commercial markets open.

Capacity is a planning problem

The proposed Cloud and AI Development Act recognises that compute expansion depends on permits, land, energy, water, finance and skilled labour. Europe should plan data centres as part of the energy and industrial system, reward efficient designs and avoid local bottlenecks that turn strategic investment into social opposition.

Procurement as strategy

Separate public buyers cannot create sufficient demand for high-assurance European services. Common procurement frameworks can establish portability, security, auditability, open interfaces and incident reporting as market expectations. Support for open-source components and transparent supply chains can reduce lock-in while strengthening European innovation.

An assurance-based market

Sovereignty is strengthened when institutions can verify, move and continue critical workloads, not when procurement relies on nationality labels.

A common assurance framework should cover ownership and control, data location, administrator access, software dependencies, continuity, portability and legal exposure. Requirements should scale with the public function and the consequence of failure. Lower-risk services can remain open to broad competition, while critical workloads require stronger evidence, protected support and tested exit arrangements.

Public buyers can shape the market by using common contract clauses and sharing assurance evidence. This reduces duplicated audits and gives providers a predictable route to demonstrate compliance. It also makes trade-offs visible: the highest level of assurance may cost more or limit functionality, so authorities should reserve it for services where interruption or external control would create material public harm.

• Adopt a tiered European assurance framework for cloud and advanced computing.
• Require portability, data return and transition assistance for critical contracts.
• Share verified assurance evidence among qualified public buyers.

Policy recommendations

1. Adopt common assurance tiers based on the criticality of the public function.
2. Aggregate public demand for secure and portable cloud and AI services.
3. Require tested exit, recovery and software-supply-chain plans in critical contracts.
4. Integrate data-centre permitting with grid, water and regional-benefit planning.
5. Measure sovereignty by assured service outcomes rather than provider nationality alone.

Indicators to watch

• Critical workload portability
• EU compute capacity
• Energy and water constraints
• Public procurement concentration

Scope and analytical method

A risk-tiered strategy for infrastructure, procurement and trusted access to advanced computing. The paper tests the issue against institutional authority, delivery capacity, political sustainability and the interests of affected partners. It separates confirmed developments from interpretation and identifies the conditions under which recommendations would need to change.

The analysis is based on a structured review of official institutional material and current primary sources. It distinguishes formal decisions and verified facts from institutional assessment and forward-looking judgement. Recommendations are tested against authority, delivery capacity, timing, political sustainability and the interests of external partners.

Public sources cannot capture classified readiness data, commercially sensitive contracting information or confidential diplomatic exchanges. Time-sensitive figures and legal developments should therefore be refreshed by responsible authorities before an operational decision is taken.

Sources and method

The sources below establish the public evidentiary basis for this paper. Interpretation and recommendations remain the responsibility of the Research Directorate. Principal public sources:

• European Commission, Cloud and AI Development Act
• European Commission, Strengthening Europe’s Tech Sovereignty