Why Europe must control more than artificial intelligence models to preserve freedom of action in the digital age
SEO title: Beyond Sovereign AI: Europe’s Digital Independence Stack
Meta description: European digital sovereignty requires more than local AI models. Explore the complete stack—from energy, semiconductors and cloud to open-source software, data, identity, cybersecurity and skills.
Suggested URL slug: /beyond-sovereign-ai-europe-digital-independence-stack/
Primary keyword: European digital sovereignty
Secondary keywords: sovereign AI, European cloud, open-source AI, AI infrastructure, technological sovereignty, digital autonomy, European data spaces
Introduction: Sovereignty Is Not a Model
Europe’s discussion about artificial intelligence has entered a decisive phase.
For several years, the debate centred on regulation: how AI should be governed, how fundamental rights should be protected and how high-risk systems should be controlled. Those questions remain important. But Europe is now confronting a deeper issue.
What happens when a society regulates technologies that it does not meaningfully control?
A European organisation may operate an AI application that appears sovereign because its interface, data and legal entity are European. Yet the application may depend on foreign processors, foreign cloud infrastructure, foreign foundation models, foreign software repositories, foreign identity services and foreign cybersecurity tools.
The application may comply with European law while remaining structurally dependent on technical decisions made elsewhere.
This is the central weakness in much of the sovereign-AI debate:
Artificial intelligence cannot be sovereign when the infrastructure beneath it is not.
On 3 June 2026, the European Commission presented a broader European Technological Sovereignty Package. Its architecture reflects an important shift: semiconductors, infrastructure, software, cloud and AI are being treated as interconnected parts of the same value chain rather than as isolated policy areas.
This is a significant development. It suggests that Europe is moving beyond the idea that sovereignty can be achieved through regulation, isolated national clouds or a handful of domestic language models.
The next task is to transform this emerging policy direction into an operational system.
Europe needs a digital independence stack: a coordinated set of capabilities that allows European societies, public authorities and businesses to continue operating, innovating and cooperating even when external suppliers, political conditions or global markets change.
This does not mean technological isolation.
It means preserving the ability to choose.
1. What Technological Sovereignty Actually Means
Sovereignty is frequently misunderstood as self-sufficiency.
No modern economy can manufacture every component, host every service, produce every dataset and develop every technology entirely within its own borders. Complex digital systems depend on international research, global supply chains and continuous knowledge exchange.
Attempting to eliminate all external dependencies would be economically unrealistic and intellectually counterproductive.
Technological sovereignty should therefore not mean that Europe must own everything.
It should mean that Europe:
- understands its critical dependencies;
- can replace or reconfigure essential components;
- controls sensitive data and operational decisions;
- retains access to necessary infrastructure;
- can audit the systems on which society depends;
- can migrate between providers without prohibitive cost;
- possesses enough internal expertise to maintain and develop critical technologies;
- and can cooperate internationally from a position of capability rather than helplessness.
A sovereign system is not necessarily closed. It is a system with credible alternatives, transparent dependencies and enforceable exit routes.
The goal is not independence from the world.
The goal is freedom from involuntary dependence.
2. AI Is Only the Visible Layer
Artificial intelligence is often presented as a discrete product: a chatbot, an analytical engine, an autonomous agent or a model embedded in a professional workflow.
In reality, AI is the visible surface of a much larger technical system.
A foundation model depends on specialised semiconductor manufacturing. Training depends on large-scale computing clusters. Those clusters depend on data centres, electricity grids, cooling systems, telecommunications networks and secure supply chains.
Model development depends on software frameworks, operating systems, development platforms, repositories, cybersecurity components and open-source libraries.
Deployment depends on cloud infrastructure, identity management, payment systems, contractual relationships and access to high-quality data.
Successful use depends on skilled professionals, sector expertise, institutional trust and organisations capable of taking responsibility for outcomes.
Europe can build a language model and still remain dependent at nearly every other layer.
For that reason, sovereign AI must be understood as a systems-engineering challenge.
The relevant question is not:
Does Europe have its own AI model?
The relevant question is:
Can Europe design, train, deploy, audit, maintain, power, secure and replace critical AI systems under changing geopolitical and commercial conditions?
That question leads directly to the digital independence stack.
The European Digital Independence Stack
Layer 1: Energy and Physical Infrastructure
Digital systems are physical systems.
Every cloud service, AI model and digital twin ultimately depends on:
- electricity generation;
- transmission infrastructure;
- substations;
- fibre connections;
- land;
- water and cooling;
- server facilities;
- maintenance personnel;
- and physical security.
AI increases the importance of this layer because advanced computing is energy-intensive. Europe cannot expand its AI capacity without simultaneously planning energy supply, grid capacity and data-centre infrastructure.
The proposed Cloud and AI Development Act recognises several of these constraints. The Commission identifies limited access to energy, land, finance and efficient permitting as barriers to European digital capacity. The proposal aims to at least triple EU data-centre capacity within five to seven years while accelerating the deployment of sustainable infrastructure.
This expansion must not become an uncontrolled race for electricity.
A sovereign European infrastructure strategy should connect data centres with:
- renewable-energy development;
- grid reinforcement;
- thermal storage;
- industrial waste-heat recovery;
- district heating;
- water-responsible cooling;
- demand-response systems;
- regional development;
- and environmental carrying capacity.
Data centres should increasingly function as integrated components of energy and urban systems rather than isolated industrial boxes.
Northern Europe has particular opportunities in this area because of its renewable resources, comparatively cool climate, engineering capacity and experience with energy-intensive industry. But regional advantages should not justify careless development. Each facility must be assessed against grid limitations, ecological effects, local value creation and alternative uses of electricity.
The sovereignty test
Europe possesses meaningful sovereignty at this layer when critical digital services can continue operating during energy disruption, infrastructure failure, supplier withdrawal or geopolitical pressure.
That requires more than renewable-energy certificates. It requires real capacity, redundancy and long-term physical planning.
Layer 2: Semiconductors and Trusted Hardware
No cloud, AI model, communications network or autonomous machine can function without semiconductors.
Europe retains important capabilities in semiconductor research, equipment, industrial applications, sensors and specialised manufacturing. However, the global semiconductor chain remains highly concentrated and deeply interdependent.
The original European Chips Act sought to reinforce research, manufacturing capacity and supply resilience. In June 2026, the Commission proposed Chips Act 2.0 to further reduce strategic dependencies and support advanced semiconductor production in Europe.
The objective should not be to reproduce every part of the global semiconductor industry inside Europe.
Instead, Europe should identify the hardware capabilities that are essential for:
- critical infrastructure;
- defence and emergency systems;
- telecommunications;
- health services;
- industrial automation;
- energy management;
- transportation;
- advanced manufacturing;
- and trustworthy artificial intelligence.
The semiconductor layer also includes packaging, testing, firmware, chip design, manufacturing equipment and the ability to verify hardware integrity.
A processor manufactured abroad may still be acceptable for many commercial applications. A processor used in a national energy-control system, military platform or identity infrastructure presents a different risk profile.
Digital sovereignty therefore requires risk-based hardware assurance.
Europe needs trusted supply pathways for the systems where compromise, interruption or hidden control would create unacceptable consequences.
The sovereignty test
A sovereign hardware strategy does not ask whether every chip is European.
It asks whether Europe can secure, inspect, replace and, where necessary, produce the critical hardware on which essential functions depend.
Layer 3: Compute, Cloud and Edge Capacity
AI capability is increasingly determined by access to computing power.
Without sufficient compute capacity, European universities cannot train advanced models, startups cannot compete, public administrations cannot operate sensitive AI systems and industries cannot develop domain-specific applications at scale.
Europe has been expanding shared computing infrastructure through the EuroHPC ecosystem and its AI Factories. As of April 2026, the Commission reported 19 AI Factories and 13 associated Antennas connecting supercomputing centres, universities, businesses, researchers and public authorities across Europe.
This is an important foundation, but sovereign compute cannot consist solely of a few centralised supercomputers.
Europe needs a federated architecture containing several levels:
- AI gigafactories for frontier-scale model development.
- AI factories and national supercomputing centres for research and industrial innovation.
- Regional cloud infrastructure for businesses and public services.
- Sector-specific trusted clouds for health, energy, construction, finance and government.
- Edge infrastructure for factories, buildings, vehicles, municipalities and remote environments.
- Local and offline systems for operations that must continue without permanent cloud connectivity.
The Cloud and AI Development Act proposes a common sovereignty framework with differentiated assurance levels. The framework considers factors such as infrastructure location, independence from third countries, transparency of software supply chains, ownership and control. It also proposes common procurement mechanisms for European public administrations.
This risk-based model is more practical than declaring every foreign cloud inherently unacceptable or every European provider automatically sovereign.
Different workloads require different levels of control.
A public tourism website and a defence command system should not be governed by identical infrastructure requirements.
The sovereignty test
European organisations should be able to determine:
- where their workloads operate;
- who can access them;
- which laws may affect the provider;
- which software dependencies are present;
- how data can be exported;
- how services can be migrated;
- and how operations continue if a provider becomes unavailable.
A cloud without a credible exit route is not sovereign infrastructure. It is rented dependency.
Layer 4: Open-Source Software and Digital Commons
Much of the modern digital world is built on open-source software.
Operating systems, databases, encryption libraries, web servers, container platforms, AI frameworks and development tools frequently depend on code created and maintained through open communities.
Open source does not automatically create sovereignty. A project may be openly licensed while its governance, infrastructure, maintainers and commercial ecosystem remain concentrated outside Europe.
However, open source provides something that proprietary software normally cannot: the legal and technical possibility to inspect, adapt, maintain and independently operate a system.
The EU Open Source Strategy published in June 2026 places open source at the centre of technological sovereignty. It proposes support across the full lifecycle—from development and deployment to governance, security and long-term maintenance. It also identifies structural challenges such as weak long-term financing, limited access to procurement and insufficient support for maintainers.
This is crucial.
Europe has often benefited from open-source innovation without sufficiently funding the people and institutions that sustain it.
Critical code should be treated as infrastructure.
That means supporting:
- maintainers;
- security audits;
- dependency mapping;
- reproducible builds;
- European mirrors and repositories;
- open standards;
- documentation;
- interoperability testing;
- long-term stewardship;
- and sustainable commercial models.
Public authorities should become more than passive users of open software. They should act as anchor customers, contributors and responsible co-owners of digital commons.
Public funding should also include maintenance obligations. Financing a new platform while ignoring its operation after the pilot period creates abandoned code, fragmented systems and repeated procurement.
The sovereignty test
A software system is meaningfully sovereign when its users have both the legal right and practical capacity to:
- inspect it;
- operate it;
- modify it;
- secure it;
- migrate from it;
- and continue maintaining it when the original supplier disappears.
Open source provides the legal foundation. Institutions, skills and financing provide the operational foundation.
Layer 5: Data, Semantics and Sector Knowledge
Artificial intelligence is not powered by algorithms alone. It is powered by organised knowledge.
Europe possesses enormous quantities of high-value data in:
- manufacturing;
- energy;
- mobility;
- agriculture;
- healthcare;
- environmental management;
- construction;
- public administration;
- cultural heritage;
- and scientific research.
Yet much of this data remains fragmented, inaccessible, poorly structured or trapped in incompatible systems.
The European Data Union Strategy seeks to expand access to high-quality data for AI, simplify data rules and strengthen European control over international data flows. It includes data labs connected to AI ecosystems and approximately €100 million in ongoing EU investment for scaling common European data spaces.
The Data Act has applied since 12 September 2025 and establishes a broader framework for access to and use of data generated through connected products and services.
However, access alone is not enough.
Data must also be:
- trustworthy;
- documented;
- interoperable;
- machine-readable;
- legally usable;
- contextually meaningful;
- and governed by clear responsibilities.
For the built environment, this means connecting BIM, GIS, digital twins, product data, environmental declarations, sensor streams, building permits, maintenance histories and material passports through common semantics and open interfaces.
A pile of PDFs is not a data space.
A proprietary model containing information that cannot be reliably exported is not a digital twin.
A national database with incompatible classifications is not interoperable infrastructure.
Europe needs sector-specific knowledge architectures in which data retains its meaning across organisations, software platforms and national borders.
The sovereignty test
A sovereign data ecosystem allows organisations and individuals to control the data they generate while enabling trusted reuse under transparent conditions.
It prevents two opposite failures:
- data being locked away and rendered economically useless;
- and data being extracted without meaningful control or fair value distribution.
European data sovereignty should enable circulation without surrender.
Layer 6: Digital Identity, Credentials and Trust
Digital services require ways to establish who or what is participating.
This includes:
- personal identity;
- professional qualifications;
- organisational authority;
- machine identity;
- product certification;
- permissions;
- digital signatures;
- and verifiable records.
Identity infrastructure is therefore one of the deepest layers of digital power.
When authentication depends entirely on a small number of foreign platforms, those platforms become informal gatekeepers for commerce, communication and public participation.
The European Digital Identity framework requires EU Member States to provide digital identity wallets to citizens by the end of 2026.
Properly implemented, the wallet architecture could support user-controlled verification of identity, age, qualifications, licences and other credentials without requiring unnecessary disclosure of personal information.
But sovereignty will depend on implementation.
European identity systems should be:
- based on open specifications;
- interoperable across borders;
- privacy-preserving;
- resistant to centralised surveillance;
- available through multiple compatible providers;
- accessible to people with limited digital skills;
- and capable of operating through resilient public infrastructure.
Identity must not become a mechanism for universal behavioural tracking.
The principle should be selective proof: citizens should disclose only what is necessary for a particular transaction.
A person proving that they are over a certain age should not need to reveal their complete identity. A professional proving a valid qualification should not need to expose unrelated personal information.
The sovereignty test
Citizens and organisations must be able to establish trust online without being forced into dependency on a single commercial identity provider or an opaque centralised system.
Layer 7: Cybersecurity and Operational Resilience
A European technology stack that cannot withstand attack, failure or disruption is not sovereign.
Cybersecurity must extend beyond perimeter protection and regulatory compliance.
Modern systems depend on complex software supply chains. A vulnerability in a small library may affect thousands of organisations. A compromised update service may bypass conventional defences. A cloud outage may interrupt services across several sectors simultaneously.
Operational resilience therefore requires:
- software bills of materials;
- dependency inventories;
- vulnerability management;
- secure development practices;
- cryptographic signing;
- verified updates;
- incident-response capacity;
- offline recovery;
- immutable backups;
- redundancy;
- and regular continuity exercises.
It also requires institutional cooperation.
Municipalities, hospitals, energy companies, universities, small businesses and central authorities cannot each build complete defensive capacity independently.
Europe needs shared security operations, sector-specific threat intelligence and trusted mechanisms for coordinated response.
Sovereignty also means resisting the temptation to centralise every system in the name of security. Excessive centralisation can create single points of technical and political failure.
A resilient architecture combines common standards with distributed implementation.
The sovereignty test
Critical services should be able to degrade safely, recover rapidly and continue essential operations when networks, suppliers or central platforms fail.
The real measure of resilience is not whether incidents occur.
It is whether society retains agency when they do.
Layer 8: Skills, Institutions and Human Capability
Infrastructure without expertise creates dependency in another form.
Europe may own data centres, models and software while lacking enough people capable of operating, auditing and improving them.
The 2026 State of the Digital Decade assessment reported that more than 60% of Europeans possessed at least basic digital skills. However, ICT specialists represented only approximately 5% of employment in 2025—half of the EU’s 2030 target—with women accounting for less than 20% of ICT specialists.
This is not simply a labour-market problem.
It is a sovereignty problem.
Europe needs:
- AI engineers;
- semiconductor specialists;
- cloud architects;
- cybersecurity professionals;
- open-source maintainers;
- data stewards;
- legal and ethics specialists;
- systems engineers;
- energy planners;
- skilled technicians;
- and domain experts who understand how digital tools affect real-world operations.
The last category is frequently neglected.
An AI system for construction cannot be made trustworthy by software developers alone. It requires architects, engineers, craftspeople, building physicists, regulators, product manufacturers and facility managers.
A healthcare model requires clinical knowledge. An energy model requires grid expertise. A cultural-heritage system requires historians, conservators and local communities.
Sovereign AI therefore depends on interdisciplinary institutions where technological expertise meets practical and cultural knowledge.
Europe should expand:
- paid apprenticeships;
- cross-sector laboratories;
- professional micro-credentials;
- open technical academies;
- industry–university partnerships;
- vocational digital training;
- public-sector technical careers;
- and mentorship networks connecting generations of expertise.
Human capability is the layer that makes every other layer usable.
The sovereignty test
Europe is sovereign only when it can understand and modify the systems it operates without permanent dependence on external consultants or inaccessible vendor expertise.
Layer 9: Governance, Standards and Public Procurement
Public procurement is one of Europe’s most powerful but underused industrial instruments.
European public authorities purchase enormous quantities of software, cloud services, consulting, telecommunications and digital infrastructure. Yet procurement processes frequently reward short-term price, established vendor scale and superficial compliance rather than long-term interoperability and resilience.
This can reinforce dependency even when political strategies call for sovereignty.
Public procurement should evaluate:
- portability;
- open interfaces;
- open standards;
- data-export capability;
- software-supply-chain transparency;
- jurisdictional exposure;
- subcontractor dependencies;
- operational continuity;
- accessibility;
- energy performance;
- and exit costs.
The proposed Cloud and AI Development Act includes a common EU-level procurement framework intended to use the combined purchasing power of public administrations.
This could become transformative if procurement moves beyond nationality-based preferences and develops technically robust sovereignty criteria.
A small European provider should not win simply because it is European. Nor should a global provider be automatically excluded when it delivers an appropriate, transparent and replaceable service.
The central requirement should be sovereignty by design.
Contracts should ensure that public institutions retain control over:
- their information;
- operational decisions;
- technical architecture;
- future suppliers;
- and continuity of service.
The sovereignty test
A public organisation should be able to change provider without rebuilding its entire digital institution from the ground up.
Where migration is practically impossible, procurement has produced lock-in rather than infrastructure.
A Risk-Based Sovereignty Model
Not every system requires maximum European control.
Attempting to apply the strictest sovereignty requirements to every website, mobile application and office tool would waste resources and slow innovation.
Europe needs a tiered model.
Tier 1: General commercial services
These systems involve limited sensitivity and can use a broad international market, provided basic security, data portability and legal requirements are satisfied.
Examples include public information websites, ordinary collaboration tools and non-sensitive business applications.
Tier 2: Important organisational systems
These systems support meaningful operations and require stronger contractual control, backup capacity, interoperability and migration planning.
Examples include project-management systems, business databases and sector collaboration platforms.
Tier 3: Essential public and industrial systems
These systems require European hosting options, audited supply chains, strong jurisdictional safeguards, operational redundancy and tested continuity plans.
Examples include municipal administration, major industrial control platforms and sensitive professional data environments.
Tier 4: Critical and strategic systems
These systems require the highest degree of European control over infrastructure, personnel, software, keys, governance and continuity.
Examples include defence, national identity, intelligence, critical energy control, emergency communication and strategically sensitive research.
This approach avoids two extremes:
- naïve dependence on any provider offering convenience;
- and protectionist isolation that blocks useful international cooperation.
Sovereignty should be proportional to consequence.
Europe Must Be Open Without Being Defenceless
Europe’s most successful path will not be technological nationalism.
Science advances through collaboration. Open-source communities cross borders. Semiconductor supply chains are global. Climate, health, security and infrastructure challenges require international cooperation.
The European Data Union Strategy itself describes sovereignty as compatible with openness to trusted partners, provided international data exchange occurs under fair, secure conditions consistent with European interests and values.
That principle should guide the entire digital stack.
Europe should cooperate deeply with democratic partners, research institutions, responsible companies and open communities across the world.
But cooperation must be based on reciprocity and resilience.
Europe should not confuse participation in global systems with permanent dependence on individual suppliers.
A strong partner is one that can contribute.
A weak partner can only comply.
A Practical European Roadmap: 2026–2032
Phase 1: Map the dependencies — 2026 to 2027
Every public authority, critical-infrastructure operator and major European company should create a digital dependency register.
This should identify:
- cloud providers;
- data locations;
- processor dependencies;
- foundation models;
- identity systems;
- software libraries;
- external APIs;
- update mechanisms;
- encryption-key control;
- contractual exit rights;
- and recovery procedures.
The objective is not immediate replacement.
The first objective is visibility.
Europe cannot manage dependencies it has not documented.
Public procurement rules should begin requiring machine-readable dependency documentation and credible exit plans for important systems.
Phase 2: Establish interoperable foundations — 2027 to 2029
Europe should scale shared infrastructure around:
- federated cloud services;
- AI Factories;
- common data spaces;
- digital identity;
- trusted credentials;
- open-source public-service components;
- secure software repositories;
- sector ontologies;
- and cross-border cybersecurity cooperation.
Open interfaces should be mandatory for publicly funded core infrastructure.
Public investment should support reusable components rather than thousands of isolated pilots.
Phase 3: Build sector intelligence ecosystems — 2028 to 2030
Each strategic sector should develop its own trusted intelligence ecosystem.
For construction, this could combine:
- BIM and openBIM;
- digital twins;
- environmental data;
- material passports;
- product documentation;
- building regulations;
- life-cycle assessment;
- maintenance records;
- and AI-assisted compliance.
Equivalent ecosystems should be developed for health, energy, mobility, agriculture, manufacturing and cultural heritage.
These systems should use common European foundations while remaining adaptable to regional languages, laws and professional practices.
Phase 4: Create credible alternatives — 2029 to 2032
By this phase, Europe should possess credible alternatives at every critical layer.
This does not require replacing all global technology providers.
It requires ensuring that no single provider, country or platform can unilaterally disable essential European capability.
Critical systems should have:
- alternative suppliers;
- tested migration paths;
- distributed backups;
- local operational modes;
- open technical documentation;
- and qualified European personnel.
Sovereignty becomes real when alternatives are operational rather than theoretical.
Five Principles for Europe’s Digital Future
1. Open, but not dependent
Europe should welcome global knowledge and markets while retaining control over critical decisions and infrastructure.
2. Distributed, but not fragmented
European systems should be decentralised enough to remain resilient, yet interoperable enough to function as a continental ecosystem.
3. Regulated, but deployable
Trustworthy regulation must be accompanied by infrastructure, guidance, standards and investment that make compliant innovation practical.
4. Sustainable by architecture
Energy, materials, land, water and climate effects must be designed into the digital stack rather than treated as external costs.
5. Human-centred, but technically serious
European values cannot survive through declarations alone. They must be expressed through protocols, procurement requirements, software architecture, governance mechanisms and institutional practice.
From Digital Consumer to Digital Co-Creator
Europe’s greatest challenge is not a complete absence of capability.
Europe possesses world-leading researchers, industries, universities, public institutions, engineers, designers, craftspeople and open-source contributors.
Its deeper problem has been fragmentation.
Projects are separated by sector. Funding is limited to pilot periods. Procurement favours familiar platforms. Data remains trapped in organisational silos. Research is not consistently translated into industrial capacity. Local knowledge rarely connects to continental infrastructure.
The digital independence stack provides a way to align these strengths.
It connects energy policy with computing.
It connects semiconductor strategy with cloud deployment.
It connects data spaces with sector expertise.
It connects open-source development with public procurement.
It connects digital identity with citizen control.
It connects cybersecurity with social resilience.
And it connects technological investment with human capability.
This is how Europe can move from being primarily a regulator and consumer of digital systems to becoming a co-creator of the technological foundations of the twenty-first century.
Conclusion: Sovereignty Is the Capacity to Continue
The ultimate test of European technological sovereignty will not be the number of AI models carrying European names.
It will be whether Europe can continue functioning when conditions change.
Can hospitals access their systems during a cloud disruption?
Can municipalities recover their data after a cyberattack?
Can industries move workloads between providers?
Can researchers obtain computing power without surrendering strategic knowledge?
Can citizens prove who they are without being tracked by commercial gatekeepers?
Can public authorities inspect the software making consequential decisions?
Can European engineers maintain critical infrastructure without waiting for permission from another continent?
Can communities benefit from AI without losing control over their knowledge, work and institutions?
These are the questions that determine sovereignty.
Europe does not need to withdraw from the world. It needs to become a stronger, more capable and more trustworthy participant in it.
The path forward is neither isolation nor unconditional dependence.
It is an open, federated and resilient European digital ecosystem built on transparent infrastructure, shared standards, human expertise and credible alternatives.
Sovereign AI is part of that future.
But it is only one layer.
The real project is to build the complete stack beneath it.