The EU’s New Sovereignty Test – Control Without Isolation

Further to extensive and growing debate on the digital sovereignty theme, I get the sesne the powers that be are finally beginning to define technology sovereignty in terms that match the reality of the AI age.

For several years, European technology sovereignty was often discussed as an aspiration Europe should control its data, reduce reliance on foreign technology and develop credible alternatives to the dominant global platforms. The objective was understandable but the term itself remained imprecise as I wrote about earlier in my piece Is Sovereignty as a Service a Category Error We Need to Retire?. Sovereignty could mean anything from storing data in an EU data centre to requiring European ownership of an entire technology stack.

For too long, sovereignty was treated as a political slogan or a data location question. So organisations stored the data in Europe, contract with a European entity, add a sovereign label and the problem was supposedly solved. The reality is it was never that simple.

The European Commission’s new Technological Sovereignty Package suggests that this thinking is beginning to mature. Presented on 3 June 2026, the package combines proposed measures covering semiconductors, cloud and AI infrastructure, open-source software and the digitalisation of energy amongst other criteria. It represents an acknowledgement that sovereignty cannot be achieved through regulation alone. Europe must also possess the infrastructure, industrial capability, skills and market demand needed to exercise meaningful technological choice.

The EU is recognising it cannot achieve sovereignty by excluding every non-European technology provider. Such an approach would be economically unrealistic and strategically self-defeating. The fastest moving innovation in AI remains globally distributed and organisations that isolate themselves from it may become less competitive, less secure and less resilient.

The EU’s emerging position is now more practical. Sovereignty increasingly means the ability to govern data, infrastructure and AI systems; understand critical dependencies; resist conflicting jurisdictional pressure; maintain operational continuity and switch or recover without unacceptable disruption. Reflecting the realities that we are in an age of rapidly changing AI models, chips, cloud platforms and agentic systems, making it unrealistic to say sovereignty about where a server sits. It is about who retains effective control when technology, suppliers or geopolitics change.That is a significant improvement.

This reflects the practice we are seeing in the industry that reflects that the real objective should be control without isolation. This implies organisations must be able to use global innovation without surrendering the authority to secure, modify, replace or continue the systems on which they depend. That requires scrutiny far beyond data residency. It includes and is not exclusively limited to source code, binaries, model weights, cryptographic keys, privileged administration, software updates, telemetry, hardware supply chains and access to specialist engineering capability.

This creates an uncomfortable challenge for many organisations. Their supposed sovereignty may be little more than contractual optimism or compliance tick box exercises. The reality is a European data centre does not help if the control plane is operated elsewhere. Open source does not guarantee independence if the organisation cannot maintain the code. An exit clause is worthless if migration has never been tested. A sovereign cloud is not sovereign if critical updates, licences or operational knowledge can be withdrawn by an external party. The danger is that sovereignty becomes another compliance theatre made up of  questionnaires, labels and assurances masking irreversible dependency.

The EUs more mature definition is therefore welcome but it simply raises the standard. Sovereignty is not a product to purchase or a certification to display. It is a continuously tested organisational capability. The latest candidate to be dragged somewhat reluctantly into the new mode of the AI era alongside Governance and Risk Management = Evergreen and real time, on demand; the old snapshot in time or binary definition no longer works. AI time compression and exponential leaps of innovation and change continue to redefine and force us all to look beyond the obvious, evolve established ways of thinking, reappraise old assumptions, finding new answers to not just harness the potential of an AI world but form many it’s about avoiding extinction.

For now, in the AI era, the sovereign organisation is not the one that owns everything. It is the one that can still make meaningful choices when circumstances change.

For an extended brief on the EU new Technological Sovereignty Package as it relates to Sovereignty, I have provided the following in PDF format – ‘European Sovereignty Grows Up for the AI Age’