Sovereignty is decided below the model: what nations need to control

In our work with ministries, public institutions and regulated enterprises across Europe and the Gulf, the same conclusion emerges in almost every engagement: sovereignty is decided further down the stack than most strategies assume.

Policy has defined the levels

The European Commission's proposed Cloud and AI Development Act gives the debate a structure. Its cloud sovereignty framework sets levels for providers serving the public sector, from a baseline, through EU-located personnel, infrastructure and assets with EU certification, to EU ownership and control and, at the strictest level, a high-assurance European cybersecurity certificate. Public tenders would weigh "Union added value" as a criterion.

These levels are, in essence, statements about infrastructure: where it is, who owns it, who operates it and who can access it.

Four layers at the facility level

We assess sovereign facilities against four layers. All four are required.

Jurisdiction. Land, owning entities and operating organisation located in Europe and subject to European law. This is the baseline commonly described as data residency.

Control. A clear, documentable chain of ownership, operation and physical and logical access, including the legal regimes that could compel access. The higher sovereignty levels focus precisely here.

Security. Security zoning, vetted supply chains and, for critical and defence-related missions, hardening against drones and electromagnetic threats.

Resilience. The ability to operate through grid stress and supply disruption: behind-the-meter generation, storage, microgrid capability and redundant connectivity.

Scale is often the wrong question

A common assumption is that sovereign AI requires hyperscale campuses. National training programmes and the EU's AI gigafactories, each expected to operate within 18 months of contract signing, do. Many ministries, agencies and regulated enterprises, however, need a few megawatts under their own control, delivered in months.

For them, factory-built modular capacity is frequently the right answer: installed on a public estate or a Qore facility, sized for current needs and expanded later. Qore Modular delivers in six to nine months on confirmed power, in four configurations.

A neutral infrastructure partner

Sovereign customers typically want to choose and own their compute, or to work with a European cloud provider. A neutral owner of land, power, building and fit-out, one that never owns the chip, preserves that choice. Combined with direct government engagement, proprietary access to power and industrialised delivery, it is how sovereign capacity can be delivered at the pace policy now demands.

Oliver Spring

Founder and Chief Executive Officer, Qore Infrastructure Partners. Profile