Even the United States doesn't control the full AI stack. Many sovereign AI programs buy local hosting and call it independence. The real test is what still runs when a foreign supplier says no.
I got here through a Formula One garage, not where I expected a conversation about national power to start.
A post on X promised that the HPC community had been solving sovereign AI's infrastructure problems for decades. I clicked through and landed on a sponsored CIO BrandPost from HPE and NVIDIA. It opened with a tribute to the Cray-1, walked through five customer stories, and somewhere in the middle sat the Mercedes-AMG Petronas Formula One Team running its digital wind tunnels. Useful for Mercedes. Not obviously useful for a finance ministry.
The detour became the story. The same post defined sovereign AI as the ability to own and control your own AI development infrastructure, which is exactly what HPE and NVIDIA sell. NVIDIA had been pushing the idea for a while. In February 2024, Jensen Huang told Bloomberg Television that countries including Canada, France, India, and Japan were discussing investment in sovereign AI capabilities, and he called a nation's data its "natural resource."
The policy idea and the sales pitch arrived together. Every government that wants its own compute is a new customer for accelerated computing.
I don't say that to dismiss the pitch. It has a real core. A country that wants its own AI capability inherits the problems supercomputing centers have handled for decades: thousands of processors acting as one system, with storage, networking, cooling, power, security, and access control that all have to work together. You can't assemble that by buying chips and finding an empty building.
But the brochure stops exactly where the hard question starts. What does sovereignty mean when processors are foreign, software crosses borders, and most of the people who run the system don't work for the government? Can governments build and run their own AI at all, or are they attaching a flattering word to a technology purchase?
The most useful definition I've found came from the British government. In a June 2025 parliamentary answer, it described sovereign AI as the UK's ability to access, influence, or control the development and deployment of critical capabilities to protect national interests and unlock growth. The same answer added close partnership with the private sector and continued international collaboration.
That is a definition a government can actually meet. Access can mean guaranteed compute for public research. Influence can come from procurement, investment, or a large state contract. Control can sit in the infrastructure, the model weights, the data, the encryption keys, the operating staff, or the authority to decide where a system runs. A country can hold one of those levers and lack the rest.
Brookings went further in a February 2026 report. Its central finding is that full-stack AI sovereignty is "structurally infeasible for almost any country," because AI runs on a transnational stack with chokepoints from minerals to models. The alternative it proposes is managed interdependence: map dependencies layer by layer, pick the interventions that are feasible, diversify suppliers and partners, and build in portability.
Under that standard, a government can use a foreign model and still improve its position by hosting it locally, adapting it to national languages, and keeping a credible route to another provider.
Brookings is just as blunt about the downside. Sovereignty programs can strand public money in systems that underperform, fragment markets and standards, and become tools of digital authoritarianism at home. Resistance to foreign power can turn into control over your own citizens. I keep that in mind every time a minister says the word.
For years, foreign dependency was a slide in a risk deck. June 2026 made it concrete.
On June 9, Anthropic released Fable 5 and Mythos 5. Mythos, the less restricted of the two, was already limited to a small group of Project Glasswing partners doing defensive cybersecurity. Three days later, the US government issued an export control directive barring foreign nationals, inside or outside the United States, from accessing either model. The directive followed a report by Amazon researchers describing a way around Fable's cybersecurity safeguards. Anthropic had no reliable way to verify nationality in real time, so it switched both models off for every user. It complied while publicly saying it disagreed, arguing that other models offered the capability in question.
The controls were lifted on June 30. Fable came back for global users on July 1. Mythos returned first to a set of US organizations, with broader partner access still being coordinated.
Three weeks is not long. What matters is who decided.
Not the customer, not the customer's government, not even the provider, which objected and complied anyway. An organization could have held a contract, a local office, and a carefully approved use case, and it would still have lost access because of a decision made in Washington.
Data location has the same problem, just quieter. The US CLOUD Act confirms that a provider subject to US jurisdiction must disclose data responsive to valid US legal process, regardless of where that data is stored. That is narrower than the claim that Washington can read any European server at will. It is much broader than the comforting idea that a Frankfurt data center puts your data under German control alone.
In June 2025, Microsoft France had to say this out loud, under oath, before a French Senate inquiry. The rapporteur asked its director of public and legal affairs whether he could guarantee that French citizens' data entrusted to Microsoft through the state's public procurement agency would never be handed to US authorities without explicit French consent. His answer was "No, I cannot guarantee it." He added that it had never happened, that Microsoft challenges unfounded requests, and that no such request has affected a European company in the past three years.
The committee's chair pointed out that Microsoft's transparency reports are self-declared and verified by no one outside the company.
The hyperscalers responded with engineering. AWS made its European Sovereign Cloud generally available in January 2026, located entirely inside the EU, separate from all other AWS regions, and run through independent EU corporate structures and EU-resident staff. That is real progress on residency and operations. It is still an American-owned stack, and a European Parliament study published in December 2025 reported that experts it interviewed describe many of these hyperscaler offerings as sovereignty-washing.
For a bank, manufacturer, hospital, or defense supplier, this is where sovereign AI stops being flag-waving. The question is the same one a ministry faces. Who can change the terms under which your critical system keeps running?
Seen as protection against concentrated dependency, the spending wave makes more sense. France used its February 2025 AI Action Summit to announce €109 billion in French and foreign private investment commitments. Canada's Sovereign AI Compute Strategy committed up to C$2 billion across new AI data centers, public supercomputing infrastructure, and compute access for smaller companies. Saudi Arabia's Public Investment Fund launched HUMAIN, a PIF-owned company with a mandate spanning data centers and cloud to models and applications.
Europe's AI Gigafactories show the operating model most clearly. The EU's tender covers up to seven facilities, backed by up to €10 billion in EU and national money, most of it expected from the 2028–2035 budget. The Commission expects the program to attract at least €20 billion in private investment. That is an expectation, not money on the table. The deadline, first announced as November 12, now runs to December 3, 2026.
Look at who does what. Consortia of companies, investors, and public entities will build and run the facilities.
The EuroHPC Joint Undertaking and participating states will buy guaranteed compute time. Reporting from the launch briefing said the private operators carry the running costs, and the public funders get a proportional share of capacity.
That is how governments usually build technology capability. They set the requirement, take on part of the risk, create demand, and reserve access. Someone else supplies the engineers. State power over the result then depends on enforceable rights, competent buyers, and enough in-house knowledge to tell whether those rights amount to control.
A government can finance a facility and still end up without useful access, portable workloads, operational knowledge, or a way out of a dominant supplier.
Supercomputing is the strongest part of the sovereign AI case, and here the HPE post earns its point. National supercomputing centers already know how to share scarce capacity among many users, isolate sensitive projects, move huge datasets, keep specialized cooling running, and keep complex systems productive over long lifecycles. EuroHPC was coordinating European supercomputing long before Council Regulation (EU) 2026/150 expanded its mandate to include AI Gigafactories.
Switzerland's Alps is a national research asset run by the Swiss National Supercomputing Centre. It is built on an HPE Cray platform and holds 10,752 NVIDIA Grace Hopper superchips. Switzerland controls who gets time on it and how it runs. It does not control what's inside.
Nobody does, completely. NVIDIA designs many of the accelerators used for frontier AI, but its annual report says its supply chain is mainly concentrated in Asia, and foundries including TSMC and Samsung produce its wafers. ASML, a Dutch company, is the world's only maker of the extreme-ultraviolet lithography systems needed for the most advanced chips. China has formidable AI companies and talent, and US rules require licenses for advanced computing items going to entities headquartered in China, or whose ultimate parent is, wherever those entities happen to be located. Further controls cover high-bandwidth memory, chipmaking equipment, and chip-design software.
If sovereignty means a fully domestic stack, the United States fails the test. So does China. So does everyone else.
A test that every major AI power fails tells a policymaker nothing.
Governments are far worse at sustaining a frontier-model race than at funding compute. Frontier development eats capital, scarce researchers, proprietary data, and repeated training runs at a pace public budgets rarely match. National programs still produce something useful once they stop measuring themselves against the global leaderboard.
Switzerland is my favorite example. ETH Zurich, EPFL, and the Swiss National Supercomputing Centre released Apertus in September 2025, in versions with 8 billion and 70 billion parameters, backed by an investment of more than 10 million GPU hours on Alps for Apertus and related research. The architecture, weights, training data, and methods are all open for inspection and reuse.
Six months later, the Canton of Ticino put it to work. A local company, Artificialy, fine-tuned the smaller model for translation, and the canton's computing center installed the tool in its own data center for a test with about 100 employees who need translations daily, starting with staff who handle confidential material. Artificialy's tool had previously run on Mistral's Mixtral. The canton switched partly because Mixtral releases its weights but not its full training data and pipeline. A European open-weight model wasn't open enough for a Swiss canton.
That is a modest deployment next to a chatbot serving hundreds of millions of people. It is also exactly the kind of use that turns sovereignty from a slogan into an administrative capability.
India took a different route. Sarvam AI, a private company backed by compute from the government's IndiaAI Mission, open-sourced 30-billion- and 105-billion-parameter models in March 2026 and says it trained both entirely in India. Its own release thanks NVIDIA for close collaboration on the project. South Korea runs something closer to a tournament: its Ministry of Science and ICT supplies GPUs and support to private consortia and eliminates teams in stages. LG AI Research, SK Telecom, and Upstage made it through the second round in August 2026.
None of this looks like a ministry training a model. Public institutions supply compute, capital, rules, and early demand. Universities and companies do the technical work. What comes out may trail the best commercial systems on broad benchmarks and still be the right tool for local languages, public records, and regulated work.
Open weights matter more than they get credit for. A remote API can disappear when a provider changes its product or a government changes the law. A model already sitting on your own hardware can't be switched off from someone else's dashboard. You still need hardware, engineers, security updates, and evaluation to keep it useful. You gain continuity, not freedom from every dependency.
Gaia-X grew out of a Franco-German initiative in 2019 and was widely received as the start of a European answer to US cloud dominance. By 2025, it was an association of more than 300 members, organized through committees and national hubs, with technical rules, labels, and data-space projects. It did not become a European hyperscaler, and today it describes itself as a standards framework rather than a cloud provider. At its November 2025 summit, its chief executive said more than 150 implementation projects were in preparation, but only a handful were operational and delivering benefits to end users.
That is a more precise criticism than calling Gaia-X dead. It produced governance architecture and a market vocabulary. Adoption lagged far behind the politics of its launch.
Aleph Alpha carries a warning about the phrase "national champion," although the facts resist a simple obituary. The Heidelberg company stepped back from the frontier race and concentrated on specialized language models for government and regulated industry. In September 2026 it signed a definitive business-combination agreement with Canada's Cohere. If the deal closes, the company will operate as Cohere, with headquarters in Toronto and Berlin and Aleph Alpha's Heidelberg office kept as a research center. As of this writing, the transaction still awaits final regulatory approval.
Less than three weeks after signing, Aleph Alpha released Kolibri, a German-English open-weight model designed to run on customer-controlled infrastructure. Germany still has the researchers, a specialized model, and domestic deployment options, and may soon have them inside a larger transatlantic company. Whether that preserves meaningful German leverage will depend on governance and operating rights that nobody outside the deal can see yet.
The pattern repeats across both stories. Political attention goes to the launch, the funding envelope, and the building. The slow work comes later: allocating capacity, updating software, keeping engineers, testing models, negotiating licenses, and deciding who answers when the system fails.
This is the part I care about most, because it is where most sovereign AI plans go quiet.
A model can sit inside national borders and still depend on someone else to run. It may need a foreign software layer, remote vendor support, signing keys held elsewhere, proprietary monitoring, or updates only the original provider can ship. You can own the servers and still be unable to inspect a model change, respond to an incident, or move the workload somewhere else.
Agentic systems raise the bar again. Once AI can call tools, read records, write files, and trigger transactions, control means far more than knowing where the model runs. Who can authorize an action? How are permissions constrained? Where are the logs stored, and who can read them? Who can change the policy? How do you stop the system without taking down the public service built around it? Server location answers only the first question on a much longer list.
I spend most of my working time on the gap between what AI governance documents promise and what deployed systems actually do. Sovereignty has the same gap.
A ministry can sign a procurement contract full of control clauses and still have no one who can tell, on an ordinary Tuesday afternoon, what its agent just did and why.
Outsourcing doesn't automatically defeat sovereignty. A domestic operator, a university consortium, or a trusted foreign partner can run a system under enforceable national rules. The government still needs enough expertise to set the architecture, audit performance, keep institutional knowledge, and replace the operator if the relationship breaks down.
Companies face the same test. A European manufacturer gains real control only when local hosting comes with authority over the model, the control plane, the keys, the logs, and the recovery process, and when the architecture makes the remaining foreign dependencies visible and replaceable.
So, can governments build sovereign AI? Yes, once they are honest about what that means. They can finance national compute, reserve capacity for public priorities, grow domestic operators, sponsor models for local languages and sensitive work, and require critical systems to have a fallback that actually runs. With a credible alternative, they can also negotiate harder with frontier providers, even when that alternative is slower or less capable.
They cannot rebuild the semiconductor, cloud, model, energy, and talent stack within their own borders. Trying would waste money, isolate researchers, and duplicate supply chains that no single country controls. The workable design keeps critical services on locally controlled capability and uses foreign frontier systems where the performance gain justifies the dependency. Trusted alliances fill some gaps. Open weights and portable workloads cover others.
That is how I now read every sovereign AI announcement. A new facility or a domestic model shows capacity. A procurement contract may reserve access. Sovereignty shows up only when those arrangements protect a decision that would otherwise belong to someone else.
Two questions cut through the branding every time. Which specific dependency did this remove? And what still works when the supplier says no?