TL;DR: European leaders are celebrating AI regulation as a form of strategic independence. They have confused writing the rules with winning the game. The countries that will actually achieve AI sovereignty in the next decade are the ones building inference infrastructure, not compliance frameworks.
I work at the intersection of AI systems and high-stakes deployment, including work that touches defense and intelligence applications. That positioning gives me a specific vantage point: I see what “AI sovereignty” looks like in practice, not in policy briefs. Check out my company Amethix
What I see in Europe is a category error being repeated at institutional scale. The assumption is that if you regulate who can deploy AI and how, you control AI. You don’t. You control the paperwork.
The European conversation about AI independence centers on model training: building European foundation models, funding EU-based research labs, requiring data localization. These are not bad things. They are also not the thing that matters.
Training a model is a one-time event. Running it is continuous.
Every inference query, every API call, every embedding computation, every real-time prediction in a production system runs on infrastructure. That infrastructure is overwhelmingly American. The compute clusters are Nvidia GPUs on AWS, Azure, and Google Cloud. The model weights that underpin most European AI applications were trained in San Francisco or Seattle.
When a European hospital system uses AI for diagnostic imaging, when a European bank uses a model for fraud detection, when a European ministry uses an LLM for document analysis, the actual computation is happening somewhere outside European jurisdiction. The data leaves. The answer comes back. The policy discussion misses the entire transaction.
Inference sovereignty means: when you run an AI query, you control the hardware it runs on, the jurisdiction it runs in, and the network path it takes.
This is not an abstract concern. Inference infrastructure is where exfiltration happens, where latency creates operational dependencies, where a sanctions regime or geopolitical shift can sever capabilities overnight.
The US has demonstrated it understands this. Export controls on Nvidia H100 chips to China were not about stopping China from building foundation models. China was already doing that. They were about constraining China’s ability to run inference at scale. The target was the operational layer, not the research layer.
Europe, meanwhile, is debating transparency obligations for AI systems while running those systems on American-controlled infrastructure. The regulation applies. The compute does not.
The UAE’s investment in Falcon, Saudi Arabia’s SDAIA initiative, Qatar’s sovereign compute programs. These are not primarily about building world-class AI research labs, although that is part of it. They are about controlling the infrastructure layer.
The pattern is consistent: acquire compute capacity on sovereign soil, build or license model weights, hire international talent to run operations locally. The result is not AI that is more advanced than what OpenAI or Google produce. It is AI that cannot be shut off by a foreign government’s export decision.
China understood this problem ten years ago. The Great Firewall is not primarily a censorship tool. It is a sovereignty architecture. Controlling the network layer means controlling which AI systems can operate within it, regardless of where those systems were trained.
Europe is building the regulatory equivalent of a firewall with no hardware behind it.
European and American AI startups are not incentivized to solve the sovereignty problem. They are incentivized to win enterprise contracts, hit ARR targets, and raise the next round.
Sovereign infrastructure is expensive, slow to build, and produces no short-term competitive advantage. A startup that invests in on-premise inference hardware for a government client loses on price to one that resells AWS API access wrapped in a compliance layer.
The compliance layer is not sovereignty. It is a UI for dependency.
This is the gap that smart institutional actors are recognizing. The ones taking it seriously are not announcing it publicly. They are quietly building air-gapped inference stacks, acquiring GPU clusters, and negotiating data residency at the hardware level, not the contract level.
The EU AI Act will produce its first significant enforcement actions in 2026. Most of them will target transparency and documentation failures, not infrastructure dependencies. The enforcement will validate the Act’s framing, which misses the real problem.
In parallel, expect more EU member states to quietly fund sovereign compute capacity outside the public regulatory narrative. Germany and France in particular have defense and intelligence establishments that understand the infrastructure gap even if the policy apparatus does not yet reflect it.
The inflection point will come when a geopolitical event severs access to American AI infrastructure for a European customer in a way that is visible and embarrassing. That is when the conversation shifts from compliance to control.
Until then, Europe will have the world’s most detailed AI regulations and run them on someone else’s computer.
Check the full episode on the official Data Science at Home YouTube channel (and don’t forget to subscribe ;)
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.