European organizations have to reckon with how to keep up with the modern world without sacrificing sovereignty. Geopolitical instability, tightening regulatory expectations and the rapid adoption of artificial intelligence (AI) mean that, for many organizations, sovereignty now sits alongside resilience and business continuity in board-level risk discussions. The question they can no longer defer is how to harness the opportunities of the modern cloud without surrendering control over their own data. Answering it requires honesty about what sovereignty means, and about where it can actually be found.

A definition Europe can trust

The European Commission’s forthcoming Cloud and AI Development Act (CADA) is the right vehicle for that honesty: giving Europe a shared, enforceable definition of what “sovereign” actually means. Without such a definition, the market is filled with commercial offerings that claim the sovereignty label without delivering the substance, a practice described as “sovereignty washing.” This gap has led some organizations to treat open source as the answer. But open source software is a licensing model, not an operating model, and it doesn’t settle questions about infrastructure or jurisdiction or even reliability and access. It’s not a route out of dependency, it’s a different dependency on project sponsors and code maintainers. A definition gives policymakers a way to properly assess claims of sovereignty against a consistent standard rather than taking marketing at face value.

Europe should not wait for CADA to take effect before acting, though. European cloud service providers (CSPs) have been partnering with established technology providers to deliver real sovereign capability, without rebuilding the entire technology stack from scratch.

The best time to plant the sovereign tree was 10 years ago

If Europe wants to grow its industrial base, it has to support the ecosystem as it is now, not as it may in 10 years’ time. CADA’s own roadmap assumes roughly five to seven years to triple the EU’s data-center capacity. Providers who have already built capacity by blending EU capabilities with proven non-EU technologies would have to spend the intervening years relinquishing their growth. It is scale, not a shortage of skills or innovation, that is the biggest practical obstacle facing a stronger European cloud market. This is precisely why partnership with proven technology sources deserves a central place in the sovereignty debate rather than being treated as a second-best option.

Partnership shortens that timeline considerably, letting European CSPs deliver sovereign, scaled services now instead of waiting for domestic capacity to catch up organically. In Italy, IPZS, owned by the Italian Ministry of Economy and Finance, is using this model to build a modern Digital Application Platform for the Italian EUDI wallet, a foundational EU digital identity initiative. It provides a live example of that model working in Europe today, at the scale and speed the policy window demands.

It is through scale that the local industrial base can deliver sovereign capabilities, compete, capture market share, and invest in developing and integrating home-grown technologies. Hoping for the alternative to happen, that is for a European technological stack to fully emerge and be adopted, is the equivalent of putting the cart before the horse.

The rules need to allow for a model that’s already working

Providers, such as evoila, are now operating well beyond Europe’s borders, alongside Uniserver. This shows the model working at a broader scale, combining local operational and jurisdictional control with proven technology. Sovereignty spans jurisdictional, technological, operational and supply-chain dimensions, and a partnership model can address all four while drawing on technology already proven at scale, rather than asking every layer to be rebuilt from first principles by a single European provider.

Alongside its cloud platform, developed in-house and operated from data centers in Europe under EU jurisdiction, IONOS also offers customers a dedicated VMware-based private cloud. It is also operated within the EU and designed to provide European data sovereignty and operational control.

Broadcom’s role in that model is deliberately narrow. It supplies the VMware cloud software layer to the CSP, while the CSP itself runs the infrastructure and holds the customer relationship, so that no European customer data passes through Broadcom or is subject to its access. Trust, in this model, follows the architecture rather than the brand. If CADA’s tiers implicitly assume that sovereignty can only be delivered by a fully European-built stack, CADA would shut out precisely the route that is already allowing Europe to scale fastest: partnership between local operators and proven technology providers.

The path forward

Europe does not have to choose between moving quickly and building sovereignty. The two are compatible, provided the legislation is calibrated to recognize it. As the European Parliament and European Council work on CADA, the priority should be for it to recognize and reward the partnership models already delivering sovereign capability across Europe today.

The above column is sponsor-generated content.

---

Disclaimer

POLITICAL ADVERTISEMENT

• The sponsor is Broadcom Inc.
• The political advertisement is linked to Broadcom’s software business and advocacy around the Cloud and AI Development Act (CADA).

More information here.

BRUSSELS — The European Union’s cybersecurity agency and in-house research center have each begun experimenting with open artificial intelligence models from China, three EU officials have told POLITICO.

The Joint Research Centre (JRC) — the EU’s in-house scientific research center — is evaluating “publicly available open-weight models” originating from China, European Commission spokesperson Maciej Berestecki confirmed. The head of ENISA, the bloc’s agency responsible for cybersecurity, also said in an interview that his team was now testing Chinese AI.

The experiments with Chinese models at the JRC are part of a broader research project to evaluate artificial intelligence that also includes leading models from the United States and Europe, Berestecki said. “Models from different origins are included in a comparative scientific evaluation of their capabilities, performance, limitations and risks,” he said, adding that the JRC is also looking into their potential scientific applications.

AI safety and security — topics currently under intense scrutiny following a series of incidents in which advanced AI models hacked real-world networks during testing activities — are not the core focus of the JRC’s testing activities, according to a different Commission official, who was granted anonymity to discuss sensitive material.

Open-weight models are those whose core components are publicly released, allowing anyone to run the model and study how it works. China’s approach to AI has leaned more towards open models than the United States. Some major U.S. tech and AI companies, including chips giant NVIDIA, are investing in open-weight models.

Forced to choose

The U.S. and China are locked in a race to dominate in the technology, with Europe largely sitting on the sidelines. Without a viable European frontier model, European private and public organizations may be left to choose between American and Chinese providers for advanced AI applications.

In a recent speech, European Commission President Ursula von der Leyen suggested Europe should not try to win the frontier AI race. A top German tech company told POLITICO this week it was dropping Europe’s leading AI lab Mistral in favor of open-source Chinese models.

The JRC has not entered into any “bespoke access” or licensing negotiations with the relevant Chinese developers, Berestecki said. The models are run on the center’s “secure, on-premises scientific infrastructure” and the Commission is not intending to use Chinese models for its own purposes, he added.

EU cyber agency ENISA — which has gained access to advanced models from top U.S. AI firms Anthropic, OpenAI and Google — is also experimenting with “a couple” of open-weight Chinese models, its executive director Juhan Lepassaar confirmed in an interview on Wednesday. 

JRC and ENISA have been tasked with working together to set up an AI testing platform under a recent EU action plan on AI and cyber, the European Commission’s attempt to respond to the growing concerns after a series of incidents involving AI systems breaking out of testing environments and breaking into other organizations’ digital systems.