Sovereign AI needs an exit plan

Location is necessary context, not the whole answer

Europe's investment in AI infrastructure is significant. The LUMI-AI procurement and EuroHPC's Gigafactories call are concrete steps towards expanding regional capacity and access. They do not, by themselves, settle every organisation's requirements for control over its own application. EuroHPC: LUMI-AI procurement contract ↗ EuroHPC: AI Gigafactories call ↗

Our view is that a serious sovereignty discussion should include a practical exit plan. If a company cannot export its data, reproduce its deployment or operate without a particular service, a local hosting address may provide less freedom than the company expects.

This is an operational argument, not a claim that one architecture automatically satisfies European law. Legal and contractual requirements need their own assessment. The technical question is what the organisation can actually change when circumstances require it.

Define what must remain under your control

Start with the assets that make the application work: data, model access, configuration, evaluation sets and operational knowledge. Establish which can be exported, which can be recreated and which depend on a provider's proprietary service.

Not every dependency is unacceptable. A managed service can provide expertise or reliability that a small team cannot economically reproduce. The useful distinction is between a dependency chosen deliberately and one discovered only when the business tries to leave.

Portability should be demonstrated

A deployment diagram is not proof of portability. A small restore or migration exercise reveals more. Can the team rebuild the application in another environment? Can it recover the necessary data and credentials through approved procedures? Do the quality and latency checks still pass?

There may be compromises. A highly specialised service can offer strong performance at the cost of portability. Supporting a second environment can consume engineering time. The business should decide whether the benefit justifies that cost, rather than adopting an absolute rule that all dependencies are bad.

Public infrastructure is part of a broader strategy

European capacity can create valuable options for research and development. Owned equipment and commercial services can provide others. The best combination depends on access terms, workload characteristics and the people available to operate it.

We would like sovereignty claims to become more concrete: state where the data goes, who operates the system, which components are replaceable and how long a transition would take. Those answers are more useful than a flag beside a server image.

Control is strongest when it can be exercised. An exit plan does not mean intending to leave a provider; it means retaining the ability to make that choice.