Picture a doctor in Lyon typing a few lines about a patient into an AI tool between appointments. The answer comes back in under a second.
In that second, the question went somewhere. It went to a data hall full of GPUs, possibly in France, possibly in Norway, Portugal or Virginia. The hall is owned by somebody, run by somebody else, and governed by a particular country's laws.
For most of the last decade, where does the data live? was a question for lawyers and procurement teams. It's now a question about what gets built, where, and for whom. That makes it a construction question too.
The case for building it here
Start with where things stand. Amazon, Microsoft and Google together hold about 70% of Europe's cloud market, according to Synergy Research. European providers hold about 15%, a share that has barely moved since 2022. On AI compute the gap is wider. A Bruegel brief published last month puts the EU at roughly 2GW of operational AI compute in 2026, about 5% of the global total, against roughly 35GW (78%) in the US.
The legal side is where it gets sharp. The US CLOUD Act (2018) allows US authorities to require US companies to hand over data in their "possession, custody or control", wherever in the world it's stored. GDPR, meanwhile, says a foreign court order on its own isn't a valid basis for transferring Europeans' personal data out of the EU. Most of the time these two regimes coexist without incident. But they can point in opposite directions, and US providers have been candid about it. In June 2025, Microsoft France's legal director was asked under oath by the French Senate whether he could guarantee that French public-sector data would never be handed to US authorities without French consent. He said he couldn't, while adding that it had never actually happened.
For governments, defence, health and critical infrastructure, "it's never happened" isn't the same as "it can't". That's the heart of the sovereignty argument: resilience and strategic autonomy, meaning Europe being able to keep running whatever happens to trade relations or geopolitics.
Brussels is now putting money and law behind that argument:
- AI gigafactories. On 30 July the Commission opened the call for up to seven AI gigafactories. It comes with up to €10bn of EU and national funding, which the Commission expects to unlock another €20bn of private investment, for more than €30bn in total. The call closes on 12 November, awards are expected in early 2027, and each site has a maximum of 18 months from contract signature to start operating.
- The Cloud and AI Development Act. Proposed on 2 July, it aims to triple EU data centre capacity within five to seven years and asks member states to designate "data centre acceleration zones" with power ready to go. It's at the start of the legislative process, so expect it to change.
- A sovereignty scorecard for buyers. The Commission's Cloud Sovereignty Framework rates providers from SEAL-0 (no sovereignty) to SEAL-4 (full EU control). The Commission set SEAL-2 as the minimum for its own sovereign cloud tender.
The case for building it with whoever's ready
There's a strong argument on the other side, and it deserves a fair hearing.
Scale. Synergy estimates US cloud providers invest around €10bn every quarter in European capex. No European programme matches that pace. The gigafactory call, ambitious as it is, totals about three quarters' worth of that spend, spread over several years.
The hyperscalers are adapting. AWS launched its European Sovereign Cloud in Brandenburg in January. It's a separate German entity, run by EU residents, backed by a planned €7.8bn investment and an estimated 2,800 full-time-equivalent jobs a year. Microsoft has committed to growing its European data centre capacity by 40% in two years across 16 countries, and has added a clause to its contracts with European governments promising to contest in court any attempt to force it to suspend operations in Europe. Google and Thales are launching a German sovereign cloud where Thales holds the keys and runs the operation.
The law is more stable than the headlines suggest. In September 2025 the EU General Court upheld the EU–US Data Privacy Framework, so for most commercial data, transfers carry on as normal.
Speed matters most. Even Bruegel's brief, which sets out how far behind Europe's compute is, argues that grid connections and permitting speed are the real constraints. It warns that heavy local-content rules could deter the very investment Europe needs. On that view, the fastest route to AI capacity in Europe is to make it easier for anyone to build here.
The line is blurrier than the debate
Stargate Norway is the clearest example of how mixed this has become.
It was announced in July 2025 as a 230MW campus at Kvandal, outside Narvik, running on hydropower. Nscale, a European AI-native operator, would build it in a joint venture with Aker, the Norwegian industrial group. OpenAI would be the anchor customer, and all three described it as infrastructure for "sovereign AI workloads across Europe". This April the tenant changed. Nscale announced an expanded deal to deliver more than 30,000 NVIDIA Rubin GPUs at Narvik to Microsoft in 2027, and reports said OpenAI would get its compute through Microsoft instead.
So is it sovereign? It's European-built, European-powered and on European soil, and its capacity is contracted to a US hyperscaler. Both are true at once, and that's what most of the market looks like. Nscale raised a $2bn Series C in March, with backers on both sides of the Atlantic. Deutsche Telekom's Munich AI factory runs on around 10,000 NVIDIA GPUs.
For contractors, the useful takeaway is this: sovereignty is a spectrum, and it's defined less by the building than by who operates it, who holds the keys and who's allowed in. The halls look much the same. The clients don't.
Why it keeps heading north
Wherever you land on sovereignty, physics has a vote. Large AI campuses need cheap, clean, abundant power. In 2025 the Nordic system price averaged under €40/MWh, well below most of continental Europe. (Issue #2 looked at what happens when data centre demand and housing compete for the same grid at home.)
The gigafactory map points the same way. Ten countries have expressed interest in hosting one: Germany, France, Italy, Spain, Portugal, Poland, Czechia, Denmark, Finland and Greece. Several of those have never been data centre hubs. Sovereign AI isn't going to be built only in Frankfurt and Paris.
What this means on site
- Find out who the client really is, because it changes the programme. An AI-native operator like Nscale often moves fast, with financing tied to GPU deliveries and a tenant contract, so the programme runs off chip arrival dates. A gigafactory consortium has a public tender, an award in early 2027 and an 18-month window to get running. Hyperscaler sovereign regions sit somewhere in between. Same kit, three different procurement rhythms. Resource each one to its own clock.
- Treat vetting as a long-lead item. Sovereign and government-backed facilities increasingly come with rules about who can operate them and who can access them. Expect some of that to reach the site, especially during commissioning and fit-out inside secure areas. In the UK, the government's published service standard for SC clearance is 90 days, and many cases take longer. Before mobilisation, find out which roles need clearance, nationality or residency checks, and who already holds them.
- Follow the new map, not the old one. The 2027 awards will create projects in places many contractors have never worked: Portugal, Poland, Greece, northern Norway. Supervisors who've delivered in a new country, worked with local subcontractors and handled unfamiliar permitting will be worth a lot. Start working out now who on your team would go.
Three numbers worth knowing
70%: the share of Europe's cloud market held by Amazon, Microsoft and Google combined. European providers hold about 15% (Synergy Research).
5%: the EU's estimated share of global operational AI compute in 2026, about 2GW, compared with 78% in the US (Bruegel, September 2026).
12 November: the date the EU's AI gigafactory call closes. Awards are expected in early 2027, and each winner has up to 18 months from contract to start operating.
So, where should Europe's AI live?
Probably in more places, owned in more ways, than either side of the debate would like. Some workloads will need full European control. Most will run happily on whichever capacity is available, reliable and affordable. The likeliest outcome is a mix: sovereign campuses, hyperscaler sovereign regions and AI-native operators, often in the same countries and sometimes in the same building.
For the people building it, the practical question isn't who's right. It's who's the client, and what do they need from the people on site? That answer now changes the programme, the vetting and the map.
One question back to you: have sovereignty requirements started to show up on your projects, whether in the contract, the access rules or the vetting? Reply and tell me. I read every answer, and the best ones will shape a future issue.
Alex The DC Build Network