Sovereignty is the new moat. The window is closing.

On European AI independence, the lessons of energy, and why infrastructure cannot wait for regulation.

In AI Superpowers, Kai-Fu Lee described a world splitting between two AI powers, the US and China, and suggested that most other countries would essentially become consumers of their technology. At the time, it felt like analysis. Today, it looks like an understatement.

But there is a third path. And Europe has a closing window to take it.

Bill Gates’ essay last week focused mostly on jobs and equity and rightly so. But buried in its nearly 6,000 words is something that deserves more attention: the warning that AI is in the wrong hands. Criminal organizations, authoritarian states, unaccountable corporations pose a challenge that regulation alone cannot solve. He calls for international cooperation. He is right. But regulation without infrastructure is just paperwork.

This is the core of what Mustafa Suleyman argues in The Coming Wave. The question of our era is not whether AI will be powerfulI. It will be, and soon beyond what most people currently imagine. The question is whether democratic institutions and human values retain meaningful control over how that power is used. That is a question about governance. But governance requires something to govern with — and right now, most European organizations have handed that leverage to someone else.

Geoffrey Hinton, the man who built the neural network foundations that power most of the AI we use today, quit Google in 2023 to say something similar. His specific concern was this: competition between the big technology companies is driving them to release AI at speeds that outpace any reasonable assessment of readiness. Nobody wants to be second. And when nobody wants to be second, nobody stops to ask whether we are actually ready.‍

"Every organization that runs its AI on a foreign provider's infrastructure has made a governance decision, even if it did not feel like one." Mikael Munck, CEO & Founder | 2021.AI‍

Here is the reality I keep coming back to: every organization that runs its AI on a foreign provider’s infrastructure has made a governance decision, even if it did not feel like one. It has decided that its most sensitive data; patient records, defence intelligence, citizen data, financial information will be processed in systems it does not control, under terms it did not negotiate, in legal jurisdictions whose interests do not always align with its own.

Hinton specifically called for people to figure out how to manage technology that could “greatly empower a handful of governments or companies.” That is the structural risk. Not a science fiction scenario. A very real, already-unfolding concentration of AI capability and infrastructure in a small number of hands (mostly American, some Chinese) while the rest of th world watches and consumes.

That is not a security risk in the abstract. It is a concrete problem I see in practice. We have several clients who now run GRACE on their own infrastructure. These are deliberate sovereign choices and it means they can apply AI to classified data that could never legally or safely go anywhere near a public cloud. That is not a niche use case. That is the future of AI in any organization that handles data that matters.

The EU AI Act was right in its instincts, even if implementation has been slower and lighter than originally planned. But the regulation that matters most is not a compliance checklist. It is the decision to build AI infrastructure that you actually control — models running on hardware you manage, in data centres subject to your law, with your organization in the governance seat.

I started 2021.AI because I believed Europe needed this. A decade in, I am more convinced than ever. Not because American AI is bad, but because dependency on any single provider, in any critical infrastructure, is a strategic liability. The organizations that build sovereign AI capability now will have structural advantages in three years that will be very hard to close.

Gates says we are not prepared. He is right. But preparation is not waiting for a policy framework. It is building, now, the infrastructure that makes responsible AI possible on your own terms.

The wave is here. The question is whether you are riding it, or being carried by it.

‍