The Sovereignty Stack Has No Bottom

At around 4:30 in the morning on 1 March 2026, an Amazon Web Services (AWS) facility in the United Arab Emirates went dark. There were sparks, then fire. Local authorities cut the power, including to the backup generators, while crews fought the blaze.

Within twenty-four hours a second AWS availability zone in the UAE had failed, and a third facility in Bahrain had suffered "physical impacts to our infrastructure". Banking apps and payment platforms from Abu Dhabi to Manama went offline, and AWS was advising customers to migrate workloads to alternate regions.

The company initially called the cause "objects" but by Monday had confirmed the objects were Iranian drones, launched in retaliation for US and Israeli strikes on Tehran.

The interesting thing here is not the war. Armed conflicts come and go. What's interesting is what this reveals about the word "sovereignty". It's a term that is increasingly important to European technology policy and which, on closer inspection, turns out to be a stack of trapdoors. Every layer where sovereignty was declared "solved" actually conceals another layer where it was not.

Peeling the stack

Let's start at the top, where the sovereignty conversation is loudest, and work down from there.

1. The application layer. The Netherlands is building GPT-NL, a Dutch large language model trained from scratch, funded with €13.5 million from the Ministry of Economic Affairs, licensed under a controlled framework, and marketed explicitly as a way to "avoid dependency on non-European providers." The European Commission's Open Source Software Strategy pushes public bodies toward openly licensed software they can, in principle, audit and modify. Both are real gains. Both run on someone else's silicon.
2. The cloud layer. In April 2026, after seven years of legal and political fighting, France finally moved its national Health Data Hub off Microsoft Azure and onto Scaleway, a domestic provider owned by Iliad. Reuters frames it as a straight repatriation; Scaleway's own announcement notes the platform was assessed against more than 350 technical criteria. In parallel, the European Commission published a Cloud Sovereignty Framework, complete with a five-band assurance scale and a weighted score across eight objectives, and used it to award €180 million of contracts to European providers. For the first time, the word "sovereign" is attached to something you can score. But a top-rated sovereign cloud still needs chips it cannot make.
3. The compute layer is where sovereignty discourse usually has a problem. Almost every "sovereign" European cloud runs on processors designed in California and fabricated in Taiwan or South Korea, on lithography machines made in the Netherlands using components from Germany, Japan, and the United States. The EU's tech sovereignty package floated in mid-2026 acknowledges this: a Chips Act 2.0, a network of AI factories and gigafactories, a push to triple domestic data-centre compute within five to seven years. But the timelines are measured in decades, and the current European position is dependency on suppliers who are themselves dependent on a fragile transpacific supply chain.
4. The energy layer. In April 2026, Cleanview and The Guardian reported that Google had partnered with Crusoe Energy to build a 933 MW gas plant in Armstrong County, Texas, powering two buildings at a campus called Goodnight, with no carbon capture, no grid connection, and up to 4.5 million tons of CO₂ emissions a year. Meta is building seven gas plants for a single Louisiana campus; Microsoft has signed a 20-year deal with Chevron for a 2.67 GW gas hub of its own in West Texas. Sovereign compute still burns someone's gas, on someone's land, under someone's planning regime, and thanks to lobbying, the emissions from these facilities are not fully public.
5. The physical and geopolitical layer. This is where the Gulf outage sits. Data centres are heavy, hot, thirsty buildings: tied to specific plots of land, cooled by specific water systems, connected to specific undersea cables. The CCCB Lab called this "the weight of the cloud" a decade ago: the metaphor of the cloud, the argument goes, misleads us about how physically located, vulnerable, and dependent the internet actually is. Roughly 99% of intercontinental data traffic runs through undersea cables. AWS alone runs well over a hundred availability zones across three dozen-plus regions. Every one of those regions sits in someone's blast radius, someone's territorial waters, someone's regulatory reach. On 1 March, "someone" turned out to be Iran.

Five layers in all, with sovereignty at the top but not at the bottom.

Why the bottom keeps moving

These layers are not just technically entangled, they are actively defended. For example, in October 2025, Corporate Europe Observatory and LobbyControl reported that the digital industry's annual lobbying spend in Brussels had reached €151 million, up 55% in four years, with the top ten firms outspending the top ten in pharmaceuticals, finance, and automotive combined. There are now more Big Tech lobbyists registered in Brussels than there are Members of the European Parliament. Meta alone declares €10 million; Amazon, Apple, and Microsoft roughly €7 million each (Euronews).

That spending has a purpose, and the purpose is visible in the outcomes. Investigations in April 2026 documented how Microsoft, DigitalEurope, and other US-aligned lobby groups pushed the European Commission to write near-verbatim confidentiality clauses into EU law, restricting public disclosure of individual data-centre emissions. Wired reported that under sustained US pressure, including from the Trump administration and its trade representatives, the AI Act, Digital Services Act, and Digital Markets Act have been substantially watered down, delayed, or thrown into legal limbo. Every layer in the sovereignty stack has a fight running underneath it, and the fights are far from being evenly matched.

This is the point that often gets lost in the "Europe is finally getting serious about sovereignty" narrative. Sovereignty is not a technical problem waiting to be solved by better engineering. Instead, it is a boundary that has to be held against sustained, well-funded pressure to move it. The "bottom" of the stack isn't a fixed depth. It's wherever the current fight is losing.

Institutions and individuals

Broadly speaking, there are two kinds of sovereignty work happening in response. Institutions (mostly national governments and EU bodies) are pushing depth. For example, France's April 2026 directive to migrate all government workstations from Windows to Linux by autumn, and its earlier mandate to replace Microsoft Teams and Zoom with the domestic "Visio" platform for 2.5 million civil servants. See also: GPT-NL, the Cloud Sovereignty Framework, the tech sovereignty package.

Individuals are chasing the same thing at their own scale: migrating to Proton, Tuta, and Mastodon, shifting from Google Docs to self-hosted alternatives, and fleeing from X.

These institutional and individual shifts are both partial for the same structural reason. A French ministry running Linux on Scaleway hosting GPT-NL is more sovereign than the same ministry three years ago. So is a household that has moved its email to Proton and its notes to an app on a Raspberry Pi. But neither has reached the bottom layer.

The ministry's Scaleway cluster still runs on non-European chips, and draws power from a European grid that imports gas. The household's Raspberry Pi is a British-designed board fabricated in Wales from silicon manufactured in Asia, and connected to the wider internet through undersea cables owned by a handful of consortia.

Neither institutions nor individuals can reach the energy or geopolitical layer alone. This isn't an argument to give up but rather an argument to stop measuring sovereignty as a destination.

A ratio, not a destination

A better way of framing this is that sovereignty is not a place you arrive at. It is a ratio, a process. How many layers of your stack can you see and choose? Divide this by the total number of layers that you depend on.

A national government that has migrated its desktops, LLMs, cloud, and productivity suite, but still buys its silicon from TSMC and its energy from an interconnected European grid, is operating at maybe three-fifths sovereignty. Likewise, a household running Linux on a self-hosted server behind a Cloudflare tunnel is operating at perhaps two-fifths. Neither is at 100%. Neither ever will be. But the ratio can be measured, tracked, and improved, and, crucially, discussed honestly with the people who fund and depend on it.

This is roughly what independent tools like the Sovereignty Score assessment (built against the European Commission's own Cloud Sovereignty Framework) are trying to do at the cloud layer. They convert the slogan of "sovereignty" to a number with a published methodology. This is worth generalising: any TechFreedom-style assessment, any organisational tech audit, any personal migration plan, benefits from asking not "are we sovereign?" but "how many layers deep does our sovereignty go, and at what depth does someone else's decision take over?"

This is the kind of question FIELD STATION exists to test in practice. Our co/core experiment is one concrete attempt to shift the ratio at the compute layer: running AI inference on hardware we own rather than hardware we rent, with a public record of what happened. It doesn't reach the bottom — nothing does — but it moves the needle.

That question ages better than any vendor comparison. The vendor in the headlines this month will be replaced by another next month. The layers won't. The chips will still need fabrication, the fabs will still need lithography, the servers will still need power, the power will still come from somewhere, and the somewhere will still sit inside someone's border, someone's weather, and, as March 1st demonstrated, someone's blast radius.

The sovereignty stack has no bottom. Better to know that, and count the layers you can hold, than to keep declaring victory one layer at a time.