Six Notes to the Commission
A policy infographic — six recommendations to the European Commission on cloud sovereignty, each scored against the Boardy test. Sovereignty is segmentation, not car manufacturing.
The Boardy Test
Sovereignty Only Matters When It Changes Behaviour
Sovereignty only matters when it changes buying behaviour, procurement, or jurisdiction. Otherwise it is branding with a flag on it.
Apply this test to any sovereignty claim — including this infographic. Each of the six notes below is scored against this standard. Half-passes, passes, hard passes, and conditional passes are all on the table.
Half-Pass
Changes language only
Pass
Changes jurisdiction or procurement
Hard Pass
Changes both buying behaviour and jurisdiction
Conditional
Option-value pending posture change
Stop the “Buy European Cloud Only” Frame
The dependency just relocates to open-source upstream, AI models, and developer tools. Trading visible dependency for invisible dependency is not sovereignty — it is camouflage.
Mandating European cloud procurement without addressing the full stack simply shifts the problem downstream. The open-source libraries, the AI model weights, the developer toolchains — these remain dominated by non-EU actors regardless of where the rack sits.
Visible Dependency
US hyperscaler hosting — easy to see, easy to target in policy.
Invisible Dependency
Open-source upstream, AI model weights, developer toolchains.
The Camouflage Risk
Buy-European mandates relocate, not eliminate, the exposure.
Finalise EUCS With Teeth
The EU Cybersecurity Certification Scheme (EUCS) top tier must define immunity from non-EU legal orders, with a tier below it that overlay providers — Bleu, S3NS, Delos — can plausibly meet.
Without a credible top tier, every regulated workload defaults back to US-direct hosting. The scheme becomes a compliance checkbox rather than a genuine jurisdictional instrument.
Frame note (28.05.2026). Tiering a sovereign-cloud certification scheme is the regulatory analogue of segmenting a sovereign-AI product line: the universal three-pillar (Data / Technology / Operational) × three-jurisdiction (EU / US / Singapore) sovereignty model from Sovereignty Field Note #2 shows the same shape — Aegis / Sovereign Infra / Connect tiers are one EU-origin enterprise's operational expression of it.
Fund the Overlay, Not the Metal
US Big Three Capex
Annual hyperscaler capital expenditure — per year and growing.
EU Cloud Revenue
Entire named EU cloud sector revenue — under one billion per year.
The Gap
Two orders of magnitude — and widening every quarter.
The EU cannot win a rack race. The rational response is to buy the legal layer: audit regimes, key custody, confidential computing, and jurisdictional overlay — not more physical infrastructure. Competing on capex is a category error.
Pay Maintainers, Not Forks
Ten European maintainers seated on Kubernetes SIG-Auth, the PostgreSQL committers list, the Linux kernel, and the PyTorch core team beats one sovereign fork.
-
→
Forks rot. Sovereign forks diverge from upstream, accumulate technical debt, and eventually collapse under maintenance burden.
-
→
Influence compounds. Upstream committer seats shape the roadmap of every dependency — globally, permanently.
-
→
Fix the CRA reading. The Cyber Resilience Act maintainer liability risk must be resolved before contributors exit European projects.
Keep China Conditional
Alibaba, Tencent, and Huawei have built capacity at hyperscaler scale. The PRC 2017 National Intelligence Law (Article 7) creates an exposure broadly analogous to the US CLOUD Act.
The policy response should be evidence-based, not reflexive. Block on facts. Reassess on posture. Diversification, not autarky, is the sovereignty primitive.
Tell the Truth About Interdependence
No modern EU AI workload runs without NVIDIA silicon, GitHub, or Meta-released open weights. Mistral, the French champion, ships its primary commercial distribution via Microsoft Azure. The model is European; the gravity is American.
NVIDIA Silicon
Every frontier AI training run depends on CUDA and H100/H200 hardware — no EU alternative at scale.
GitHub & Tooling
The global developer graph runs on Microsoft-owned infrastructure — version control, CI/CD, package registries.
Open Weights
Meta's Llama family underpins much of EU open-source AI development — American IP, European deployment.
Mistral on Azure
Europe's flagship model champion distributes commercially through an American hyperscaler — rational, not shameful.
Lifetime Scope Journal · 13 May 2026 · onelifetime.world/posts/six-notes-to-the-commission.html
Subscribe to Lifetime Scope Journal
Weekly insights on EU compliance, AI agents, and industrial transformation. English edition.
Subscribe