How To Build Real AI Sovereignty

Antoni Kozelski, CEO/founder of Vstorm, an agentic AI engineering firm helping companies implement agentic AI to transform their businesses.

​Gartner forecasts that worldwide sovereign cloud spending will reach $80 billion in 2026, growing more than 35% from 2025. And yet the European Commission reports that the EU still depends on non-EU providers for over 80% of its key digital products, services and infrastructure. Money is pouring into the word “sovereign.” The dependence it is meant to fix has barely moved.

In my own work, I’ve found the reason is rarely the data center. It is ownership: which layers of the stack a company actually holds, which it rents and who can revoke them. Nearly every client who asks us for a “sovereign” system means something different by the word.

The Structural Case For Owning The Stack

The instinct to treat sovereignty as a location (e.g., “Our data sits in-country, and therefore, we are sovereign.”) is the first and most expensive mistake leaders can make. Location is not control. The CLOUD Act lets U.S. authorities compel a U.S.-incorporated provider to hand over data held anywhere in the world, including in an EU data center. The postcode on the server changes nothing. What governs the system is the law that governs the company operating it.

Jurisdiction follows the company, not the data center. Data residency asks where information sits. AI sovereignty asks who holds legal and operational authority over it and whether a foreign entity could alter, disable or disclose it without consent.

No one has finished writing the rules yet. The EU’s Cloud and AI Development Act is still moving through negotiation, its sovereignty framework unsettled. Open standards for agentic systems are still being drafted; the Agentic AI Foundation, hosted by the Linux Foundation and launched in late 2025, exists to coordinate those standards, and my company contributes to that work.