The Sovereignty Nobody Asked For
What connects €67 billion, 2,800 projected jobs and 243 lines of code.
Europe is spending tens of billions on geopolitical sovereignty - structurally unachievable without owning chips, software or capital - driven by concerns over strategic autonomy.
Enterprise data shows only 36% of workloads actually require sovereign infrastructure.
And microGPT just proved the other 64% could build pragmatic, selective control at 1/1000th the cost.
Three data points, one week, one contradiction
February 12, Andrej Karpathy releases microGPT. The algorithmic core of frontier AI in 243 lines of Python. Zero dependencies. No PyTorch. No black box.
He wrote: “I cannot simplify this any further.”
February 13, Tomasz Tunguz publishes capital rotation data. Technology companies growing 19% but stocks are flat. Energy up 17%. Materials up 16.5%. Investors rotating $600-650 billion into physical infrastructure - power, materials, construction.
At the same time, Christophe Vidal shares France’s data center arithmetic (in French):
€67 billion invested in 2025.
Trendeo projects these investments will generate approximately 2,800 direct jobs. €24 million per job.
More expensive than training an astronaut.
If the algorithm became transparent and capital is flooding infrastructure, why did Europe spend €67B and get zero economic leverage?
Politicians, investors and enterprises are solving three different problems.
None of them are talking to each other.
The algorithm became transparent
microGPT is an art project, not a production code.
243 lines of pure Python. Zero dependencies. Embeddings, multi-head attention, RMS normalization, autoregressive generation.
“This is the full algorithmic content of what is needed… Everything else is just for efficiency”
Anand Iyer at Lightspeed Ventures called it “The K&R of language models”.
You can read it in one sitting. Understand how LLMs work.
The algorithm is no longer a black box defended by vendor lock-in.
Any engineering team can study it.
Customize it. Deploy it for specific internal use cases.
The question shifted. From “Can we do this?” to “Should we do this for these workloads?”
Capital rotated to infrastructure before it knew algorithms were transparent
Tunguz’s data shows technology companies growing 19% revenue, 18% earnings. But technology stocks flat in 2026.
Energy: 5% revenue growth → 16% earnings = 3x operating leverage.
Materials: 8% revenue → 17% earnings.
Energy stocks up 17%, Materials up 16.5%, Industrials up 12%.
Hyperscalers spending $600-650 billion on AI infrastructure in 2026. That infrastructure needs physical assets. Power plants. Cooling systems. Rare earth materials. Construction. Land.
The capital flows to the sectors that supply the infrastructure, not the software that runs on it.
Tunguz published February 13, capturing Q4 2025 investor behavior.
microGPT dropped February 12, 2026.
Investors made a $650B bet before microGPT proved enterprises could build internal models for specific workloads.
What “sovereign cloud” actually means
€67 billion in data center investments announced in France in 2025. Trendeo projects these investments will generate approximately 2,800 direct jobs. €24 million per position.
But only 36% of enterprise workloads actually require sovereignty. The other 64% could use domain-specific models at 1/1000th the cost - the path microGPT just made visible.
But what does “sovereign” actually deliver?
Test 1. Independent from non-EU components, services, capital?
ABSOLUTELY, NO.
€50-70B of France’s €67B came from foreign capital - Brookfield (Canada), MGX (UAE). France’s largest operator, Data4, sold to Brookfield in 2023.
GPUs from Taiwan. Servers from China. Software from USA.
Nothing is sovereign here.
Test 2. Data protection - two separate legal questions
First question: Can EU personal data be transferred to US companies?
Schrems II (2020) invalidated Privacy Shield for ALL personal data. US surveillance laws don’t provide adequate protections for EU citizens’ data.
ALL personal data transfers to US now require Standard Contractual Clauses PLUS Transfer Impact Assessment PLUS supplementary technical measures. This made transfers legally complex for ordinary personal data (names, emails, addresses).
For special categories - much harder:
GDPR Article 9 covers health data, biometric data, political opinions, religious beliefs, genetic data, sex life. These require both Article 6 legal basis PLUS Article 9 exception.
German regulator BfArM declared US cloud providers “not suitable for processing personal health data”. Austrian DPA ruled Google Analytics unlawful for health websites.
For defense and critical infrastructure - sector-specific restrictions:
EU tightening restrictions on US cloud for strategic space data due to Cloud Act concerns. NIS2 Directive and EUCS certification create additional barriers for US providers in regulated sectors.
This is a GDPR data transfer restriction - separate from Cloud Act jurisdiction.
Second question: Can US authorities compel access to EU data stored by US companies?
UNFORTUNATELY, YES - regardless of physical location.
Microsoft testified under oath before French Senate in June 2025 that it cannot guarantee protection from US authorities, even for data stored in France. If compelled by US legal order, they provide the data (in French).
Cloud Act grants US authorities extraterritorial power to compel US companies to produce data “regardless of where such data is located”.
This creates a legal collision:
GDPR Article 5 requires lawful processing.
GDPR Article 32 requires appropriate security measures.
Cloud Act access violates both - foreign government gets access without EU legal process, customer notification, or GDPR safeguards.
“Jurisdiction follows the corporation, not the dirt”. If provider is US-owned, US government has legal reach even into “European” servers.
There are exceptions:
Air-gapped (Google Distributed Cloud) - physically isolated, no network. Cannot be compelled because provider cannot access.
HYOK (Hold Your Own Key) encryption - customer controls keys externally. Provider cannot decrypt even if compelled.
Pure EU providers with zero US operations - not subject to Cloud Act. Must verify NO US parent company, NO US subsidiary.
Test 3. What does the market actually buy?
Gartner forecasts €23B “sovereign cloud” spending by 2027.
This forecast includes:
US hyperscalers (AWS ESC, Microsoft EU Data Boundary)
EU providers with US operations (OVHcloud)
True EU-only providers (volume unknown)
Air-gapped deployments (niche)
“This is bad news for hyperscalers, of course, yet US-owned sovereign cloud services are expected to attract some of the reallocated IaaS spend, according to Gartner — even if local providers are likely to benefit most.”
Gartner estimates that roughly 80 percent of sovereign cloud spending will be tied to new digital projects or legacy systems that have not yet moved to the cloud.
Only about one-fifth of existing workloads are expected to be relocated from global platforms to local or regional providers over the next several years, a process the firm describes as geopatriation.
Test 4. Who actually needs this?
I previously cited the Accenture report.
Only 36% of AI initiatives and data within European organizations require a sovereign approach.
Yet 62% are seeking sovereign solutions, with banking (76%), public service (69%) and utilities (70%) leading the charge.
The paradox is that 65% of these same organizations acknowledge they cannot remain competitive without non-European technology providers.
The Sovereignty contradiction
Europe spent €67B building infrastructure using foreign capital (Brookfield, MGX), operating on foreign hardware (Taiwan GPUs, Chinese servers), for a market where only 36% of workloads actually require sovereignty.
The “sovereign cloud” market mixes US hyperscalers - where Microsoft admits Cloud Act jurisdiction applies - with local providers, without clear legal differentiation.
Banking, public sector and utilities demand sovereignty. Then deploy 64% of their workloads on infrastructure that doesn’t deliver it.
And microGPT revealed the pragmatic alternative: internal models for the 64% that don’t need full regulatory sovereignty. Domain-specific. Selective control. At 1/1000th the cost..
Falsifiability tests
This diagnosis rests on four testable claims. If any collapse, the entire thesis fails.
Claim 1: US hyperscaler “sovereign” offerings remain subject to Cloud Act
Falsified if a European court or independent legal analysis demonstrates that AWS European Sovereign Cloud or Microsoft EU Data Boundary successfully isolate customer data from US Cloud Act jurisdiction - contradicting Microsoft France’s June 2025 Senate testimony where they stated they cannot guarantee protection.
Claim 2: Only 36% of enterprise workloads require sovereignty
Falsified if independent enterprise surveys (not vendor-commissioned) show more than 60% of production workloads classified as “requires sovereign infrastructure due to regulatory or data sensitivity constraints” - contradicting Accenture’s findings.
Claim 3: €24M per job represents systemic inefficiency, not temporary capex phase
Falsified if French government data shows operational phase job creation (post-construction) reaches more than 10,000 direct jobs by 2027, bringing per-job cost below €7M - indicating the 2,800 figure captured only initial construction phase.
Claim 4: microGPT-style internal models are pragmatically buildable for enterprise use
Falsified if major enterprise CTO publishes cost analysis showing internal model development plus inference infrastructure costs exceed hyperscaler API costs by more than 3x for domain-specific workloads handling fewer than 10M requests per month - proving the economics don’t work at enterprise scale.
If all four claims hold, the thesis stands:
Europe is subsidizing infrastructure that delivers neither sovereignty (Microsoft admits Cloud Act applies) nor enterprise value (€67B for 2,800 jobs), while missing the pragmatic alternative microGPT made visible.
As usual, here’s my ask.
If you aren’t subscribed, subscribe. It takes two seconds. It costs nothing. It separates the signal from the noise.
If you have a voice, restack it. Let your network see the signal.
And if this resonated with you, if it gave you the language to name the problem, pledge your support.
It is the only way to support the weekly Signals and influence the next deep-dive Analysis.
Key sources
Karpathy microGPT (Feb 12, 2026)
Tunguz capital rotation data (Feb 13, 2026)
Christophe Vidal France data centers (French, Feb 2026)
Accenture sovereign AI report (Nov 2025)
Microsoft French Senate testimony (June 2025)
Gartner sovereign cloud forecast (Feb 2026)