Residency is not sovereignty

For most organisations, the data question feels settled. You pick a provider, choose a region close to home, and the contract confirms your data sits on local soil. Servers in London, governed by UK law. Box ticked. Conversation over.

It shouldn't be.

In June 2026, the European Commission unveiled a sweeping Tech Sovereignty Package, the same week the European Parliament dropped Google as its default search engine for a French one. Behind the symbolism sits real money and proposed law: a target of €120 billion of chip investment, €2 billion for open source software, and a Cloud and AI Development Act that would require sensitive public sector data to be hosted on services controlled by EU entities. It is still a proposal, and final adoption could take 18 to 24 months. Which raises a fair question: If so much European data already lives on European soil, why spend that much to move it? Because location was never the protection people assumed it was.

Where data sits and who can reach it are different questions

A data centre in London tells you the postcode of the building. It says nothing about whose law can open the door. The US CLOUD Act lets American authorities compel any US-headquartered provider to hand over data, wherever in the world it sits. The server can be in Slough, the cables under British soil, and the legal reach still runs to Washington. Ownership decides jurisdiction, not geography. A London address on an American company is still an American company. And this is not a fringe case. A Computer Weekly analysis found that 95 percent of UK central and local public sector bodies spent money on hyperscale cloud in 2023/24, rising to 99 percent once software running on those platforms is counted, and the hyperscalers are largely Microsoft, Amazon and Google. That makes much of British institutional computing foreign-reachable by default. None of this is an argument against American technology. It is one of the best in the world for a reason. The point is narrower: residency and sovereignty are not the same thing, and most contracts only ever promised the first.

What real sovereignty asks of you

Sovereignty is not a switch you flip. It is engineered before you sign, and two choices carry most of the weight. First, an operating entity outside US legal reach, one that cannot be compelled the way an American company can. Second, encryption keys held by you, or by someone who cannot be forced to hand them over. Get both right and the foreign order still arrives, but complying with it returns nothing anyone can read. This does not mean guarding every file the same way. A marketing page does not need what a case file needs, and treating them alike just burns budget. The work is knowing which data carries real risk, then choosing the providers and locations that protect it. That is not a detail to settle last. Made early, it is the sovereignty decision itself.

Where this connects to how we think at Metadat-AI

The organisations we work with are not all hauling government systems out of foreign clouds, but the tension is familiar: concerns that valuable IP could be demanded at any moment by a US company. Capability is easy to buy, but full control when working with US companies is no longer easy. Ideally, this is something to decide upfront, but for many organisations, a migration task may already be coming.

This matters twice over for AI, where the question is no longer just where your data rests, but where it is processed. Storage was always an obvious question of jurisdiction, confidentiality and protection. The location and provider processing that data with AI for tagging is now something to consider too. Residency tells you where your data sleeps. True sovereignty also asks who holds the key. By the time someone comes asking, that question is already answered, one way or another, so it is better to review your providers and make that decision sooner rather than later.

Sources

European Commission Tech Sovereignty Package, proposed 3 June 2026 (summary: Jones Day).
European Parliament switches default search engine to Qwant, 4 June 2026 (MediaNama).
UK public sector hyperscale dependence (The Next Web, citing Computer Weekly).