For about thirty years, globalization looked like the obviously sensible idea. Make each thing where it’s made best, ship it wherever it’s needed, and let trade tie countries together so closely that falling out becomes too expensive. Slovakia, where I live, joined the EU in 2004 and the euro in 2009, right in the middle of that era, and built much of its economy on car factories that run on parts from everywhere.
It worked well enough that the dependencies stopped feeling like dependencies.
Then they started showing up, one at a time. Before Russia’s full-scale invasion of Ukraine, about 45% of the EU’s gas imports came from Russia. The Commission’s own factsheet on critical raw materials notes that “100% of the rare earths used for permanent magnets globally are refined in China”, and in October 2025 Beijing tightened its export controls on them. The same month, a fight over Nexperia, a Dutch chipmaker owned by a Chinese group, ended with China blocking exports from Nexperia’s Chinese plants and European car production at risk over some of the most basic chips in a car.
The law has its own version. In June 2025, Microsoft France’s director of public and legal affairs was asked at a French Senate inquiry whether he could guarantee that French citizens’ data would never be handed to US authorities without France’s authorization. His answer, as reported: “No, I cannot guarantee it.” Amazon, Microsoft and Google hold about 70% of Europe’s cloud market. European providers hold about 15%.
AI already had its moment too. In January 2025, the outgoing US administration published a rule on exporting advanced AI chips. Ten EU member states made its list of trusted destinations. The other seventeen, Slovakia among them, would have needed licenses, with limits on how much computing power they could buy. The rule was withdrawn on May 13, 2025, two days before it would have applied. For four months, the question of how many AI chips a Slovak company could buy had an answer in Washington.
AI raises the stakes for a simple reason. Gas gets burned and a chip gets installed. An AI model you use through someone else’s cloud is never really delivered. It keeps running on someone else’s hardware, under someone else’s law, and it can be updated, repriced or switched off without you. As more of what banks, hospitals and public administrations do runs through these models, the question of who can switch them off stops being theoretical.
So is sovereign AI a utopia?
If it means owning everything from the mine to the model, yes. If it means something smaller, it may be the most practical idea in European AI policy. And if you build smaller or specialized models in Europe, or write the strategy that decides what gets funded, the EU AI Act has something specific to say about the smaller version.
What Sovereign AI Means
There's no legal definition. The AI Act doesn't use the term, and neither does any other EU law I know of. It's a political label, and it gets attached to very different plans, from building a national frontier model to running an open one on servers at home.
The Tony Blair Institute, in a January report on sovereignty in AI, is blunt about the starting point:
"Full self-sufficiency is too expensive, too slow and, for most countries, simply impossible."
Its version of the goal is more modest. Sovereignty, the report says, is "not a binary condition to be achieved or lost. It is fundamentally a question of agency and choice." It also recommends fine-tuning open-weight models for national languages and sectors, as a way to build capability without entering the race for frontier models.
I believe that sovereignty isn’t owning the whole stack. It’s being able to walk away from any one piece of it.
Under that definition, small and open models aren’t the consolation prize. A model small enough to run on hardware you already have needs fewer of the chips someone else can ration. If you can also adapt it to your own language and replace it when something better comes along, it's about as sovereign as AI gets.
Europe Is Betting on Scale
The money says Europe reads the word differently.
When the Commission launched InvestAI in February 2025, it announced a €20 billion fund for AI gigafactories, each with “around 100 000 last-generation AI chips” and built to train “the most complex, very large, AI models.” The call for tenders to build them closes in December. Europe doesn’t manufacture the advanced AI chips these sites run on, so the first step toward sovereignty at this scale is a very large order from abroad.
To put the gigafactories in AI Act terms: the AI Act presumes a general-purpose model belongs in its top tier, the one for systemic risk, once its training used more than 10²⁵ floating-point operations (FLOP), a measure of total computation. By a rough estimate, a cluster of 100,000 top-end chips running at 40% of peak could get there in about three days. It still shows what the infrastructure is for: the models the AI Act watches most closely.
Europe’s best-known model developer is moving the same way. Mistral raised €3 billion in September, in part to build its own computing capacity.
The smaller path gets smaller checks. OpenEuroLLM, a consortium led by Charles University in Prague that is building open models for all official EU languages, has €20.65 million in EU funding. Switzerland, outside the EU, went smaller and more open: in September 2025, EPFL, ETH Zurich and the Swiss national supercomputing center released Apertus, fully open models trained on more than 1,000 languages and developed, in EPFL’s words, with “due consideration” to “the transparency obligations under the EU AI Act.”
The scale bet may well be the right one for Europe as a whole.
How the AI Act Sorts the Two Paths
The AI Act regulates AI systems by what they’re used for. On top of that, it adds a separate regime for general-purpose models, where the top tier is presumed by training compute.
The first layer covers every AI system, whatever model sits underneath:
Prohibited practices in Article 5, which have applied since February 2, 2025.
High-risk uses, such as credit scoring and life and health insurance pricing in Annex III, from December 2, 2027. AI built into regulated products like medical devices follows from August 2, 2028.
Transparency duties in Article 50, which have applied since August 2, 2026.
The second layer covers general-purpose AI models. Under Article 3(63), that’s a model that
“displays significant generality and is capable of competently performing a wide range of distinct tasks.”
The Commission’s guidelines add an indicative test: training compute above 10²³ FLOP, plus the ability to generate language, as text or audio, or images or video from text. They also list large models that aren’t general-purpose: some because they do only one kind of thing, such as speech transcription or image upscaling, and some because they don’t generate language, images or video at all, such as models that play chess or video games or that are “modelling weather patterns or physical systems.”
A model that plays chess brilliantly is not a general-purpose AI model. The Commission has put that in writing.
General-purpose models have the duties listed in Article 53: technical documentation, information for the companies building on them, a copyright policy and a public summary of the training content. Those with systemic risk have more under Article 55: evaluations, risk mitigation, incident reporting and cybersecurity.
Those duties sit with the company that provides the model. If a European bank or ministry runs on a foreign general-purpose model, the duties sit with the foreign provider, and so does the control. Build or adapt your own, and some of them come home with it. The question for anyone weighing the sovereign option is how many of the duties land on you.
For the smaller path, not many. A narrow model built for one job isn’t a general-purpose model, so Article 53 doesn’t apply to it at all. Take an open model and fine-tune it on your own data, and under the Commission’s guidelines you only become its provider if the modification uses more than a third of the original’s training compute, which, by the Commission’s own account, few modifications currently do. And the rules on how you use AI don’t care where the model came from. A credit scoring system is high-risk whether it runs on a home-grown model or an American one. Choosing the sovereign option doesn’t add regulatory cost. In the same use, it usually removes some.
Releasing your own model openly, the way OpenEuroLLM and Apertus do, comes with an exemption too. Open general-purpose models that aren’t monetized are spared the documentation duties in Article 53, though they still need the copyright policy and the training summary. Above the top-tier threshold, the exemption disappears. The AI Act makes openness cheaper right up to the point where a model joins the top tier.
Where the Top Tier Starts
So where is that point, and does the smaller path ever reach it?
Article 51 puts a general-purpose model in the top tier if it has “high impact capabilities”, and presumes those capabilities above 10²⁵ FLOP, the line the gigafactories are built to cross in days. Article 3(64) defines high-impact capabilities as “capabilities that match or exceed the capabilities recorded in the most advanced general-purpose AI models.”
The definition is relative: a capability counts as high-impact only while it sits near the top, so the bar moves with the frontier. And capabilities don’t stay at the top for long. As of August 2025, Epoch AI found that open models small enough to run on a single consumer graphics card matched frontier performance after an average lag of six to twelve months.
Part of how that happens is distillation, training a small model on a large one’s outputs. The Commission’s guidelines count the computation used to generate that training data, unless the data is publicly available, but they exclude “compute used to train parent model(s) used in distillation.” A small model can inherit a large model’s abilities without inheriting its compute count. (When a provider distills its own model, the guidelines may treat the result as part of the same model’s lifecycle, so the clean case is distilling from someone else’s.)
For a European team on the smaller path, that’s mostly good news. A small model that catches up with last year’s frontier stays out of the top tier by definition, and even one that matches today’s frontier isn’t presumed into it, because the presumption counts compute. For now, the guidelines also make compute the only trigger for a provider’s own duty to tell the Commission. The AI Act isn’t blind to this. Under Article 51(1)(b), the Commission can designate a model with “capabilities or an impact equivalent” to the top tier, using the criteria in Annex XIII, and those include reach: high impact on the EU market is presumed once a model is available to 10,000 registered business users in the EU. As far as I can find, the Commission hasn’t publicly designated any model that way yet.
For anyone worried about what widely available, capable models can do, the same default is a gap. Researchers disagree about how long compute thresholds can keep up: Sara Hooker argued in 2024 that, “as currently implemented”, they’re “shortsighted and likely to fail to mitigate risk”, while a 2026 analysis from MIRI’s technical governance fellowship concluded they “remain a viable governance instrument.”
What the AI Act Doesn’t Reward
That debate is mostly about where to draw the line. A different question is what the line should measure, and the smaller path has the most at stake in the answer.
One influential view in AI safety locates the risk in a combination: how capable a system is, how general, and how much it can do on its own. A capable model doing one bounded job under a human’s control is a different thing from one that can take on any task and act without asking.
Annex XIII, the list the Commission uses to designate models, already names those properties: how many tasks a model can take on without retraining, how well it adapts to new ones, how autonomous it is and which tools it can use.
But the list works mainly in one direction. The Commission uses it to put a model into the top tier, or to reconsider that decision later.
A provider above the compute line can argue that its model doesn’t actually present systemic risk, but the bar is high. The Commission’s guidelines accept two kinds of argument: the model isn’t as capable as its compute suggests, or it’s that capable and still not risky. For the second, safeguards the provider has built or plans to build don’t count, and “we designed it to be controllable” is mostly a safeguard. The top-tier obligations apply in the meantime.
What doesn’t exist is a lighter regime, set out in advance, for models designed to be controllable.
The tool for fixing this is already in the text. Article 51(3) tells the Commission to update the compute threshold and add new benchmarks and indicators “when necessary”, so the law keeps up with the technology, and it names better algorithms as one of the developments to watch. Better algorithms are the smaller path.
The Commission’s own guidelines admit that training compute is an imperfect stand-in for what a model can do, and say it will keep looking for other measures, especially ones smaller companies can apply easily.
In my view, that moment has come. The Commission should start measuring what a model can do, not only how much computing power went into training it. Annex XIII already lists what to measure: how many tasks a model can handle, how much it can do on its own and which tools it can use. Measured that way, a small model as capable as the frontier wouldn't slip under the line, and a model built to stay within limits would finally get credit for it.
It won't be easy to write, because autonomy depends partly on how a model is deployed. It would still be closer to the real risk than counting operations. And for a Europe that won't win on scale, it would mean a law that rewards the kind of AI it can realistically build.
What to Do With This
If you build or fine-tune smaller models, or decide whether to fund them:
Check whether your model is general-purpose at all. The 10²³ FLOP test is indicative. A model that does one kind of task can fall outside the definition even above that line, and a small model that’s genuinely general can, exceptionally, fall inside it below the line. The guidelines’ examples are the best place to start.
Keep your compute records. Count the computation used to generate synthetic training data, including data you threw away, unless that data is publicly available. Distillation from someone else’s model doesn’t add the parent’s training compute to yours. If you’re anywhere near 10²⁵, the guidelines expect you to estimate the total before the large training run starts, within a 30% margin, and to document how you estimated it.
If you modify someone else’s general-purpose model, the Commission’s guidelines use an indicative line: you become the provider of the modified model when the modification uses more than a third of the original’s training compute. Your documentation, copyright and training-summary duties then cover only the modification. If the original was in the top tier, though, your modified model is presumed to be in it too, with the full top-tier obligations. Below the line, you can still be the provider of the AI system you build with it.
If you release openly, check the license and monetization conditions before you rely on the exemption, and plan for the copyright policy and training summary anyway.
If your system lands on the Annex III list, the choice of model won’t change the high-risk rules. Check the Article 6(3) exceptions, including the narrow procedural task, unless the system profiles people. If you rely on one, document why before you place the system on the market or put it into service, and register it. Those rules apply from December 2, 2027 too.
If you write sovereignty strategy, look at what each investment lets you walk away from, and know which path the AI Act watches. The open, specialized models carry lighter obligations at the model level and keep more choice at home.
So is sovereign AI a utopia?
I would say only if it means building everything Europe now imports.
The smaller version, a model Europe can run, adapt and walk away from, is already being built in Prague and Lausanne, and the AI Act already makes it cheap.
What the AI Act doesn't do yet is treat it as the safer choice.
Like this article? The AI Governance Roadmap is something you can use in practice. It’s a company’s roadmap with steps and working documents. It includes the classification, the inventory spreadsheet, the role assignment, the vendor questions, the AI policy template. Everything a company needs to govern AI, at one place.