Sovereign by Design, Vulnerable by Default

The talk opens with a 2026 Paris Senate inquiry in which a Microsoft executive could not guarantee that European customers' data would never be handed to the U.S. government. The speakers use that exchange to argue that data location and legal authority are separate things, and that policy rarely accounts for the gap. They frame their argument as a chain: sovereignty policy changes architecture, architecture changes the threat model, and most policymaking skips the middle step. They trace the idea back to the Peace of Westphalia, which tied authority to territory, and argue that internet infrastructure breaks that tie.

The middle section walks through the four domains of cloud, software, AI and hardware, and then through the tech stack layer by layer. At the data layer, residency rules and the U.S. CLOUD Act draw different borders. At the infrastructure layer, export controls and chip subsidies concentrate workloads and narrow the set of accepted suppliers. At the model layer, nationality and jurisdiction have to become account checks, IP filters or API credentials. The speakers cite a June 2026 Commerce order that forced a worldwide suspension of two frontier models, a procurement pause in Ireland over a large Microsoft contract, and an estimated 15 to 30 percent premium for sovereign cloud. An audience Q&A covered companies bound by conflicting legal regimes, satellite internet and shifting political trust.

The takeaway is that engineers should raise their technical objections before policy hardens into architecture. Sovereignty claims need security designed in from the start, because every control a policy requires becomes a boundary, and every boundary becomes a seam that an attacker can probe.