Compute Sovereignty Is Not About Where The Building Is

Google will spend at least €13 billion on data centres in Finland. Every machine will stand on EU soil, cooled by Nordic air, running on Finnish nuclear power. None of that tells you who can reach the workloads inside, which is the only question compute sovereignty has ever asked.

Google calls it its largest single investment in Europe. It covers 2027 and 2028, across Hamina, Kajaani, Muhos and Vaala. It also carries something Google has never signed outside the United States. That is a 22-year agreement with Fortum to buy up to half the output of the Loviisa nuclear plant, which supplies around a tenth of Finland’s electricity.

For anyone told that European data centres settle the compute sovereignty question, this is the week to read what was actually signed.

What Google committed, and for how long

The capital number is the headline. The duration is the story.

The power purchase agreement runs for 22 years. Fortum says it supplies the economic certainty for a life-extension programme that carries Loviisa through its operating licence to 2050. Google adds onshore wind contracts and a 94 megawatt battery system to smooth the cold, still periods when Nordic wind drops away.

Set that against the regulatory furniture around it. The AI Act is two years old. It was amended by the Digital Omnibus this July. A Cloud and AI Development Act is still only a proposal. This energy contract will outlive several complete cycles of the rules meant to govern the thing it powers, and the plant it keeps alive will still be running in 2050.

The part that is genuinely good

There is no honest way to write this as a warning. More compute inside the Union is a real gain for compute sovereignty, and the constraint on European AI has never been law. It has been capacity.

Google puts the construction phase at more than 37,000 jobs and an annual boost of €3.6 billion to Finnish GDP. Those are the company’s own figures. Read them as such. The nuclear commitment is harder to wave away, because a plant that keeps running to 2050 changes what the Finnish grid can carry regardless of who signed the contract.

Why location was never the compute sovereignty test

Here is the trap, and it is the oldest one in this field. A data centre in Finland owned and operated by a US company answers to US law in the ways that matter, and to EU law in the ways that also matter. Both are true at once. Presence does not displace jurisdiction.

That is why the Commission stopped treating location as the answer. The Cloud and AI Development Act, proposed on 3 June, builds a four-level assurance framework, and EU location is level one. The floor, not the finish. Level two adds demonstrated independence from third countries and a transparent software supply chain. At level three the provider must be owned and controlled from the EU, with criteria reaching as far as personnel. Level four demands full control of the software supply chain with no third-country interference. The sovereignty rules now point in both directions rather than resolving on a border.

What actually moves compute sovereignty

Compute sovereignty is a property of contracts and control rather than postcodes. Four things change your position, and none is the address:

• Who holds operational control, meaning who can log in, patch, restart and read.
• Which legal orders the operator must answer, including ones with non-disclosure attached.
• Whether the workload is portable, so you can leave with your weights, your data and your pipeline intact.
• Where the hardware and its firmware come from, and who can service it.

A Finnish postcode improves latency and it improves the carbon numbers. It moves exactly one of the four.

The concentration question nobody is asking yet

The sharper issue is not this deal. It is the shape that emerges when you add the deals together.

Google in Finland. Microsoft and ByteDance also hunting Nordic sites, according to the Reuters coverage of the same announcement. Nvidia this week naming eight Australian operators for a buildout of up to two gigawatts by 2027. Each announcement reads as diversification. Stacked up, they describe a small number of companies deciding where the world’s compute lives and on what terms.

The energy layer is the new lock-in

Vendor lock-in used to be about data formats and egress fees. Then it became about model weights. This deal points at a third layer.

When a hyperscaler contracts half a plant’s output for 22 years, that energy stops being neutral infrastructure any buyer can bid for. It has an owner with a two-decade claim. A European competitor wanting comparable baseload now bids against a signed contract rather than an open market. That is a compute sovereignty problem expressed in megawatts.

That is not an accusation of wrongdoing. Fortum needed the certainty, and it says the investment programme depends on it. It is simply a form of dependency that procurement questions do not yet reach, because until recently there was no reason to write them.

What to do with this on Monday morning

Nothing here demands a change of supplier. It demands a change of question, because compute sovereignty is decided in the vendor review rather than in the announcement.

Stop accepting the location answer

When a vendor tells you the data stays in the EU, that is the beginning of the compute sovereignty conversation rather than the end of it. Follow it with the operational one. Who administers the environment, from which country and under whose employment. Then ask what happens if they receive a lawful order they cannot tell you about.

Price the exit before you need it

Portability is the only one of the four properties you can secure entirely through your own contract. Ask what leaving looks like in concrete terms. How long, at what cost and in what format your artefacts arrive. A vendor who cannot answer that in a sentence has told you the answer.

Read the energy line in your vendor’s disclosures

This one is new, and it belongs in the annual vendor review. Long-term power agreements now sit in hyperscaler sustainability reporting and press releases. They tell you where a supplier has committed capacity for decades. That predicts where your workloads physically end up better than any regional availability statement.

The Finnish announcement is good news for European compute capacity and it changes very little about compute sovereignty itself. Holding both of those at once is the whole skill. The organisations that get compute sovereignty wrong will be the ones that read a press release about EU data centres and quietly closed a risk item that was never about geography.

Future Prep tracks how these questions land in procurement rather than in policy papers. If your vendor review still resolves on where the data sits, your compute sovereignty test is asking a question the Commission stopped asking two years ago.