A supplier acquisition can quietly move national identity infrastructure under foreign jurisdiction. The DigiD sovereignty risk is a live example of how this happens, why EU law already rules it out and what every EU organisation running critical systems should check before the same logic applies to them.
The EU sovereign cloud label has no agreed legal definition. Before trusting a vendor’s sovereignty claim, practitioners should demand written answers to three questions about ownership, jurisdiction and certification.
The Anthropic–Pentagon clash and the OpenAI deal that followed show how quickly access to a key AI platform can be reclassified by U.S. policy. EU organisations need a sovereignty-aware AI strategy before the next disruption forces the question.
