Governance, Regulation & Sovereign AI
Cross-cutting force · The rules the city runs under
- Why it matters
- Rules determine which architectures are permissible, which suppliers are usable in a given jurisdiction, and how much documentation sits between a model and production.
- The bottleneck
- Fragmentation. Different jurisdictions are converging slowly, and multinational deployments have to satisfy the strictest applicable rule.
- Who captures value?
- Providers who make compliance straightforward, including sovereign infrastructure operators and governance tooling, plus incumbents whose scale absorbs compliance cost more easily.
- What could change?
- Enforcement intensity is still being established. Meaningful penalties under existing frameworks would change buying behaviour faster than any new statute.
Rules shape what can be built, where data may sit, and what a deployed model must be able to explain about itself. They cut across every layer rather than sitting on top of one.
Regulation is often treated as an afterthought in technology writing, which is a mistake here. Data residency requirements decide which data centres a customer may use. Model governance obligations decide what documentation a lab must produce. Export controls decide who may buy the most advanced chips. These are not commentary on the ecosystem, they are inputs to it.
Tap or hover a box to see what it does
Regulation and model governance
The EU AI Act sets obligations by risk category, and frameworks such as the NIST AI Risk Management Framework provide voluntary structure. Privacy law, notably GDPR, applies to AI systems as it does to anything else processing personal data.
Sovereignty and national infrastructure
Several governments now treat domestic compute and models as strategic assets, funding national infrastructure and requiring that certain data and workloads remain inside their borders. That is a large part of why regional AI clouds exist.
Nebius Group
Operates AI focused cloud infrastructure in Europe. It emerged from the old Yandex international business after the Russian operations were sold in 2024, with the Dutch parent keeping the global assets.
European customers with data residency requirements need somewhere local to train and serve. Sovereign preference is a real commercial tailwind.
Sub-scale relative to the hyperscalers, capital hungry, and still proving durable demand.
Mistral AI
Develops efficient models, several released with open weights, aimed at European enterprises and sovereign deployments.
The clearest European answer to the question of who trains models for customers that would rather not send data across the Atlantic.
Competing on efficiency against far larger budgets, and a sovereignty tailwind that is partly political.
Private, French, with strategic investors including industrial and technology partners. Exposure is largely unavailable to public investors.
Oracle
Runs Oracle Cloud Infrastructure with a strong GPU cluster business, and sells the databases and applications that hold a great deal of enterprise data.
It sits in two layers at once. The database estate gives it a claim on enterprise data, and OCI has become a meaningful venue for large scale AI training capacity.
Building GPU capacity is capital hungry and the customer list is concentrated. Committed backlog is a promise, not yet revenue.
How to think about the economics
- GrowthModerate
How quickly demand in this part of the ecosystem is expanding.
- Capital intensityLow
How much money has to be spent up front before revenue arrives.
- Competitive moatModerate
How difficult it is for a credible new entrant to take the business.
- Customer concentrationLow
How much revenue depends on a small number of buyers.
- Disruption riskModerate
How exposed the layer is to a technical or commercial shift.
This is a framework for thinking about the economics of a layer, not a recommendation. An important AI company, a strategically advantaged company, an investable security and an attractively valued security are four different things.
Where value may accrue
Trust, jurisdictional presence and the ability to evidence compliance. Compliance cost also acts as a quiet barrier to entry, which tends to favour scale.
Key terms in this layer
- Sovereign AI
- Compute, models and data kept inside a jurisdiction because governments treat them as strategic assets. A large part of why regional AI clouds exist.
- ExampleNational AI infrastructure programmes in Europe and the Middle East.
- Related termsData centreFoundation model
Sources and further reading (3)+
- 1Regulation (EU) 2024/1689, the AI Act · European Union
- 2AI Risk Management Framework · NIST
- 3General Data Protection Regulation · European Union
The AI ecosystem changes rapidly. Company positions, technologies and market data reflect information available at the date above.