The debate around Europe’s AI sovereignty just became a lot less theoretical.
On June 3, the European Commission published its proposal for the “Cloud and AI Development Act,” aimed at strengthening the European cloud and AI ecosystem and reducing the risk of critical digital systems becoming entirely dependent on non-European providers.
Then, last week, Anthropic announced that it had received a directive from the US government to suspend access to Fable 5 and Mythos 5 for foreign nationals — both inside and outside the United States. To comply with the directive, Anthropic would need to disable both models for all customers.
The full picture is still unclear. What triggered the decision, how long it will last, and how it will be resolved are all open questions.
But the lesson for Europe is already plain:
When access to critical AI can be switched off from outside Europe, sovereignty becomes a business issue.
Four questions every European company must ask
For European companies, the question is not whether American AI tools are good. Many are excellent. They will remain part of the stack.
The practical meaning of AI sovereignty comes down to four questions:
- Can your infrastructure be influenced by other countries or external interests?
- Do you have response time and alternatives if access rights change or restrictions arrive?
- Can you justify the business risk of an unplanned outage?
- And the fourth question most overlook: Are your data secure enough when legal systems come into conflict?
Server location is not the same as legal jurisdiction
Having a server located in Germany does not protect you if the operator is a US corporation. US companies are subject to the CLOUD Act. That means US authorities can, under certain conditions, access data stored on European servers if the operator is American.
The Anthropic incident shows how quickly a decision made in Washington can have a direct impact on your operations. Server location and legal jurisdiction are not the same thing.
What this means in practice
Anyone who can answer those four questions for their critical AI workloads knows where they stand. Anyone who cannot has an open risk.
That is the practical meaning of AI sovereignty.
And it is time for European companies to start reducing critical dependencies in the AI space where outside control could become a business risk.