Geopolitics, Sovereignty, Export Controls & Data Residency

For most of the data-center era, geopolitics was a risk line in an appendix — a sentence about political stability, a nod to the tax regime, a hedge on currency. For an AI factory in 2026 it is a gate at the front of the funnel, sitting alongside power and water as a pass/fail criterion. The two scarcest inputs to an AI build — advanced accelerators and the legal right to run a workload free of foreign compulsion — are both now controlled by states, not markets. You can have the cheapest stranded gigawatt on earth and the coldest free-cooling climate in the hemisphere, and still be unable to deploy a single GB300 if your jurisdiction is on the wrong side of a US export line. You can build a flawless hall on home soil and still hand a foreign government a lawful path to the model weights running inside it, because the firm that operates it answers to that government's subpoena. Neither is an edge case; together they organize where the 2026 buildout is and is not allowed to happen.

Three forks drive the gate, and each is a first-class siting input. Export controls and country tiering: which silicon a jurisdiction can buy, under what conditions, and how quickly the rules whipsaw — because the chip you design the hall around may be re-controlled, decontrolled, taxed, or re-tiered between the day you break ground and the day you energize. Sovereignty, where the critical distinction is between data residency (a geography requirement, cheap and common) and technical sovereignty (a jurisdiction-exposure ceiling, expensive and rare), and where the CLOUD Act vs GDPR collision turns the operator-of-record into a sovereignty variable. And supply-chain and energy geopolitics: how dependence on a single bilateral relationship for chips, design, support, and even firmware updates becomes a concentrated risk that allied-vs-non-allied siting either amplifies or hedges.

The demand side has changed shape. A material and growing fraction of the 2026 buildout is not hyperscaler capacity chasing global users — it is sovereign AI: nation-states and national champions building compute they can call their own, for reasons of strategic autonomy, industrial policy, and (increasingly) the fear of being cut off. The Gulf has put this in concrete: the UAE's G42 and Saudi Arabia's HUMAIN anchor multi-gigawatt programs, with Stargate UAE targeting a 1 GW cluster (G42 with OpenAI, Oracle, Nvidia, Cisco, SoftBank). Europe's sovereign-cloud push, India's national-compute ambitions, and a dozen national-champion projects elsewhere share the same logic. The siting consequence is that the buyer's sovereignty objective is now part of the design basis — it dictates not just where the slab goes but who is allowed to operate it, whose chips fill it, and what legal walls must surround the data plane.

The decision this forces on a developer is a positioning one. A site can be built to serve sovereign demand — which means accepting residency mandates, local-operator structures, and reporting compacts as design constraints — or it can be built for the open hyperscale/neocloud market, where those constraints are friction to be minimized. The two are not freely interchangeable: a hall engineered for a sovereign tenant's compliance posture (air-gapped management plane, in-country staff, audited supply chain) carries cost that the open market will not pay for, and an open-market hall cannot win sovereign workloads without a retrofit of governance it was never scoped for. Like the workload archetype in Chapter 1.1, the choice cascades through the design and cannot be bolted on later.

The first geopolitical variable for an AI build is whether your jurisdiction can lawfully receive the highest-end US-origin accelerators — and that question has been a moving target. The Biden administration's Framework for Artificial Intelligence Diffusion (published 15 January 2025) proposed a global three-tier regime: a small unrestricted bloc of close allies (Tier 1), a large middle group subject to per-country compute caps and licensing (Tier 2), and a denied group including China and arms-embargoed states (Tier 3). It would also have controlled the export of the most advanced model weights, not just the chips — the first time a US rule reached for the artifact rather than the silicon. Industry and allies revolted over the complexity and the collateral damage to friendly nations stuck in Tier 2, and the Trump administration rescinded the Diffusion Rule in May 2025, days before it took effect (US BIS rescission notice, 2025).

What replaced it is not deregulation — it is a more bilateral, more discretionary, and arguably less predictable regime. The H20 saga is the canonical illustration of the whipsaw: Nvidia's China-market H20 was effectively license-gated in April 2025 (Nvidia took a $4.5B H20 inventory charge), then licenses were reopened in mid-2025 under an unprecedented 15%-of-China-revenue remittance to the US government (the same arrangement applied to AMD's MI308), and effective 15 January 2026 BIS moved certain advanced-compute exports to China/Macau from presumption-of-denial to case-by-case review for named items (H200/MI325X-class and lesser equivalents). For the Gulf, access is now bought through a security compact: in November 2025 BIS authorized up to 70,000 advanced Nvidia chips split between G42 and HUMAIN, conditioned on a new Regulated Technology Environment (RTE) framework of rigorous security and reporting requirements. The pattern is tiering by treaty and compliance, rather than by static list.

The most expensive sovereignty mistake is conflating two very different requirements. Data residency is a geography rule: the bytes must physically sit inside a named border. It is often simpler than technical-sovereignty controls, but still requires verified storage, replication, backup, support, telemetry and data-flow boundaries — and it is what most procurement language actually asks for. Technical sovereignty is a jurisdiction-exposure rule: the operating and key-custody design can prevent an order to the provider from yielding workload plaintext, but it does not prevent lawful compulsion against the customer, metadata holders, or the key-management control plane. Residency does not deliver sovereignty, and the gap between them is where buyers overpay or under-protect. A dataset can be resident in Frankfurt, encrypted, and audited — and still be lawfully reachable by a foreign state if the firm operating the facility answers to that state's courts.

The mechanism that collapses residency into a false comfort is the US CLOUD Act (2018), which can compel a provider subject to US jurisdiction to produce data in its possession, custody or control, including data stored abroad, subject to statutory process and potential conflict-of-law mechanisms. Frankfurt, Dublin, Stockholm — provider nationality, corporate control, possession/custody/control, key custody, service design and the particular legal process all affect exposure. This collides head-on with the EU's data-protection regime, and the collision stopped being theoretical in June 2025 when Microsoft's French legal director acknowledged before the French Senate, under oath, that the company could not guarantee it would refuse a lawful CLOUD Act request for EU-resident data — that the provider would evaluate a lawful request under the applicable legal framework; contractual promises alone do not displace governing law. The EU response has been structural: the EU Data Act (applying from September 2025) requires cloud providers to implement measures preventing unlawful non-EU government access to EU-stored non-personal data and to challenge conflicting requests; and a wave of sovereign-cloud builds (AWS European Sovereign Cloud in Brandenburg, a multi-billion-euro EU-resident-operated partition; the EuroStack initiative; Gaia-X's successors) is trying to engineer the immunity that residency alone cannot provide.

The downstream consequence for a developer is a design-basis fork. If the target tenant needs rung 1 (residency), the build is conventional — in-region siting and a labelled data plane. If it needs rung 3 (technical sovereignty), the facility must be re-architected: a local operating entity that is not a subsidiary reachable by a foreign parent, customer-held or customer-controlled HSM-gated encryption keys that remove the provider's plaintext path without shielding the customer, metadata holders, or key-management control plane from lawful process, an air-gapped or in-country management plane with no offshore administrative access, and an audited supply chain for the hardware root of trust. Each carries cost and constraint that residency alone does not imply. Selling rung 1 to a tenant who needed rung 3 is a breach waiting to be discovered; building rung 3 for a tenant who only needed rung 1 is margin left on the table. The model- and key-protection engineering that underpins rung 3 is treated in Chapter 11.8, and the compliance/certification scaffolding in Chapter 11.11.

The third fork is dependence. An AI factory is a concentrated bet on a long, fragile, and politically exposed supply chain — and a single bilateral relationship can sit astride several links of it at once. The accelerators are overwhelmingly US-designed and Taiwan-fabricated; the most advanced packaging and HBM are similarly concentrated; the firmware, the CUDA-class software stack, and even ongoing security updates flow from vendors subject to one government's export jurisdiction. That means a hostile policy turn does not just stop the next chip shipment — it can, in principle, reach installed capacity through support and update channels. The Gulf compacts make this explicit: the chips come with reporting and audit conditions precisely because the exporter retains leverage after the sale.

Energy geopolitics layers a second dependence on top. The 2026 buildout's appetite for firm power has pulled it toward jurisdictions with cheap or stranded energy — but cheap energy and benign politics do not always coincide. Gulf gigawatts are abundant and competitively priced, and they come bundled with the export-compact conditions above. Nordic and Iberian sites offer firm renewables and free cooling inside the allied bloc but at a power-price and capacity premium. The decision a developer faces is whether to optimize for the cheapest reliable megawatt (which may carry a sovereignty or export string) or to pay the allied-bloc premium for a build that no single foreign policy switch can throttle. This is the same speed-to-power and power-cost calculus engineered in Chapter 3.2 and Chapter 3.3 — but with a geopolitical risk premium added to the discount rate.

The 2026 H200 episode added a sixth regime shift with a new lesson: the buyer's government can be the binding regulator. Washington moved named advanced-compute exports to case-by-case in January 2026 and by May had licensed H200 sales to roughly ten Chinese firms (capped ~75,000 units per customer) — and then nothing shipped: Beijing steered buyers toward the domestic stack, and only in August did limited imports move (~10,000 units each to ByteDance and Tencent) under Chinese-side caps and training-on-public-data-only conditions, with inference directed to domestic silicon. An export license is necessary, not sufficient; both capitals now hold a veto.

Two enforcement-side realities sharpen the fork. First, transshipment and diversion controls: as the case-by-case regime widens, the US has leaned harder on tracking where chips physically end up, which turns a partner jurisdiction's reporting compliance (the RTE-style audit trail) into a precondition for continued access — a governance burden the host facility must carry. Second, the installed-base leverage point above means that even a fully energized, fully populated sovereign cluster is not wholly insulated: support contracts, firmware signing, and software entitlements remain levers. A developer building for a sovereign tenant must therefore treat post-deployment dependence — not just the import license — as part of the threat model, which is where this chapter hands off to the supply-chain and hardware-provenance engineering in Chapter 11.3.

As everywhere in siting, sort the geopolitical decisions by the cost of changing your mind. Irreversible (decide once, at scoping): the jurisdiction of the slab and therefore the export bloc your interconnection sits in — you cannot move a 1 GW campus from a case-by-case jurisdiction into the core bloc, and you cannot un-pour a hall built to a compliance posture the market won't pay for. Reversible (re-decide as policy moves): the operator-of-record (changeable only with a substantive transfer of control, personnel, systems, contracts, keys and data; paperwork alone may not change jurisdictional reach), the data-plane placement within a portfolio of sites, the specific accelerator generation within a power/cooling envelope, and the second-source chip qualification you keep warm against re-control. Where the option premium is cheap, convert irreversible exposures into reversible ones — qualify a fallback chip, structure the operating entity for sovereignty optionality, keep a portfolio that spans more than one bloc — and over-build only the substrate (the jurisdiction and bloc choice) that you genuinely cannot retrofit. The market-cluster scoring that weighs these geopolitical gates against power, cost, and latency is assembled in Chapter 3.13.