Geopolitics, Sovereignty, Export Controls & Data Residency

For most of the data-center era, geopolitics was a risk line in an appendix: a sentence on political stability, a nod to the tax regime, a hedge on currency. For an AI factory in 2026 it is a gate at the front of the funnel, a pass/fail criterion alongside power and water. The two scarcest inputs to an AI build, advanced accelerators and the legal right to run a workload free of foreign compulsion, are now controlled by states, not markets.

You can have the cheapest stranded gigawatt on earth and the coldest free-cooling climate in the hemisphere, and still be unable to deploy a single GB300 if your jurisdiction sits on the wrong side of a US export line. You can build a flawless hall on home soil and still hand a foreign government a lawful path to the model weights inside it, because the firm that operates it answers to that government's subpoena. Neither is an edge case. Together they decide where the 2026 buildout can and cannot happen.

Three forks drive the gate, and each is a siting input. Export controls and country tiering decide which silicon a jurisdiction can buy, on what conditions, and how fast the rules whipsaw: the chip you design the hall around may be re-controlled, decontrolled, taxed or re-tiered between groundbreaking and energization. Sovereignty separates data residency (a geography requirement, cheap and common) from technical sovereignty (a ceiling on jurisdiction exposure, expensive and rare), and the CLOUD Act vs GDPR collision makes the operator of record a sovereignty variable. Supply-chain and energy geopolitics ask how much of the build rests on one bilateral relationship for chips, design, support and firmware updates, a concentration that allied-vs-non-allied siting either amplifies or hedges.

The demand side has changed shape. A material and growing share of the 2026 buildout is not hyperscaler capacity chasing global users but sovereign AI: nation-states and national champions building compute they can call their own, for strategic autonomy, industrial policy and, increasingly, fear of being cut off. The Gulf has made this concrete. The UAE's G42 and Saudi Arabia's HUMAIN anchor multi-gigawatt programs, with Stargate UAE targeting a 1 GW cluster (G42 with OpenAI, Oracle, Nvidia, Cisco, SoftBank). Europe's sovereign-cloud push, India's national-compute ambitions and a dozen national-champion projects elsewhere follow the same logic. The buyer's sovereignty objective therefore becomes part of the design basis: it dictates where the slab goes, who may operate it, whose chips fill it, and what legal walls surround the data plane.

That forces a positioning decision on the developer. Build to serve sovereign demand, and residency mandates, local-operator structures and reporting compacts become design constraints. Build for the open hyperscale or neocloud market, and those same constraints are friction to minimize. The two are not interchangeable. A hall engineered for a sovereign tenant (air-gapped management plane, in-country staff, audited supply chain) carries cost the open market will not pay for, and an open-market hall cannot win sovereign workloads without a governance retrofit it was never scoped for. Like the workload archetype in Chapter 1.1, the choice cascades through the design and cannot be bolted on later.

Europe now buys sovereign capacity directly. EuroHPC's AI Gigafactories call (published 30 July 2026, bids due 12 November 2026) will pick up to seven AI Gigafactories, spread across at least seven member states. EuroHPC and the participating states will jointly buy compute access time from the winners as anchor customers rather than pay grants. Winners are expected in early 2027 and operations roughly 18 months later, so a bidder has to settle its power path before bidding.

The first geopolitical variable is whether your jurisdiction can lawfully receive the highest-end US-origin accelerators, and that question has been a moving target. The Biden administration's Framework for Artificial Intelligence Diffusion (published 15 January 2025) proposed a global three-tier regime: a small unrestricted bloc of close allies (Tier 1), a large middle group under per-country compute caps and licensing (Tier 2), and a denied group including China and arms-embargoed states (Tier 3). It would also have controlled exports of the most advanced model weights, the first time a US rule reached for the artifact rather than the silicon. Industry and allies objected to the complexity and to the collateral damage for friendly nations stuck in Tier 2. On 13 May 2025, two days before compliance was due, the Trump administration announced it would not enforce the Diffusion Rule and would replace it (US BIS). The rule is still in the CFR, and as of October 2026 nobody had published a rescission or a replacement. On 12 May 2026 GAO decided that the non-enforcement policy counts as a rule in its own right, subject to the Congressional Review Act.

Dropping enforcement did not bring deregulation. Access is now more bilateral and more discretionary, and arguably harder to predict. The H20 saga shows the whipsaw. In April 2025 the H20, Nvidia's China-market part, started to need a license, and Nvidia booked a $4.5B charge for excess H20 inventory and purchase obligations. Licenses reopened in mid-2025 alongside a reported 15% share of China revenue that US officials said they expected and that no regulation ever codified (the same arrangement was reported for AMD's MI308). Effective 15 January 2026, BIS moved qualifying direct US exports of H200/MI325X-class and lesser items to China/Macau from presumption of denial to case-by-case review. Qualifying items must stay under a total processing performance (TPP) of 21,000 and DRAM bandwidth of 6,500 GB/s, and the applicant must make the rule's certifications. The chips must also pass independent testing in the United States. From 15 January 2026, covered foreign-made chips that enter the US for onward export pay the 25% Section 232 import tariff. Nvidia says in its 27 August 2026 filing that it has not passed that cost on to customers.

The Gulf buys its access with a security compact. Commerce's November 19, 2025 announcement described approvals for G42 and HUMAIN, each up to 35,000 NVIDIA Blackwell GB300-equivalents, conditioned on a new Regulated Technology Environment (RTE) framework of rigorous security and reporting requirements. That announcement is neither a shipment count nor current permission for an order, so get the buyer's operative license and its conditions. The pattern is tiering by treaty and compliance rather than by static list.

For the UAE the compact has since become a list in the regulations. A BIS rule effective 10 July 2026 moved the UAE into Country Group A:5 and dropped the license requirement for advanced-computing items when the consignee and every end user are on an approved list. On the list are UAE government agencies, G42 and Core42, plus eight US AI companies and their UAE subsidiaries: Amazon, Apple, Google, Meta, Microsoft, OpenAI, Oracle and xAI. The agency approval does not cover state-owned companies, or the agencies' contractors and grantees. Any other UAE buyer, US-headquartered firms included, must either hold a license or get itself added to the list. It applies through a BIS advisory opinion, and Commerce decides each request case by case within 30 days. A listed buyer is still bound by the end-use and end-user licensing rules in Part 744 of the EAR. The G42 and Core42 listing expires on 6 April 2027 unless the two have become US companies or BIS extends it, so a hall built for them carries that date as a supply risk. BIS had published no equivalent rule for Saudi Arabia by October 2026, so HUMAIN still works under its buyer-specific approval.

The most expensive sovereignty mistake is conflating two different requirements. Data residency is a geography rule: the bytes must physically sit inside a named border. It is often easier to meet than technical sovereignty, but storage, replication, backup, support, telemetry and data flows all have to be checked against that border. Technical sovereignty is a jurisdiction-exposure rule: the operating and key-custody design can stop an order served on the provider from yielding workload plaintext. It does not stop lawful compulsion against the customer, metadata holders or the key-management control plane. Residency does not deliver sovereignty, and the gap between them is where buyers overpay or under-protect. A dataset can sit in Frankfurt, encrypted and audited, and still be lawfully reachable by a foreign state if the firm operating the facility answers to that state's courts.

The US CLOUD Act (2018) is the mechanism that turns residency into false comfort. It can compel a provider subject to US jurisdiction to produce data in its possession, custody or control, including data stored abroad, subject to statutory process and possible conflict-of-law mechanisms. Frankfurt, Dublin and Stockholm are no shield on their own. Exposure depends on the provider's nationality and corporate control, who has possession, custody or control of the data, who holds the keys, how the service is designed, and which legal process is used. The collision with the EU's data-protection regime stopped being theoretical in June 2025, when Microsoft's French legal director told the French Senate, under oath, that the company could not guarantee it would refuse a lawful CLOUD Act request for EU-resident data. The provider would assess a lawful request under whatever law applies, and a contractual promise alone does not override governing law.

The EU response has been structural. The EU Data Act (applying from September 2025) requires cloud providers to implement measures preventing unlawful non-EU government access to EU-stored non-personal data and to challenge conflicting requests. On 3 June 2026 the Commission proposed the Cloud and AI Development Act (CADA). Public-sector cloud procurement would get four Union assurance levels, with the level chosen by risk assessment. Level 4 demands EU-based operations, no control by a third-country government or company, and effective control of the software supply chain. On 12 October 2026 it was still only a proposal, so write any of its assurance criteria into the contract separately from the residency clause. National schemes already apply in the meantime, for example France's SecNumCloud qualification and Germany's BSI C5 security attestation; the EU-wide EUCS scheme has not been adopted (Chapter 11.11).

Sovereign-cloud builds aim at the gap residency leaves. AWS European Sovereign Cloud went generally available on January 14, 2026. It is a multi-billion-euro partition in Brandenburg, with EU infrastructure kept physically and logically separate and its own local operations. A tenant still has to test those operating controls against the jurisdictional exposure it can accept. The EuroStack initiative and Gaia-X's successors aim at the same gap.

For a developer this is a design-basis fork. A tenant who needs rung 1 (residency) gets a conventional build: in-region siting, with every copy, support path and telemetry flow checked against the border. If it needs rung 3 (technical sovereignty), the facility must be re-architected. It needs a local operating entity that is not a subsidiary reachable by a foreign parent. It needs customer-controlled key custody with attested confidential-computing isolation and secure key release, which keeps the provider's software out of plaintext during execution. Intel and AMD rule physical memory attacks out of scope, so physical custody of the host must also sit inside the boundary (Chapter 11.5). It needs an air-gapped or in-country management plane with no offshore administrative access, and an audited supply chain for the hardware root of trust. Each adds cost and constraint that residency alone does not imply. Selling rung 1 to a tenant who needed rung 3 is a breach waiting to be discovered; building rung 3 for a tenant who needed only rung 1 leaves margin on the table. Chapter 11.8 covers the model- and key-protection engineering behind rung 3, and Chapter 11.11 the compliance and certification scaffolding.

The third fork is dependence. An AI factory is a concentrated bet on a long, fragile, politically exposed supply chain, and one bilateral relationship can sit across several links of it at once. The vast majority of accelerators are designed in the US and fabricated in Taiwan, and the most advanced packaging and HBM are concentrated in much the same way. The firmware, the CUDA-class software stack and the ongoing security updates all come from vendors under one government's export jurisdiction. A hostile policy turn therefore does not just stop the next chip shipment. It can, in principle, reach installed capacity through support and update channels. The Gulf deals show it plainly: only listed or licensed recipients get the chips, and on terms Washington may tighten or allow to expire (the G42 and Core42 listing carries an end date), so the exporter's leverage outlasts the sale.

The US now applies the mirror image at home, screening the power equipment a US site imports rather than the chips America exports. Executive Order 14421 (26 August 2026) gives DOE power to block, attach conditions to, or unwind any purchase of bulk-power equipment from a covered foreign entity, which in practice means China. Transformers, breakers, inverters and battery systems are all in scope, and DOE owes its implementing rules by 24 December 2026. Before you place equipment orders, check where every item rated 69 kV and above was made and who owns its supplier, and do the same for the battery plant (Chapter 2.3).

Energy geopolitics adds a second dependence. The 2026 buildout's appetite for firm power has pulled it toward jurisdictions with cheap or stranded energy, but cheap energy and benign politics do not always coincide. Gulf gigawatts are abundant and competitively priced, and they come bundled with the export-compact conditions above. They carry physical risk too. Drone strikes in March 2026 damaged AWS facilities in the UAE and Bahrain, and in a September 2026 status update AWS said its Bahrain region cannot be restored (Chapter 11.2). Price diversity across regions, not just availability zones, into any Gulf deployment. Nordic and Iberian sites offer firm renewables and free cooling inside the allied bloc, at a premium on power price and capacity. The developer's choice is the cheapest reliable megawatt, which may carry a sovereignty or export string, or the allied-bloc premium for a build with lower destination-control risk. This is the speed-to-power and power-cost calculus of Chapter 3.2 and Chapter 3.3, with a geopolitical risk premium added to the discount rate.

The H200 episode shows that after US approval, the buyer's own government can still have the final say. On 14 May 2026 Reuters reported that about ten Chinese buyers held approvals for up to 75,000 chips each and had received none. Nvidia's 27 August filing confirms that licenses started in February and that it shipped limited volumes in its quarter ended 26 July. On 8 July The Information reported proposed restrictions limiting the chips to training on public data. On 19 August the Financial Times reported, as reproduced by Tom's Hardware, that ByteDance and Tencent had each taken about 10,000 H200s in the preceding weeks. Most licensed volume was headed for Hong Kong, and allowances were described as up to 100,000 per buyer. The US license, the Chinese import approval and the approved deployment site are three separate gates.

Three enforcement facts sharpen the fork. First, transshipment and diversion controls: as the case-by-case regime widens, the US has leaned harder on tracking where chips end up. That makes a partner jurisdiction's reporting compliance (the RTE-style audit trail) a precondition for continued access, and a governance burden the host facility must carry. Second, tenant ownership is an export gate too. Tenant-owned hardware procurement must screen the recipient's headquarters and ultimate-parent headquarters before capacity is committed, because the D:5/Macau license gate follows the recipient across borders. The gate applies to hardware transactions. BIS's 31 May 2026 guidance does not make otherwise compliant operators stop using or servicing items already installed. Third, the installed-base leverage point above means that even a fully energized, fully populated sovereign cluster is not wholly insulated, since support contracts, firmware signing and software entitlements remain levers. A developer building for a sovereign tenant must treat post-deployment dependence, not just the import license, as part of the threat model. Chapter 11.3 covers the supply-chain and hardware-provenance engineering.

As everywhere in siting, sort the geopolitical decisions by the cost of changing your mind. Irreversible (decide once, at scoping): the jurisdiction of the slab, and therefore the export bloc your interconnection sits in. You cannot move a 1 GW campus from a case-by-case jurisdiction into the core bloc, and you cannot un-pour a hall built to a compliance posture the market won't pay for. Reversible (re-decide as policy moves): the operator of record (changeable, but only through the real transfer of control described above), the data-plane placement within a portfolio of sites, the specific accelerator generation within the power and cooling limits, and the second-source chip qualification you keep warm against re-control. Where the option premium is cheap, convert irreversible exposures into reversible ones: qualify a fallback chip, structure the operating entity for sovereignty optionality, and keep a portfolio that spans more than one bloc. Over-build only the substrate you genuinely cannot retrofit, meaning the jurisdiction and bloc choice. Chapter 3.13 assembles the market-cluster scoring that weighs these geopolitical gates against power, cost and latency.