Technology Governance Wiki - User contributions [en]

Economies of Scope (Mariona)

2026-10-06T19:10:15Z

Fortuny Jané Mariona:

In economics, the term "[https://en.wikipedia.org/wiki/Economies_of_scope economies of scope]" refers to a model/theory that defends that the ATC ([https://en.wikipedia.org/wiki/Average_cost Average Total Cost]) of a company can decrease through broadening its production/services by [https://en.wikipedia.org/wiki/Diversification_(marketing_strategy) diversifying its products]. This model says that a company is considered within the 'economy of scope' concept when this one expands its productions from one successful product to more than one (that is usually related to the original). Through this action, the company is able to take advantage of the already cemented industry (by the first original product) and then diversify its production line with a lower cost/without this action being a cost overrun. This model says the product diversification in one same company proves to be of a cheaper cost and a lower time margin than if two different enterprises were to produce independently, precisely due to the previous cemented success of the one company in the same sector that decides to diversify [1][2].

Among the main advantages is an improvement in the company's economic and financial situation. Generating higher returns and increasing purchasing volumes with suppliers boosts financial health. Furthermore, making better use of machinery, resources, and processes helps ensure that the company's activity grows rather than declines. At the same time, this reduces the risk of [https://en.wikipedia.org/wiki/Bankruptcy bankruptcy], as new segments have been incorporated into the business [3].

However, the most common disadvantage is a loss of management efficiency. When expanding products and production, it is important not to forget to strengthen the part of the company responsible for business management. At the same time, the company may lose sight of the principles on which it was founded, since it should not be forgotten that quantity does not always mean quality. This potential decline in product quality could end up affecting the company's reputation, leading to a loss of customers [3].

A clear example is [https://en.wikipedia.org/wiki/Google Google]. Best known for running one of the world's most widely used [https://en.wikipedia.org/wiki/Search_engine search engines], Google now operates across a wide range of sectors: [https://en.wikipedia.org/wiki/Online_advertising online advertising], video ([https://en.wikipedia.org/wiki/YouTube YouTube]), mobile operating systems ([https://en.wikipedia.org/wiki/Android_(operating_system) Android]), [https://en.wikipedia.org/wiki/Cloud_computing cloud computing] ([https://en.wikipedia.org/wiki/Google_Cloud_Platform Google Cloud]), consumer devices such as [https://en.wikipedia.org/wiki/Google_Pixel Pixel] smartphones and [https://en.wikipedia.org/wiki/Pixel_Watch smartwatches], and [https://en.wikipedia.org/wiki/Artificial_intelligence artificial intelligence] research ([https://en.wikipedia.org/wiki/Google_DeepMind Google DeepMind]). What makes this an economy of scope is that these businesses share the same core resources [1][2]. Google's [https://en.wikipedia.org/wiki/Data_center data centres], custom AI chips ([https://en.wikipedia.org/wiki/Tensor_Processing_Unit TPUs]) and software infrastructure were built to power Search, but the same infrastructure now also runs YouTube and the services Google sells to its Cloud customers [4]. Similarly, the same family of AI models ([https://en.wikipedia.org/wiki/Gemini_(language_model) Gemini]) is used across all of Google's major products, from Search to [https://en.wikipedia.org/wiki/Gmail Gmail] and Android [4]. This allows each new service to be developed and run at a lower cost than it would be for a standalone company, a pattern that economists identify as a defining feature of large [https://en.wikipedia.org/wiki/Digital_platform_(infrastructure) digital platforms] [5][6]. Since 2015, Google has been part of a parent company, [https://en.wikipedia.org/wiki/Alphabet_Inc. Alphabet], which also owns more experimental ventures such as [https://en.wikipedia.org/wiki/Waymo Waymo] (self-driving cars). Notably, Alphabet placed these businesses outside Google precisely because they were too unrelated to benefit from the same shared resources [7].

Even so, Google's diversification has its limits. The large majority of Alphabet's revenue still came from advertising in 2025, and its experimental ventures, grouped under "Other Bets", recorded an operating loss of $7.5 billion that year [8].

Economies of scope demonstrate how, in a [https://en.wikipedia.org/wiki/Capitalism capitalist] market, power tends to reinforce itself. A company that has already accumulated significant resources (infrastructure, data, distribution networks, brand recognition) can use them to launch new products and then, according to this concept, achieve a much lower cost than if a new player is starting from scratch, or if independent companies were to be producing these products [1][2]. Consequently, each new product costs the established company less, generates additional revenue and data, and further strengthens its position. In other words, companies that are already powerful are best positioned to become even more powerful, which raises the [https://en.wikipedia.org/wiki/Barriers_to_entry barriers to entry] for competitors and contributes to [https://en.wikipedia.org/wiki/Market_concentration market concentration] [5][6].

This concept acknowledges that sharing resources does not always reduce costs: when producing multiple goods jointly is more expensive than producing them separately, economists speak of diseconomies of scope [1]. However, the concept cannot explain or predict when this shift occurs. It offers a way to compare costs once they are known, but it does not clarify the extent to which a company can diversify before the costs of coordinating and managing its businesses outweigh the savings derived from shared resources. Nor does it address demand: economies of scope may reduce the cost of launching a new product, but they do not guarantee that consumers will want it. This raises a question regarding governance. If neither the company nor the regulator can determine the tipping point in advance, it is difficult to assess whether a platform's expansion will generate real [https://en.wikipedia.org/wiki/Economic_efficiency efficiencies] or simply lead to a greater concentration of [https://en.wikipedia.org/wiki/Market_power market power].

'''References'''

[1] Panzar, J. C. & Willig, R. D. (1981). "Economies of Scope". ''American Economic Review'', 71(2), 268–272.

[2] Teece, D. J. (1980). "Economies of scope and the scope of the enterprise". ''Journal of Economic Behavior & Organization'', 1(3), 223–247.

[3] Economia i Finances. [https://ca.economiafinanzas.com/economies-d%27abast/ "Economies d'abast"]. Retrieved 6 October 2026.

[4] Alphabet Inc. (2026). [https://www.sec.gov/Archives/edgar/data/1652044/000165204426000018/goog-20251231.htm ''Form 10-K: Annual Report for the Fiscal Year Ended December 31, 2025'']. U.S. Securities and Exchange Commission. Retrieved 6 October 2026.

[5] Parker, G., Petropoulos, G. & Van Alstyne, M. (2021). [https://wordpress.bruegel.org/wp-content/uploads/2021/06/WP-2021-01-updated-150621.pdf "Platform mergers and antitrust"]. ''Industrial and Corporate Change'', 30(5). Retrieved 6 October 2026.

[6] Crémer, J., de Montjoye, Y.-A. & Schweitzer, H. (2019). ''Competition Policy for the Digital Era''. European Commission.

[7] Page, L. (2015). [https://abc.xyz/investor/founders-letters/2015/ "2015 Founders' Letter"]. Alphabet Investor Relations. Retrieved 6 October 2026.

[8] Alphabet Inc. (2026). [https://www.sec.gov/Archives/edgar/data/0001652044/000130817926000344/goog014907-ars.pdf ''2025 Annual Report'']. U.S. Securities and Exchange Commission. Retrieved 6 October 2026.

Economies of Scope (Mariona)

2026-10-06T18:52:34Z

Fortuny Jané Mariona:

In economics, the term "economies of scope" refers to a model/theory that defends that the ATC (Average Total Cost) of a company can decrease through broadening its production/services by diversifying its products. This model says that a company is considered within the 'economy of scope' concept when this one expands its productions from one successful product to more than one(that is usually related to the original. Through this action, the company is able to take advantage of the already cemented industry (by the first original product) and then diversify its production line with a lower cost/without this action being a cost overrun. This model says the product diversification in one same company proves to be of a cheaper cost and a lower time margin than if two different enterprises were to produce independently, precisely due to the previous cemented success of the one company in the same sector that decides to diversify. 

Among the main advantages is an improvement in the company's economic and financial situation. Generating higher returns and increasing purchasing volumes with suppliers boosts financial health. Furthermore, making better use of machinery, resources, and processes helps ensure that the company's activity grows rather than declines. At the same time, this reduces the risk of bankruptcy, as new segments have been incorporated into the business. 

However, the most common disadvantage is a loss of management efficiency. When expanding products and production, it is important not to forget to strengthen the part of the company responsible for business management. At the same time, the company may lose sight of the principles on which it was founded, since it should not be forgotten that quantity does not always mean quality. This potential decline in product quality could end up affecting the company's reputation, leading to a loss of customers.

Another example is [https://en.wikipedia.org/wiki/Google Google]. Best known for running one of the world's most widely used [https://en.wikipedia.org/wiki/Search_engine search engines], Google now operates across a wide range of sectors: [https://en.wikipedia.org/wiki/Online_advertising online advertising], video ([https://en.wikipedia.org/wiki/YouTube YouTube]), mobile operating systems ([https://en.wikipedia.org/wiki/Android_(operating_system) Android]), [https://en.wikipedia.org/wiki/Cloud_computing cloud computing] ([https://en.wikipedia.org/wiki/Google_Cloud_Platform Google Cloud]), consumer devices such as [https://en.wikipedia.org/wiki/Google_Pixel Pixel] smartphones and [https://en.wikipedia.org/wiki/Pixel_Watch smartwatches], and [https://en.wikipedia.org/wiki/Artificial_intelligence artificial intelligence] research ([https://en.wikipedia.org/wiki/Google_DeepMind Google DeepMind]). What makes this an [https://en.wikipedia.org/wiki/Economies_of_scope economy of scope] is that these businesses share the same core resources [1][2]. Google's [https://en.wikipedia.org/wiki/Data_center data centres], custom AI chips ([https://en.wikipedia.org/wiki/Tensor_Processing_Unit TPUs]) and software infrastructure were built to power Search, but the same infrastructure now also runs YouTube and the services Google sells to its Cloud customers [3]. Similarly, the same family of AI models ([https://en.wikipedia.org/wiki/Gemini_(language_model) Gemini]) is used across all of Google's major products, from Search to [https://en.wikipedia.org/wiki/Gmail Gmail] and Android [3]. This allows each new service to be developed and run at a lower cost than it would be for a standalone company, a pattern that economists identify as a defining feature of large [https://en.wikipedia.org/wiki/Digital_platform_(infrastructure) digital platforms] [4][5]. Since 2015, Google has been part of a parent company, [https://en.wikipedia.org/wiki/Alphabet_Inc. Alphabet], which also owns more experimental ventures such as [https://en.wikipedia.org/wiki/Waymo Waymo] (self-driving cars). Notably, Alphabet placed these businesses outside Google precisely because they were too unrelated to benefit from the same shared resources [6].

Even so, Google's diversification has its limits. The large majority of Alphabet's revenue still came from advertising in 2025, and its experimental ventures, grouped under "Other Bets", recorded an operating loss of $7.5 billion that year [7].

'''References'''

[1] Panzar, J. C. & Willig, R. D. (1981). "Economies of Scope". ''American Economic Review'', 71(2), 268–272.

[2] Teece, D. J. (1980). "Economies of scope and the scope of the enterprise". ''Journal of Economic Behavior & Organization'', 1(3), 223–247.

[3] Alphabet Inc. (2026). [https://www.sec.gov/Archives/edgar/data/1652044/000165204426000018/goog-20251231.htm ''Form 10-K: Annual Report for the Fiscal Year Ended December 31, 2025'']. U.S. Securities and Exchange Commission. Retrieved 6 October 2026.

[4] Parker, G., Petropoulos, G. & Van Alstyne, M. (2021). [https://wordpress.bruegel.org/wp-content/uploads/2021/06/WP-2021-01-updated-150621.pdf "Platform mergers and antitrust"]. ''Industrial and Corporate Change'', 30(5). Retrieved 6 October 2026.

[5] Crémer, J., de Montjoye, Y.-A. & Schweitzer, H. (2019). ''Competition Policy for the Digital Era''. European Commission.

[6] Page, L. (2015). [https://abc.xyz/investor/founders-letters/2015/ "2015 Founders' Letter"]. Alphabet Investor Relations. Retrieved 6 October 2026.

[7] Alphabet Inc. (2026). [https://www.sec.gov/Archives/edgar/data/0001652044/000130817926000344/goog014907-ars.pdf ''2025 Annual Report'']. U.S. Securities and Exchange Commission. Retrieved 6 October 2026.

Economies of Scope (Mariona)

2026-10-06T18:51:42Z

Fortuny Jané Mariona:

In economics, the term "economies of scope" refers to a model/theory that defends that the ATC (Average Total Cost) of a company can decrease through broadening its production/services by diversifying its products. This model says that a company is considered within the 'economy of scope' concept when this one expands its productions from one successful product to more than one(that is usually related to the original. Through this action, the company is able to take advantage of the already cemented industry (by the first original product) and then diversify its production line with a lower cost/without this action being a cost overrun. This model says the product diversification in one same company proves to be of a cheaper cost and a lower time margin than if two different enterprises were to produce independently, precisely due to the previous cemented success of the one company in the same sector that decides to diversify. 

Among the main advantages is an improvement in the company's economic and financial situation. Generating higher returns and increasing purchasing volumes with suppliers boosts financial health. Furthermore, making better use of machinery, resources, and processes helps ensure that the company's activity grows rather than declines. At the same time, this reduces the risk of bankruptcy, as new segments have been incorporated into the business. 

However, the most common disadvantage is a loss of management efficiency. When expanding products and production, it is important not to forget to strengthen the part of the company responsible for business management. At the same time, the company may lose sight of the principles on which it was founded, since it should not be forgotten that quantity does not always mean quality. This potential decline in product quality could end up affecting the company's reputation, leading to a loss of customers.

Another example is [https://en.wikipedia.org/wiki/Google Google]. Best known for running one of the world's most widely used [https://en.wikipedia.org/wiki/Search_engine search engines], Google now operates across a wide range of sectors: [https://en.wikipedia.org/wiki/Online_advertising online advertising], video ([https://en.wikipedia.org/wiki/YouTube YouTube]), mobile operating systems ([https://en.wikipedia.org/wiki/Android_(operating_system) Android]), [https://en.wikipedia.org/wiki/Cloud_computing cloud computing] ([https://en.wikipedia.org/wiki/Google_Cloud_Platform Google Cloud]), consumer devices such as [https://en.wikipedia.org/wiki/Google_Pixel Pixel] smartphones and [https://en.wikipedia.org/wiki/Pixel_Watch smartwatches], and [https://en.wikipedia.org/wiki/Artificial_intelligence artificial intelligence] research ([https://en.wikipedia.org/wiki/Google_DeepMind Google DeepMind]). What makes this an [https://en.wikipedia.org/wiki/Economies_of_scope economy of scope] is that these businesses share the same core resources.<sup>1, 2</sup> Google's [https://en.wikipedia.org/wiki/Data_center data centres], custom AI chips ([https://en.wikipedia.org/wiki/Tensor_Processing_Unit TPUs]) and software infrastructure were built to power Search, but the same infrastructure now also runs YouTube and the services Google sells to its Cloud customers.<sup>3</sup> Similarly, the same family of AI models ([https://en.wikipedia.org/wiki/Gemini_(language_model) Gemini]) is used across all of Google's major products, from Search to [https://en.wikipedia.org/wiki/Gmail Gmail] and Android.<sup>3</sup> This allows each new service to be developed and run at a lower cost than it would be for a standalone company, a pattern that economists identify as a defining feature of large [https://en.wikipedia.org/wiki/Digital_platform_(infrastructure) digital platforms].<sup>4, 5</sup> Since 2015, Google has been part of a parent company, [https://en.wikipedia.org/wiki/Alphabet_Inc. Alphabet], which also owns more experimental ventures such as [https://en.wikipedia.org/wiki/Waymo Waymo] (self-driving cars). Notably, Alphabet placed these businesses outside Google precisely because they were too unrelated to benefit from the same shared resources.<sup>6</sup>

Even so, Google's diversification has its limits. The large majority of Alphabet's revenue still came from advertising in 2025, and its experimental ventures, grouped under "Other Bets", recorded an operating loss of $7.5 billion that year.<sup>7</sup>

== References ==<br># Panzar, J. C. & Willig, R. D. (1981). "Economies of Scope". ''American Economic Review'', 71(2), 268–272.<br># Teece, D. J. (1980). "Economies of scope and the scope of the enterprise". ''Journal of Economic Behavior & Organization'', 1(3), 223–247.<br># Alphabet Inc. (2026). [https://www.sec.gov/Archives/edgar/data/1652044/000165204426000018/goog-20251231.htm ''Form 10-K: Annual Report for the Fiscal Year Ended December 31, 2025'']. U.S. Securities and Exchange Commission. Retrieved 6 October 2026.<br># Parker, G., Petropoulos, G. & Van Alstyne, M. (2021). [https://wordpress.bruegel.org/wp-content/uploads/2021/06/WP-2021-01-updated-150621.pdf "Platform mergers and antitrust"]. ''Industrial and Corporate Change'', 30(5). Retrieved 6 October 2026.<br># Crémer, J., de Montjoye, Y.-A. & Schweitzer, H. (2019). ''Competition Policy for the Digital Era''. European Commission.<br># Page, L. (2015). [https://abc.xyz/investor/founders-letters/2015/ "2015 Founders' Letter"]. Alphabet Investor Relations. Retrieved 6 October 2026.<br># Alphabet Inc. (2026). [https://www.sec.gov/Archives/edgar/data/0001652044/000130817926000344/goog014907-ars.pdf ''2025 Annual Report'']. U.S. Securities and Exchange Commission. Retrieved 6 October 2026.

Economies of Scope (Mariona)

2026-10-06T18:50:47Z

Fortuny Jané Mariona:

In economics, the term "economies of scope" refers to a model/theory that defends that the ATC (Average Total Cost) of a company can decrease through broadening its production/services by diversifying its products. This model says that a company is considered within the 'economy of scope' concept when this one expands its productions from one successful product to more than one(that is usually related to the original. Through this action, the company is able to take advantage of the already cemented industry (by the first original product) and then diversify its production line with a lower cost/without this action being a cost overrun. This model says the product diversification in one same company proves to be of a cheaper cost and a lower time margin than if two different enterprises were to produce independently, precisely due to the previous cemented success of the one company in the same sector that decides to diversify. 

Among the main advantages is an improvement in the company's economic and financial situation. Generating higher returns and increasing purchasing volumes with suppliers boosts financial health. Furthermore, making better use of machinery, resources, and processes helps ensure that the company's activity grows rather than declines. At the same time, this reduces the risk of bankruptcy, as new segments have been incorporated into the business. 

However, the most common disadvantage is a loss of management efficiency. When expanding products and production, it is important not to forget to strengthen the part of the company responsible for business management. At the same time, the company may lose sight of the principles on which it was founded, since it should not be forgotten that quantity does not always mean quality. This potential decline in product quality could end up affecting the company's reputation, leading to a loss of customers.

Another example is [[Google]]. Best known for running one of the world's most widely used [[search engine]]s, Google now operates across a wide range of sectors: [[online advertising]], video ([[YouTube]]), mobile operating systems ([[Android (operating system)|Android]]), [[cloud computing]] ([[Google Cloud Platform|Google Cloud]]), consumer devices such as [[Google Pixel|Pixel]] smartphones and [[Pixel Watch|smartwatches]], and [[artificial intelligence]] research ([[Google DeepMind]]). What makes this an [[economies of scope|economy of scope]] is that these businesses share the same core resources.<ref name="PanzarWillig1981">{{cite journal |last1=Panzar |first1=John C. |last2=Willig |first2=Robert D. |date=1981 |title=Economies of Scope |journal=American Economic Review |volume=71 |issue=2 |pages=268–272}}</ref><ref name="Teece1980">{{cite journal |last=Teece |first=David J. |date=1980 |title=Economies of scope and the scope of the enterprise |journal=Journal of Economic Behavior & Organization |volume=1 |issue=3 |pages=223–247}}</ref> Google's [[data center|data centres]], custom AI chips ([[Tensor Processing Unit|TPUs]]) and software infrastructure were built to power Search, but the same infrastructure now also runs YouTube and the services Google sells to its Cloud customers.<ref name="Alphabet10K2025">{{cite report |author=Alphabet Inc. |date=2026 |title=Form 10-K: Annual Report for the Fiscal Year Ended December 31, 2025 |publisher=U.S. Securities and Exchange Commission |url=https://www.sec.gov/Archives/edgar/data/1652044/000165204426000018/goog-20251231.htm |access-date=6 October 2026}}</ref> Similarly, the same family of AI models ([[Gemini (language model)|Gemini]]) is used across all of Google's major products, from Search to [[Gmail]] and Android.<ref name="Alphabet10K2025" /> This allows each new service to be developed and run at a lower cost than it would be for a standalone company, a pattern that economists identify as a defining feature of large [[Digital platform (infrastructure)|digital platforms]].<ref name="ParkerEtAl2021">{{cite journal |last1=Parker |first1=Geoffrey |last2=Petropoulos |first2=Georgios |last3=Van Alstyne |first3=Marshall |date=2021 |title=Platform mergers and antitrust |journal=Industrial and Corporate Change |volume=30 |issue=5 |url=https://wordpress.bruegel.org/wp-content/uploads/2021/06/WP-2021-01-updated-150621.pdf |access-date=6 October 2026}}</ref><ref name="Cremer2019">{{cite report |last1=Crémer |first1=Jacques |last2=de Montjoye |first2=Yves-Alexandre |last3=Schweitzer |first3=Heike |date=2019 |title=Competition Policy for the Digital Era |publisher=European Commission}}</ref> Since 2015, Google has been part of a parent company, [[Alphabet Inc.|Alphabet]], which also owns more experimental ventures such as [[Waymo]] (self-driving cars). Notably, Alphabet placed these businesses outside Google precisely because they were too unrelated to benefit from the same shared resources.<ref name="Page2015">{{cite web |last=Page |first=Larry |date=2015 |title=2015 Founders' Letter |website=Alphabet Investor Relations |publisher=Alphabet Inc. |url=https://abc.xyz/investor/founders-letters/2015/ |access-date=6 October 2026}}</ref>

Even so, Google's diversification has its limits. The large majority of Alphabet's revenue still came from advertising in 2025, and its experimental ventures, grouped under "Other Bets", recorded an operating loss of $7.5 billion that year.<ref name="AlphabetAR2025">{{cite report |author=Alphabet Inc. |date=2026 |title=2025 Annual Report |publisher=U.S. Securities and Exchange Commission |url=https://www.sec.gov/Archives/edgar/data/0001652044/000130817926000344/goog014907-ars.pdf |access-date=6 October 2026}}</ref>

== References ==<br>{{reflist}}

Economies of Scope (Mariona)

2026-10-06T18:27:30Z

Fortuny Jané Mariona: Created page with "In economics, the term "economies of scope" refers to a model/theory that defends that the ATC (Average Total Cost) of a company can decrease through broadening its production/services by diversifying its products. This model says that a company is considered within the 'economy of scope' concept when this one expands its productions from one successful product to more than one(that is usually related to the original. Through this action, the company is able to take adva..."

Governance by markets

2026-10-06T13:45:28Z

Fortuny Jané Mariona:

= Glossary =
= [https://wiki.ivir.nl/index.php?title=Data_as_an_input_to_market_power Data as an input to market power] (Sergey) =<p>In the present digital economy, data has emerged as a valuable economic commodity that entities leverage to gain a competitive edge over their rivals [[https://repository.nls.ac.in/cgi/viewcontent.cgi?article=1478&context=nlsblr 1]]. '''Data''' is an input into production, so businesses that control data can have market power and impede the entry of potential competitors. '''Market power''' refers to a firm's ability to influence the price, output, or other market conditions in its favour, without being constrained by competitive forces [[https://www.tutor2u.net/economics/reference/what-is-meant-by-market-power 2]].</p><p>'''Data as an input to market power''' means that access to information can help a business limit the competitive pressure it faces. Information about searches, clicks or purchases can improve services and advertising. If competitors cannot obtain comparable information at a reasonable cost, they may struggle to offer an attractive alternative. This can allow a platform to raise prices or worsen quality or privacy protections without losing enough business to make doing so unprofitable. This matters even when a service is free, because competition also concerns advertising charges, personal information and the choices available. Data can be used repeatedly and by several businesses without being used up. However, access can be restricted through contracts and technical controls. Nevertheless, holding a large dataset alone does not establish market power.</p><p>'''Google Search''' illustrates this mechanism. Google controls over 91% of global search engine traffic [[https://www.statista.com/statistics/1381664/worldwide-all-devices-market-share-of-search-engines/ 3]] and uses information about users’ searches and the results they click to improve the relevance of its rankings. A larger volume of searches gives it more opportunities to learn, including about unusual queries that smaller search engines encounter less often. Better results can attract further use, producing additional information and reinforcing the advantage. A new search engine may therefore struggle to attract users while lacking the information needed to improve its service. Data access can constitute a significant barrier to entry when this type of analytics is necessary to participate in a market, particularly when alternatives are limited. </p><p>A platform’s control over data access can shape who is able to compete with it. By determining whether, and on what terms, rivals can access that information, a platform can influence the competitive opportunities available to others. This suggests that regulation should examine access to strategically important data alongside prices and market shares. Article 6(11) of the EU Digital Markets Act [[https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng#:~:text=giving%20their%20consent.-,11.%C2%A0,-The%20gatekeeper%20shall 4]] reflects this approach: certain large search providers must, on request, share specified search data with rival search providers on fair and non-discriminatory terms, with relevant personal data anonymised. The aim is to help rivals compete while protecting users. A data advantage does not, by itself, establish unlawful conduct.</p><p>Would access to equivalent data enable a rival to compete effectively? The concept cannot answer this on its own. Additional data may eventually add little value, become outdated, or have substitutes. Firms also need the skills and computing resources to use it. Google’s default positions in browsers and devices can further restrict rivals’ access to users even if data become available. The unresolved issue is how much competitive advantage comes from data itself and how much comes from these other resources and arrangements. </p>

= Two Sided Markets (Ceren) =<p>In two-sided markets, two sides of a market interact through an intermediary. These markets typically have some externality,<code class="mwt-code">Carl Shapiro and Hal R Varian, ''Information Rules: A Strategic Guide to the Network Economy'' (Harvard Business School Press 2010), 183.</code><sup></sup> where the decisions of the sides affect the other. The intermediary also has multitudes of effects on both sides, mainly identified in the related literature through its pricing.</p><p>An example of a two sided market is payment systems, whereby the credit card providing bank is the intermediary between the customers and merchants. In this example, banks provide credit cards to customers to be utilized in their payments, and merchants accept payment via multiple credit card systems to accommodate payments from customers holding credit cards from such providers[https://doi.org/10.1257/jep.23.3.125 .]</p><p>The main power of the intermediary materializes in their pricing toward the merchant (and the merchant’s bank in interchange fees in case of payment being transferred through different banks). Customers will be expected to be more loyal, holding a few credit cards, whereas merchants accept payment from many banks to accommodate all customers’ payment methods. Banks will provide more subsidies to customers to attract them and compete aggressively on the customer side, making their platform more desirable to work with by merchants, who will in turn be more accepting of the platform’s fees to gain the business of the larger volume of customers. However, dynamic pricing (increasing fees after gaining entry and loyalty) may be a way for these platforms to abuse their power.</p><p>The concept may be derailed from these logical / analytical systems of operation or expected outcomes when public policy interferes with the market. For example, net neutrality rules regulate what internet service providers (the intermediary) can charge content providers (one side) who aim to reach the consumers (the other side). In this case the above considerations and the concept are halted.</p>

= Switching costs and lock-in (Kate) =
[[File:Untitled Diagram.drawio (1).png|300px|thumb|Goods Matrix]]

= Excludability and rivalrousness (Paul)  =
=== Excludability and Rivalrousness ===<p>The terms excludability and rivalrousness both refer to consumption characteristics that can be assigned to- or identified in goods. </p><p>'''Excludability''': Goods to which economic actors can technically or legally restrict access are considered to have ‘high excludability’. Conversely, goods to which access cannot be restricted are of ‘low excludability’, or, in absolute terms, ‘non-excludable’.</p><p>'''Rivalrousness''': Rivalrousness on the other hand refers to the finitude of the good in question. The greater the depletion of the stock, quantity, or amount is on account of one party’s consumption, the more rivalrous a good is. </p><p>Tabulating the characteristics against one another allows for inference and definition of the type of good an object, service, or resource may constitute (see fig. 1). Excludability and Rivalrousness of goods can therethrough serve as a predictor for certain types of market failures: Goods which are non-excludable or of low excludability, but nonetheless costly to provide, are vulnerable to so-called free rider problem. Goods which are non-excludable, but highly rivalrous (common goods), may lead to the tragedy of the commons, that is over-exploitation.<br></p>

=== AI Training and the (non-)excludability of information. ===<p>The unusual nature of excludability and rivalrousness of data further compromises the applicability of the goods classification built thereon. In traditional economics, a non-excludable and non-rivalrous good would be seen as a public good. This does apply insofar as data is vulnerable to corporate exploitation without commensurate indemnification. Data usage may however actually be anti-rival in the sense that increasing aggregate usage increases the value of the data (better labeling, easier access, previously undrawn conclusions, etc.), rather than diminish the ‘stock’ of data. Conversely, data may be rivalrous not in its absolute depletion by consumption, but rather the benefit or competitive advantage usage of that data may confer: If all AI firms are able to train on the exact same data (all available data), the utility of that data may still increase, but the competitive advantage of possessing that data is exhausted.</p>

=== Free-Rider Problems & Public Data ===<p>As any party can benefit from publicly available data at no cost or low cost, the incentive for private market actors to fund its creation is comparatively weak. Consequently, public bodies (and less frequently open-source foundations and non-profits) often assume the responsibility for the provision of this type of data. A classical example is weather data and its creation by national weather agencies.</p>

= Interoperability (Sisi) =

#What is interoperability?[[https://www.ibm.com/think/topics/interoperability 1]]<p>Interoperability is a “standards-based” approach that enables different IT systems to communicate with minimal end-user interaction to exchange data and “share functionality”. Each system also allows the other system to “read, update, modify, and analyze” data with minimal human interaction. [[https://www.oracle.com/nl/interoperability/ 2]]</p><p>Interoperability works by having different systems share data by employing the same standards for data formats (e.g., Extensible Markup Language or JavaScript Object Notation), exchange, and vocabulary to title data elements. These standards are agreed upon “in advance” by organizations, industry types, and user groups. Then, software developers build the system based on the model agreed upon.</p>

#Concrete example from a digital technology or platform<p>Interoperable systems are vital in healthcare, commerce, and public safety. A notable example includes the integration of Electronic Health Records (HER). This system allows different healthcare providers to securely access and share personal patient information regardless of the specific EHR system used.[[https://data.europa.eu/en/news-events/news/interoperability-solutions-bridging-systems-connected-future 3]] An example of such a system is the GNU Health Hospital Information System, which is a model employed by small private offices and large national public health systems.[[https://interoperable-europe.ec.europa.eu/collection/gnu-health/solution/gnu-health-hospital-information-system 4]]</p><p>For example, a health care professional may access lab results and patient history data from various platforms to enable them to make a diagnosis.</p>

#One governance implication: what does this concept explain about how platforms exercise power?<p>Interoperability is a powerful tool because it helps provide a “seamless user experience” and optimizes data sharing between separate systems. It helps companies and organizations access data from multiple sources and improve efficiency, such as accelerating workflows and reducing the possibility of errors by pooling data from its sources.</p><p>Interoperability standards are mandated by law on the technical side to ensure “critical systems” are compatible, especially in public safety and health. [[https://www.ibm.com/think/topics/interoperability 5]]</p><p>In Europe, interoperability is governed by the European Health Data Space regulation (EHDS); the “first common EU data space dedicated to a specific sector as part of the European strategy for data.”</p><p>This Regulation aims to benefit EU citizens such as patients, researchers, healthcare professionals, and industry players by establishing a common framework for the exchange of electronic health data within the EU. In addition, it enables certain data to be “reused” for public purpose and innovative scientific research. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 6]]</p>

#Where does the concept break down or fail to explain something<p>While the EDHS harmonizes a legal and technical framework for sharing EU data, its shortcoming is its gradual implementation. The EDHS entered into force in 2025; however, most of its obligations will not apply until 2029. This leaves four years for health care companies to use interoperability in a deregulated manner. [[https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en 7]]</p><p>Furthermore, there are actual barriers to achieving full interoperability in healthcare, including data silos (which isolate data collections and hinder data exchange), lack of standardization (where one system records blood pressure as free text, another system stores it as a structured numeric value), and deficient infrastructure, which requires significant technological upgrading.</p><p>The burden remains on health companies to decide which standards to adopt and how much to invest in stable technological infrastructure to strengthen their data governance and interoperability. [[https://www.tigahealth.com/how-to-overcome-healthcare-interoperability-challenges/ 8]]</p>

= "Economies of Scale (Jihae)" =
= [[Economies of Scope (Mariona)]] =
= [[Network Effects (Indirect) - Sebastián]] =
= [[Monopsony - (Atmika)]] =
===== [https://wiki.ivir.nl/index.php?title=Market_tipping_-_Rodrigue Market Tipping - Rodrigue] =====
== Vertical Integration by Pablo Latorre ==<p>'''1. Definition'''</p><p style="text-align: justify;">“Vertical Integration” is the control by a single corporation of two or more consecutive steps of the same production chain of activity in such a manner that said corporation does not need to rely on others for them (1). In the context of digital markets, “Vertical Integration” usually refers to the position of a platform that operates a marketplace or infrastructure that other enterprises depend on and, at the same time, commercializes products or services in that same space (2). Therefore, in a “Vertical Integration” the platform is both, provider and competitor, of other enterprises.</p><p><br></p><p>'''2. Example: Amazon as a Marketplace'''</p><p style="text-align: justify;">Amazon operates the largest online marketplace (3) in the world and, thus, thousands of small and medium size enterprises depend on it to connect with their costumers. At the same time, Amazon commercializes its own products on its marketplace (4), acting as a retailer and competitor to those enterprises. Such dual role allows Amazon to exercise competitive advantages: first, it can access detailed, non-public data on the enterprises’ sales, including products, prices, and costumer behavior; and second, it can decide the rules that define the products that appear first as the result of a costumer search.</p><p style="text-align: justify;">In 2022 Amazon had to commit to the European Commission to not use the enterprises’ non-public data for its retail business and to treat equally rival offers in its “Buy Box” (5). Currently, the Digital Markets Act (DMA) establishes matching general obligations for designated gatekeepers (6).</p><p><br></p><p>'''3. Governance Implication'''</p><p style="text-align: justify;">“Vertical Integration” allows platforms to exercise power over enterprises through digital architecture. When a platform operates a marketplace and competes in it, its ordinary decisions on digital architecture (i.e. on algorithms, searches, products visibility) can become tools for power and competition. In a sense, platforms are the ''de facto'' private regulators of markets in which they have clear commercial interests. Such state of affairs allows to understand a strategy change in antitrust cases. Traditionally, antitrust intervenes after the harm, however regulators are moving towards ''ex ante'' conduct rules (i.e. the DMA) (7).</p><p><br></p><p>'''4. Open Question'''</p><p style="text-align: justify;">“Vertical Integration” clearly explains the incentive structure that drives platforms to favor their own products through the exercise of digital architecture mediated competitive advantages. However, “Vertical Integration” assumes that the line between one product (i.e. the marketplace, the search engine) and the other (i.e. the products, the websites competing on the platform) is clear when, in practice, this is not always so. For instance, nowadays when a user search something in Google Search, Google not only provides links to websites that contain the desired information but also the desired information itself with AI-generated summaries. In this case, two possible perspectives arise: on the one hand, that Google could be abusing its position to capture the online information market by displacing websites that depend on it; on the other hand, that Google could be simply improving its search engine and search itself because what users actually want is information and not links to it. In this example, “Vertical Integration” is incapable of settling the issue because it depends on a clear distinction between one product and the other (or one market and the other) and that is absent in this case. Moreover, even if in the presented case was possible to separate one product from the other (or one market from the other), “Vertical Integration” does not provide a clear criteria to establish when an “integration” is abusive exclusion of competitors and when it is legitimate and necessary innovation.</p><p><br></p><p>'''References'''</p><p style="text-align: justify;">(1) “Vertical integration” (''Cambridge Dictionary'') [https://dictionary.cambridge.org/dictionary/english/vertical-integration https://dictionary.cambridge.org/dictionary/english/vertical-integration] accessed 4 October 2026.</p><p>(2) [https://academic.oup.com/antitrust/article/6/3/355/5034073?itm_medium=sidebar&itm_source=trendmd-widget&itm_campaign=Journal_of_Antitrust_Enforcement&itm_content=Journal_of_Antitrust_Enforcement_0 Bostoen Friso, “Online Platforms and Vertical Integration: The Return of Margin Squeeze” (2018) (6) ''Journal of Antitrust Enforcement'' 355.]</p><p style="text-align: justify;">(3) Lovell Keir, “Top 10 Ecommerce Marketplaces in the World: 2026 Rankings by GMV, Users & Reach” (''ServeRetail'', 2 January 2026) [https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/ https://www.serveretail.com/blog/marketplace/the-10-largest-ecommerce-marketplaces-in-the-world-size-reach-and-cx-strategy/] accessed 4 October 2026.</p><p style="text-align: justify;">(4) Ellison Mara, “What are Amazon's Brands, Explained” (''Ir Mountaintopuniversity Ng'') [https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained https://ir.mountaintopuniversity.edu.ng/article/what-are-amazon-s-brands-explained] accessed 4 October 2026.</p><p style="text-align: justify;">(5) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=oj:JOC_2023_087_R_0005 Summary of Commission Decision of 20 December 2022 Relating to a Proceeding under Article 102 of the Treaty on the Functioning of the European Union and Article 54 of the EEA Agreement (Cases AT.40462 – Amazon Marketplace, and AT.40703 – Amazon Buy Box) (2023) OJ C87.]</p><p style="text-align: justify;">(6) [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2022.265.01.0001.01.ENG&toc=OJ%3AL%3A2022%3A265%3ATOC Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) [2022] OJ L265/1.]</p><p style="text-align: justify;">(7) OECD, "Ex Ante Regulation and Competition in Digital Markets" (''OECD Roundtables on Competition Policy Papers, OECD Publishing 2021'') [https://doi.org/10.1787/c83e178d-en https://doi.org/10.1787/c83e178d-en] accessed 4 October 2026.</p>

Excludability and rivalrousness

2026-10-02T11:10:13Z

Fortuny Jané Mariona: Created page with "<p>The terms excludability and rivalrousness both refer to consumption characteristics that can be assigned to- or identified in goods. </p><p>Excludability: Goods to which economic actors can technically or legally restrict access are considered to have ‘high excludability’. Conversely, goods to which access cannot be restricted are of ‘low excludability’, or, in absolute terms, ‘non-excludable’.</p><p>Rivalrousness: Rivalrousness on the other hand refe..."

<p>The terms excludability and rivalrousness both refer to consumption characteristics that can be assigned to- or identified in goods. </p><p>Excludability: Goods to which economic actors can technically or legally restrict access are considered to have ‘high excludability’. Conversely, goods to which access cannot be restricted are of ‘low excludability’, or, in absolute terms, ‘non-excludable’.</p><p>Rivalrousness: Rivalrousness on the other hand refers to the finitude of the good in question. The greater the depletion of the stock, quantity, or amount is on account of one party’s consumption, the more rivalrous a good is. </p><p>Tabulating the characteristics against one another allows for inference and definition of the type of good an object, service, or resource may constitute (see fig. 1). Excludability and Rivalrousness of goods can therethrough serve as a predictor for certain types of market failures: Goods which are non-excludable or of low excludability, but nonetheless costly to provide, are vulnerable to so-called free rider problem. Goods which are non-excludable, but highly rivalrous (common goods), may lead to the tragedy of the commons, that is over-exploitation.<br></p><p>AI Training and the (non-)excludability of information.</p><p> The unusual nature of excludability and rivalrousness of data further compromises the applicability of the goods classification built thereon. In traditional economics, a non-excludable and non-rivalrous good would be seen as a public good. This does apply insofar as data is vulnerable to corporate exploitation without commensurate indemnification. Data usage may however actually be anti-rival in the sense that increasing aggregate usage increases the value of the data (better labeling, easier access, previously undrawn conclusions, etc.), rather than diminish the ‘stock’ of data.</p>

Network effects (direct)

2026-10-02T11:03:37Z

Fortuny Jané Mariona: Created page with "keko"

keko

Infrastructures: Digital Sovereignty

2026-09-25T15:25:11Z

Fortuny Jané Mariona: /* Supply Chain management and the Cloud */

= Infrastructures: Digital Sovereignty =
Digital Sovereignty in the European Union is a [https://www.tandfonline.com/doi/full/10.1080/17579961.2026.2705118 term used to convey ] a broad array of policy ambitions in relation to digital technology development and use: the urgency to regain control over data, infrastructures, and (critical) technologies, the establishment of strategic autonomy, the conclusion of partnerships with geopolitical allies, and the reduction of critical dependencies. According to the Digital Decade Policy Programme [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52023SC0570 Implementation Report] of 2023, digital sovereignty refers to the EU's "ability to act independently in the digital world and therefore it constitutes a crucial means to safeguard [EU] values".

= Brazil =
'''''Words: 2142'''''
<div style="font-weight: 400;">
== 1. Introduction: What Is Digital Sovereignty? ==
</div>
<div style="font-weight: 400;"><p>Digital sovereignty refers to the capacity of a state to exercise autonomy, self-determination, and control over data, digital infrastructure, and technologies. This encompasses three distinct but overlapping dimensions: internet sovereignty (control over networks and online content), data sovereignty (governance of data flows, privacy, and cybersecurity), and technological sovereignty (control over critical technologies such as artificial intelligence, semiconductors, and raw materials). The endeavor toward digital sovereignty was accelerated by the Snowden revelations. Brazil has developed its own discourse on digital sovereignty, shaped by its historical concerns about foreign surveillance, its position as a major emerging economy, and its ambition to become a global technology actor. </p></div>
<div style="font-weight: 400;">
== 2. Brazil's National Digital Sovereignty Outlook ==
</div>
<div style="font-weight: 400;"><p>Brazil's approach to digital sovereignty is rooted in a long-standing concern about technological dependence and foreign surveillance. The 2013 revelation that the National Security Agency had intercepted communications of Brazilian President Dilma Rousseff and surveilled Petrobras (Brazil's state oil company) served as a breakpoint moment. This urged the Brazilian political agenda to reduce reliance on foreign digital infrastructure, and prompted Brazil to accelerate its own digital infrastructure projects. The most notable infrastructure project is the EllaLink undersea cables, connecting Brazil to Portugal (and thereby South America to Europe), which was explicitly designed to circumvent internet routing controlled by the US and enhance Brazil's data [https://www.cambridge.org/core/books/digital-sovereignty-in-the-brics-countries/introduction/88A1164945DC955023BB812CA88FEABC sovereignty. ]</p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty discourse is also closely tied to its open-source tradition. Brazil has historically been a strong proponent of open-source software. In the early 2000’s, during the Lula administration, Brazil’s government promoted free and open-source software as a tool for reducing dependence on proprietary foreign technology and lowering [https://www.researchgate.net/publication/316669377_Free_Software_as_Public_Service_in_Brazil_An_Assessment_of_Activism_Policy_and_Technology costs. ]This open-source orientation remains an element of Brazil's digital sovereignty strategy today: the development of national AI models, open data ecosystems, and publicly governed cloud infrastructure all reflect this tradition.  </p></div>
<div style="font-weight: 400;"><p>The Brazilian AI Plan (PBIA) explicitly includes the development of a national AI software stack and open training databases, reflecting the view that open-source tools are a vehicle for technological autonomy rather than a security risk. </p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty strategy is therefore characterised by two core priorities: (i) reducing dependence on foreign digital infrastructure and proprietary technology and (ii) building domestic capacity in critical technology sectors (AI, semiconductors, critical minerals). </p></div>
<div style="font-weight: 400;">
== 3. Regulatory Framework: Artificial Intelligence ==
</div>
<div style="font-weight: 400;">
=== 3.1 Brazilian AI Strategy (EBIA) ===
</div>
<div style="font-weight: 400;"><p>Brazil's first official national AI strategy, the Estratégia Brasileira de Inteligência Artificial (EBIA), established the country's overarching vision for AI governance. Based on the OECD's AI principles, EBIA is structured around pillars including ethical and responsible AI, data governance, innovation, education and workforce development, public sector use of AI, and international cooperation. It explicitly prioritises human-centred AI, the protection of fundamental rights, transparency, and risk mitigation. However, EBIA is a soft law instrument: it sets principles only, with no binding obligations, no enforcement mechanisms, and no dedicated budget. It functions as a normative framework that articulates values and directions rather than imposing legal duties. </p></div>
<div style="font-weight: 400;">
=== 3.2 Brazilian AI Plan (PBIA, 2024–2028) ===
</div>
<div style="font-weight: 400;"><p>The Plano Brasileiro de Inteligência Artificial (PBIA), launched on 30 July 2024 under the motto "AI for the Good of All," builds on EBIA by translating strategic vision into a concrete investment and infrastructure roadmap. Approved by the National Council for Science and Technology and coordinated by the Ministry of Science, Technology and Innovation, the PBIA is a strategic non-binding soft-law policy framework with a planned investment of R$23.03 billion through 2028. </p></div>
<div style="font-weight: 400;"><p>The PBIA combines immediate-impact initiatives with structural actions organised into five axes. These actions aim to develop the capabilities and skills needed for sustainable AI development in Brazil, while strengthening national sovereignty, technological autonomy, competitiveness and responsible innovation. Approximately 98.1% of planned investment is directed towards these structural actions. AI for Business Innovation (59.9%), Infrastructure and AI Development (25.2%), and AI for Improving Public Services (7.6%) receive the largest shares, followed by Dissemination, Education and Training in AI (5.0%). Support for AI Regulation and Governance receives approximately 0.4%. This distribution indicates an emphasis on building technological and industrial capacity. It is also indicative that Brazil prioritizes developing the technology infrastructure over implementing regulation in the form of hard law. From a digital sovereignty perspective, several elements of the PBIA are particularly significant. The Infrastructure and AI Development axis includes a National AI Infrastructure Program aimed at investing in high-performance computing and autonomous AI hardware to support technological sovereignty. It also includes a Sustainability and Renewable Energy Programme for AI, supporting renewable-energy infrastructure and efficient resource use, and a Programme for Structuring the Data and Software Ecosystem for AI intended to reduce external dependence, improve training datasets and develop a national AI software stack. AI for improving public services axis provides for a Sovereign Cloud, private or community cloud infrastructure managed exclusively by public agencies or state-owned companies, to increase control, security and sovereignty over sensitive data and ensure it is stored on national territory. The AI for Business Innovation axis aims to support sectors within the AI production chain, including information and communication technologies (ICT) and microelectronics, and to position Brazil as a global data centre hub. The PBIA reports that Brazil currently operates only 168 data centres (ranking 13th globally, compared to over 5,000 in the United States). Its AI Value Chain Promotion Programme seeks to strengthen and expand the domestic AI value chain, from supporting startups to developing Brazilian companies supplying foundation models. </p></div>
<div style="font-weight: 400;"><p>Bill No PL 2338/2023, which proposes a comprehensive AI framework, has passed the Senate and remains under consideration in the Chamber of Deputies, the lower house of Brazil’s National Congress. Until it is enacted, Brazil's AI governance framework remains largely in the realm of soft law, creating legal uncertainty for investors, developers, and citizens alike. </p></div>
<div style="font-weight: 400;">
== 4. Regulatory Framework: Semiconductors and Critical Minerals ==
</div>
<div style="font-weight: 400;">
=== 4.1 Brasil Semicon (Law No. 14.968/2024) ===
</div>
<div style="font-weight: 400;"><p>The Brazil Semiconductor Programme (Brasil Semicon), established under Law No. 14.968 of 11 September 2024, constitutes Brazil's principal hard law instrument for technological sovereignty in the semiconductor sector. It establishes a national strategy and guidelines to encourage research, development, innovation, production, and application of semiconductors, displays, and solar panels. Brasil Semicon updates and expands the instruments of PADIS (the Support Program for Technological Development of the Semiconductor Industry), extending tax incentives until the end of 2029 and broadening their scope to include software, specialised services, technical assistance, and other stages of the production chain. Decree No. 13.065 of 16 July 2026 activated the programme, establishing the rules for the semiconductor industry and facilitating access to PADIS tax incentives. The programme aims to attract investments in the national chip supply chain until 2029, directly addressing Brazil's dependence on foreign semiconductor manufacturing. </p></div>
<div style="font-weight: 400;"><div>
=== 4.2 National Policy on Critical and Strategic Minerals (Law No. 15.506/2026) ===
</div>
<div><p>Published on 16 September 2026, Law No. 15.506/2026 establishes a national policy and governance structure for critical and strategic minerals. It aims to promote research, extraction, processing, and transformation of critical and strategic minerals domestically, adding value to supply chains rather than exporting raw materials. The policy explicitly seeks to strengthen Brazil's economic and geopolitical security by ensuring a stable domestic supply of minerals essential to the digital economy — including those required for semiconductors, batteries, and AI hardware. It provides up to R$5 billion in tax credits (covering up to 20% of eligible expenses) from 2030 through 2034 for mineral processing, manufacturing, and recycling projects, and authorises a Mineral Activity Guarantee Fund with up to R$2 billion in federal contributions. This law is significant because Brazil holds some of the world's largest reserves of rare earth minerals and other critical inputs for the digital economy, and the policy represents a strategic decision to leverage these resources for domestic technological development rather than simply exporting them. </p></div>
<div>
== 5. The EU–Brazil Digital Partnership (2026) ==

<div><p>Signed on 12 June 2026, the EU–Brazil Digital Partnership is a soft law instrument establishing a framework for bilateral cooperation on issues that concern digital sovereignty.  </p></div>
<div>
i) Article 2 commits both parties to fostering meaningful digital development and inclusion while preserving digital sovereignty, democratic principles, and human rights.  </div>
<div>
ii) Article 3 provides for reciprocal recognition of data protection levels — based on the European Parliament's adequacy decision of January 2026 and Brazil's ANPD Resolution 32 — thereby easing cross-border data flows and building trust in bilateral data governance.  </div>
<div>iii)
Article 15 commits both parties to developing national technology supply chains to ensure that global interdependence does not undermine their respective technological sovereignties.  </div>
<div>
iv) Article 17 provides for cooperation on AI development and deployment, referencing the PBIA and comparable EU programmes.  </div>
<div>
v) Articles 19 and 21 establish information-sharing mechanisms on data governance, data spaces, digital services, and digital markets, with an explicit commitment to preserving regulatory autonomy.  </div>
<div>
vi) Article 23 references Brazil's EllaLink undersea cable project as a concrete expression of its digital sovereignty ambitions. </div>
<div><p>The Digital Partnership is a precursor to harder legal instruments: it is future-facing, flexible, and oriented toward sharing know-how and building mutual trust. Its soft law nature is appropriate given the current rate of innovation in technology. </p></div>
<div></div>

== 6. Comparison with the EU ==
</div>
<div><p>Brazil and the EU share the same fundamental goal: reducing dependence on foreign (primarily US and Chinese) digital infrastructure and technology. However, they pursue it through different regulatory architectures. </p></div>
<div><p>The EU has adopted a comprehensive, multi-layered hard law framework for digital sovereignty, encompassing the GDPR, the NIS 2 Directive, the Cybersecurity Act, the Chips Act, and the Critical Raw Materials Act, alongside the newly proposed EU Tech Sovereignty Package (June 2026) including the Cloud and AI Development Act (CADA) and an EU Open Source Strategy. The package therefore combines legislative proposals with non-binding policy instruments. The EU's approach combines binding regulation with substantial public investment, and it applies to both public and private sector actors. </p></div>
<div><p>Brazil, by contrast, has followed a more strategy-led approach to developing its dedicated AI framework. Its AI governance framework remains largely in soft law (EBIA and PBIA), with binding legislation (PL 2338) still pending. Brazil’s hard law instruments are concentrated in the industrial and resource sectors (Brasil Semicon; the Critical Minerals Law), reflecting a Brazil’s priority being placed on supply chain sovereignty and infrastructure building (rather than regulatory compliance frameworks).  </p></div>
<div><p>In 2026 Brazil began developing the Nuvem Brasileira, a national cloud infrastructure designed to keep critical government data and control of the infrastructure under Brazilian jurisdiction, while favouring open standards and reducing dependence on foreign technology providers. Specifically, the Brazilian government decided that Microsoft and other foreign big tech providers would not be the preferred providers for the Nuvem Brasileira. The government is explicitly assessing dependencies on foreign suppliers and whether the State could continue operating critical services if an external provider became unavailable. Brazil’s model does not require everything to be Brazilian-made, but focuses on control over data, operations and technology.  This shifts sovereignty from simply where data is stored to who controls the infrastructure, keys, software, jurisdiction and ability to operate independently. It is alongside REDATA, which uses datacentre incentives to build domestic technological capacity. Brazil's open-source orientation also distinguishes it from the EU. Both jurisdictions promote open source as a means of strengthening technological autonomy. While the EU has adopted an Open Source Strategy and the CADA references open-source principles, Brazil's commitment to open-source software is deeper and more historically embedded, reflecting a political tradition that views proprietary technology as a vector of foreign dependence. The PBIA's emphasis on a national AI software stack and open training data reflects this tradition and represents a distinctive approach to technological sovereignty that merits attention in comparative analysis. </p></div>
<div><p>Finally, both Brazil and the EU face the same structural challenge: the global digital economy is dominated by a small number of US and Chinese technology companies, and neither jurisdiction has yet succeeded in producing domestic alternatives at comparable scale. Brazil's ambition to become a global data centre hub and to develop sovereign AI models is bold, but the gap between aspiration and capacity remains large. The EU's more developed AI-specific regulatory architecture provides stronger protections for citizens and clearer rules for industry, but has been criticised for potentially hampering innovation. Brazil's softer approach may allow for faster initial development, but risks leaving citizens and the market without adequate legal protection in the interim. </p></div>
<div>
== 7. Conclusion ==
</div>
<div><p>Brazil's approach to digital sovereignty is characterised by a strong national discourse rooted in concerns about foreign surveillance and technological dependence, a soft law-dominant AI governance framework that is still evolving toward binding regulation, and hard law instruments in the semiconductor and critical minerals sectors that reflect a strategic prioritisation of supply-chain sovereignty. Brazil's open-source tradition adds a distinctive dimension to its digital sovereignty strategy, positioning it differently from both the. The EU–Brazil Digital Partnership represents a meaningful step toward bilateral cooperation, but its soft law nature means  its impact will depend on follow-through.  </p></div></div>

= China =
<p><strong style="font-size: 14.4px;">Words: 2306</strong><br></p>
<div><p><br></p></div>
<div><p>'''Introduction'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;">“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence.</p></div>
<div style="text-align: justify;"><p>In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</p></div>
<div style="text-align: justify;"><p>In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</p></div>
<div style="text-align: justify;"><p>Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</p></div>
<div><p style="text-align: justify;"><br></p></div>
<div><p>'''Cybersecurity Law'''</p></div>
<div><p><br></p></div>
<div><p>The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</p></div>
<div><p style="text-align: justify;" >In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</p></div>
<div><p style="text-align: justify;" >In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</p></div>
<div><p style="text-align: justify;" >Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</p></div>
<div><p style="text-align: justify;" >In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</p></div>
<div><p><br></p></div>
<div><p>'''Data Security Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development.</p></div>
<div><p style="text-align: justify;" >It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</p></div>
<div><p style="text-align: justify;" >The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</p></div>
<div><p style="text-align: justify;" >In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</p></div>
<div><p><br></p></div>
<div><p>'''Personal Information Protection Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40).</p></div>
<div><p style="text-align: justify;" >Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</p></div>
<div><p><br></p></div>
<div><p>'''China’s State Centered Concept of Digital Sovereignty'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to ''“abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order”'' (see article 13), and why the the Data Security Law establishes as an objective to ''“preserve State sovereignty, security, and development interests”'' (see article 1).</p></div>
<div><p style="text-align: justify;" >Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</p></div>
<div><p style="text-align: justify;" >In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</p></div>
<div><p style="text-align: justify;" >In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</p></div>
<div><p style="text-align: justify;" >These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</p></div>
<div><p style="text-align: justify;" >In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</p></div>
<div><p><br></p></div>
<div><p>'''China Model Versus the European Union Model'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context.</p></div>
<div><p style="text-align: justify;" >EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</p></div>
<div><p style="text-align: justify;" >Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</p></div>
<div><p>As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</p></div>
<div><p style="text-align: justify;" >This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</p></div>
<div><p style="text-align: justify;" >Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</p></div>
<div><p>''''''</p>
<p>'''References'''</p></div>
<div><p><br></p></div>
<div><p>'''(1)'''<span class="apple-converted-space"> </span>Cybersecurity Law of the People's Republic of China (2025 Amendment).</p></div>
<div><p>'''(2)'''<span class="apple-converted-space"> </span>Data Security Law of the People's Republic of China (2021).</p></div>
<div><p>'''(3)'''<span class="apple-converted-space"> </span>Personal Information Protection Law of the People's Republic of China (2021).</p></div>
<div><p>'''(4)'''<span class="apple-converted-space"> </span>Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</p></div>
<div><p>'''(5)'''<span class="apple-converted-space"> </span>Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, </p>
[https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']</div>
<div><p>'''(6)'''<span class="apple-converted-space"> </span>Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, </p>
[https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty]</div>
<div>'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>
<div></div>

= [[Infrastructures:India|India]] =

= United States =
== The Concept of Digital Sovereignty ==
<p>The idea of “digital sovereignty” is not a single concept. There are a number of scholars who attempted to define digital sovereignty. [https://www.academia.edu/99043334/What_does_the_notion_of_sovereignty_mean_when_referring_to_the_digital Couture and Toupin] and [https://www.researchgate.net/publication/343611573_The_Fight_for_Digital_Sovereignty_What_It_Is_and_Why_It_Matters_Especially_for_the_EU Floridi] emphasized the '''control''' over the digital realm, in which Floridi saw a combination of democratic legitimacy with innovative flexibility by a hybrid system of control. On the other hand, [https://techreg.org/article/view/23778?articlesBySimilarityPage=1 Chung] looked into the aspect of '''authority''' by defining digital sovereignty as a state’s ability to define, implement and enforce political and legal decisions across digital systems, platforms and data infrastructures. She also reconceptualized the term by asserting that sovereignty should be understood as governance '''capacity''' rather than exclusive control. There is a variety of perspectives in determining what digital sovereignty means and conflicting definitions based on varying national strategies.</p><p>The definition of digital sovereignty adopted throughout this study is a merge of authority and practical capacity of a state to set, apply and defend its own rules governing the digital infrastructure, data flows and algorithmic systems that shape its legal and political orders, against interference by outside actors, whether public or private, including other levels of government within the same state.</p>
=== The United States Sovereignty Strategy: AI Dominance ===
<p>Unlike the EU who attempts to maintain digital sovereignty under its regulatory control, the idea of securing digital sovereignty is not its priority for the US. Their goal is to ensure geopolitical dominance by entrenching American advantage in the technologies that determine their economic and military standing, against a field of competitors, namely China as the principal one.</p><p>From ''[https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf Winning the Race: America’s AI Action Plan]'', Issued on 23 July 2025, the US outlines 103 recommended actions by three pillars:</p>

*Pillar 1: Accelerate AI Innovation – removing “bureaucratic red tapes” which hinder technological advancement by deregulation
*Pillar 2: Build American AI Infrastructure – fostering an environment conducive to AI innovations
*Pillar 3: Lead in International AI Diplomacy and Security – Ensuring its global hegemonic position in AI technology<p>As explicitly stated from the plan, their core interest is in winning the race and securing its geopolitical primacy relative to other competitors rather than enhancing its authority and capacity over its domestic digital governance. The Plan itself has no legal force, yet the actual implementation is played by executive orders and procurements.</p>
== The Four Registers ==
<p>American digital policy has an organising purpose, and it is not regulation. It is primacy: maintaining American advantage in the technologies that determine economic and military standing, against a field of competitors, of which China is the principal one. The framing is stated in the instruments themselves — the order that set the current course is titled Removing Barriers to American Leadership in Artificial Intelligence, and the strategy it produced is titled Winning the Race. Beneath that strategy, the United States steers digital developments through four registers, descending in legal formality and ascending in speed.</p><p>'''Statute''' is the thinnest register. The [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] and the [https://www.congress.gov/bill/118th-congress/house-bill/7521 Protecting Americans from Foreign Adversary Controlled Applications Act] are both narrow and adversary-specific, and general legislation has failed: the Senate stripped a ten-year moratorium on state enforcement of AI laws from the One Big Beautiful Bill Act by a vote of 99 to 1.</p><p>'''Executive orders''' carry the load. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] produced the Data Security Program, an export control keyed to adversary identity rather than to any standard of protection; Executive Order 14320 finances the export of full-stack American AI packages; Executive Order 14365 asserts a national AI framework and directs litigation against inconsistent state laws.</p><p>'''Procurement''' is quieter and probably more effective, and is illustrated below by the cloud and semiconductor sectors.</p><p>'''Announcement''' is the fastest register and the least examined. On 19 January 2025 the President posted on Truth Social that he would issue an order extending the statutory TikTok divestment deadline, and [https://www.theguardian.com/us-news/2025/jan/19/trump-tiktok-ban-executive-order TikTok restored service] in the United States the same day, before any instrument existed. A platform serving some 170 million US users changed its conduct based solely on anticipated legality.</p>
=== Direction of Travel ===
<p>The direction of policy is consistent across all four registers and runs four ways. Outward, the export programme pushes the domestic AI stack into third markets. Inward, the Data Security Program and Team Telecom review screen foreign access based on a counterparty's identity rather than the safeguards it offers. Homeward, subsidy builds domestic capacity. Downward, federal policy presses on the states, and it is working even though preemption ordinarily requires a congressional enactment: Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower automated decision-making statute stripped of deployer impact-assessment duties, while California's frontier AI statute (SB 53) contains a federal-deference clause under which compliance with a comparable federal framework discharges the state obligation. States are deferring in advance to a federal standard that does not yet exist.</p><p>Outward and homeward movement build the US position; inward and downward movement defend it against interference, foreign in the former case and domestic in the latter. The same adversary-identity test recurs in an export control, a subsidy condition, and a screening review alike.</p>

== US Infrastructure and Resources efforts for AI dominance ==

=== Supply Chain management and the Cloud ===

The United States aims to maintain its position in the [https://www.cambridge.org/core/journals/international-organization/article/digital-disintegration-technoblocs-and-strategic-sovereignty-in-the-ai-era/DD86C6FD3FDD7FBBADEF100C6935D577 international order, seeking to surpass and constrain rival powers]. Technological dominance constitutes one of the principal means of pursuing this objective, and in recent years this pursuit has centred increasingly on artificial intelligence, a domain heavily dependent on underlying industrial capacity and resource access.

Cloud service dependency describes a form of [https://www.cambridge.org/core/journals/review-of-international-studies/article/susan-strange-meets-the-everyday-the-mundane-sources-of-structural-power/1D23361D622C523F7EB785EA54105858 structural power] exercised not through territorial control but through infrastructural ownership. Because US firms hold roughly [https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 two-thirds of the EU cloud market], a majority of European data, public and private, resides within entities potentially subject to US jurisdiction, irrespective of the server's physical location. This constitutes strategic advantage precisely because it requires no conventional projection of power abroad: dominance is achieved by occupying the infrastructural layer itself, converting market position into jurisdictional reach and, in turn, translating informational access into epistemic and strategic advantage. The [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] grants the United States access to foreign data provided this is held by a US cloud service provider, access guaranteed only through a defined legal process, the issuance of a judicial warrant subject to probable cause. [https://www.law.cornell.edu/uscode/text/50/1881a FISA Section 702], by contrast, authorises access to foreign data held in US clouds for intelligence purposes through compelled provider assistance, and in this instance no comparable judicial procedure is required by law. These divergent standards of authorisation, and the reach they enable, stand in direct tension with the protections EU law seeks to guarantee.

<p dir="auto">Ironically, the US maintains mechanisms to protect its data from foreign control while monitoring others’, consolidating digital sovereignty by setting the terms of engagement.</p>
[https://www.fedramp.gov/ FedRAMP] establishes the conditions under which any cloud provider, including foreign entities, may process US federal government data, asserting sovereign gatekeeping over access to its own infrastructure even as it resists equivalent constraints abroad. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] and the accompanying [https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern DOJ rule (2025)], although criticised for their generalistic scope, restrict the outbound transfer of bulk sensitive data to designated "countries of concern." The asymmetry is instructive when set against the EU's broadly equivalent instruments: both regimes exercise control, but over opposite targets, the United States restricts flows to named adversaries, while the EU restricts flows to any third country whose legal framework it deems inadequate, a criterion of general application rather than one confined to a defined list of hostile states.

The EU's principal instrument of power has consequently been regulatory rather than infrastructural, expressed through the [https://gdpr-info.eu/art-48-gdpr/ GDPR (Art. 48)] and the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act], mechanisms of constraint and protection rather than instruments of reach comparable to the [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] or [https://www.law.cornell.edu/uscode/text/50/1881a FISA]. There's a clear divergence in objective these reflect, and it is rooted in the different conception tof human rights, values and norms, related to data protection and privacy both actors have. Worth mentioning, the EU's position is further constrained by a material deficit, limited infrastructural capacity, financial resources.

As of right now, the United States can circumvent the normative safeguards the EU has imposed in some cases (through [https://www.law.cornell.edu/uscode/text/50/1881a FISA]), and it already possesses [https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 the infrastructural capacity the EU lacks ]. This gives the US vast dominance in the field, which could be equated to what the EU coins as cloud sovereignty. Aware of the risks this dependency poses, both to data access and to the strategic advantage it affords the US, the EU has sought to reduce it through a succession of initiatives. [https://www.enisa.europa.eu/publications/eucs-cloud-service-scheme EUCS] was one such attempt, and remains only a non-legally-binding standard; whether the [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52026PC0502 Cloud and AI Development Act] fares better remains to be seen.

=== Supply Chain management and Semiconductors ===
The United States and the European Union are equally invested in developing a domestic semiconductor industry, what separates them is their approach, the risks willing to run, the tools willing to use, and, above all, the capabilities and resources each power has. The US specifially aims to develop a bigger industry in this sector to rival competing hegemonic powers, to then gain AI dominance, strategic advantage and a stronger position in the international order.

The centrepiece is the [https://www.govinfo.gov/content/pkg/PLAW-117publ167/pdf/PLAW-117publ167.pdf CHIPS and Science Act], a statute that funds domestic fabrication and research through grants, loans and awards administered by the Department of Commerce. Its force comes from its scale: $39 billion in manufacturing incentives (including $2 billion reserved for legacy chips) and $11 billion for R&D, a federal pool officials themselves [https://www.reuters.com/technology/us-picks-team-oversee-527-bln-semiconductor-funding-2022-09-20/ described at the time] as $52.7 billion, on top of a Section 48D investment tax credit set from 25 to 35 percent in 2025. This is a single, centralised federal pool, commanded and disbursed by one government. The [https://eur-lex.europa.eu/eli/reg/2023/1781/oj/eng EU Chips Act (Regulation (EU) 2023/1781)] pursues the identical objective, a resilient domestic semiconductor base, but with a wholly different reach: its own budget is capped at a "maximum indicative amount" of just EUR 3.3 billion and decentralised Member State state aid. The US pursues to clash with other powers and surpass them through several measures in this statute, none of which the EU has an equivalent to.

The [https://www.federalregister.gov/documents/2023/09/25/2023-20471/preventing-the-improper-use-of-chips-act-funding CHIPS guardrails rule] binds every recipient of the funds for ten years: the Expansion Clawback bars material expansion, defined as growth of more than 5 percent, of semiconductor manufacturing capacity in a "foreign country of concern". These are protection measures, converting a subsidy into standing control over where a funded firm may grow and with whom it may cooperate, minimising ties to rival powers while building US capacity unilaterally.

The [https://www.federalregister.gov/documents/2022/10/13/2022-21658/implementation-of-additional-export-controls-certain-advanced-computing-and-semiconductor BIS export-control rule] does two things. First, it blocks advanced chips and chip-making equipment from reaching ‘countries of concern’ even when made outside the US, if US' technology, software or tools were used somewhere along the way to make them. Second, it stops any American, wherever in the world they work, from helping build advanced chips for those countries, even in a support role like shipping or servicing. What the US rule shows, in a way cloud policy does not, is active separation: a deliberate policy of isolating adversary states from American inputs, expertise and even American citizens' labour, building domestic capacity at home rather than permitting it to leak abroad through investment, export or cooperation.

The [https://www.federalregister.gov/documents/2026/01/20/2026-01052/adjusting-imports-of-semiconductors-semiconductor-manufacturing-equipment-and-their-derivative Section 232 proclamation] of 14 January 2026 shows the same modus operandi differently: a 25% tariff on certain advanced chips, and, in August 2025, the [https://newsroom.intel.com/corporate/intel-and-trump-administration-reach-historic-agreement conversion of $8.9 billion owed to Intel into a 9.9 percent equity stake] in the company. Neither is a law of general application; both are one-off executive moves, using a tariff or an ownership stake to get what the government wants directly. The US reaches for leverage and deal-making, not just regulation, a tool the EU does not use.

CHIPS award recipients are also barred by law from using federal funds to pay shareholder dividends or buy back stock, a restriction the [https://www.nist.gov/document/approach-capital-allocation-policies CHIPS Program Office] has sought to extend for five years from the date of an award.

=== Supply Chain Management and Rare Earth Minerals ===
<p class="mwt-heading">AI systems require advanced semiconductors, semiconductors require rare earth elements and critical minerals,  and the United States currently remains reliant on processing capacity concentrated in China. Where the [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] addresses the fabrication layer, a separate and more fragmented body of law addresses the mineral layer beneath it. Unlike the EU's [https://eur-lex.europa.eu/eli/reg/2024/1252/oj/eng Critical Raw Materials Act], the American framework layers a foundational statute, an executive order, and a narrower defense-procurement statute.<br></p>

==== Energy Act of 2020 ====
Section 7002 of the Energy Act of 2020 (codified at [https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=30-USC-185389929-22931526&term_occur=999&term_src= 30 U.S.C. §1606]) supplies the foundational definitions. It defines a "critical mineral" through a delegated standard: a "byproduct" is a critical mineral whose recovery depends on the production of a host mineral not itself designated critical, while a "critical material" is any non-fuel mineral, element, substance, or material the Secretary of Energy determines carries a high risk of supply-chain disruption. This is primarily an administrative and classificatory act: it does not itself compel production, but it creates the taxonomy (which of the 17 rare earth elements are legally "critical") on which subsequent executive and procurement action depends.

==== Executive Order 14241 (2025) ====
[https://public-inspection.federalregister.gov/2025-05212.pdf Executive Order 14241], entitled "Immediate Measures to Increase American Mineral Production," signed March 20, 2025, operationalizes that taxonomy. Its Section 1 purpose clause is unusually candid about the framing: national and economic security are now threatened by dependence on hostile foreign powers. Operationally, Section 3 directs every federal agency involved in permitting to submit to the National Energy Dominance Council a list of all mineral production projects for which a plan of operations or permit application has been submitted, after which agency heads must identify projects that can be immediately approved and expedite them. The Order invokes [https://www.law.cornell.edu/uscode/text/50/4533 Title III of the Defense Production Act] to mobilize financing, and tasks the NEDC, chaired by the Secretary of the Interior, with coordinating implementation across Defense, Energy, Interior, and Agriculture. Unlike the CHIPS Act, it required no congressional appropriation, and unlike the Energy Act, it does not merely classify inputs but seeks to physically build an alternative domestic supply chain, the mining-and-processing analogue to the CRMA's "strategic projects" mechanism. Executive Order 14241 has since been diluted by [https://www.whitehouse.gov/presidential-actions/2025/04/reinvigorating-americas-beautiful-clean-coal-industry-and-amending-executive-order-14241/ Executive Order 14261], which extends designation of criticality to sectorally unrelated materials such as coal.

==== 10 U.S.C. §4872 and the DFARS ====
The narrowest instrument is [https://www.law.cornell.edu/uscode/text/10/4872 10 U.S.C. §4872], which provides that the Secretary of Defense may not procure any covered material melted or produced in any covered nation, or any end item containing such material. [https://www.law.cornell.edu/definitions/uscode.php?def_id=10-USC-1197798417-780045830&term_src=title:10:subtitle:A:part:V:subpart:I:chapter:385:subchapter:III:section:4872 “Covered nations"] are defined as North Korea, China, Russia, and Iran, covered materials include samarium-cobalt and neodymium-iron-boron magnets. Implemented through [https://www.acquisition.gov/dfars/225.7018-2-restriction. DFARS 225.7018-2], the clause currently bars acquisition of any covered material melted or produced in any covered country, tightening in 2027 to cover the entire chain. This statute does not build supply; it leverages the federal government's own purchasing power to exclude adversary-sourced inputs from the defense industrial base, a tool with no direct EU parallel, since the CRMA's diversification targets operate through incentive rather than exclusion.

Infrastructures: Digital Sovereignty

2026-09-25T15:22:04Z

Fortuny Jané Mariona: /* Supply Chain management and Semiconductors */

= Infrastructures: Digital Sovereignty =
Digital Sovereignty in the European Union is a [https://www.tandfonline.com/doi/full/10.1080/17579961.2026.2705118 term used to convey ] a broad array of policy ambitions in relation to digital technology development and use: the urgency to regain control over data, infrastructures, and (critical) technologies, the establishment of strategic autonomy, the conclusion of partnerships with geopolitical allies, and the reduction of critical dependencies. According to the Digital Decade Policy Programme [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52023SC0570 Implementation Report] of 2023, digital sovereignty refers to the EU's "ability to act independently in the digital world and therefore it constitutes a crucial means to safeguard [EU] values".

= Brazil =
'''''Words: 2142'''''
<div style="font-weight: 400;">
== 1. Introduction: What Is Digital Sovereignty? ==
</div>
<div style="font-weight: 400;"><p>Digital sovereignty refers to the capacity of a state to exercise autonomy, self-determination, and control over data, digital infrastructure, and technologies. This encompasses three distinct but overlapping dimensions: internet sovereignty (control over networks and online content), data sovereignty (governance of data flows, privacy, and cybersecurity), and technological sovereignty (control over critical technologies such as artificial intelligence, semiconductors, and raw materials). The endeavor toward digital sovereignty was accelerated by the Snowden revelations. Brazil has developed its own discourse on digital sovereignty, shaped by its historical concerns about foreign surveillance, its position as a major emerging economy, and its ambition to become a global technology actor. </p></div>
<div style="font-weight: 400;">
== 2. Brazil's National Digital Sovereignty Outlook ==
</div>
<div style="font-weight: 400;"><p>Brazil's approach to digital sovereignty is rooted in a long-standing concern about technological dependence and foreign surveillance. The 2013 revelation that the National Security Agency had intercepted communications of Brazilian President Dilma Rousseff and surveilled Petrobras (Brazil's state oil company) served as a breakpoint moment. This urged the Brazilian political agenda to reduce reliance on foreign digital infrastructure, and prompted Brazil to accelerate its own digital infrastructure projects. The most notable infrastructure project is the EllaLink undersea cables, connecting Brazil to Portugal (and thereby South America to Europe), which was explicitly designed to circumvent internet routing controlled by the US and enhance Brazil's data [https://www.cambridge.org/core/books/digital-sovereignty-in-the-brics-countries/introduction/88A1164945DC955023BB812CA88FEABC sovereignty. ]</p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty discourse is also closely tied to its open-source tradition. Brazil has historically been a strong proponent of open-source software. In the early 2000’s, during the Lula administration, Brazil’s government promoted free and open-source software as a tool for reducing dependence on proprietary foreign technology and lowering [https://www.researchgate.net/publication/316669377_Free_Software_as_Public_Service_in_Brazil_An_Assessment_of_Activism_Policy_and_Technology costs. ]This open-source orientation remains an element of Brazil's digital sovereignty strategy today: the development of national AI models, open data ecosystems, and publicly governed cloud infrastructure all reflect this tradition.  </p></div>
<div style="font-weight: 400;"><p>The Brazilian AI Plan (PBIA) explicitly includes the development of a national AI software stack and open training databases, reflecting the view that open-source tools are a vehicle for technological autonomy rather than a security risk. </p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty strategy is therefore characterised by two core priorities: (i) reducing dependence on foreign digital infrastructure and proprietary technology and (ii) building domestic capacity in critical technology sectors (AI, semiconductors, critical minerals). </p></div>
<div style="font-weight: 400;">
== 3. Regulatory Framework: Artificial Intelligence ==
</div>
<div style="font-weight: 400;">
=== 3.1 Brazilian AI Strategy (EBIA) ===
</div>
<div style="font-weight: 400;"><p>Brazil's first official national AI strategy, the Estratégia Brasileira de Inteligência Artificial (EBIA), established the country's overarching vision for AI governance. Based on the OECD's AI principles, EBIA is structured around pillars including ethical and responsible AI, data governance, innovation, education and workforce development, public sector use of AI, and international cooperation. It explicitly prioritises human-centred AI, the protection of fundamental rights, transparency, and risk mitigation. However, EBIA is a soft law instrument: it sets principles only, with no binding obligations, no enforcement mechanisms, and no dedicated budget. It functions as a normative framework that articulates values and directions rather than imposing legal duties. </p></div>
<div style="font-weight: 400;">
=== 3.2 Brazilian AI Plan (PBIA, 2024–2028) ===
</div>
<div style="font-weight: 400;"><p>The Plano Brasileiro de Inteligência Artificial (PBIA), launched on 30 July 2024 under the motto "AI for the Good of All," builds on EBIA by translating strategic vision into a concrete investment and infrastructure roadmap. Approved by the National Council for Science and Technology and coordinated by the Ministry of Science, Technology and Innovation, the PBIA is a strategic non-binding soft-law policy framework with a planned investment of R$23.03 billion through 2028. </p></div>
<div style="font-weight: 400;"><p>The PBIA combines immediate-impact initiatives with structural actions organised into five axes. These actions aim to develop the capabilities and skills needed for sustainable AI development in Brazil, while strengthening national sovereignty, technological autonomy, competitiveness and responsible innovation. Approximately 98.1% of planned investment is directed towards these structural actions. AI for Business Innovation (59.9%), Infrastructure and AI Development (25.2%), and AI for Improving Public Services (7.6%) receive the largest shares, followed by Dissemination, Education and Training in AI (5.0%). Support for AI Regulation and Governance receives approximately 0.4%. This distribution indicates an emphasis on building technological and industrial capacity. It is also indicative that Brazil prioritizes developing the technology infrastructure over implementing regulation in the form of hard law. From a digital sovereignty perspective, several elements of the PBIA are particularly significant. The Infrastructure and AI Development axis includes a National AI Infrastructure Program aimed at investing in high-performance computing and autonomous AI hardware to support technological sovereignty. It also includes a Sustainability and Renewable Energy Programme for AI, supporting renewable-energy infrastructure and efficient resource use, and a Programme for Structuring the Data and Software Ecosystem for AI intended to reduce external dependence, improve training datasets and develop a national AI software stack. AI for improving public services axis provides for a Sovereign Cloud, private or community cloud infrastructure managed exclusively by public agencies or state-owned companies, to increase control, security and sovereignty over sensitive data and ensure it is stored on national territory. The AI for Business Innovation axis aims to support sectors within the AI production chain, including information and communication technologies (ICT) and microelectronics, and to position Brazil as a global data centre hub. The PBIA reports that Brazil currently operates only 168 data centres (ranking 13th globally, compared to over 5,000 in the United States). Its AI Value Chain Promotion Programme seeks to strengthen and expand the domestic AI value chain, from supporting startups to developing Brazilian companies supplying foundation models. </p></div>
<div style="font-weight: 400;"><p>Bill No PL 2338/2023, which proposes a comprehensive AI framework, has passed the Senate and remains under consideration in the Chamber of Deputies, the lower house of Brazil’s National Congress. Until it is enacted, Brazil's AI governance framework remains largely in the realm of soft law, creating legal uncertainty for investors, developers, and citizens alike. </p></div>
<div style="font-weight: 400;">
== 4. Regulatory Framework: Semiconductors and Critical Minerals ==
</div>
<div style="font-weight: 400;">
=== 4.1 Brasil Semicon (Law No. 14.968/2024) ===
</div>
<div style="font-weight: 400;"><p>The Brazil Semiconductor Programme (Brasil Semicon), established under Law No. 14.968 of 11 September 2024, constitutes Brazil's principal hard law instrument for technological sovereignty in the semiconductor sector. It establishes a national strategy and guidelines to encourage research, development, innovation, production, and application of semiconductors, displays, and solar panels. Brasil Semicon updates and expands the instruments of PADIS (the Support Program for Technological Development of the Semiconductor Industry), extending tax incentives until the end of 2029 and broadening their scope to include software, specialised services, technical assistance, and other stages of the production chain. Decree No. 13.065 of 16 July 2026 activated the programme, establishing the rules for the semiconductor industry and facilitating access to PADIS tax incentives. The programme aims to attract investments in the national chip supply chain until 2029, directly addressing Brazil's dependence on foreign semiconductor manufacturing. </p></div>
<div style="font-weight: 400;"><div>
=== 4.2 National Policy on Critical and Strategic Minerals (Law No. 15.506/2026) ===
</div>
<div><p>Published on 16 September 2026, Law No. 15.506/2026 establishes a national policy and governance structure for critical and strategic minerals. It aims to promote research, extraction, processing, and transformation of critical and strategic minerals domestically, adding value to supply chains rather than exporting raw materials. The policy explicitly seeks to strengthen Brazil's economic and geopolitical security by ensuring a stable domestic supply of minerals essential to the digital economy — including those required for semiconductors, batteries, and AI hardware. It provides up to R$5 billion in tax credits (covering up to 20% of eligible expenses) from 2030 through 2034 for mineral processing, manufacturing, and recycling projects, and authorises a Mineral Activity Guarantee Fund with up to R$2 billion in federal contributions. This law is significant because Brazil holds some of the world's largest reserves of rare earth minerals and other critical inputs for the digital economy, and the policy represents a strategic decision to leverage these resources for domestic technological development rather than simply exporting them. </p></div>
<div>
== 5. The EU–Brazil Digital Partnership (2026) ==

<div><p>Signed on 12 June 2026, the EU–Brazil Digital Partnership is a soft law instrument establishing a framework for bilateral cooperation on issues that concern digital sovereignty.  </p></div>
<div>
i) Article 2 commits both parties to fostering meaningful digital development and inclusion while preserving digital sovereignty, democratic principles, and human rights.  </div>
<div>
ii) Article 3 provides for reciprocal recognition of data protection levels — based on the European Parliament's adequacy decision of January 2026 and Brazil's ANPD Resolution 32 — thereby easing cross-border data flows and building trust in bilateral data governance.  </div>
<div>iii)
Article 15 commits both parties to developing national technology supply chains to ensure that global interdependence does not undermine their respective technological sovereignties.  </div>
<div>
iv) Article 17 provides for cooperation on AI development and deployment, referencing the PBIA and comparable EU programmes.  </div>
<div>
v) Articles 19 and 21 establish information-sharing mechanisms on data governance, data spaces, digital services, and digital markets, with an explicit commitment to preserving regulatory autonomy.  </div>
<div>
vi) Article 23 references Brazil's EllaLink undersea cable project as a concrete expression of its digital sovereignty ambitions. </div>
<div><p>The Digital Partnership is a precursor to harder legal instruments: it is future-facing, flexible, and oriented toward sharing know-how and building mutual trust. Its soft law nature is appropriate given the current rate of innovation in technology. </p></div>
<div></div>

== 6. Comparison with the EU ==
</div>
<div><p>Brazil and the EU share the same fundamental goal: reducing dependence on foreign (primarily US and Chinese) digital infrastructure and technology. However, they pursue it through different regulatory architectures. </p></div>
<div><p>The EU has adopted a comprehensive, multi-layered hard law framework for digital sovereignty, encompassing the GDPR, the NIS 2 Directive, the Cybersecurity Act, the Chips Act, and the Critical Raw Materials Act, alongside the newly proposed EU Tech Sovereignty Package (June 2026) including the Cloud and AI Development Act (CADA) and an EU Open Source Strategy. The package therefore combines legislative proposals with non-binding policy instruments. The EU's approach combines binding regulation with substantial public investment, and it applies to both public and private sector actors. </p></div>
<div><p>Brazil, by contrast, has followed a more strategy-led approach to developing its dedicated AI framework. Its AI governance framework remains largely in soft law (EBIA and PBIA), with binding legislation (PL 2338) still pending. Brazil’s hard law instruments are concentrated in the industrial and resource sectors (Brasil Semicon; the Critical Minerals Law), reflecting a Brazil’s priority being placed on supply chain sovereignty and infrastructure building (rather than regulatory compliance frameworks).  </p></div>
<div><p>In 2026 Brazil began developing the Nuvem Brasileira, a national cloud infrastructure designed to keep critical government data and control of the infrastructure under Brazilian jurisdiction, while favouring open standards and reducing dependence on foreign technology providers. Specifically, the Brazilian government decided that Microsoft and other foreign big tech providers would not be the preferred providers for the Nuvem Brasileira. The government is explicitly assessing dependencies on foreign suppliers and whether the State could continue operating critical services if an external provider became unavailable. Brazil’s model does not require everything to be Brazilian-made, but focuses on control over data, operations and technology.  This shifts sovereignty from simply where data is stored to who controls the infrastructure, keys, software, jurisdiction and ability to operate independently. It is alongside REDATA, which uses datacentre incentives to build domestic technological capacity. Brazil's open-source orientation also distinguishes it from the EU. Both jurisdictions promote open source as a means of strengthening technological autonomy. While the EU has adopted an Open Source Strategy and the CADA references open-source principles, Brazil's commitment to open-source software is deeper and more historically embedded, reflecting a political tradition that views proprietary technology as a vector of foreign dependence. The PBIA's emphasis on a national AI software stack and open training data reflects this tradition and represents a distinctive approach to technological sovereignty that merits attention in comparative analysis. </p></div>
<div><p>Finally, both Brazil and the EU face the same structural challenge: the global digital economy is dominated by a small number of US and Chinese technology companies, and neither jurisdiction has yet succeeded in producing domestic alternatives at comparable scale. Brazil's ambition to become a global data centre hub and to develop sovereign AI models is bold, but the gap between aspiration and capacity remains large. The EU's more developed AI-specific regulatory architecture provides stronger protections for citizens and clearer rules for industry, but has been criticised for potentially hampering innovation. Brazil's softer approach may allow for faster initial development, but risks leaving citizens and the market without adequate legal protection in the interim. </p></div>
<div>
== 7. Conclusion ==
</div>
<div><p>Brazil's approach to digital sovereignty is characterised by a strong national discourse rooted in concerns about foreign surveillance and technological dependence, a soft law-dominant AI governance framework that is still evolving toward binding regulation, and hard law instruments in the semiconductor and critical minerals sectors that reflect a strategic prioritisation of supply-chain sovereignty. Brazil's open-source tradition adds a distinctive dimension to its digital sovereignty strategy, positioning it differently from both the. The EU–Brazil Digital Partnership represents a meaningful step toward bilateral cooperation, but its soft law nature means  its impact will depend on follow-through.  </p></div></div>

= China =
<p><strong style="font-size: 14.4px;">Words: 2306</strong><br></p>
<div><p><br></p></div>
<div><p>'''Introduction'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;">“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence.</p></div>
<div style="text-align: justify;"><p>In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</p></div>
<div style="text-align: justify;"><p>In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</p></div>
<div style="text-align: justify;"><p>Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</p></div>
<div><p style="text-align: justify;"><br></p></div>
<div><p>'''Cybersecurity Law'''</p></div>
<div><p><br></p></div>
<div><p>The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</p></div>
<div><p style="text-align: justify;" >In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</p></div>
<div><p style="text-align: justify;" >In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</p></div>
<div><p style="text-align: justify;" >Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</p></div>
<div><p style="text-align: justify;" >In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</p></div>
<div><p><br></p></div>
<div><p>'''Data Security Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development.</p></div>
<div><p style="text-align: justify;" >It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</p></div>
<div><p style="text-align: justify;" >The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</p></div>
<div><p style="text-align: justify;" >In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</p></div>
<div><p><br></p></div>
<div><p>'''Personal Information Protection Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40).</p></div>
<div><p style="text-align: justify;" >Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</p></div>
<div><p><br></p></div>
<div><p>'''China’s State Centered Concept of Digital Sovereignty'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to ''“abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order”'' (see article 13), and why the the Data Security Law establishes as an objective to ''“preserve State sovereignty, security, and development interests”'' (see article 1).</p></div>
<div><p style="text-align: justify;" >Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</p></div>
<div><p style="text-align: justify;" >In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</p></div>
<div><p style="text-align: justify;" >In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</p></div>
<div><p style="text-align: justify;" >These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</p></div>
<div><p style="text-align: justify;" >In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</p></div>
<div><p><br></p></div>
<div><p>'''China Model Versus the European Union Model'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context.</p></div>
<div><p style="text-align: justify;" >EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</p></div>
<div><p style="text-align: justify;" >Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</p></div>
<div><p>As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</p></div>
<div><p style="text-align: justify;" >This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</p></div>
<div><p style="text-align: justify;" >Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</p></div>
<div><p>''''''</p>
<p>'''References'''</p></div>
<div><p><br></p></div>
<div><p>'''(1)'''<span class="apple-converted-space"> </span>Cybersecurity Law of the People's Republic of China (2025 Amendment).</p></div>
<div><p>'''(2)'''<span class="apple-converted-space"> </span>Data Security Law of the People's Republic of China (2021).</p></div>
<div><p>'''(3)'''<span class="apple-converted-space"> </span>Personal Information Protection Law of the People's Republic of China (2021).</p></div>
<div><p>'''(4)'''<span class="apple-converted-space"> </span>Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</p></div>
<div><p>'''(5)'''<span class="apple-converted-space"> </span>Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, </p>
[https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']</div>
<div><p>'''(6)'''<span class="apple-converted-space"> </span>Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, </p>
[https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty]</div>
<div>'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>
<div></div>

= [[Infrastructures:India|India]] =

= United States =
== The Concept of Digital Sovereignty ==
<p>The idea of “digital sovereignty” is not a single concept. There are a number of scholars who attempted to define digital sovereignty. [https://www.academia.edu/99043334/What_does_the_notion_of_sovereignty_mean_when_referring_to_the_digital Couture and Toupin] and [https://www.researchgate.net/publication/343611573_The_Fight_for_Digital_Sovereignty_What_It_Is_and_Why_It_Matters_Especially_for_the_EU Floridi] emphasized the '''control''' over the digital realm, in which Floridi saw a combination of democratic legitimacy with innovative flexibility by a hybrid system of control. On the other hand, [https://techreg.org/article/view/23778?articlesBySimilarityPage=1 Chung] looked into the aspect of '''authority''' by defining digital sovereignty as a state’s ability to define, implement and enforce political and legal decisions across digital systems, platforms and data infrastructures. She also reconceptualized the term by asserting that sovereignty should be understood as governance '''capacity''' rather than exclusive control. There is a variety of perspectives in determining what digital sovereignty means and conflicting definitions based on varying national strategies.</p><p>The definition of digital sovereignty adopted throughout this study is a merge of authority and practical capacity of a state to set, apply and defend its own rules governing the digital infrastructure, data flows and algorithmic systems that shape its legal and political orders, against interference by outside actors, whether public or private, including other levels of government within the same state.</p>
=== The United States Sovereignty Strategy: AI Dominance ===
<p>Unlike the EU who attempts to maintain digital sovereignty under its regulatory control, the idea of securing digital sovereignty is not its priority for the US. Their goal is to ensure geopolitical dominance by entrenching American advantage in the technologies that determine their economic and military standing, against a field of competitors, namely China as the principal one.</p><p>From ''[https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf Winning the Race: America’s AI Action Plan]'', Issued on 23 July 2025, the US outlines 103 recommended actions by three pillars:</p>

*Pillar 1: Accelerate AI Innovation – removing “bureaucratic red tapes” which hinder technological advancement by deregulation
*Pillar 2: Build American AI Infrastructure – fostering an environment conducive to AI innovations
*Pillar 3: Lead in International AI Diplomacy and Security – Ensuring its global hegemonic position in AI technology<p>As explicitly stated from the plan, their core interest is in winning the race and securing its geopolitical primacy relative to other competitors rather than enhancing its authority and capacity over its domestic digital governance. The Plan itself has no legal force, yet the actual implementation is played by executive orders and procurements.</p>
== The Four Registers ==
<p>American digital policy has an organising purpose, and it is not regulation. It is primacy: maintaining American advantage in the technologies that determine economic and military standing, against a field of competitors, of which China is the principal one. The framing is stated in the instruments themselves — the order that set the current course is titled Removing Barriers to American Leadership in Artificial Intelligence, and the strategy it produced is titled Winning the Race. Beneath that strategy, the United States steers digital developments through four registers, descending in legal formality and ascending in speed.</p><p>'''Statute''' is the thinnest register. The [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] and the [https://www.congress.gov/bill/118th-congress/house-bill/7521 Protecting Americans from Foreign Adversary Controlled Applications Act] are both narrow and adversary-specific, and general legislation has failed: the Senate stripped a ten-year moratorium on state enforcement of AI laws from the One Big Beautiful Bill Act by a vote of 99 to 1.</p><p>'''Executive orders''' carry the load. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] produced the Data Security Program, an export control keyed to adversary identity rather than to any standard of protection; Executive Order 14320 finances the export of full-stack American AI packages; Executive Order 14365 asserts a national AI framework and directs litigation against inconsistent state laws.</p><p>'''Procurement''' is quieter and probably more effective, and is illustrated below by the cloud and semiconductor sectors.</p><p>'''Announcement''' is the fastest register and the least examined. On 19 January 2025 the President posted on Truth Social that he would issue an order extending the statutory TikTok divestment deadline, and [https://www.theguardian.com/us-news/2025/jan/19/trump-tiktok-ban-executive-order TikTok restored service] in the United States the same day, before any instrument existed. A platform serving some 170 million US users changed its conduct based solely on anticipated legality.</p>
=== Direction of Travel ===
<p>The direction of policy is consistent across all four registers and runs four ways. Outward, the export programme pushes the domestic AI stack into third markets. Inward, the Data Security Program and Team Telecom review screen foreign access based on a counterparty's identity rather than the safeguards it offers. Homeward, subsidy builds domestic capacity. Downward, federal policy presses on the states, and it is working even though preemption ordinarily requires a congressional enactment: Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower automated decision-making statute stripped of deployer impact-assessment duties, while California's frontier AI statute (SB 53) contains a federal-deference clause under which compliance with a comparable federal framework discharges the state obligation. States are deferring in advance to a federal standard that does not yet exist.</p><p>Outward and homeward movement build the US position; inward and downward movement defend it against interference, foreign in the former case and domestic in the latter. The same adversary-identity test recurs in an export control, a subsidy condition, and a screening review alike.</p>

== US Infrastructure and Resources efforts for AI dominance ==

=== Supply Chain management and the Cloud ===

The United States aims to maintain its position in the [https://www.cambridge.org/core/journals/international-organization/article/digital-disintegration-technoblocs-and-strategic-sovereignty-in-the-ai-era/DD86C6FD3FDD7FBBADEF100C6935D577 international order, seeking to surpass and constrain rival powers]. Technological dominance constitutes one of the principal means of pursuing this objective, and in recent years this pursuit has centred increasingly on artificial intelligence, a domain heavily dependent on underlying industrial capacity and resource access.

Cloud service dependency describes a form of [https://www.cambridge.org/core/journals/review-of-international-studies/article/susan-strange-meets-the-everyday-the-mundane-sources-of-structural-power/1D23361D622C523F7EB785EA54105858 structural power] exercised not through territorial control but through infrastructural ownership. Because US firms hold roughly [https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 two-thirds of the EU cloud market], a majority of European data, public and private, resides within entities potentially subject to US jurisdiction, irrespective of the server's physical location. This constitutes strategic advantage precisely because it requires no conventional projection of power abroad: dominance is achieved by occupying the infrastructural layer itself, converting market position into jurisdictional reach and, in turn, translating informational access into epistemic and strategic advantage. The [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] grants the United States access to foreign data provided this is held by a US cloud service provider, access guaranteed only through a defined legal process, the issuance of a judicial warrant subject to probable cause. [https://www.law.cornell.edu/uscode/text/50/1881a FISA Section 702], by contrast, authorises access to foreign data held in US clouds for intelligence purposes through compelled provider assistance, and in this instance no comparable judicial procedure is required by law. These divergent standards of authorisation, and the reach they enable, stand in direct tension with the protections EU law seeks to guarantee.

<p dir="auto">Ironically, the US maintains mechanisms to protect its data from foreign control while monitoring others’, consolidating digital sovereignty by setting the terms of engagement.</p>
[https://www.fedramp.gov/ FedRAMP] establishes the conditions under which any cloud provider, including foreign entities, may process US federal government data, asserting sovereign gatekeeping over access to its own infrastructure even as it resists equivalent constraints abroad. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] and the accompanying [https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern DOJ rule (2025)], although criticised for their generalistic scope, restrict the outbound transfer of bulk sensitive data to designated "countries of concern." The asymmetry is instructive when set against the EU's broadly equivalent instruments: both regimes exercise control, but over opposite targets, the United States restricts flows to named adversaries, while the EU restricts flows to any third country whose legal framework it deems inadequate, a criterion of general application rather than one confined to a defined list of hostile states.

The EU's principal instrument of power has consequently been regulatory rather than infrastructural, expressed through the [https://gdpr-info.eu/art-48-gdpr/ GDPR (Art. 48)] and the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act], mechanisms of constraint and protection rather than instruments of reach comparable to the [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] or [https://www.law.cornell.edu/uscode/text/50/1881a FISA]. There's a clear divergence in objective these reflect, and it is rooted in the different conception tof human rights, values and norms, related to data protection and privacy both actors have. Worth mentioning, the EU's position is further constrained by a material deficit, limited infrastructural capacity, financial resources.

As of right now, the United States can circumvent the normative safeguards the EU has imposed in some cases (through [https://www.law.cornell.edu/uscode/text/50/1881a FISA]), and it already possesses the infrastructural capacity the EU lacks ([https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 only 13 to 15 percent of the market is EU-owned]). This gives the US vast dominance in the field, which could be equated to what the EU coins as cloud sovereignty. Aware of the risks this dependency poses, both to data access and to the strategic advantage it affords the US, the EU has sought to reduce it through a succession of initiatives. [https://www.enisa.europa.eu/publications/eucs-cloud-service-scheme EUCS] was one such attempt, and remains only a non-legally-binding standard; whether the [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52026PC0502 Cloud and AI Development Act] fares better remains to be seen.

=== Supply Chain management and Semiconductors ===
The United States and the European Union are equally invested in developing a domestic semiconductor industry, what separates them is their approach, the risks willing to run, the tools willing to use, and, above all, the capabilities and resources each power has. The US specifially aims to develop a bigger industry in this sector to rival competing hegemonic powers, to then gain AI dominance, strategic advantage and a stronger position in the international order.

The centrepiece is the [https://www.govinfo.gov/content/pkg/PLAW-117publ167/pdf/PLAW-117publ167.pdf CHIPS and Science Act], a statute that funds domestic fabrication and research through grants, loans and awards administered by the Department of Commerce. Its force comes from its scale: $39 billion in manufacturing incentives (including $2 billion reserved for legacy chips) and $11 billion for R&D, a federal pool officials themselves [https://www.reuters.com/technology/us-picks-team-oversee-527-bln-semiconductor-funding-2022-09-20/ described at the time] as $52.7 billion, on top of a Section 48D investment tax credit set from 25 to 35 percent in 2025. This is a single, centralised federal pool, commanded and disbursed by one government. The [https://eur-lex.europa.eu/eli/reg/2023/1781/oj/eng EU Chips Act (Regulation (EU) 2023/1781)] pursues the identical objective, a resilient domestic semiconductor base, but with a wholly different reach: its own budget is capped at a "maximum indicative amount" of just EUR 3.3 billion and decentralised Member State state aid. The US pursues to clash with other powers and surpass them through several measures in this statute, none of which the EU has an equivalent to.

The [https://www.federalregister.gov/documents/2023/09/25/2023-20471/preventing-the-improper-use-of-chips-act-funding CHIPS guardrails rule] binds every recipient of the funds for ten years: the Expansion Clawback bars material expansion, defined as growth of more than 5 percent, of semiconductor manufacturing capacity in a "foreign country of concern". These are protection measures, converting a subsidy into standing control over where a funded firm may grow and with whom it may cooperate, minimising ties to rival powers while building US capacity unilaterally.

The [https://www.federalregister.gov/documents/2022/10/13/2022-21658/implementation-of-additional-export-controls-certain-advanced-computing-and-semiconductor BIS export-control rule] does two things. First, it blocks advanced chips and chip-making equipment from reaching ‘countries of concern’ even when made outside the US, if US' technology, software or tools were used somewhere along the way to make them. Second, it stops any American, wherever in the world they work, from helping build advanced chips for those countries, even in a support role like shipping or servicing. What the US rule shows, in a way cloud policy does not, is active separation: a deliberate policy of isolating adversary states from American inputs, expertise and even American citizens' labour, building domestic capacity at home rather than permitting it to leak abroad through investment, export or cooperation.

The [https://www.federalregister.gov/documents/2026/01/20/2026-01052/adjusting-imports-of-semiconductors-semiconductor-manufacturing-equipment-and-their-derivative Section 232 proclamation] of 14 January 2026 shows the same modus operandi differently: a 25% tariff on certain advanced chips, and, in August 2025, the [https://newsroom.intel.com/corporate/intel-and-trump-administration-reach-historic-agreement conversion of $8.9 billion owed to Intel into a 9.9 percent equity stake] in the company. Neither is a law of general application; both are one-off executive moves, using a tariff or an ownership stake to get what the government wants directly. The US reaches for leverage and deal-making, not just regulation, a tool the EU does not use.

CHIPS award recipients are also barred by law from using federal funds to pay shareholder dividends or buy back stock, a restriction the [https://www.nist.gov/document/approach-capital-allocation-policies CHIPS Program Office] has sought to extend for five years from the date of an award.

=== Supply Chain Management and Rare Earth Minerals ===
<p class="mwt-heading">AI systems require advanced semiconductors, semiconductors require rare earth elements and critical minerals,  and the United States currently remains reliant on processing capacity concentrated in China. Where the [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] addresses the fabrication layer, a separate and more fragmented body of law addresses the mineral layer beneath it. Unlike the EU's [https://eur-lex.europa.eu/eli/reg/2024/1252/oj/eng Critical Raw Materials Act], the American framework layers a foundational statute, an executive order, and a narrower defense-procurement statute.<br></p>

==== Energy Act of 2020 ====
Section 7002 of the Energy Act of 2020 (codified at [https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=30-USC-185389929-22931526&term_occur=999&term_src= 30 U.S.C. §1606]) supplies the foundational definitions. It defines a "critical mineral" through a delegated standard: a "byproduct" is a critical mineral whose recovery depends on the production of a host mineral not itself designated critical, while a "critical material" is any non-fuel mineral, element, substance, or material the Secretary of Energy determines carries a high risk of supply-chain disruption. This is primarily an administrative and classificatory act: it does not itself compel production, but it creates the taxonomy (which of the 17 rare earth elements are legally "critical") on which subsequent executive and procurement action depends.

==== Executive Order 14241 (2025) ====
[https://public-inspection.federalregister.gov/2025-05212.pdf Executive Order 14241], entitled "Immediate Measures to Increase American Mineral Production," signed March 20, 2025, operationalizes that taxonomy. Its Section 1 purpose clause is unusually candid about the framing: national and economic security are now threatened by dependence on hostile foreign powers. Operationally, Section 3 directs every federal agency involved in permitting to submit to the National Energy Dominance Council a list of all mineral production projects for which a plan of operations or permit application has been submitted, after which agency heads must identify projects that can be immediately approved and expedite them. The Order invokes [https://www.law.cornell.edu/uscode/text/50/4533 Title III of the Defense Production Act] to mobilize financing, and tasks the NEDC, chaired by the Secretary of the Interior, with coordinating implementation across Defense, Energy, Interior, and Agriculture. Unlike the CHIPS Act, it required no congressional appropriation, and unlike the Energy Act, it does not merely classify inputs but seeks to physically build an alternative domestic supply chain, the mining-and-processing analogue to the CRMA's "strategic projects" mechanism. Executive Order 14241 has since been diluted by [https://www.whitehouse.gov/presidential-actions/2025/04/reinvigorating-americas-beautiful-clean-coal-industry-and-amending-executive-order-14241/ Executive Order 14261], which extends designation of criticality to sectorally unrelated materials such as coal.

==== 10 U.S.C. §4872 and the DFARS ====
The narrowest instrument is [https://www.law.cornell.edu/uscode/text/10/4872 10 U.S.C. §4872], which provides that the Secretary of Defense may not procure any covered material melted or produced in any covered nation, or any end item containing such material. [https://www.law.cornell.edu/definitions/uscode.php?def_id=10-USC-1197798417-780045830&term_src=title:10:subtitle:A:part:V:subpart:I:chapter:385:subchapter:III:section:4872 “Covered nations"] are defined as North Korea, China, Russia, and Iran, covered materials include samarium-cobalt and neodymium-iron-boron magnets. Implemented through [https://www.acquisition.gov/dfars/225.7018-2-restriction. DFARS 225.7018-2], the clause currently bars acquisition of any covered material melted or produced in any covered country, tightening in 2027 to cover the entire chain. This statute does not build supply; it leverages the federal government's own purchasing power to exclude adversary-sourced inputs from the defense industrial base, a tool with no direct EU parallel, since the CRMA's diversification targets operate through incentive rather than exclusion.

Infrastructures: Digital Sovereignty

2026-09-25T15:20:44Z

Fortuny Jané Mariona: /* Supply Chain management and the Cloud */

= Infrastructures: Digital Sovereignty =
Digital Sovereignty in the European Union is a [https://www.tandfonline.com/doi/full/10.1080/17579961.2026.2705118 term used to convey ] a broad array of policy ambitions in relation to digital technology development and use: the urgency to regain control over data, infrastructures, and (critical) technologies, the establishment of strategic autonomy, the conclusion of partnerships with geopolitical allies, and the reduction of critical dependencies. According to the Digital Decade Policy Programme [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52023SC0570 Implementation Report] of 2023, digital sovereignty refers to the EU's "ability to act independently in the digital world and therefore it constitutes a crucial means to safeguard [EU] values".

= Brazil =
'''''Words: 2142'''''
<div style="font-weight: 400;">
== 1. Introduction: What Is Digital Sovereignty? ==
</div>
<div style="font-weight: 400;"><p>Digital sovereignty refers to the capacity of a state to exercise autonomy, self-determination, and control over data, digital infrastructure, and technologies. This encompasses three distinct but overlapping dimensions: internet sovereignty (control over networks and online content), data sovereignty (governance of data flows, privacy, and cybersecurity), and technological sovereignty (control over critical technologies such as artificial intelligence, semiconductors, and raw materials). The endeavor toward digital sovereignty was accelerated by the Snowden revelations. Brazil has developed its own discourse on digital sovereignty, shaped by its historical concerns about foreign surveillance, its position as a major emerging economy, and its ambition to become a global technology actor. </p></div>
<div style="font-weight: 400;">
== 2. Brazil's National Digital Sovereignty Outlook ==
</div>
<div style="font-weight: 400;"><p>Brazil's approach to digital sovereignty is rooted in a long-standing concern about technological dependence and foreign surveillance. The 2013 revelation that the National Security Agency had intercepted communications of Brazilian President Dilma Rousseff and surveilled Petrobras (Brazil's state oil company) served as a breakpoint moment. This urged the Brazilian political agenda to reduce reliance on foreign digital infrastructure, and prompted Brazil to accelerate its own digital infrastructure projects. The most notable infrastructure project is the EllaLink undersea cables, connecting Brazil to Portugal (and thereby South America to Europe), which was explicitly designed to circumvent internet routing controlled by the US and enhance Brazil's data [https://www.cambridge.org/core/books/digital-sovereignty-in-the-brics-countries/introduction/88A1164945DC955023BB812CA88FEABC sovereignty. ]</p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty discourse is also closely tied to its open-source tradition. Brazil has historically been a strong proponent of open-source software. In the early 2000’s, during the Lula administration, Brazil’s government promoted free and open-source software as a tool for reducing dependence on proprietary foreign technology and lowering [https://www.researchgate.net/publication/316669377_Free_Software_as_Public_Service_in_Brazil_An_Assessment_of_Activism_Policy_and_Technology costs. ]This open-source orientation remains an element of Brazil's digital sovereignty strategy today: the development of national AI models, open data ecosystems, and publicly governed cloud infrastructure all reflect this tradition.  </p></div>
<div style="font-weight: 400;"><p>The Brazilian AI Plan (PBIA) explicitly includes the development of a national AI software stack and open training databases, reflecting the view that open-source tools are a vehicle for technological autonomy rather than a security risk. </p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty strategy is therefore characterised by two core priorities: (i) reducing dependence on foreign digital infrastructure and proprietary technology and (ii) building domestic capacity in critical technology sectors (AI, semiconductors, critical minerals). </p></div>
<div style="font-weight: 400;">
== 3. Regulatory Framework: Artificial Intelligence ==
</div>
<div style="font-weight: 400;">
=== 3.1 Brazilian AI Strategy (EBIA) ===
</div>
<div style="font-weight: 400;"><p>Brazil's first official national AI strategy, the Estratégia Brasileira de Inteligência Artificial (EBIA), established the country's overarching vision for AI governance. Based on the OECD's AI principles, EBIA is structured around pillars including ethical and responsible AI, data governance, innovation, education and workforce development, public sector use of AI, and international cooperation. It explicitly prioritises human-centred AI, the protection of fundamental rights, transparency, and risk mitigation. However, EBIA is a soft law instrument: it sets principles only, with no binding obligations, no enforcement mechanisms, and no dedicated budget. It functions as a normative framework that articulates values and directions rather than imposing legal duties. </p></div>
<div style="font-weight: 400;">
=== 3.2 Brazilian AI Plan (PBIA, 2024–2028) ===
</div>
<div style="font-weight: 400;"><p>The Plano Brasileiro de Inteligência Artificial (PBIA), launched on 30 July 2024 under the motto "AI for the Good of All," builds on EBIA by translating strategic vision into a concrete investment and infrastructure roadmap. Approved by the National Council for Science and Technology and coordinated by the Ministry of Science, Technology and Innovation, the PBIA is a strategic non-binding soft-law policy framework with a planned investment of R$23.03 billion through 2028. </p></div>
<div style="font-weight: 400;"><p>The PBIA combines immediate-impact initiatives with structural actions organised into five axes. These actions aim to develop the capabilities and skills needed for sustainable AI development in Brazil, while strengthening national sovereignty, technological autonomy, competitiveness and responsible innovation. Approximately 98.1% of planned investment is directed towards these structural actions. AI for Business Innovation (59.9%), Infrastructure and AI Development (25.2%), and AI for Improving Public Services (7.6%) receive the largest shares, followed by Dissemination, Education and Training in AI (5.0%). Support for AI Regulation and Governance receives approximately 0.4%. This distribution indicates an emphasis on building technological and industrial capacity. It is also indicative that Brazil prioritizes developing the technology infrastructure over implementing regulation in the form of hard law. From a digital sovereignty perspective, several elements of the PBIA are particularly significant. The Infrastructure and AI Development axis includes a National AI Infrastructure Program aimed at investing in high-performance computing and autonomous AI hardware to support technological sovereignty. It also includes a Sustainability and Renewable Energy Programme for AI, supporting renewable-energy infrastructure and efficient resource use, and a Programme for Structuring the Data and Software Ecosystem for AI intended to reduce external dependence, improve training datasets and develop a national AI software stack. AI for improving public services axis provides for a Sovereign Cloud, private or community cloud infrastructure managed exclusively by public agencies or state-owned companies, to increase control, security and sovereignty over sensitive data and ensure it is stored on national territory. The AI for Business Innovation axis aims to support sectors within the AI production chain, including information and communication technologies (ICT) and microelectronics, and to position Brazil as a global data centre hub. The PBIA reports that Brazil currently operates only 168 data centres (ranking 13th globally, compared to over 5,000 in the United States). Its AI Value Chain Promotion Programme seeks to strengthen and expand the domestic AI value chain, from supporting startups to developing Brazilian companies supplying foundation models. </p></div>
<div style="font-weight: 400;"><p>Bill No PL 2338/2023, which proposes a comprehensive AI framework, has passed the Senate and remains under consideration in the Chamber of Deputies, the lower house of Brazil’s National Congress. Until it is enacted, Brazil's AI governance framework remains largely in the realm of soft law, creating legal uncertainty for investors, developers, and citizens alike. </p></div>
<div style="font-weight: 400;">
== 4. Regulatory Framework: Semiconductors and Critical Minerals ==
</div>
<div style="font-weight: 400;">
=== 4.1 Brasil Semicon (Law No. 14.968/2024) ===
</div>
<div style="font-weight: 400;"><p>The Brazil Semiconductor Programme (Brasil Semicon), established under Law No. 14.968 of 11 September 2024, constitutes Brazil's principal hard law instrument for technological sovereignty in the semiconductor sector. It establishes a national strategy and guidelines to encourage research, development, innovation, production, and application of semiconductors, displays, and solar panels. Brasil Semicon updates and expands the instruments of PADIS (the Support Program for Technological Development of the Semiconductor Industry), extending tax incentives until the end of 2029 and broadening their scope to include software, specialised services, technical assistance, and other stages of the production chain. Decree No. 13.065 of 16 July 2026 activated the programme, establishing the rules for the semiconductor industry and facilitating access to PADIS tax incentives. The programme aims to attract investments in the national chip supply chain until 2029, directly addressing Brazil's dependence on foreign semiconductor manufacturing. </p></div>
<div style="font-weight: 400;"><div>
=== 4.2 National Policy on Critical and Strategic Minerals (Law No. 15.506/2026) ===
</div>
<div><p>Published on 16 September 2026, Law No. 15.506/2026 establishes a national policy and governance structure for critical and strategic minerals. It aims to promote research, extraction, processing, and transformation of critical and strategic minerals domestically, adding value to supply chains rather than exporting raw materials. The policy explicitly seeks to strengthen Brazil's economic and geopolitical security by ensuring a stable domestic supply of minerals essential to the digital economy — including those required for semiconductors, batteries, and AI hardware. It provides up to R$5 billion in tax credits (covering up to 20% of eligible expenses) from 2030 through 2034 for mineral processing, manufacturing, and recycling projects, and authorises a Mineral Activity Guarantee Fund with up to R$2 billion in federal contributions. This law is significant because Brazil holds some of the world's largest reserves of rare earth minerals and other critical inputs for the digital economy, and the policy represents a strategic decision to leverage these resources for domestic technological development rather than simply exporting them. </p></div>
<div>
== 5. The EU–Brazil Digital Partnership (2026) ==

<div><p>Signed on 12 June 2026, the EU–Brazil Digital Partnership is a soft law instrument establishing a framework for bilateral cooperation on issues that concern digital sovereignty.  </p></div>
<div>
i) Article 2 commits both parties to fostering meaningful digital development and inclusion while preserving digital sovereignty, democratic principles, and human rights.  </div>
<div>
ii) Article 3 provides for reciprocal recognition of data protection levels — based on the European Parliament's adequacy decision of January 2026 and Brazil's ANPD Resolution 32 — thereby easing cross-border data flows and building trust in bilateral data governance.  </div>
<div>iii)
Article 15 commits both parties to developing national technology supply chains to ensure that global interdependence does not undermine their respective technological sovereignties.  </div>
<div>
iv) Article 17 provides for cooperation on AI development and deployment, referencing the PBIA and comparable EU programmes.  </div>
<div>
v) Articles 19 and 21 establish information-sharing mechanisms on data governance, data spaces, digital services, and digital markets, with an explicit commitment to preserving regulatory autonomy.  </div>
<div>
vi) Article 23 references Brazil's EllaLink undersea cable project as a concrete expression of its digital sovereignty ambitions. </div>
<div><p>The Digital Partnership is a precursor to harder legal instruments: it is future-facing, flexible, and oriented toward sharing know-how and building mutual trust. Its soft law nature is appropriate given the current rate of innovation in technology. </p></div>
<div></div>

== 6. Comparison with the EU ==
</div>
<div><p>Brazil and the EU share the same fundamental goal: reducing dependence on foreign (primarily US and Chinese) digital infrastructure and technology. However, they pursue it through different regulatory architectures. </p></div>
<div><p>The EU has adopted a comprehensive, multi-layered hard law framework for digital sovereignty, encompassing the GDPR, the NIS 2 Directive, the Cybersecurity Act, the Chips Act, and the Critical Raw Materials Act, alongside the newly proposed EU Tech Sovereignty Package (June 2026) including the Cloud and AI Development Act (CADA) and an EU Open Source Strategy. The package therefore combines legislative proposals with non-binding policy instruments. The EU's approach combines binding regulation with substantial public investment, and it applies to both public and private sector actors. </p></div>
<div><p>Brazil, by contrast, has followed a more strategy-led approach to developing its dedicated AI framework. Its AI governance framework remains largely in soft law (EBIA and PBIA), with binding legislation (PL 2338) still pending. Brazil’s hard law instruments are concentrated in the industrial and resource sectors (Brasil Semicon; the Critical Minerals Law), reflecting a Brazil’s priority being placed on supply chain sovereignty and infrastructure building (rather than regulatory compliance frameworks).  </p></div>
<div><p>In 2026 Brazil began developing the Nuvem Brasileira, a national cloud infrastructure designed to keep critical government data and control of the infrastructure under Brazilian jurisdiction, while favouring open standards and reducing dependence on foreign technology providers. Specifically, the Brazilian government decided that Microsoft and other foreign big tech providers would not be the preferred providers for the Nuvem Brasileira. The government is explicitly assessing dependencies on foreign suppliers and whether the State could continue operating critical services if an external provider became unavailable. Brazil’s model does not require everything to be Brazilian-made, but focuses on control over data, operations and technology.  This shifts sovereignty from simply where data is stored to who controls the infrastructure, keys, software, jurisdiction and ability to operate independently. It is alongside REDATA, which uses datacentre incentives to build domestic technological capacity. Brazil's open-source orientation also distinguishes it from the EU. Both jurisdictions promote open source as a means of strengthening technological autonomy. While the EU has adopted an Open Source Strategy and the CADA references open-source principles, Brazil's commitment to open-source software is deeper and more historically embedded, reflecting a political tradition that views proprietary technology as a vector of foreign dependence. The PBIA's emphasis on a national AI software stack and open training data reflects this tradition and represents a distinctive approach to technological sovereignty that merits attention in comparative analysis. </p></div>
<div><p>Finally, both Brazil and the EU face the same structural challenge: the global digital economy is dominated by a small number of US and Chinese technology companies, and neither jurisdiction has yet succeeded in producing domestic alternatives at comparable scale. Brazil's ambition to become a global data centre hub and to develop sovereign AI models is bold, but the gap between aspiration and capacity remains large. The EU's more developed AI-specific regulatory architecture provides stronger protections for citizens and clearer rules for industry, but has been criticised for potentially hampering innovation. Brazil's softer approach may allow for faster initial development, but risks leaving citizens and the market without adequate legal protection in the interim. </p></div>
<div>
== 7. Conclusion ==
</div>
<div><p>Brazil's approach to digital sovereignty is characterised by a strong national discourse rooted in concerns about foreign surveillance and technological dependence, a soft law-dominant AI governance framework that is still evolving toward binding regulation, and hard law instruments in the semiconductor and critical minerals sectors that reflect a strategic prioritisation of supply-chain sovereignty. Brazil's open-source tradition adds a distinctive dimension to its digital sovereignty strategy, positioning it differently from both the. The EU–Brazil Digital Partnership represents a meaningful step toward bilateral cooperation, but its soft law nature means  its impact will depend on follow-through.  </p></div></div>

= China =
<p><strong style="font-size: 14.4px;">Words: 2306</strong><br></p>
<div><p><br></p></div>
<div><p>'''Introduction'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;">“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence.</p></div>
<div style="text-align: justify;"><p>In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</p></div>
<div style="text-align: justify;"><p>In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</p></div>
<div style="text-align: justify;"><p>Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</p></div>
<div><p style="text-align: justify;"><br></p></div>
<div><p>'''Cybersecurity Law'''</p></div>
<div><p><br></p></div>
<div><p>The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</p></div>
<div><p style="text-align: justify;" >In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</p></div>
<div><p style="text-align: justify;" >In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</p></div>
<div><p style="text-align: justify;" >Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</p></div>
<div><p style="text-align: justify;" >In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</p></div>
<div><p><br></p></div>
<div><p>'''Data Security Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development.</p></div>
<div><p style="text-align: justify;" >It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</p></div>
<div><p style="text-align: justify;" >The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</p></div>
<div><p style="text-align: justify;" >In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</p></div>
<div><p><br></p></div>
<div><p>'''Personal Information Protection Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40).</p></div>
<div><p style="text-align: justify;" >Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</p></div>
<div><p><br></p></div>
<div><p>'''China’s State Centered Concept of Digital Sovereignty'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to ''“abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order”'' (see article 13), and why the the Data Security Law establishes as an objective to ''“preserve State sovereignty, security, and development interests”'' (see article 1).</p></div>
<div><p style="text-align: justify;" >Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</p></div>
<div><p style="text-align: justify;" >In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</p></div>
<div><p style="text-align: justify;" >In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</p></div>
<div><p style="text-align: justify;" >These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</p></div>
<div><p style="text-align: justify;" >In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</p></div>
<div><p><br></p></div>
<div><p>'''China Model Versus the European Union Model'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context.</p></div>
<div><p style="text-align: justify;" >EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</p></div>
<div><p style="text-align: justify;" >Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</p></div>
<div><p>As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</p></div>
<div><p style="text-align: justify;" >This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</p></div>
<div><p style="text-align: justify;" >Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</p></div>
<div><p>''''''</p>
<p>'''References'''</p></div>
<div><p><br></p></div>
<div><p>'''(1)'''<span class="apple-converted-space"> </span>Cybersecurity Law of the People's Republic of China (2025 Amendment).</p></div>
<div><p>'''(2)'''<span class="apple-converted-space"> </span>Data Security Law of the People's Republic of China (2021).</p></div>
<div><p>'''(3)'''<span class="apple-converted-space"> </span>Personal Information Protection Law of the People's Republic of China (2021).</p></div>
<div><p>'''(4)'''<span class="apple-converted-space"> </span>Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</p></div>
<div><p>'''(5)'''<span class="apple-converted-space"> </span>Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, </p>
[https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']</div>
<div><p>'''(6)'''<span class="apple-converted-space"> </span>Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, </p>
[https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty]</div>
<div>'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>
<div></div>

= [[Infrastructures:India|India]] =

= United States =
== The Concept of Digital Sovereignty ==
<p>The idea of “digital sovereignty” is not a single concept. There are a number of scholars who attempted to define digital sovereignty. [https://www.academia.edu/99043334/What_does_the_notion_of_sovereignty_mean_when_referring_to_the_digital Couture and Toupin] and [https://www.researchgate.net/publication/343611573_The_Fight_for_Digital_Sovereignty_What_It_Is_and_Why_It_Matters_Especially_for_the_EU Floridi] emphasized the '''control''' over the digital realm, in which Floridi saw a combination of democratic legitimacy with innovative flexibility by a hybrid system of control. On the other hand, [https://techreg.org/article/view/23778?articlesBySimilarityPage=1 Chung] looked into the aspect of '''authority''' by defining digital sovereignty as a state’s ability to define, implement and enforce political and legal decisions across digital systems, platforms and data infrastructures. She also reconceptualized the term by asserting that sovereignty should be understood as governance '''capacity''' rather than exclusive control. There is a variety of perspectives in determining what digital sovereignty means and conflicting definitions based on varying national strategies.</p><p>The definition of digital sovereignty adopted throughout this study is a merge of authority and practical capacity of a state to set, apply and defend its own rules governing the digital infrastructure, data flows and algorithmic systems that shape its legal and political orders, against interference by outside actors, whether public or private, including other levels of government within the same state.</p>
=== The United States Sovereignty Strategy: AI Dominance ===
<p>Unlike the EU who attempts to maintain digital sovereignty under its regulatory control, the idea of securing digital sovereignty is not its priority for the US. Their goal is to ensure geopolitical dominance by entrenching American advantage in the technologies that determine their economic and military standing, against a field of competitors, namely China as the principal one.</p><p>From ''[https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf Winning the Race: America’s AI Action Plan]'', Issued on 23 July 2025, the US outlines 103 recommended actions by three pillars:</p>

*Pillar 1: Accelerate AI Innovation – removing “bureaucratic red tapes” which hinder technological advancement by deregulation
*Pillar 2: Build American AI Infrastructure – fostering an environment conducive to AI innovations
*Pillar 3: Lead in International AI Diplomacy and Security – Ensuring its global hegemonic position in AI technology<p>As explicitly stated from the plan, their core interest is in winning the race and securing its geopolitical primacy relative to other competitors rather than enhancing its authority and capacity over its domestic digital governance. The Plan itself has no legal force, yet the actual implementation is played by executive orders and procurements.</p>
== The Four Registers ==
<p>American digital policy has an organising purpose, and it is not regulation. It is primacy: maintaining American advantage in the technologies that determine economic and military standing, against a field of competitors, of which China is the principal one. The framing is stated in the instruments themselves — the order that set the current course is titled Removing Barriers to American Leadership in Artificial Intelligence, and the strategy it produced is titled Winning the Race. Beneath that strategy, the United States steers digital developments through four registers, descending in legal formality and ascending in speed.</p><p>'''Statute''' is the thinnest register. The [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] and the [https://www.congress.gov/bill/118th-congress/house-bill/7521 Protecting Americans from Foreign Adversary Controlled Applications Act] are both narrow and adversary-specific, and general legislation has failed: the Senate stripped a ten-year moratorium on state enforcement of AI laws from the One Big Beautiful Bill Act by a vote of 99 to 1.</p><p>'''Executive orders''' carry the load. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] produced the Data Security Program, an export control keyed to adversary identity rather than to any standard of protection; Executive Order 14320 finances the export of full-stack American AI packages; Executive Order 14365 asserts a national AI framework and directs litigation against inconsistent state laws.</p><p>'''Procurement''' is quieter and probably more effective, and is illustrated below by the cloud and semiconductor sectors.</p><p>'''Announcement''' is the fastest register and the least examined. On 19 January 2025 the President posted on Truth Social that he would issue an order extending the statutory TikTok divestment deadline, and [https://www.theguardian.com/us-news/2025/jan/19/trump-tiktok-ban-executive-order TikTok restored service] in the United States the same day, before any instrument existed. A platform serving some 170 million US users changed its conduct based solely on anticipated legality.</p>
=== Direction of Travel ===
<p>The direction of policy is consistent across all four registers and runs four ways. Outward, the export programme pushes the domestic AI stack into third markets. Inward, the Data Security Program and Team Telecom review screen foreign access based on a counterparty's identity rather than the safeguards it offers. Homeward, subsidy builds domestic capacity. Downward, federal policy presses on the states, and it is working even though preemption ordinarily requires a congressional enactment: Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower automated decision-making statute stripped of deployer impact-assessment duties, while California's frontier AI statute (SB 53) contains a federal-deference clause under which compliance with a comparable federal framework discharges the state obligation. States are deferring in advance to a federal standard that does not yet exist.</p><p>Outward and homeward movement build the US position; inward and downward movement defend it against interference, foreign in the former case and domestic in the latter. The same adversary-identity test recurs in an export control, a subsidy condition, and a screening review alike.</p>

== US Infrastructure and Resources efforts for AI dominance ==

=== Supply Chain management and the Cloud ===

The United States aims to maintain its position in the [https://www.cambridge.org/core/journals/international-organization/article/digital-disintegration-technoblocs-and-strategic-sovereignty-in-the-ai-era/DD86C6FD3FDD7FBBADEF100C6935D577 international order, seeking to surpass and constrain rival powers]. Technological dominance constitutes one of the principal means of pursuing this objective, and in recent years this pursuit has centred increasingly on artificial intelligence, a domain heavily dependent on underlying industrial capacity and resource access.

Cloud service dependency describes a form of [https://www.cambridge.org/core/journals/review-of-international-studies/article/susan-strange-meets-the-everyday-the-mundane-sources-of-structural-power/1D23361D622C523F7EB785EA54105858 structural power] exercised not through territorial control but through infrastructural ownership. Because US firms hold roughly [https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 two-thirds of the EU cloud market], a majority of European data, public and private, resides within entities potentially subject to US jurisdiction, irrespective of the server's physical location. This constitutes strategic advantage precisely because it requires no conventional projection of power abroad: dominance is achieved by occupying the infrastructural layer itself, converting market position into jurisdictional reach and, in turn, translating informational access into epistemic and strategic advantage. The [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] grants the United States access to foreign data provided this is held by a US cloud service provider, access guaranteed only through a defined legal process, the issuance of a judicial warrant subject to probable cause. [https://www.law.cornell.edu/uscode/text/50/1881a FISA Section 702], by contrast, authorises access to foreign data held in US clouds for intelligence purposes through compelled provider assistance, and in this instance no comparable judicial procedure is required by law. These divergent standards of authorisation, and the reach they enable, stand in direct tension with the protections EU law seeks to guarantee.

<p dir="auto">Ironically, the US maintains mechanisms to protect its data from foreign control while monitoring others’, consolidating digital sovereignty by setting the terms of engagement.</p>
[https://www.fedramp.gov/ FedRAMP] establishes the conditions under which any cloud provider, including foreign entities, may process US federal government data, asserting sovereign gatekeeping over access to its own infrastructure even as it resists equivalent constraints abroad. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] and the accompanying [https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern DOJ rule (2025)], although criticised for their generalistic scope, restrict the outbound transfer of bulk sensitive data to designated "countries of concern." The asymmetry is instructive when set against the EU's broadly equivalent instruments: both regimes exercise control, but over opposite targets, the United States restricts flows to named adversaries, while the EU restricts flows to any third country whose legal framework it deems inadequate, a criterion of general application rather than one confined to a defined list of hostile states.

The EU's principal instrument of power has consequently been regulatory rather than infrastructural, expressed through the [https://gdpr-info.eu/art-48-gdpr/ GDPR (Art. 48)] and the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act], mechanisms of constraint and protection rather than instruments of reach comparable to the [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] or [https://www.law.cornell.edu/uscode/text/50/1881a FISA]. There's a clear divergence in objective these reflect, and it is rooted in the different conception tof human rights, values and norms, related to data protection and privacy both actors have. Worth mentioning, the EU's position is further constrained by a material deficit, limited infrastructural capacity, financial resources.

As of right now, the United States can circumvent the normative safeguards the EU has imposed in some cases (through [https://www.law.cornell.edu/uscode/text/50/1881a FISA]), and it already possesses the infrastructural capacity the EU lacks ([https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 only 13 to 15 percent of the market is EU-owned]). This gives the US vast dominance in the field, which could be equated to what the EU coins as cloud sovereignty. Aware of the risks this dependency poses, both to data access and to the strategic advantage it affords the US, the EU has sought to reduce it through a succession of initiatives. [https://www.enisa.europa.eu/publications/eucs-cloud-service-scheme EUCS] was one such attempt, and remains only a non-legally-binding standard; whether the [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52026PC0502 Cloud and AI Development Act] fares better remains to be seen.

=== Supply Chain management and Semiconductors ===
The United States and the European Union are equally invested in developing a domestic semiconductor industry, what separates them is their approach, the risks willing to run, the tools willing to use, and, above all, the capabilities and resources each power has. The US specifially aims to develop a bigger industry in this sector to rival competing hegemonic powers, to then gain AI dominance, strategic advantage and a stronger position in the international order.

The centrepiece is the [https://www.govinfo.gov/content/pkg/PLAW-117publ167/pdf/PLAW-117publ167.pdf CHIPS and Science Act] of August 2022, a statute that funds domestic fabrication and research through grants, loans and awards administered by the Department of Commerce. Its force comes from its scale: $39 billion in manufacturing incentives (including $2 billion reserved for legacy chips) and $11 billion for R&D, a federal pool officials themselves [https://www.reuters.com/technology/us-picks-team-oversee-527-bln-semiconductor-funding-2022-09-20/ described at the time] as $52.7 billion, on top of a Section 48D investment tax credit set from 25 to 35 percent in 2025. This is a single, centralised federal pool, commanded and disbursed by one government. The [https://eur-lex.europa.eu/eli/reg/2023/1781/oj/eng EU Chips Act (Regulation (EU) 2023/1781)] pursues the identical objective, a resilient domestic semiconductor base, but with a wholly different reach: its own budget is capped at a "maximum indicative amount" of just EUR 3.3 billion and decentralised Member State state aid. The US pursues to clash with other powers and surpass them through several measures in this statute, none of which the EU has an equivalent to.

The [https://www.federalregister.gov/documents/2023/09/25/2023-20471/preventing-the-improper-use-of-chips-act-funding CHIPS guardrails rule] binds every recipient of the funds for ten years: the Expansion Clawback bars material expansion, defined as growth of more than 5 percent, of semiconductor manufacturing capacity in a "foreign country of concern". These are protection measures, converting a subsidy into standing control over where a funded firm may grow and with whom it may cooperate, minimising ties to rival powers while building US capacity unilaterally.

The [https://www.federalregister.gov/documents/2022/10/13/2022-21658/implementation-of-additional-export-controls-certain-advanced-computing-and-semiconductor BIS export-control rule] does two things. First, it blocks advanced chips and chip-making equipment from reaching ‘countries of concern’ even when made outside the US, if US' technology, software or tools were used somewhere along the way to make them. Second, it stops any American, wherever in the world they work, from helping build advanced chips for those countries, even in a support role like shipping or servicing. What the US rule shows, in a way cloud policy does not, is active separation: a deliberate policy of isolating adversary states from American inputs, expertise and even American citizens' labour, building domestic capacity at home rather than permitting it to leak abroad through investment, export or cooperation.

The [https://www.federalregister.gov/documents/2026/01/20/2026-01052/adjusting-imports-of-semiconductors-semiconductor-manufacturing-equipment-and-their-derivative Section 232 proclamation] of 14 January 2026 shows the same modus operandi differently: a 25% tariff on certain advanced chips, and, in August 2025, the [https://newsroom.intel.com/corporate/intel-and-trump-administration-reach-historic-agreement conversion of $8.9 billion owed to Intel into a 9.9 percent equity stake] in the company. Neither is a law of general application; both are one-off executive moves, using a tariff or an ownership stake to get what the government wants directly. The US reaches for leverage and deal-making, not just regulation, a tool the EU does not use.

CHIPS award recipients are also barred by law from using federal funds to pay shareholder dividends or buy back stock, a restriction the [https://www.nist.gov/document/approach-capital-allocation-policies CHIPS Program Office] has sought to extend for five years from the date of an award.

=== Supply Chain Management and Rare Earth Minerals ===
<p class="mwt-heading">AI systems require advanced semiconductors, semiconductors require rare earth elements and critical minerals,  and the United States currently remains reliant on processing capacity concentrated in China. Where the [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] addresses the fabrication layer, a separate and more fragmented body of law addresses the mineral layer beneath it. Unlike the EU's [https://eur-lex.europa.eu/eli/reg/2024/1252/oj/eng Critical Raw Materials Act], the American framework layers a foundational statute, an executive order, and a narrower defense-procurement statute.<br></p>

==== Energy Act of 2020 ====
Section 7002 of the Energy Act of 2020 (codified at [https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=30-USC-185389929-22931526&term_occur=999&term_src= 30 U.S.C. §1606]) supplies the foundational definitions. It defines a "critical mineral" through a delegated standard: a "byproduct" is a critical mineral whose recovery depends on the production of a host mineral not itself designated critical, while a "critical material" is any non-fuel mineral, element, substance, or material the Secretary of Energy determines carries a high risk of supply-chain disruption. This is primarily an administrative and classificatory act: it does not itself compel production, but it creates the taxonomy (which of the 17 rare earth elements are legally "critical") on which subsequent executive and procurement action depends.

==== Executive Order 14241 (2025) ====
[https://public-inspection.federalregister.gov/2025-05212.pdf Executive Order 14241], entitled "Immediate Measures to Increase American Mineral Production," signed March 20, 2025, operationalizes that taxonomy. Its Section 1 purpose clause is unusually candid about the framing: national and economic security are now threatened by dependence on hostile foreign powers. Operationally, Section 3 directs every federal agency involved in permitting to submit to the National Energy Dominance Council a list of all mineral production projects for which a plan of operations or permit application has been submitted, after which agency heads must identify projects that can be immediately approved and expedite them. The Order invokes [https://www.law.cornell.edu/uscode/text/50/4533 Title III of the Defense Production Act] to mobilize financing, and tasks the NEDC, chaired by the Secretary of the Interior, with coordinating implementation across Defense, Energy, Interior, and Agriculture. Unlike the CHIPS Act, it required no congressional appropriation, and unlike the Energy Act, it does not merely classify inputs but seeks to physically build an alternative domestic supply chain, the mining-and-processing analogue to the CRMA's "strategic projects" mechanism. Executive Order 14241 has since been diluted by [https://www.whitehouse.gov/presidential-actions/2025/04/reinvigorating-americas-beautiful-clean-coal-industry-and-amending-executive-order-14241/ Executive Order 14261], which extends designation of criticality to sectorally unrelated materials such as coal.

==== 10 U.S.C. §4872 and the DFARS ====
The narrowest instrument is [https://www.law.cornell.edu/uscode/text/10/4872 10 U.S.C. §4872], which provides that the Secretary of Defense may not procure any covered material melted or produced in any covered nation, or any end item containing such material. [https://www.law.cornell.edu/definitions/uscode.php?def_id=10-USC-1197798417-780045830&term_src=title:10:subtitle:A:part:V:subpart:I:chapter:385:subchapter:III:section:4872 “Covered nations"] are defined as North Korea, China, Russia, and Iran, covered materials include samarium-cobalt and neodymium-iron-boron magnets. Implemented through [https://www.acquisition.gov/dfars/225.7018-2-restriction. DFARS 225.7018-2], the clause currently bars acquisition of any covered material melted or produced in any covered country, tightening in 2027 to cover the entire chain. This statute does not build supply; it leverages the federal government's own purchasing power to exclude adversary-sourced inputs from the defense industrial base, a tool with no direct EU parallel, since the CRMA's diversification targets operate through incentive rather than exclusion.

Infrastructures: Digital Sovereignty

2026-09-25T15:19:31Z

Fortuny Jané Mariona: /* Supply Chain management and the Cloud */

= Infrastructures: Digital Sovereignty =
Digital Sovereignty in the European Union is a [https://www.tandfonline.com/doi/full/10.1080/17579961.2026.2705118 term used to convey ] a broad array of policy ambitions in relation to digital technology development and use: the urgency to regain control over data, infrastructures, and (critical) technologies, the establishment of strategic autonomy, the conclusion of partnerships with geopolitical allies, and the reduction of critical dependencies. According to the Digital Decade Policy Programme [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52023SC0570 Implementation Report] of 2023, digital sovereignty refers to the EU's "ability to act independently in the digital world and therefore it constitutes a crucial means to safeguard [EU] values".

= Brazil =
'''''Words: 2142'''''
<div style="font-weight: 400;">
== 1. Introduction: What Is Digital Sovereignty? ==
</div>
<div style="font-weight: 400;"><p>Digital sovereignty refers to the capacity of a state to exercise autonomy, self-determination, and control over data, digital infrastructure, and technologies. This encompasses three distinct but overlapping dimensions: internet sovereignty (control over networks and online content), data sovereignty (governance of data flows, privacy, and cybersecurity), and technological sovereignty (control over critical technologies such as artificial intelligence, semiconductors, and raw materials). The endeavor toward digital sovereignty was accelerated by the Snowden revelations. Brazil has developed its own discourse on digital sovereignty, shaped by its historical concerns about foreign surveillance, its position as a major emerging economy, and its ambition to become a global technology actor. </p></div>
<div style="font-weight: 400;">
== 2. Brazil's National Digital Sovereignty Outlook ==
</div>
<div style="font-weight: 400;"><p>Brazil's approach to digital sovereignty is rooted in a long-standing concern about technological dependence and foreign surveillance. The 2013 revelation that the National Security Agency had intercepted communications of Brazilian President Dilma Rousseff and surveilled Petrobras (Brazil's state oil company) served as a breakpoint moment. This urged the Brazilian political agenda to reduce reliance on foreign digital infrastructure, and prompted Brazil to accelerate its own digital infrastructure projects. The most notable infrastructure project is the EllaLink undersea cables, connecting Brazil to Portugal (and thereby South America to Europe), which was explicitly designed to circumvent internet routing controlled by the US and enhance Brazil's data [https://www.cambridge.org/core/books/digital-sovereignty-in-the-brics-countries/introduction/88A1164945DC955023BB812CA88FEABC sovereignty. ]</p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty discourse is also closely tied to its open-source tradition. Brazil has historically been a strong proponent of open-source software. In the early 2000’s, during the Lula administration, Brazil’s government promoted free and open-source software as a tool for reducing dependence on proprietary foreign technology and lowering [https://www.researchgate.net/publication/316669377_Free_Software_as_Public_Service_in_Brazil_An_Assessment_of_Activism_Policy_and_Technology costs. ]This open-source orientation remains an element of Brazil's digital sovereignty strategy today: the development of national AI models, open data ecosystems, and publicly governed cloud infrastructure all reflect this tradition.  </p></div>
<div style="font-weight: 400;"><p>The Brazilian AI Plan (PBIA) explicitly includes the development of a national AI software stack and open training databases, reflecting the view that open-source tools are a vehicle for technological autonomy rather than a security risk. </p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty strategy is therefore characterised by two core priorities: (i) reducing dependence on foreign digital infrastructure and proprietary technology and (ii) building domestic capacity in critical technology sectors (AI, semiconductors, critical minerals). </p></div>
<div style="font-weight: 400;">
== 3. Regulatory Framework: Artificial Intelligence ==
</div>
<div style="font-weight: 400;">
=== 3.1 Brazilian AI Strategy (EBIA) ===
</div>
<div style="font-weight: 400;"><p>Brazil's first official national AI strategy, the Estratégia Brasileira de Inteligência Artificial (EBIA), established the country's overarching vision for AI governance. Based on the OECD's AI principles, EBIA is structured around pillars including ethical and responsible AI, data governance, innovation, education and workforce development, public sector use of AI, and international cooperation. It explicitly prioritises human-centred AI, the protection of fundamental rights, transparency, and risk mitigation. However, EBIA is a soft law instrument: it sets principles only, with no binding obligations, no enforcement mechanisms, and no dedicated budget. It functions as a normative framework that articulates values and directions rather than imposing legal duties. </p></div>
<div style="font-weight: 400;">
=== 3.2 Brazilian AI Plan (PBIA, 2024–2028) ===
</div>
<div style="font-weight: 400;"><p>The Plano Brasileiro de Inteligência Artificial (PBIA), launched on 30 July 2024 under the motto "AI for the Good of All," builds on EBIA by translating strategic vision into a concrete investment and infrastructure roadmap. Approved by the National Council for Science and Technology and coordinated by the Ministry of Science, Technology and Innovation, the PBIA is a strategic non-binding soft-law policy framework with a planned investment of R$23.03 billion through 2028. </p></div>
<div style="font-weight: 400;"><p>The PBIA combines immediate-impact initiatives with structural actions organised into five axes. These actions aim to develop the capabilities and skills needed for sustainable AI development in Brazil, while strengthening national sovereignty, technological autonomy, competitiveness and responsible innovation. Approximately 98.1% of planned investment is directed towards these structural actions. AI for Business Innovation (59.9%), Infrastructure and AI Development (25.2%), and AI for Improving Public Services (7.6%) receive the largest shares, followed by Dissemination, Education and Training in AI (5.0%). Support for AI Regulation and Governance receives approximately 0.4%. This distribution indicates an emphasis on building technological and industrial capacity. It is also indicative that Brazil prioritizes developing the technology infrastructure over implementing regulation in the form of hard law. From a digital sovereignty perspective, several elements of the PBIA are particularly significant. The Infrastructure and AI Development axis includes a National AI Infrastructure Program aimed at investing in high-performance computing and autonomous AI hardware to support technological sovereignty. It also includes a Sustainability and Renewable Energy Programme for AI, supporting renewable-energy infrastructure and efficient resource use, and a Programme for Structuring the Data and Software Ecosystem for AI intended to reduce external dependence, improve training datasets and develop a national AI software stack. AI for improving public services axis provides for a Sovereign Cloud, private or community cloud infrastructure managed exclusively by public agencies or state-owned companies, to increase control, security and sovereignty over sensitive data and ensure it is stored on national territory. The AI for Business Innovation axis aims to support sectors within the AI production chain, including information and communication technologies (ICT) and microelectronics, and to position Brazil as a global data centre hub. The PBIA reports that Brazil currently operates only 168 data centres (ranking 13th globally, compared to over 5,000 in the United States). Its AI Value Chain Promotion Programme seeks to strengthen and expand the domestic AI value chain, from supporting startups to developing Brazilian companies supplying foundation models. </p></div>
<div style="font-weight: 400;"><p>Bill No PL 2338/2023, which proposes a comprehensive AI framework, has passed the Senate and remains under consideration in the Chamber of Deputies, the lower house of Brazil’s National Congress. Until it is enacted, Brazil's AI governance framework remains largely in the realm of soft law, creating legal uncertainty for investors, developers, and citizens alike. </p></div>
<div style="font-weight: 400;">
== 4. Regulatory Framework: Semiconductors and Critical Minerals ==
</div>
<div style="font-weight: 400;">
=== 4.1 Brasil Semicon (Law No. 14.968/2024) ===
</div>
<div style="font-weight: 400;"><p>The Brazil Semiconductor Programme (Brasil Semicon), established under Law No. 14.968 of 11 September 2024, constitutes Brazil's principal hard law instrument for technological sovereignty in the semiconductor sector. It establishes a national strategy and guidelines to encourage research, development, innovation, production, and application of semiconductors, displays, and solar panels. Brasil Semicon updates and expands the instruments of PADIS (the Support Program for Technological Development of the Semiconductor Industry), extending tax incentives until the end of 2029 and broadening their scope to include software, specialised services, technical assistance, and other stages of the production chain. Decree No. 13.065 of 16 July 2026 activated the programme, establishing the rules for the semiconductor industry and facilitating access to PADIS tax incentives. The programme aims to attract investments in the national chip supply chain until 2029, directly addressing Brazil's dependence on foreign semiconductor manufacturing. </p></div>
<div style="font-weight: 400;"><div>
=== 4.2 National Policy on Critical and Strategic Minerals (Law No. 15.506/2026) ===
</div>
<div><p>Published on 16 September 2026, Law No. 15.506/2026 establishes a national policy and governance structure for critical and strategic minerals. It aims to promote research, extraction, processing, and transformation of critical and strategic minerals domestically, adding value to supply chains rather than exporting raw materials. The policy explicitly seeks to strengthen Brazil's economic and geopolitical security by ensuring a stable domestic supply of minerals essential to the digital economy — including those required for semiconductors, batteries, and AI hardware. It provides up to R$5 billion in tax credits (covering up to 20% of eligible expenses) from 2030 through 2034 for mineral processing, manufacturing, and recycling projects, and authorises a Mineral Activity Guarantee Fund with up to R$2 billion in federal contributions. This law is significant because Brazil holds some of the world's largest reserves of rare earth minerals and other critical inputs for the digital economy, and the policy represents a strategic decision to leverage these resources for domestic technological development rather than simply exporting them. </p></div>
<div>
== 5. The EU–Brazil Digital Partnership (2026) ==

<div><p>Signed on 12 June 2026, the EU–Brazil Digital Partnership is a soft law instrument establishing a framework for bilateral cooperation on issues that concern digital sovereignty.  </p></div>
<div>
i) Article 2 commits both parties to fostering meaningful digital development and inclusion while preserving digital sovereignty, democratic principles, and human rights.  </div>
<div>
ii) Article 3 provides for reciprocal recognition of data protection levels — based on the European Parliament's adequacy decision of January 2026 and Brazil's ANPD Resolution 32 — thereby easing cross-border data flows and building trust in bilateral data governance.  </div>
<div>iii)
Article 15 commits both parties to developing national technology supply chains to ensure that global interdependence does not undermine their respective technological sovereignties.  </div>
<div>
iv) Article 17 provides for cooperation on AI development and deployment, referencing the PBIA and comparable EU programmes.  </div>
<div>
v) Articles 19 and 21 establish information-sharing mechanisms on data governance, data spaces, digital services, and digital markets, with an explicit commitment to preserving regulatory autonomy.  </div>
<div>
vi) Article 23 references Brazil's EllaLink undersea cable project as a concrete expression of its digital sovereignty ambitions. </div>
<div><p>The Digital Partnership is a precursor to harder legal instruments: it is future-facing, flexible, and oriented toward sharing know-how and building mutual trust. Its soft law nature is appropriate given the current rate of innovation in technology. </p></div>
<div></div>

== 6. Comparison with the EU ==
</div>
<div><p>Brazil and the EU share the same fundamental goal: reducing dependence on foreign (primarily US and Chinese) digital infrastructure and technology. However, they pursue it through different regulatory architectures. </p></div>
<div><p>The EU has adopted a comprehensive, multi-layered hard law framework for digital sovereignty, encompassing the GDPR, the NIS 2 Directive, the Cybersecurity Act, the Chips Act, and the Critical Raw Materials Act, alongside the newly proposed EU Tech Sovereignty Package (June 2026) including the Cloud and AI Development Act (CADA) and an EU Open Source Strategy. The package therefore combines legislative proposals with non-binding policy instruments. The EU's approach combines binding regulation with substantial public investment, and it applies to both public and private sector actors. </p></div>
<div><p>Brazil, by contrast, has followed a more strategy-led approach to developing its dedicated AI framework. Its AI governance framework remains largely in soft law (EBIA and PBIA), with binding legislation (PL 2338) still pending. Brazil’s hard law instruments are concentrated in the industrial and resource sectors (Brasil Semicon; the Critical Minerals Law), reflecting a Brazil’s priority being placed on supply chain sovereignty and infrastructure building (rather than regulatory compliance frameworks).  </p></div>
<div><p>In 2026 Brazil began developing the Nuvem Brasileira, a national cloud infrastructure designed to keep critical government data and control of the infrastructure under Brazilian jurisdiction, while favouring open standards and reducing dependence on foreign technology providers. Specifically, the Brazilian government decided that Microsoft and other foreign big tech providers would not be the preferred providers for the Nuvem Brasileira. The government is explicitly assessing dependencies on foreign suppliers and whether the State could continue operating critical services if an external provider became unavailable. Brazil’s model does not require everything to be Brazilian-made, but focuses on control over data, operations and technology.  This shifts sovereignty from simply where data is stored to who controls the infrastructure, keys, software, jurisdiction and ability to operate independently. It is alongside REDATA, which uses datacentre incentives to build domestic technological capacity. Brazil's open-source orientation also distinguishes it from the EU. Both jurisdictions promote open source as a means of strengthening technological autonomy. While the EU has adopted an Open Source Strategy and the CADA references open-source principles, Brazil's commitment to open-source software is deeper and more historically embedded, reflecting a political tradition that views proprietary technology as a vector of foreign dependence. The PBIA's emphasis on a national AI software stack and open training data reflects this tradition and represents a distinctive approach to technological sovereignty that merits attention in comparative analysis. </p></div>
<div><p>Finally, both Brazil and the EU face the same structural challenge: the global digital economy is dominated by a small number of US and Chinese technology companies, and neither jurisdiction has yet succeeded in producing domestic alternatives at comparable scale. Brazil's ambition to become a global data centre hub and to develop sovereign AI models is bold, but the gap between aspiration and capacity remains large. The EU's more developed AI-specific regulatory architecture provides stronger protections for citizens and clearer rules for industry, but has been criticised for potentially hampering innovation. Brazil's softer approach may allow for faster initial development, but risks leaving citizens and the market without adequate legal protection in the interim. </p></div>
<div>
== 7. Conclusion ==
</div>
<div><p>Brazil's approach to digital sovereignty is characterised by a strong national discourse rooted in concerns about foreign surveillance and technological dependence, a soft law-dominant AI governance framework that is still evolving toward binding regulation, and hard law instruments in the semiconductor and critical minerals sectors that reflect a strategic prioritisation of supply-chain sovereignty. Brazil's open-source tradition adds a distinctive dimension to its digital sovereignty strategy, positioning it differently from both the. The EU–Brazil Digital Partnership represents a meaningful step toward bilateral cooperation, but its soft law nature means  its impact will depend on follow-through.  </p></div></div>

= China =
<p><strong style="font-size: 14.4px;">Words: 2306</strong><br></p>
<div><p><br></p></div>
<div><p>'''Introduction'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;">“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence.</p></div>
<div style="text-align: justify;"><p>In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</p></div>
<div style="text-align: justify;"><p>In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</p></div>
<div style="text-align: justify;"><p>Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</p></div>
<div><p style="text-align: justify;"><br></p></div>
<div><p>'''Cybersecurity Law'''</p></div>
<div><p><br></p></div>
<div><p>The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</p></div>
<div><p style="text-align: justify;" >In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</p></div>
<div><p style="text-align: justify;" >In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</p></div>
<div><p style="text-align: justify;" >Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</p></div>
<div><p style="text-align: justify;" >In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</p></div>
<div><p><br></p></div>
<div><p>'''Data Security Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development.</p></div>
<div><p style="text-align: justify;" >It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</p></div>
<div><p style="text-align: justify;" >The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</p></div>
<div><p style="text-align: justify;" >In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</p></div>
<div><p><br></p></div>
<div><p>'''Personal Information Protection Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40).</p></div>
<div><p style="text-align: justify;" >Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</p></div>
<div><p><br></p></div>
<div><p>'''China’s State Centered Concept of Digital Sovereignty'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to ''“abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order”'' (see article 13), and why the the Data Security Law establishes as an objective to ''“preserve State sovereignty, security, and development interests”'' (see article 1).</p></div>
<div><p style="text-align: justify;" >Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</p></div>
<div><p style="text-align: justify;" >In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</p></div>
<div><p style="text-align: justify;" >In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</p></div>
<div><p style="text-align: justify;" >These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</p></div>
<div><p style="text-align: justify;" >In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</p></div>
<div><p><br></p></div>
<div><p>'''China Model Versus the European Union Model'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context.</p></div>
<div><p style="text-align: justify;" >EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</p></div>
<div><p style="text-align: justify;" >Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</p></div>
<div><p>As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</p></div>
<div><p style="text-align: justify;" >This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</p></div>
<div><p style="text-align: justify;" >Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</p></div>
<div><p>''''''</p>
<p>'''References'''</p></div>
<div><p><br></p></div>
<div><p>'''(1)'''<span class="apple-converted-space"> </span>Cybersecurity Law of the People's Republic of China (2025 Amendment).</p></div>
<div><p>'''(2)'''<span class="apple-converted-space"> </span>Data Security Law of the People's Republic of China (2021).</p></div>
<div><p>'''(3)'''<span class="apple-converted-space"> </span>Personal Information Protection Law of the People's Republic of China (2021).</p></div>
<div><p>'''(4)'''<span class="apple-converted-space"> </span>Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</p></div>
<div><p>'''(5)'''<span class="apple-converted-space"> </span>Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, </p>
[https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']</div>
<div><p>'''(6)'''<span class="apple-converted-space"> </span>Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, </p>
[https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty]</div>
<div>'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>
<div></div>

= [[Infrastructures:India|India]] =

= United States =
== The Concept of Digital Sovereignty ==
<p>The idea of “digital sovereignty” is not a single concept. There are a number of scholars who attempted to define digital sovereignty. [https://www.academia.edu/99043334/What_does_the_notion_of_sovereignty_mean_when_referring_to_the_digital Couture and Toupin] and [https://www.researchgate.net/publication/343611573_The_Fight_for_Digital_Sovereignty_What_It_Is_and_Why_It_Matters_Especially_for_the_EU Floridi] emphasized the '''control''' over the digital realm, in which Floridi saw a combination of democratic legitimacy with innovative flexibility by a hybrid system of control. On the other hand, [https://techreg.org/article/view/23778?articlesBySimilarityPage=1 Chung] looked into the aspect of '''authority''' by defining digital sovereignty as a state’s ability to define, implement and enforce political and legal decisions across digital systems, platforms and data infrastructures. She also reconceptualized the term by asserting that sovereignty should be understood as governance '''capacity''' rather than exclusive control. There is a variety of perspectives in determining what digital sovereignty means and conflicting definitions based on varying national strategies.</p><p>The definition of digital sovereignty adopted throughout this study is a merge of authority and practical capacity of a state to set, apply and defend its own rules governing the digital infrastructure, data flows and algorithmic systems that shape its legal and political orders, against interference by outside actors, whether public or private, including other levels of government within the same state.</p>
=== The United States Sovereignty Strategy: AI Dominance ===
<p>Unlike the EU who attempts to maintain digital sovereignty under its regulatory control, the idea of securing digital sovereignty is not its priority for the US. Their goal is to ensure geopolitical dominance by entrenching American advantage in the technologies that determine their economic and military standing, against a field of competitors, namely China as the principal one.</p><p>From ''[https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf Winning the Race: America’s AI Action Plan]'', Issued on 23 July 2025, the US outlines 103 recommended actions by three pillars:</p>

*Pillar 1: Accelerate AI Innovation – removing “bureaucratic red tapes” which hinder technological advancement by deregulation
*Pillar 2: Build American AI Infrastructure – fostering an environment conducive to AI innovations
*Pillar 3: Lead in International AI Diplomacy and Security – Ensuring its global hegemonic position in AI technology<p>As explicitly stated from the plan, their core interest is in winning the race and securing its geopolitical primacy relative to other competitors rather than enhancing its authority and capacity over its domestic digital governance. The Plan itself has no legal force, yet the actual implementation is played by executive orders and procurements.</p>
== The Four Registers ==
<p>American digital policy has an organising purpose, and it is not regulation. It is primacy: maintaining American advantage in the technologies that determine economic and military standing, against a field of competitors, of which China is the principal one. The framing is stated in the instruments themselves — the order that set the current course is titled Removing Barriers to American Leadership in Artificial Intelligence, and the strategy it produced is titled Winning the Race. Beneath that strategy, the United States steers digital developments through four registers, descending in legal formality and ascending in speed.</p><p>'''Statute''' is the thinnest register. The [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] and the [https://www.congress.gov/bill/118th-congress/house-bill/7521 Protecting Americans from Foreign Adversary Controlled Applications Act] are both narrow and adversary-specific, and general legislation has failed: the Senate stripped a ten-year moratorium on state enforcement of AI laws from the One Big Beautiful Bill Act by a vote of 99 to 1.</p><p>'''Executive orders''' carry the load. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] produced the Data Security Program, an export control keyed to adversary identity rather than to any standard of protection; Executive Order 14320 finances the export of full-stack American AI packages; Executive Order 14365 asserts a national AI framework and directs litigation against inconsistent state laws.</p><p>'''Procurement''' is quieter and probably more effective, and is illustrated below by the cloud and semiconductor sectors.</p><p>'''Announcement''' is the fastest register and the least examined. On 19 January 2025 the President posted on Truth Social that he would issue an order extending the statutory TikTok divestment deadline, and [https://www.theguardian.com/us-news/2025/jan/19/trump-tiktok-ban-executive-order TikTok restored service] in the United States the same day, before any instrument existed. A platform serving some 170 million US users changed its conduct based solely on anticipated legality.</p>
=== Direction of Travel ===
<p>The direction of policy is consistent across all four registers and runs four ways. Outward, the export programme pushes the domestic AI stack into third markets. Inward, the Data Security Program and Team Telecom review screen foreign access based on a counterparty's identity rather than the safeguards it offers. Homeward, subsidy builds domestic capacity. Downward, federal policy presses on the states, and it is working even though preemption ordinarily requires a congressional enactment: Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower automated decision-making statute stripped of deployer impact-assessment duties, while California's frontier AI statute (SB 53) contains a federal-deference clause under which compliance with a comparable federal framework discharges the state obligation. States are deferring in advance to a federal standard that does not yet exist.</p><p>Outward and homeward movement build the US position; inward and downward movement defend it against interference, foreign in the former case and domestic in the latter. The same adversary-identity test recurs in an export control, a subsidy condition, and a screening review alike.</p>

== US Infrastructure and Resources efforts for AI dominance ==

=== Supply Chain management and the Cloud ===

The United States aims to maintain its position in the [https://www.cambridge.org/core/journals/international-organization/article/digital-disintegration-technoblocs-and-strategic-sovereignty-in-the-ai-era/DD86C6FD3FDD7FBBADEF100C6935D577 international order, seeking to surpass and constrain rival powers]. Technological dominance constitutes one of the principal means of pursuing this objective, and in recent years this pursuit has centred increasingly on artificial intelligence, a domain heavily dependent on underlying industrial capacity and resource access.

Cloud service dependency describes a form of [https://www.cambridge.org/core/journals/review-of-international-studies/article/susan-strange-meets-the-everyday-the-mundane-sources-of-structural-power/1D23361D622C523F7EB785EA54105858 structural power] exercised not through territorial control but through infrastructural ownership. Because US firms hold roughly [https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 two-thirds of the EU cloud market], a majority of European data, public and private, resides within entities potentially subject to US jurisdiction, irrespective of the server's physical location. This constitutes strategic advantage precisely because it requires no conventional projection of power abroad: dominance is achieved by occupying the infrastructural layer itself, converting market position into jurisdictional reach and, in turn, translating informational access into epistemic and strategic advantage. The [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] grants the United States access to foreign data provided this is held by a US cloud service provider, access guaranteed only through a defined legal process, the issuance of a judicial warrant subject to probable cause. [https://www.law.cornell.edu/uscode/text/50/1881a FISA Section 702], by contrast, authorises access to foreign data held in US clouds for intelligence purposes through compelled provider assistance, and in this instance no comparable judicial procedure is required by law. These divergent standards of authorisation, and the reach they enable, stand in direct tension with the protections EU law seeks to guarantee.

<p dir="auto">Ironically, the US maintains mechanisms to protect its data from foreign control while monitoring others’, consolidating digital sovereignty by setting the terms of engagement.</p>
[https://www.fedramp.gov/ FedRAMP] establishes the conditions under which any cloud provider, including foreign entities, may process US federal government data, asserting sovereign gatekeeping over access to its own infrastructure even as it resists equivalent constraints abroad. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] and the accompanying [https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern DOJ rule (2025)], although criticised for their generalistic scope, restrict the outbound transfer of bulk sensitive data to designated "countries of concern." The asymmetry is instructive when set against the EU's broadly equivalent instruments: both regimes exercise control, but over opposite targets, the United States restricts flows to named adversaries, while the EU restricts flows to any third country whose legal framework it deems inadequate, a criterion of general application rather than one confined to a defined list of hostile states.

The EU's principal instrument of power has consequently been regulatory rather than infrastructural, expressed through the [https://gdpr-info.eu/art-48-gdpr/ GDPR (Art. 48)] and the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act], mechanisms of constraint and protection rather than instruments of reach comparable to the [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] or [https://www.law.cornell.edu/uscode/text/50/1881a FISA]. There's a clear divergence in objective these reflect, and it is rooted in the different conception tof human rights, values and norms, related to data protection and privacy both actors have. Worth mentioning, the EU's position is further constrained by a material deficit, limited infrastructural capacity, financial resources.

As of right now, the United States can circumvent the normative safeguards the EU has imposed in some cases (through [https://www.law.cornell.edu/uscode/text/50/1881a FISA]), and it already possesses the infrastructural capacity the EU lacks ([https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 only 13 to 15 percent of the market is EU-owned]). This gives the US vast dominance in the field, which could be equated to what the EU coins as cloud sovereignty. Aware of the risks this dependency poses, both to data access and to the strategic advantage it affords the US, the EU has sought to reduce it through a succession of initiatives. [https://www.enisa.europa.eu/publications/eucs-cloud-service-scheme EUCS] was one such attempt, and remains only a non-legally-binding standard, stalled, per the [https://www.iss.europa.eu/publications/briefs/technical-political-when-cloud-certification-scheme-divides-europe EUISS], by Member States divided over their reliance on US providers; whether the [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52026PC0502 Cloud and AI Development Act] fares better remains to be seen.

=== Supply Chain management and Semiconductors ===
The United States and the European Union are equally invested in developing a domestic semiconductor industry, what separates them is their approach, the risks willing to run, the tools willing to use, and, above all, the capabilities and resources each power has. The US specifially aims to develop a bigger industry in this sector to rival competing hegemonic powers, to then gain AI dominance, strategic advantage and a stronger position in the international order.

The centrepiece is the [https://www.govinfo.gov/content/pkg/PLAW-117publ167/pdf/PLAW-117publ167.pdf CHIPS and Science Act] of August 2022, a statute that funds domestic fabrication and research through grants, loans and awards administered by the Department of Commerce. Its force comes from its scale: $39 billion in manufacturing incentives (including $2 billion reserved for legacy chips) and $11 billion for R&D, a federal pool officials themselves [https://www.reuters.com/technology/us-picks-team-oversee-527-bln-semiconductor-funding-2022-09-20/ described at the time] as $52.7 billion, on top of a Section 48D investment tax credit set from 25 to 35 percent in 2025. This is a single, centralised federal pool, commanded and disbursed by one government. The [https://eur-lex.europa.eu/eli/reg/2023/1781/oj/eng EU Chips Act (Regulation (EU) 2023/1781)] pursues the identical objective, a resilient domestic semiconductor base, but with a wholly different reach: its own budget is capped at a "maximum indicative amount" of just EUR 3.3 billion and decentralised Member State state aid. The US pursues to clash with other powers and surpass them through several measures in this statute, none of which the EU has an equivalent to.

The [https://www.federalregister.gov/documents/2023/09/25/2023-20471/preventing-the-improper-use-of-chips-act-funding CHIPS guardrails rule] binds every recipient of the funds for ten years: the Expansion Clawback bars material expansion, defined as growth of more than 5 percent, of semiconductor manufacturing capacity in a "foreign country of concern". These are protection measures, converting a subsidy into standing control over where a funded firm may grow and with whom it may cooperate, minimising ties to rival powers while building US capacity unilaterally.

The [https://www.federalregister.gov/documents/2022/10/13/2022-21658/implementation-of-additional-export-controls-certain-advanced-computing-and-semiconductor BIS export-control rule] does two things. First, it blocks advanced chips and chip-making equipment from reaching ‘countries of concern’ even when made outside the US, if US' technology, software or tools were used somewhere along the way to make them. Second, it stops any American, wherever in the world they work, from helping build advanced chips for those countries, even in a support role like shipping or servicing. What the US rule shows, in a way cloud policy does not, is active separation: a deliberate policy of isolating adversary states from American inputs, expertise and even American citizens' labour, building domestic capacity at home rather than permitting it to leak abroad through investment, export or cooperation.

The [https://www.federalregister.gov/documents/2026/01/20/2026-01052/adjusting-imports-of-semiconductors-semiconductor-manufacturing-equipment-and-their-derivative Section 232 proclamation] of 14 January 2026 shows the same modus operandi differently: a 25% tariff on certain advanced chips, and, in August 2025, the [https://newsroom.intel.com/corporate/intel-and-trump-administration-reach-historic-agreement conversion of $8.9 billion owed to Intel into a 9.9 percent equity stake] in the company. Neither is a law of general application; both are one-off executive moves, using a tariff or an ownership stake to get what the government wants directly. The US reaches for leverage and deal-making, not just regulation, a tool the EU does not use.

CHIPS award recipients are also barred by law from using federal funds to pay shareholder dividends or buy back stock, a restriction the [https://www.nist.gov/document/approach-capital-allocation-policies CHIPS Program Office] has sought to extend for five years from the date of an award.

=== Supply Chain Management and Rare Earth Minerals ===
<p class="mwt-heading">AI systems require advanced semiconductors, semiconductors require rare earth elements and critical minerals,  and the United States currently remains reliant on processing capacity concentrated in China. Where the [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] addresses the fabrication layer, a separate and more fragmented body of law addresses the mineral layer beneath it. Unlike the EU's [https://eur-lex.europa.eu/eli/reg/2024/1252/oj/eng Critical Raw Materials Act], the American framework layers a foundational statute, an executive order, and a narrower defense-procurement statute.<br></p>

==== Energy Act of 2020 ====
Section 7002 of the Energy Act of 2020 (codified at [https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=30-USC-185389929-22931526&term_occur=999&term_src= 30 U.S.C. §1606]) supplies the foundational definitions. It defines a "critical mineral" through a delegated standard: a "byproduct" is a critical mineral whose recovery depends on the production of a host mineral not itself designated critical, while a "critical material" is any non-fuel mineral, element, substance, or material the Secretary of Energy determines carries a high risk of supply-chain disruption. This is primarily an administrative and classificatory act: it does not itself compel production, but it creates the taxonomy (which of the 17 rare earth elements are legally "critical") on which subsequent executive and procurement action depends.

==== Executive Order 14241 (2025) ====
[https://public-inspection.federalregister.gov/2025-05212.pdf Executive Order 14241], entitled "Immediate Measures to Increase American Mineral Production," signed March 20, 2025, operationalizes that taxonomy. Its Section 1 purpose clause is unusually candid about the framing: national and economic security are now threatened by dependence on hostile foreign powers. Operationally, Section 3 directs every federal agency involved in permitting to submit to the National Energy Dominance Council a list of all mineral production projects for which a plan of operations or permit application has been submitted, after which agency heads must identify projects that can be immediately approved and expedite them. The Order invokes [https://www.law.cornell.edu/uscode/text/50/4533 Title III of the Defense Production Act] to mobilize financing, and tasks the NEDC, chaired by the Secretary of the Interior, with coordinating implementation across Defense, Energy, Interior, and Agriculture. Unlike the CHIPS Act, it required no congressional appropriation, and unlike the Energy Act, it does not merely classify inputs but seeks to physically build an alternative domestic supply chain, the mining-and-processing analogue to the CRMA's "strategic projects" mechanism. Executive Order 14241 has since been diluted by [https://www.whitehouse.gov/presidential-actions/2025/04/reinvigorating-americas-beautiful-clean-coal-industry-and-amending-executive-order-14241/ Executive Order 14261], which extends designation of criticality to sectorally unrelated materials such as coal.

==== 10 U.S.C. §4872 and the DFARS ====
The narrowest instrument is [https://www.law.cornell.edu/uscode/text/10/4872 10 U.S.C. §4872], which provides that the Secretary of Defense may not procure any covered material melted or produced in any covered nation, or any end item containing such material. [https://www.law.cornell.edu/definitions/uscode.php?def_id=10-USC-1197798417-780045830&term_src=title:10:subtitle:A:part:V:subpart:I:chapter:385:subchapter:III:section:4872 “Covered nations"] are defined as North Korea, China, Russia, and Iran, covered materials include samarium-cobalt and neodymium-iron-boron magnets. Implemented through [https://www.acquisition.gov/dfars/225.7018-2-restriction. DFARS 225.7018-2], the clause currently bars acquisition of any covered material melted or produced in any covered country, tightening in 2027 to cover the entire chain. This statute does not build supply; it leverages the federal government's own purchasing power to exclude adversary-sourced inputs from the defense industrial base, a tool with no direct EU parallel, since the CRMA's diversification targets operate through incentive rather than exclusion.

Infrastructures: Digital Sovereignty

2026-09-25T15:16:15Z

Fortuny Jané Mariona: /* Supply Chain management and Semiconductors */

= Infrastructures: Digital Sovereignty =
Digital Sovereignty in the European Union is a [https://www.tandfonline.com/doi/full/10.1080/17579961.2026.2705118 term used to convey ] a broad array of policy ambitions in relation to digital technology development and use: the urgency to regain control over data, infrastructures, and (critical) technologies, the establishment of strategic autonomy, the conclusion of partnerships with geopolitical allies, and the reduction of critical dependencies. According to the Digital Decade Policy Programme [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52023SC0570 Implementation Report] of 2023, digital sovereignty refers to the EU's "ability to act independently in the digital world and therefore it constitutes a crucial means to safeguard [EU] values".

= Brazil =
'''''Words: 2142'''''
<div style="font-weight: 400;">
== 1. Introduction: What Is Digital Sovereignty? ==
</div>
<div style="font-weight: 400;"><p>Digital sovereignty refers to the capacity of a state to exercise autonomy, self-determination, and control over data, digital infrastructure, and technologies. This encompasses three distinct but overlapping dimensions: internet sovereignty (control over networks and online content), data sovereignty (governance of data flows, privacy, and cybersecurity), and technological sovereignty (control over critical technologies such as artificial intelligence, semiconductors, and raw materials). The endeavor toward digital sovereignty was accelerated by the Snowden revelations. Brazil has developed its own discourse on digital sovereignty, shaped by its historical concerns about foreign surveillance, its position as a major emerging economy, and its ambition to become a global technology actor. </p></div>
<div style="font-weight: 400;">
== 2. Brazil's National Digital Sovereignty Outlook ==
</div>
<div style="font-weight: 400;"><p>Brazil's approach to digital sovereignty is rooted in a long-standing concern about technological dependence and foreign surveillance. The 2013 revelation that the National Security Agency had intercepted communications of Brazilian President Dilma Rousseff and surveilled Petrobras (Brazil's state oil company) served as a breakpoint moment. This urged the Brazilian political agenda to reduce reliance on foreign digital infrastructure, and prompted Brazil to accelerate its own digital infrastructure projects. The most notable infrastructure project is the EllaLink undersea cables, connecting Brazil to Portugal (and thereby South America to Europe), which was explicitly designed to circumvent internet routing controlled by the US and enhance Brazil's data [https://www.cambridge.org/core/books/digital-sovereignty-in-the-brics-countries/introduction/88A1164945DC955023BB812CA88FEABC sovereignty. ]</p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty discourse is also closely tied to its open-source tradition. Brazil has historically been a strong proponent of open-source software. In the early 2000’s, during the Lula administration, Brazil’s government promoted free and open-source software as a tool for reducing dependence on proprietary foreign technology and lowering [https://www.researchgate.net/publication/316669377_Free_Software_as_Public_Service_in_Brazil_An_Assessment_of_Activism_Policy_and_Technology costs. ]This open-source orientation remains an element of Brazil's digital sovereignty strategy today: the development of national AI models, open data ecosystems, and publicly governed cloud infrastructure all reflect this tradition.  </p></div>
<div style="font-weight: 400;"><p>The Brazilian AI Plan (PBIA) explicitly includes the development of a national AI software stack and open training databases, reflecting the view that open-source tools are a vehicle for technological autonomy rather than a security risk. </p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty strategy is therefore characterised by two core priorities: (i) reducing dependence on foreign digital infrastructure and proprietary technology and (ii) building domestic capacity in critical technology sectors (AI, semiconductors, critical minerals). </p></div>
<div style="font-weight: 400;">
== 3. Regulatory Framework: Artificial Intelligence ==
</div>
<div style="font-weight: 400;">
=== 3.1 Brazilian AI Strategy (EBIA) ===
</div>
<div style="font-weight: 400;"><p>Brazil's first official national AI strategy, the Estratégia Brasileira de Inteligência Artificial (EBIA), established the country's overarching vision for AI governance. Based on the OECD's AI principles, EBIA is structured around pillars including ethical and responsible AI, data governance, innovation, education and workforce development, public sector use of AI, and international cooperation. It explicitly prioritises human-centred AI, the protection of fundamental rights, transparency, and risk mitigation. However, EBIA is a soft law instrument: it sets principles only, with no binding obligations, no enforcement mechanisms, and no dedicated budget. It functions as a normative framework that articulates values and directions rather than imposing legal duties. </p></div>
<div style="font-weight: 400;">
=== 3.2 Brazilian AI Plan (PBIA, 2024–2028) ===
</div>
<div style="font-weight: 400;"><p>The Plano Brasileiro de Inteligência Artificial (PBIA), launched on 30 July 2024 under the motto "AI for the Good of All," builds on EBIA by translating strategic vision into a concrete investment and infrastructure roadmap. Approved by the National Council for Science and Technology and coordinated by the Ministry of Science, Technology and Innovation, the PBIA is a strategic non-binding soft-law policy framework with a planned investment of R$23.03 billion through 2028. </p></div>
<div style="font-weight: 400;"><p>The PBIA combines immediate-impact initiatives with structural actions organised into five axes. These actions aim to develop the capabilities and skills needed for sustainable AI development in Brazil, while strengthening national sovereignty, technological autonomy, competitiveness and responsible innovation. Approximately 98.1% of planned investment is directed towards these structural actions. AI for Business Innovation (59.9%), Infrastructure and AI Development (25.2%), and AI for Improving Public Services (7.6%) receive the largest shares, followed by Dissemination, Education and Training in AI (5.0%). Support for AI Regulation and Governance receives approximately 0.4%. This distribution indicates an emphasis on building technological and industrial capacity. It is also indicative that Brazil prioritizes developing the technology infrastructure over implementing regulation in the form of hard law. From a digital sovereignty perspective, several elements of the PBIA are particularly significant. The Infrastructure and AI Development axis includes a National AI Infrastructure Program aimed at investing in high-performance computing and autonomous AI hardware to support technological sovereignty. It also includes a Sustainability and Renewable Energy Programme for AI, supporting renewable-energy infrastructure and efficient resource use, and a Programme for Structuring the Data and Software Ecosystem for AI intended to reduce external dependence, improve training datasets and develop a national AI software stack. AI for improving public services axis provides for a Sovereign Cloud, private or community cloud infrastructure managed exclusively by public agencies or state-owned companies, to increase control, security and sovereignty over sensitive data and ensure it is stored on national territory. The AI for Business Innovation axis aims to support sectors within the AI production chain, including information and communication technologies (ICT) and microelectronics, and to position Brazil as a global data centre hub. The PBIA reports that Brazil currently operates only 168 data centres (ranking 13th globally, compared to over 5,000 in the United States). Its AI Value Chain Promotion Programme seeks to strengthen and expand the domestic AI value chain, from supporting startups to developing Brazilian companies supplying foundation models. </p></div>
<div style="font-weight: 400;"><p>Bill No PL 2338/2023, which proposes a comprehensive AI framework, has passed the Senate and remains under consideration in the Chamber of Deputies, the lower house of Brazil’s National Congress. Until it is enacted, Brazil's AI governance framework remains largely in the realm of soft law, creating legal uncertainty for investors, developers, and citizens alike. </p></div>
<div style="font-weight: 400;">
== 4. Regulatory Framework: Semiconductors and Critical Minerals ==
</div>
<div style="font-weight: 400;">
=== 4.1 Brasil Semicon (Law No. 14.968/2024) ===
</div>
<div style="font-weight: 400;"><p>The Brazil Semiconductor Programme (Brasil Semicon), established under Law No. 14.968 of 11 September 2024, constitutes Brazil's principal hard law instrument for technological sovereignty in the semiconductor sector. It establishes a national strategy and guidelines to encourage research, development, innovation, production, and application of semiconductors, displays, and solar panels. Brasil Semicon updates and expands the instruments of PADIS (the Support Program for Technological Development of the Semiconductor Industry), extending tax incentives until the end of 2029 and broadening their scope to include software, specialised services, technical assistance, and other stages of the production chain. Decree No. 13.065 of 16 July 2026 activated the programme, establishing the rules for the semiconductor industry and facilitating access to PADIS tax incentives. The programme aims to attract investments in the national chip supply chain until 2029, directly addressing Brazil's dependence on foreign semiconductor manufacturing. </p></div>
<div style="font-weight: 400;"><div>
=== 4.2 National Policy on Critical and Strategic Minerals (Law No. 15.506/2026) ===
</div>
<div><p>Published on 16 September 2026, Law No. 15.506/2026 establishes a national policy and governance structure for critical and strategic minerals. It aims to promote research, extraction, processing, and transformation of critical and strategic minerals domestically, adding value to supply chains rather than exporting raw materials. The policy explicitly seeks to strengthen Brazil's economic and geopolitical security by ensuring a stable domestic supply of minerals essential to the digital economy — including those required for semiconductors, batteries, and AI hardware. It provides up to R$5 billion in tax credits (covering up to 20% of eligible expenses) from 2030 through 2034 for mineral processing, manufacturing, and recycling projects, and authorises a Mineral Activity Guarantee Fund with up to R$2 billion in federal contributions. This law is significant because Brazil holds some of the world's largest reserves of rare earth minerals and other critical inputs for the digital economy, and the policy represents a strategic decision to leverage these resources for domestic technological development rather than simply exporting them. </p></div>
<div>
== 5. The EU–Brazil Digital Partnership (2026) ==

<div><p>Signed on 12 June 2026, the EU–Brazil Digital Partnership is a soft law instrument establishing a framework for bilateral cooperation on issues that concern digital sovereignty.  </p></div>
<div>
i) Article 2 commits both parties to fostering meaningful digital development and inclusion while preserving digital sovereignty, democratic principles, and human rights.  </div>
<div>
ii) Article 3 provides for reciprocal recognition of data protection levels — based on the European Parliament's adequacy decision of January 2026 and Brazil's ANPD Resolution 32 — thereby easing cross-border data flows and building trust in bilateral data governance.  </div>
<div>iii)
Article 15 commits both parties to developing national technology supply chains to ensure that global interdependence does not undermine their respective technological sovereignties.  </div>
<div>
iv) Article 17 provides for cooperation on AI development and deployment, referencing the PBIA and comparable EU programmes.  </div>
<div>
v) Articles 19 and 21 establish information-sharing mechanisms on data governance, data spaces, digital services, and digital markets, with an explicit commitment to preserving regulatory autonomy.  </div>
<div>
vi) Article 23 references Brazil's EllaLink undersea cable project as a concrete expression of its digital sovereignty ambitions. </div>
<div><p>The Digital Partnership is a precursor to harder legal instruments: it is future-facing, flexible, and oriented toward sharing know-how and building mutual trust. Its soft law nature is appropriate given the current rate of innovation in technology. </p></div>
<div></div>

== 6. Comparison with the EU ==
</div>
<div><p>Brazil and the EU share the same fundamental goal: reducing dependence on foreign (primarily US and Chinese) digital infrastructure and technology. However, they pursue it through different regulatory architectures. </p></div>
<div><p>The EU has adopted a comprehensive, multi-layered hard law framework for digital sovereignty, encompassing the GDPR, the NIS 2 Directive, the Cybersecurity Act, the Chips Act, and the Critical Raw Materials Act, alongside the newly proposed EU Tech Sovereignty Package (June 2026) including the Cloud and AI Development Act (CADA) and an EU Open Source Strategy. The package therefore combines legislative proposals with non-binding policy instruments. The EU's approach combines binding regulation with substantial public investment, and it applies to both public and private sector actors. </p></div>
<div><p>Brazil, by contrast, has followed a more strategy-led approach to developing its dedicated AI framework. Its AI governance framework remains largely in soft law (EBIA and PBIA), with binding legislation (PL 2338) still pending. Brazil’s hard law instruments are concentrated in the industrial and resource sectors (Brasil Semicon; the Critical Minerals Law), reflecting a Brazil’s priority being placed on supply chain sovereignty and infrastructure building (rather than regulatory compliance frameworks).  </p></div>
<div><p>In 2026 Brazil began developing the Nuvem Brasileira, a national cloud infrastructure designed to keep critical government data and control of the infrastructure under Brazilian jurisdiction, while favouring open standards and reducing dependence on foreign technology providers. Specifically, the Brazilian government decided that Microsoft and other foreign big tech providers would not be the preferred providers for the Nuvem Brasileira. The government is explicitly assessing dependencies on foreign suppliers and whether the State could continue operating critical services if an external provider became unavailable. Brazil’s model does not require everything to be Brazilian-made, but focuses on control over data, operations and technology.  This shifts sovereignty from simply where data is stored to who controls the infrastructure, keys, software, jurisdiction and ability to operate independently. It is alongside REDATA, which uses datacentre incentives to build domestic technological capacity. Brazil's open-source orientation also distinguishes it from the EU. Both jurisdictions promote open source as a means of strengthening technological autonomy. While the EU has adopted an Open Source Strategy and the CADA references open-source principles, Brazil's commitment to open-source software is deeper and more historically embedded, reflecting a political tradition that views proprietary technology as a vector of foreign dependence. The PBIA's emphasis on a national AI software stack and open training data reflects this tradition and represents a distinctive approach to technological sovereignty that merits attention in comparative analysis. </p></div>
<div><p>Finally, both Brazil and the EU face the same structural challenge: the global digital economy is dominated by a small number of US and Chinese technology companies, and neither jurisdiction has yet succeeded in producing domestic alternatives at comparable scale. Brazil's ambition to become a global data centre hub and to develop sovereign AI models is bold, but the gap between aspiration and capacity remains large. The EU's more developed AI-specific regulatory architecture provides stronger protections for citizens and clearer rules for industry, but has been criticised for potentially hampering innovation. Brazil's softer approach may allow for faster initial development, but risks leaving citizens and the market without adequate legal protection in the interim. </p></div>
<div>
== 7. Conclusion ==
</div>
<div><p>Brazil's approach to digital sovereignty is characterised by a strong national discourse rooted in concerns about foreign surveillance and technological dependence, a soft law-dominant AI governance framework that is still evolving toward binding regulation, and hard law instruments in the semiconductor and critical minerals sectors that reflect a strategic prioritisation of supply-chain sovereignty. Brazil's open-source tradition adds a distinctive dimension to its digital sovereignty strategy, positioning it differently from both the. The EU–Brazil Digital Partnership represents a meaningful step toward bilateral cooperation, but its soft law nature means  its impact will depend on follow-through.  </p></div></div>

= China =
<p><strong style="font-size: 14.4px;">Words: 2306</strong><br></p>
<div><p><br></p></div>
<div><p>'''Introduction'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;">“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence.</p></div>
<div style="text-align: justify;"><p>In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</p></div>
<div style="text-align: justify;"><p>In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</p></div>
<div style="text-align: justify;"><p>Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</p></div>
<div><p style="text-align: justify;"><br></p></div>
<div><p>'''Cybersecurity Law'''</p></div>
<div><p><br></p></div>
<div><p>The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</p></div>
<div><p style="text-align: justify;" >In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</p></div>
<div><p style="text-align: justify;" >In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</p></div>
<div><p style="text-align: justify;" >Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</p></div>
<div><p style="text-align: justify;" >In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</p></div>
<div><p><br></p></div>
<div><p>'''Data Security Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development.</p></div>
<div><p style="text-align: justify;" >It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</p></div>
<div><p style="text-align: justify;" >The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</p></div>
<div><p style="text-align: justify;" >In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</p></div>
<div><p><br></p></div>
<div><p>'''Personal Information Protection Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40).</p></div>
<div><p style="text-align: justify;" >Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</p></div>
<div><p><br></p></div>
<div><p>'''China’s State Centered Concept of Digital Sovereignty'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to ''“abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order”'' (see article 13), and why the the Data Security Law establishes as an objective to ''“preserve State sovereignty, security, and development interests”'' (see article 1).</p></div>
<div><p style="text-align: justify;" >Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</p></div>
<div><p style="text-align: justify;" >In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</p></div>
<div><p style="text-align: justify;" >In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</p></div>
<div><p style="text-align: justify;" >These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</p></div>
<div><p style="text-align: justify;" >In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</p></div>
<div><p><br></p></div>
<div><p>'''China Model Versus the European Union Model'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context.</p></div>
<div><p style="text-align: justify;" >EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</p></div>
<div><p style="text-align: justify;" >Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</p></div>
<div><p>As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</p></div>
<div><p style="text-align: justify;" >This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</p></div>
<div><p style="text-align: justify;" >Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</p></div>
<div><p>''''''</p>
<p>'''References'''</p></div>
<div><p><br></p></div>
<div><p>'''(1)'''<span class="apple-converted-space"> </span>Cybersecurity Law of the People's Republic of China (2025 Amendment).</p></div>
<div><p>'''(2)'''<span class="apple-converted-space"> </span>Data Security Law of the People's Republic of China (2021).</p></div>
<div><p>'''(3)'''<span class="apple-converted-space"> </span>Personal Information Protection Law of the People's Republic of China (2021).</p></div>
<div><p>'''(4)'''<span class="apple-converted-space"> </span>Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</p></div>
<div><p>'''(5)'''<span class="apple-converted-space"> </span>Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, </p>
[https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']</div>
<div><p>'''(6)'''<span class="apple-converted-space"> </span>Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, </p>
[https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty]</div>
<div>'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>
<div></div>

= [[Infrastructures:India|India]] =

= United States =
== The Concept of Digital Sovereignty ==
<p>The idea of “digital sovereignty” is not a single concept. There are a number of scholars who attempted to define digital sovereignty. [https://www.academia.edu/99043334/What_does_the_notion_of_sovereignty_mean_when_referring_to_the_digital Couture and Toupin] and [https://www.researchgate.net/publication/343611573_The_Fight_for_Digital_Sovereignty_What_It_Is_and_Why_It_Matters_Especially_for_the_EU Floridi] emphasized the '''control''' over the digital realm, in which Floridi saw a combination of democratic legitimacy with innovative flexibility by a hybrid system of control. On the other hand, [https://techreg.org/article/view/23778?articlesBySimilarityPage=1 Chung] looked into the aspect of '''authority''' by defining digital sovereignty as a state’s ability to define, implement and enforce political and legal decisions across digital systems, platforms and data infrastructures. She also reconceptualized the term by asserting that sovereignty should be understood as governance '''capacity''' rather than exclusive control. There is a variety of perspectives in determining what digital sovereignty means and conflicting definitions based on varying national strategies.</p><p>The definition of digital sovereignty adopted throughout this study is a merge of authority and practical capacity of a state to set, apply and defend its own rules governing the digital infrastructure, data flows and algorithmic systems that shape its legal and political orders, against interference by outside actors, whether public or private, including other levels of government within the same state.</p>
=== The United States Sovereignty Strategy: AI Dominance ===
<p>Unlike the EU who attempts to maintain digital sovereignty under its regulatory control, the idea of securing digital sovereignty is not its priority for the US. Their goal is to ensure geopolitical dominance by entrenching American advantage in the technologies that determine their economic and military standing, against a field of competitors, namely China as the principal one.</p><p>From ''[https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf Winning the Race: America’s AI Action Plan]'', Issued on 23 July 2025, the US outlines 103 recommended actions by three pillars:</p>

*Pillar 1: Accelerate AI Innovation – removing “bureaucratic red tapes” which hinder technological advancement by deregulation
*Pillar 2: Build American AI Infrastructure – fostering an environment conducive to AI innovations
*Pillar 3: Lead in International AI Diplomacy and Security – Ensuring its global hegemonic position in AI technology<p>As explicitly stated from the plan, their core interest is in winning the race and securing its geopolitical primacy relative to other competitors rather than enhancing its authority and capacity over its domestic digital governance. The Plan itself has no legal force, yet the actual implementation is played by executive orders and procurements.</p>
== The Four Registers ==
<p>American digital policy has an organising purpose, and it is not regulation. It is primacy: maintaining American advantage in the technologies that determine economic and military standing, against a field of competitors, of which China is the principal one. The framing is stated in the instruments themselves — the order that set the current course is titled Removing Barriers to American Leadership in Artificial Intelligence, and the strategy it produced is titled Winning the Race. Beneath that strategy, the United States steers digital developments through four registers, descending in legal formality and ascending in speed.</p><p>'''Statute''' is the thinnest register. The [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] and the [https://www.congress.gov/bill/118th-congress/house-bill/7521 Protecting Americans from Foreign Adversary Controlled Applications Act] are both narrow and adversary-specific, and general legislation has failed: the Senate stripped a ten-year moratorium on state enforcement of AI laws from the One Big Beautiful Bill Act by a vote of 99 to 1.</p><p>'''Executive orders''' carry the load. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] produced the Data Security Program, an export control keyed to adversary identity rather than to any standard of protection; Executive Order 14320 finances the export of full-stack American AI packages; Executive Order 14365 asserts a national AI framework and directs litigation against inconsistent state laws.</p><p>'''Procurement''' is quieter and probably more effective, and is illustrated below by the cloud and semiconductor sectors.</p><p>'''Announcement''' is the fastest register and the least examined. On 19 January 2025 the President posted on Truth Social that he would issue an order extending the statutory TikTok divestment deadline, and [https://www.theguardian.com/us-news/2025/jan/19/trump-tiktok-ban-executive-order TikTok restored service] in the United States the same day, before any instrument existed. A platform serving some 170 million US users changed its conduct based solely on anticipated legality.</p>
=== Direction of Travel ===
<p>The direction of policy is consistent across all four registers and runs four ways. Outward, the export programme pushes the domestic AI stack into third markets. Inward, the Data Security Program and Team Telecom review screen foreign access based on a counterparty's identity rather than the safeguards it offers. Homeward, subsidy builds domestic capacity. Downward, federal policy presses on the states, and it is working even though preemption ordinarily requires a congressional enactment: Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower automated decision-making statute stripped of deployer impact-assessment duties, while California's frontier AI statute (SB 53) contains a federal-deference clause under which compliance with a comparable federal framework discharges the state obligation. States are deferring in advance to a federal standard that does not yet exist.</p><p>Outward and homeward movement build the US position; inward and downward movement defend it against interference, foreign in the former case and domestic in the latter. The same adversary-identity test recurs in an export control, a subsidy condition, and a screening review alike.</p>

== US Infrastructure and Resources efforts for AI dominance ==

=== Supply Chain management and the Cloud ===

The United States aims to maintain its position in the [https://www.cambridge.org/core/journals/international-organization/article/digital-disintegration-technoblocs-and-strategic-sovereignty-in-the-ai-era/DD86C6FD3FDD7FBBADEF100C6935D577 international order, seeking to surpass and constrain rival powers]. Technological dominance constitutes one of the principal means of pursuing this objective, and in recent years this pursuit has centred increasingly on artificial intelligence, a domain heavily dependent on underlying industrial capacity and resource access.

Cloud service dependency describes a form of [https://www.cambridge.org/core/journals/review-of-international-studies/article/susan-strange-meets-the-everyday-the-mundane-sources-of-structural-power/1D23361D622C523F7EB785EA54105858 structural power] exercised not through territorial control but through infrastructural ownership. Because US firms hold roughly [https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 two-thirds of the EU cloud market], a majority of European data, public and private, resides within entities potentially subject to US jurisdiction, irrespective of the server's physical location. This constitutes strategic advantage precisely because it requires no conventional projection of power abroad: dominance is achieved by occupying the infrastructural layer itself, converting market position into jurisdictional reach and, in turn, translating informational access into epistemic and strategic advantage. The [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] grants the United States access to foreign data provided this is held by a US cloud service provider, access guaranteed only through a defined legal process, the issuance of a judicial warrant subject to probable cause. [https://www.law.cornell.edu/uscode/text/50/1881a FISA Section 702], by contrast, authorises access to foreign data held in US clouds for intelligence purposes through compelled provider assistance, and in this instance no comparable judicial procedure is required by law. These divergent standards of authorisation, and the reach they enable, stand in direct tension with the protections EU law seeks to guarantee.

<p dir="auto">Ironically, the US maintains mechanisms to protect its data from foreign control while monitoring others’, consolidating digital sovereignty by setting the terms of engagement.</p>

[https://www.fedramp.gov/ FedRAMP] establishes the conditions under which any cloud provider, including foreign entities, may process US federal government data, asserting sovereign gatekeeping over access to its own infrastructure even as it resists equivalent constraints abroad. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] and the accompanying [https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern DOJ rule (2025)], although criticised for their generalistic scope, restrict the outbound transfer of bulk sensitive data to designated "countries of concern." The asymmetry is instructive when set against the EU's broadly equivalent instruments: both regimes exercise control, but over opposite targets, the United States restricts flows to named adversaries, while the EU restricts flows to any third country whose legal framework it deems inadequate, a criterion of general application rather than one confined to a defined list of hostile states.

The EU's principal instrument of power has consequently been regulatory rather than infrastructural, expressed through the [https://gdpr-info.eu/art-48-gdpr/ GDPR (Art. 48)] and the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act], mechanisms of constraint and protection rather than instruments of reach comparable to the [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] or [https://www.law.cornell.edu/uscode/text/50/1881a FISA]. There is a clear divergence in objective these reflect, and it is rooted in the different conception the EU has of human rights, values and norms, related to data protection and privacy in comparison to the US'. Worth mentioning, the EU's position is further constrained by a material deficit, limited infrastructural capacity, financial resources.

As of right now, the United States can circumvent the normative safeguards the EU has imposed in some cases (through [https://www.law.cornell.edu/uscode/text/50/1881a FISA]), and it already possesses the infrastructural capacity the EU lacks ([https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 only 13 to 15 percent of the market is EU-owned]). This gives the US vast dominance in the field, which could be equated to what the EU coins as cloud sovereignty. Aware of the risks this dependency poses, both to data access and to the strategic advantage it affords the US, the EU has sought to reduce it through a succession of initiatives. [https://www.enisa.europa.eu/publications/eucs-cloud-service-scheme EUCS] was one such attempt, and remains only a non-legally-binding standard, stalled, per the [https://www.iss.europa.eu/publications/briefs/technical-political-when-cloud-certification-scheme-divides-europe EUISS], by Member States divided over their reliance on US providers; whether the [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52026PC0502 Cloud and AI Development Act] fares better remains to be seen.

=== Supply Chain management and Semiconductors ===
The United States and the European Union are equally invested in developing a domestic semiconductor industry, what separates them is their approach, the risks willing to run, the tools willing to use, and, above all, the capabilities and resources each power has. The US specifially aims to develop a bigger industry in this sector to rival competing hegemonic powers, to then gain AI dominance, strategic advantage and a stronger position in the international order.

The centrepiece is the [https://www.govinfo.gov/content/pkg/PLAW-117publ167/pdf/PLAW-117publ167.pdf CHIPS and Science Act] of August 2022, a statute that funds domestic fabrication and research through grants, loans and awards administered by the Department of Commerce. Its force comes from its scale: $39 billion in manufacturing incentives (including $2 billion reserved for legacy chips) and $11 billion for R&D, a federal pool officials themselves [https://www.reuters.com/technology/us-picks-team-oversee-527-bln-semiconductor-funding-2022-09-20/ described at the time] as $52.7 billion, on top of a Section 48D investment tax credit set from 25 to 35 percent in 2025. This is a single, centralised federal pool, commanded and disbursed by one government. The [https://eur-lex.europa.eu/eli/reg/2023/1781/oj/eng EU Chips Act (Regulation (EU) 2023/1781)] pursues the identical objective, a resilient domestic semiconductor base, but with a wholly different reach: its own budget is capped at a "maximum indicative amount" of just EUR 3.3 billion and decentralised Member State state aid. The US pursues to clash with other powers and surpass them through several measures in this statute, none of which the EU has an equivalent to.

The [https://www.federalregister.gov/documents/2023/09/25/2023-20471/preventing-the-improper-use-of-chips-act-funding CHIPS guardrails rule] binds every recipient of the funds for ten years: the Expansion Clawback bars material expansion, defined as growth of more than 5 percent, of semiconductor manufacturing capacity in a "foreign country of concern". These are protection measures, converting a subsidy into standing control over where a funded firm may grow and with whom it may cooperate, minimising ties to rival powers while building US capacity unilaterally.

The [https://www.federalregister.gov/documents/2022/10/13/2022-21658/implementation-of-additional-export-controls-certain-advanced-computing-and-semiconductor BIS export-control rule] does two things. First, it blocks advanced chips and chip-making equipment from reaching ‘countries of concern’ even when made outside the US, if US' technology, software or tools were used somewhere along the way to make them. Second, it stops any American, wherever in the world they work, from helping build advanced chips for those countries, even in a support role like shipping or servicing. What the US rule shows, in a way cloud policy does not, is active separation: a deliberate policy of isolating adversary states from American inputs, expertise and even American citizens' labour, building domestic capacity at home rather than permitting it to leak abroad through investment, export or cooperation.

The [https://www.federalregister.gov/documents/2026/01/20/2026-01052/adjusting-imports-of-semiconductors-semiconductor-manufacturing-equipment-and-their-derivative Section 232 proclamation] of 14 January 2026 shows the same modus operandi differently: a 25% tariff on certain advanced chips, and, in August 2025, the [https://newsroom.intel.com/corporate/intel-and-trump-administration-reach-historic-agreement conversion of $8.9 billion owed to Intel into a 9.9 percent equity stake] in the company. Neither is a law of general application; both are one-off executive moves, using a tariff or an ownership stake to get what the government wants directly. The US reaches for leverage and deal-making, not just regulation, a tool the EU does not use.

CHIPS award recipients are also barred by law from using federal funds to pay shareholder dividends or buy back stock, a restriction the [https://www.nist.gov/document/approach-capital-allocation-policies CHIPS Program Office] has sought to extend for five years from the date of an award.

=== Supply Chain Management and Rare Earth Minerals ===
<p class="mwt-heading">AI systems require advanced semiconductors, semiconductors require rare earth elements and critical minerals,  and the United States currently remains reliant on processing capacity concentrated in China. Where the [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] addresses the fabrication layer, a separate and more fragmented body of law addresses the mineral layer beneath it. Unlike the EU's [https://eur-lex.europa.eu/eli/reg/2024/1252/oj/eng Critical Raw Materials Act], the American framework layers a foundational statute, an executive order, and a narrower defense-procurement statute.<br></p>

==== Energy Act of 2020 ====
Section 7002 of the Energy Act of 2020 (codified at [https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=30-USC-185389929-22931526&term_occur=999&term_src= 30 U.S.C. §1606]) supplies the foundational definitions. It defines a "critical mineral" through a delegated standard: a "byproduct" is a critical mineral whose recovery depends on the production of a host mineral not itself designated critical, while a "critical material" is any non-fuel mineral, element, substance, or material the Secretary of Energy determines carries a high risk of supply-chain disruption. This is primarily an administrative and classificatory act: it does not itself compel production, but it creates the taxonomy (which of the 17 rare earth elements are legally "critical") on which subsequent executive and procurement action depends.

==== Executive Order 14241 (2025) ====
[https://public-inspection.federalregister.gov/2025-05212.pdf Executive Order 14241], entitled "Immediate Measures to Increase American Mineral Production," signed March 20, 2025, operationalizes that taxonomy. Its Section 1 purpose clause is unusually candid about the framing: national and economic security are now threatened by dependence on hostile foreign powers. Operationally, Section 3 directs every federal agency involved in permitting to submit to the National Energy Dominance Council a list of all mineral production projects for which a plan of operations or permit application has been submitted, after which agency heads must identify projects that can be immediately approved and expedite them. The Order invokes [https://www.law.cornell.edu/uscode/text/50/4533 Title III of the Defense Production Act] to mobilize financing, and tasks the NEDC, chaired by the Secretary of the Interior, with coordinating implementation across Defense, Energy, Interior, and Agriculture. Unlike the CHIPS Act, it required no congressional appropriation, and unlike the Energy Act, it does not merely classify inputs but seeks to physically build an alternative domestic supply chain, the mining-and-processing analogue to the CRMA's "strategic projects" mechanism. Executive Order 14241 has since been diluted by [https://www.whitehouse.gov/presidential-actions/2025/04/reinvigorating-americas-beautiful-clean-coal-industry-and-amending-executive-order-14241/ Executive Order 14261], which extends designation of criticality to sectorally unrelated materials such as coal.

==== 10 U.S.C. §4872 and the DFARS ====
The narrowest instrument is [https://www.law.cornell.edu/uscode/text/10/4872 10 U.S.C. §4872], which provides that the Secretary of Defense may not procure any covered material melted or produced in any covered nation, or any end item containing such material. [https://www.law.cornell.edu/definitions/uscode.php?def_id=10-USC-1197798417-780045830&term_src=title:10:subtitle:A:part:V:subpart:I:chapter:385:subchapter:III:section:4872 “Covered nations"] are defined as North Korea, China, Russia, and Iran, covered materials include samarium-cobalt and neodymium-iron-boron magnets. Implemented through [https://www.acquisition.gov/dfars/225.7018-2-restriction. DFARS 225.7018-2], the clause currently bars acquisition of any covered material melted or produced in any covered country, tightening in 2027 to cover the entire chain. This statute does not build supply; it leverages the federal government's own purchasing power to exclude adversary-sourced inputs from the defense industrial base, a tool with no direct EU parallel, since the CRMA's diversification targets operate through incentive rather than exclusion.

Infrastructures: Digital Sovereignty

2026-09-25T14:29:37Z

Fortuny Jané Mariona: /* Supply Chain management and the Cloud */

= Infrastructures: Digital Sovereignty =
Digital Sovereignty in the European Union is a [https://www.tandfonline.com/doi/full/10.1080/17579961.2026.2705118 term used to convey ] a broad array of policy ambitions in relation to digital technology development and use: the urgency to regain control over data, infrastructures, and (critical) technologies, the establishment of strategic autonomy, the conclusion of partnerships with geopolitical allies, and the reduction of critical dependencies. According to the Digital Decade Policy Programme [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52023SC0570 Implementation Report] of 2023, digital sovereignty refers to the EU's "ability to act independently in the digital world and therefore it constitutes a crucial means to safeguard [EU] values".

= Brazil =
<div style="font-weight: 400;">

== 1. Introduction: What Is Digital Sovereignty? ==
</div>
<div style="font-weight: 400;"><p>Digital sovereignty refers to the capacity of a state to exercise autonomy, self-determination, and control over data, digital infrastructure, and technologies. This encompasses three distinct but overlapping dimensions: internet sovereignty (control over networks and online content), data sovereignty (governance of data flows, privacy, and cybersecurity), and technological sovereignty (control over critical technologies such as artificial intelligence, semiconductors, and raw materials). The endeavor toward digital sovereignty was accelerated by the Snowden revelations. Brazil has developed its own discourse on digital sovereignty, shaped by its historical concerns about foreign surveillance, its position as a major emerging economy, and its ambition to become a global technology actor. </p></div>
<div style="font-weight: 400;">

== 2. Brazil's National Digital Sovereignty Outlook ==
</div>
<div style="font-weight: 400;"><p>Brazil's approach to digital sovereignty is rooted in a long-standing concern about technological dependence and foreign surveillance. The 2013 revelation that the National Security Agency had intercepted communications of Brazilian President Dilma Rousseff and surveilled Petrobras (Brazil's state oil company) served as a breakpoint moment. This urged the Brazilian political agenda to reduce reliance on foreign digital infrastructure, and prompted Brazil to accelerate its own digital infrastructure projects. The most notable infrastructure project is the EllaLink undersea cables, connecting Brazil to Portugal (and thereby South America to Europe), which was explicitly designed to circumvent internet routing controlled by the US and enhance Brazil's data [https://www.cambridge.org/core/books/digital-sovereignty-in-the-brics-countries/introduction/88A1164945DC955023BB812CA88FEABC sovereignty. ]</p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty discourse is also closely tied to its open-source tradition. Brazil has historically been a strong proponent of open-source software. In the early 2000’s, during the Lula administration, Brazil’s government promoted free and open-source software as a tool for reducing dependence on proprietary foreign technology and lowering [https://www.researchgate.net/publication/316669377_Free_Software_as_Public_Service_in_Brazil_An_Assessment_of_Activism_Policy_and_Technology costs. ]This open-source orientation remains an element of Brazil's digital sovereignty strategy today: the development of national AI models, open data ecosystems, and publicly governed cloud infrastructure all reflect this tradition.  </p></div>
<div style="font-weight: 400;"><p>The Brazilian AI Plan (PBIA) explicitly includes the development of a national AI software stack and open training databases, reflecting the view that open-source tools are a vehicle for technological autonomy rather than a security risk. </p></div>
<div style="font-weight: 400;"><p>Brazil's national digital sovereignty strategy is therefore characterised by two core priorities: (i) reducing dependence on foreign digital infrastructure and proprietary technology and (ii) building domestic capacity in critical technology sectors (AI, semiconductors, critical minerals). </p></div>
<div style="font-weight: 400;">

== 3. Regulatory Framework: Artificial Intelligence ==
</div>
<div style="font-weight: 400;">

=== 3.1 Brazilian AI Strategy (EBIA) ===
</div>
<div style="font-weight: 400;"><p>Brazil's first official national AI strategy, the Estratégia Brasileira de Inteligência Artificial (EBIA), established the country's overarching vision for AI governance. Based on the OECD's AI principles, EBIA is structured around pillars including ethical and responsible AI, data governance, innovation, education and workforce development, public sector use of AI, and international cooperation. It explicitly prioritises human-centred AI, the protection of fundamental rights, transparency, and risk mitigation. However, EBIA is a soft law instrument: it sets principles only, with no binding obligations, no enforcement mechanisms, and no dedicated budget. It functions as a normative framework that articulates values and directions rather than imposing legal duties. </p></div>
<div style="font-weight: 400;">

=== 3.2 Brazilian AI Plan (PBIA, 2024–2028) ===
</div>
<div style="font-weight: 400;"><p>The Plano Brasileiro de Inteligência Artificial (PBIA), launched on 30 July 2024 under the motto "AI for the Good of All," builds on EBIA by translating strategic vision into a concrete investment and infrastructure roadmap. Approved by the National Council for Science and Technology and coordinated by the Ministry of Science, Technology and Innovation, the PBIA is a strategic non-binding soft-law policy framework with a planned investment of R$23.03 billion through 2028. </p></div>
<div style="font-weight: 400;"><p>The PBIA combines immediate-impact initiatives with structural actions organised into five axes. These actions aim to develop the capabilities and skills needed for sustainable AI development in Brazil, while strengthening national sovereignty, technological autonomy, competitiveness and responsible innovation. Approximately 98.1% of planned investment is directed towards these structural actions. AI for Business Innovation (59.9%), Infrastructure and AI Development (25.2%), and AI for Improving Public Services (7.6%) receive the largest shares, followed by Dissemination, Education and Training in AI (5.0%). Support for AI Regulation and Governance receives approximately 0.4%. This distribution indicates an emphasis on building technological and industrial capacity. It is also indicative that Brazil prioritizes developing the technology infrastructure over implementing regulation in the form of hard law. From a digital sovereignty perspective, several elements of the PBIA are particularly significant. The Infrastructure and AI Development axis includes a National AI Infrastructure Program aimed at investing in high-performance computing and autonomous AI hardware to support technological sovereignty. It also includes a Sustainability and Renewable Energy Programme for AI, supporting renewable-energy infrastructure and efficient resource use, and a Programme for Structuring the Data and Software Ecosystem for AI intended to reduce external dependence, improve training datasets and develop a national AI software stack. AI for improving public services axis provides for a Sovereign Cloud, private or community cloud infrastructure managed exclusively by public agencies or state-owned companies, to increase control, security and sovereignty over sensitive data and ensure it is stored on national territory. The AI for Business Innovation axis aims to support sectors within the AI production chain, including information and communication technologies (ICT) and microelectronics, and to position Brazil as a global data centre hub. The PBIA reports that Brazil currently operates only 168 data centres (ranking 13th globally, compared to over 5,000 in the United States). Its AI Value Chain Promotion Programme seeks to strengthen and expand the domestic AI value chain, from supporting startups to developing Brazilian companies supplying foundation models. </p></div>
<div style="font-weight: 400;"><p>Bill No PL 2338/2023, which proposes a comprehensive AI framework, has passed the Senate and remains under consideration in the Chamber of Deputies, the lower house of Brazil’s National Congress. Until it is enacted, Brazil's AI governance framework remains largely in the realm of soft law, creating legal uncertainty for investors, developers, and citizens alike. </p></div>
<div style="font-weight: 400;">

== 4. Regulatory Framework: Semiconductors and Critical Minerals ==
</div>
<div style="font-weight: 400;">

=== 4.1 Brasil Semicon (Law No. 14.968/2024) ===
</div>
<div style="font-weight: 400;"><p>The Brazil Semiconductor Programme (Brasil Semicon), established under Law No. 14.968 of 11 September 2024, constitutes Brazil's principal hard law instrument for technological sovereignty in the semiconductor sector. It establishes a national strategy and guidelines to encourage research, development, innovation, production, and application of semiconductors, displays, and solar panels. Brasil Semicon updates and expands the instruments of PADIS (the Support Program for Technological Development of the Semiconductor Industry), extending tax incentives until the end of 2029 and broadening their scope to include software, specialised services, technical assistance, and other stages of the production chain. Decree No. 13.065 of 16 July 2026 activated the programme, establishing the rules for the semiconductor industry and facilitating access to PADIS tax incentives. The programme aims to attract investments in the national chip supply chain until 2029, directly addressing Brazil's dependence on foreign semiconductor manufacturing. </p></div>
<div style="font-weight: 400;"><div>

=== 4.2 National Policy on Critical and Strategic Minerals (Law No. 15.506/2026) ===
</div>
<div><p>Published on 16 September 2026, Law No. 15.506/2026 establishes a national policy and governance structure for critical and strategic minerals. It aims to promote research, extraction, processing, and transformation of critical and strategic minerals domestically, adding value to supply chains rather than exporting raw materials. The policy explicitly seeks to strengthen Brazil's economic and geopolitical security by ensuring a stable domestic supply of minerals essential to the digital economy — including those required for semiconductors, batteries, and AI hardware. It provides up to R$5 billion in tax credits (covering up to 20% of eligible expenses) from 2030 through 2034 for mineral processing, manufacturing, and recycling projects, and authorises a Mineral Activity Guarantee Fund with up to R$2 billion in federal contributions. This law is significant because Brazil holds some of the world's largest reserves of rare earth minerals and other critical inputs for the digital economy, and the policy represents a strategic decision to leverage these resources for domestic technological development rather than simply exporting them. </p></div>
<div>

== 5. The EU–Brazil Digital Partnership (2026) ==
</div>
<div><p>Signed on 12 June 2026, the EU–Brazil Digital Partnership is a soft law instrument establishing a framework for bilateral cooperation on issues that concern digital sovereignty.  </p></div>
<div>
#Article 2 commits both parties to fostering meaningful digital development and inclusion while preserving digital sovereignty, democratic principles, and human rights.  
</div>
<div>
#Article 3 provides for reciprocal recognition of data protection levels — based on the European Parliament's adequacy decision of January 2026 and Brazil's ANPD Resolution 32 — thereby easing cross-border data flows and building trust in bilateral data governance.  
</div>
<div>
#Article 15 commits both parties to developing national technology supply chains to ensure that global interdependence does not undermine their respective technological sovereignties.  
</div>
<div>
#Article 17 provides for cooperation on AI development and deployment, referencing the PBIA and comparable EU programmes.  
</div>
<div>
#Articles 19 and 21 establish information-sharing mechanisms on data governance, data spaces, digital services, and digital markets, with an explicit commitment to preserving regulatory autonomy.  
</div>
<div>
#Article 23 references Brazil's EllaLink undersea cable project as a concrete expression of its digital sovereignty ambitions. 
</div>
<div><p>The Digital Partnership is a precursor to harder legal instruments: it is future-facing, flexible, and oriented toward sharing know-how and building mutual trust. Its soft law nature is appropriate given the current rate of innovation in technology. </p></div>
<div>

== 6. Comparison with the EU ==
</div>
<div><p>Brazil and the EU share the same fundamental goal: reducing dependence on foreign (primarily US and Chinese) digital infrastructure and technology. However, they pursue it through different regulatory architectures. </p></div>
<div><p>The EU has adopted a comprehensive, multi-layered hard law framework for digital sovereignty, encompassing the GDPR, the NIS 2 Directive, the Cybersecurity Act, the Chips Act, and the Critical Raw Materials Act, alongside the newly proposed EU Tech Sovereignty Package (June 2026) including the Cloud and AI Development Act (CADA) and an EU Open Source Strategy. The package therefore combines legislative proposals with non-binding policy instruments. The EU's approach combines binding regulation with substantial public investment, and it applies to both public and private sector actors. </p></div>
<div><p>Brazil, by contrast, has followed a more strategy-led approach to developing its dedicated AI framework. Its AI governance framework remains largely in soft law (EBIA and PBIA), with binding legislation (PL 2338) still pending. Brazil’s hard law instruments are concentrated in the industrial and resource sectors (Brasil Semicon; the Critical Minerals Law), reflecting a Brazil’s priority being placed on supply chain sovereignty and infrastructure building (rather than regulatory compliance frameworks).  </p></div>
<div><p>In 2026 Brazil began developing the Nuvem Brasileira, a national cloud infrastructure designed to keep critical government data and control of the infrastructure under Brazilian jurisdiction, while favouring open standards and reducing dependence on foreign technology providers. Specifically, the Brazilian government decided that Microsoft and other foreign big tech providers would not be the preferred providers for the Nuvem Brasileira. The government is explicitly assessing dependencies on foreign suppliers and whether the State could continue operating critical services if an external provider became unavailable. Brazil’s model does not require everything to be Brazilian-made, but focuses on control over data, operations and technology.  This shifts sovereignty from simply where data is stored to who controls the infrastructure, keys, software, jurisdiction and ability to operate independently. It is alongside REDATA, which uses datacentre incentives to build domestic technological capacity. Brazil's open-source orientation also distinguishes it from the EU. Both jurisdictions promote open source as a means of strengthening technological autonomy. While the EU has adopted an Open Source Strategy and the CADA references open-source principles, Brazil's commitment to open-source software is deeper and more historically embedded, reflecting a political tradition that views proprietary technology as a vector of foreign dependence. The PBIA's emphasis on a national AI software stack and open training data reflects this tradition and represents a distinctive approach to technological sovereignty that merits attention in comparative analysis. </p></div>
<div><p>Finally, both Brazil and the EU face the same structural challenge: the global digital economy is dominated by a small number of US and Chinese technology companies, and neither jurisdiction has yet succeeded in producing domestic alternatives at comparable scale. Brazil's ambition to become a global data centre hub and to develop sovereign AI models is bold, but the gap between aspiration and capacity remains large. The EU's more developed AI-specific regulatory architecture provides stronger protections for citizens and clearer rules for industry, but has been criticised for potentially hampering innovation. Brazil's softer approach may allow for faster initial development, but risks leaving citizens and the market without adequate legal protection in the interim. </p></div>
<div>

== 7. Conclusion ==
</div>
<div><p>Brazil's approach to digital sovereignty is characterised by a strong national discourse rooted in concerns about foreign surveillance and technological dependence, a soft law-dominant AI governance framework that is still evolving toward binding regulation, and hard law instruments in the semiconductor and critical minerals sectors that reflect a strategic prioritisation of supply-chain sovereignty. Brazil's open-source tradition adds a distinctive dimension to its digital sovereignty strategy, positioning it differently from both the. The EU–Brazil Digital Partnership represents a meaningful step toward bilateral cooperation, but its soft law nature means  its impact will depend on follow-through.  </p></div></div>

= China =
<p><strong style="font-size: 14.4px;">Words: 2306</strong><br></p>
<div><p><br></p></div>
<div><p>'''Introduction'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;">“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence.</p></div>
<div style="text-align: justify;"><p>In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held around the 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Chinese Internet search market.</p></div>
<div style="text-align: justify;"><p>In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.</p></div>
<div style="text-align: justify;"><p>Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws aim for China to develop the autonomy and capacity necessary to exercise full control over its information infrastructure and data.</p></div>
<div><p style="text-align: justify;"><br></p></div>
<div><p>'''Cybersecurity Law'''</p></div>
<div><p><br></p></div>
<div><p>The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (see article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.</p></div>
<div><p style="text-align: justify;" >In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services. CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (see articles 23, 36, 37, 38, and 40).</p></div>
<div><p style="text-align: justify;" >In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (see articles 23, 27, 30 and 51).</p></div>
<div><p style="text-align: justify;" >Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information. CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (see article 39). Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (see article 42).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (see article 4), continuously improve the national cybersecurity strategy (see article 5), and deal with cybersecurity risks and threats (see article 6).</p></div>
<div><p style="text-align: justify;" >In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (see articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).</p></div>
<div><p><br></p></div>
<div><p>'''Data Security Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development.</p></div>
<div><p style="text-align: justify;" >It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (see article 21). Other categories of data are “important data” and “general data” which are not defined in the law but in complementary regulations.</p></div>
<div><p style="text-align: justify;" >The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (see article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (see articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (see article 36).</p></div>
<div><p style="text-align: justify;" >Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (see article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (see article 5).</p></div>
<div><p style="text-align: justify;" >In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (see article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (see article 48).</p></div>
<div><p style="text-align: justify;" >Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (see articles 45 and 52).</p></div>
<div><p><br></p></div>
<div><p>'''Personal Information Protection Law'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Personal Information Protection Law (of 2021) is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (see articles 36 and 40).</p></div>
<div><p style="text-align: justify;" >Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (see articles 42 and 43).</p></div>
<div><p><br></p></div>
<div><p>'''China’s State Centered Concept of Digital Sovereignty'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty. China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors, which explains why the Cybersecurity Law establishes the obligation of private actors to ''“abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order”'' (see article 13), and why the the Data Security Law establishes as an objective to ''“preserve State sovereignty, security, and development interests”'' (see article 1).</p></div>
<div><p style="text-align: justify;" >Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.</p></div>
<div><p style="text-align: justify;" >In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade.</p></div>
<div><p style="text-align: justify;" >In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved in a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure.</p></div>
<div><p style="text-align: justify;" >These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, the most visible example of territorialization, drawing an effective Internet frontier between China and the rest of the world.</p></div>
<div><p style="text-align: justify;" >In this way, China's digital sovereignty concept demands asserting control over information infrastructures and data gathered or generated within its borders as well as to protect relevant or sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.</p></div>
<div><p><br></p></div>
<div><p>'''China Model Versus the European Union Model'''</p></div>
<div><p><br></p></div>
<div><p style="text-align: justify;" >The European Union (EU) and China represent two different models of digital sovereignty. The EU approach contrasts with China’s State-centered and security-driven model because it emerged from a supranational, rights-centered, and democratic context.</p></div>
<div><p style="text-align: justify;" >EU’s efforts to achieve digital sovereignty began in 2013 when Edward Snowden’s revelations of United States National Security Agency (NSA) interception of European communications exposed its dependence on foreign technology and triggered a wave of policy and regulatory efforts. Such efforts led to the adoption of the GDPR in 2016 which enshrined individuals' rights, including the rights of access to and objection to processing of personal data. The EU continued by developing two consumer protection regulations in 2019, in addition to conducting several antitrust proceedings against American hyperscalers such as Alphabet, Amazon, and Apple between 2015 and 2020. In 2024, the EU adopted the AI Act with the purpose of harmonizing AI development and deployment with EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.</p></div>
<div><p style="text-align: justify;" >Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not yet.</p></div>
<div><p>As European Commission President von der Leyen stated in 2019, ''"it is not too late to achieve technological sovereignty in some critical technology areas"''. The EU has been trying to catching up with China, which spent the last decade tightening its State authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI Governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending from non-foreign interference, the logic underpinning China's digital sovereignty doctrine.</p></div>
<div><p style="text-align: justify;" >This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's Security Law, which directs the State to support AI research, infrastructure, ethical norms, and risk supervision.</p></div>
<div><p style="text-align: justify;" >Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct State-led development, information control, and an explicit fusion of domestic statutes and international declaratory positioning. This makes China's model arguably more comprehensive compared to the EU.</p></div>
<div><p>''''''</p>
<p>'''References'''</p></div>
<div><p><br></p></div>
<div><p>'''(1)'''<span class="apple-converted-space"> </span>Cybersecurity Law of the People's Republic of China (2025 Amendment).</p></div>
<div><p>'''(2)'''<span class="apple-converted-space"> </span>Data Security Law of the People's Republic of China (2021).</p></div>
<div><p>'''(3)'''<span class="apple-converted-space"> </span>Personal Information Protection Law of the People's Republic of China (2021).</p></div>
<div><p>'''(4)'''<span class="apple-converted-space"> </span>Ministry of Foreign Affairs of the People's Republic of China, "Shanghai Declaration on Global AI Governance" (4 July 2024).</p></div>
<div><p>'''(5)'''<span class="apple-converted-space"> </span>Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, </p>
[https://doi.org/10.1002/poi3.427' https://doi.org/10.1002/poi3.427']</div>
<div><p>'''(6)'''<span class="apple-converted-space"> </span>Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, </p>
[https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty]</div>
<div>'''(7) '''Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.</div>
<div></div>

= [[Infrastructures:India|India]] =

#Historical context:
<p>In light of decolonization and liberalization of the economy around the 1980s, India experienced a new wave of innovation and global economic relevance owing to their educated workforce (1). India has remained an enthusiastic participant in the global market and international political space, following the same trend as other economic powers that once promoted open trade relations, switching towards national interests - settling on a theme of self-reliance.</p>
<p><br></p>
#Digital Sovereignty Ambition:
<p>“Digital sovereignty” is a concept that has been used by scholars and policymakers as an umbrella term to make claims over all aspects of digital infrastructures (2). In order to analyze the instruments used in India to pursue digital sovereignty, we must explore those instruments under the light of different conceptualizations deeply linked to this term. Therefore, we will resort to the following notions: 1. Technological sovereignty; 2. Internet sovereignty; and 3. Data sovereignty.</p>
<p><br></p>
#Technological Sovereignty:
<p>Technological sovereignty “refers to the efforts of nations and/or countries to create technologies that reduce American control over, and surveillance of technological systems, including the Internet” (3). Therefore, in this section we outline the main attempts from the Indian Government directed towards reducing their technological dependencies, especially when it comes to critical infrastructures.</p>
<p>One of the early instruments to gaining a broader control over India’s infrastructure was the Information Technology Act, 2000, (the “IT Act”) as amended by The Information Technology (Amendment) Act 2008. Section 70 of the IT Act (https://indiankanoon.org/doc/1680277/) invests the Government with the authority to define via an official notification certain computer resources as protected systems. The provision takes a further step in elaborating what counts as “Critical Information Infrastructure” (CII), defining it as the computer resource, the incapacitation or destruction of which shall have a debilitating impact on national security, economy, public health or safety.</p>
<p>In the protection of CII, Section 70A (https://indiankanoon.org/doc/106027784/) decrees the establishment of a dedicated national nodal agency, which shall be responsible for several measures including R&D relating to protection of CII. However, despite this regulatory effort, little was achieved during this time to address the topic of technological dependencies.</p>
<p>As a response, the Ministry of Electronics and Information Technology (MeitY) issued the country’s first National Cyber Security Policy (NCSP) (https://www.meity.gov.in/static/uploads/2024/02/National_cyber_security_policy-2013_0.pdf) in 2013. This Policy can be categorized as a soft law instrument aimed at steering the country towards building a secure and resilient cyberspace for citizens, businesses and Government. Among its many objectives, the Policy aimed at developing “suitable indigenous security technologies through frontier technology research, leading to widespread deployment of secure ICT products / processes in general and specifically for addressing National Security requirements”. The NCSP proposed many strategies to enhance security in the cyberspace, including:</p>
*- Strengthening the Regulatory framework.
*- Creating a National Level Computer Emergency Response Team (CERT-In).
*- Operating a 24x7 National Critical Information Infrastructure Protection Centre to function as the nodal agency for critical information infrastructure protection.
*- Reducing supply chain risks by creating and maintaining testing infrastructure and facilities for IT security product evaluation and compliance verification as per global standards and practices.
<p>Many of these strategies were followed through, albeit with different degrees of success when it comes to achieving sovereignty in the technological sphere.</p>
<p>To begin with, the NCSP led to the creation of the National Critical Information Infrastructure Protection Centre (“NCIIPC”). As the commanding authority accountable, the NCIIPC introduced the Information Security Practices and Procedures for Protected System Rules, 2018 (https://www.meity.gov.in/static/uploads/2024/02/NCIIPC-Rules-notification-1.pdf) (the “NCIIPC Rules”) and issued Guidelines for the Protection of National Critical Information Infrastructure, 2015 (https://www.asianlaws.org/gcld/cyberlawdb/IN/guidelines/NCIIPC_Guidelines_V2.pdf) (the “NCIIPC Guidelines”) to safeguard India’s CII from unauthorized access, modification, use, disclosure and disruption to ensure a safe, secure and resilient information infrastructure for critical sectors in the country. Among these rules, certain requirements stand out, such as the mandatory inventories of hardware and software related to CII (Section 3(3-e) of NCIIPC Rules) and the promotion of indigenous Research and Development (R&D) regarding the protection of CII (Section 4.3.7 of NCIIPC Guidelines).</p>
<p>In addition, the India Stack (the “Stack”) was a nationwide government program that recognized societal inequalities enhanced and perpetuated due to lack of access to the internet and technology. As a socialist endeavor, the Government launched platforms to dissipate welfare functions, promoting digital literacy and enhancing electronic governance. These systems were conceived as being mostly indigenous and open-source, allowing India to now export this technology framework to other nations (https://indianmasterminds.com/news/india-signs-mous-23-countries-digital-public-infrastructure-india-stack-upi-global-183393/) looking to build their own digital stack.</p>
<p>Furthermore, under the Public Procurement (Preference to Make in India) Order, 2017 (https://www.dpiit.gov.in/static/uploads/2025/07/a2243b925eacf5e116e0e3f43630a8b2.pdf), MeitY issued a notification designating cyber security as a strategic sector, stating that "preference shall be provided by all procuring entities to domestically manufactured/produced Cyber Security Products" with preference granted to companies incorporated in India whose product IP and licensing revenue accrue domestically, and royalty payments abroad capped at 50% of the product's cost.</p>
<p>Despite the above, technological dependency is still an issue in India. The policy on data centers is a clear example of this, since these facilities have proliferated in India during recent years under a sovereignty discourse. Under India's Consolidated FDI Policy Circular of 2020 (https://www.dpiit.gov.in/static/uploads/2025/07/3ab2ec2a3bdb91c69653b7c34618c14a.pdf ) (DPIIT), data centers have not required prior government or central bank approval. Implying that the nation intends to favor foreign investment in their construction. These incentives mean that the infrastructure for data centers “will be built upon American foundation models and run on American chips” (4), a policy that ultimately benefits hyperscalers without offering much in return for affected populations.</p>
<p>This dilemma showcases one of the main tensions still prevalent in India: developing indigenous infrastructure for critical services in order to prevent dependency on third countries (as shown with the Stack) vs boosting investment by encouraging foreign companies to build digital infrastructures within Indian sovereign territories.</p>
<p><br><br></p>
#Internet Sovereignty:
<p>Internet or network sovereignty is a notion invoked by protectionists or nationalist agendas in an attempt to “control the digital networks and information running through them”(5).</p>
<p>The NCSP provided an adequate advisory and guideline basis which helped protect infrastructures and public services upon which the Digital India Scheme (DIS) was promoted. DIS sought to expand access to the Internet of Things from city to rural areas to facilitate government functions and financial transactions digitally through secured high speed broadband and digital public infrastructures (DPI), a foundational block of the Stack (6).</p>
<p>The India Stack is a three-stage e-government infrastructure project based on the digitalized Aadhaar platform, comprised of the Identity Layer (developed since 2009), the Payment Layer (developed since 2010), and the final Data Layer (building on the previous two layers), designed to combat money laundering and corruption, better monitor financial flows, and provide the Indian population with simplified access to financial services (7).</p>
<p>This is a pivotal policy to analyze for a better grasp on the internet sovereignty sought by the Indian Government. The main achievements of this initiative are the following:</p>
#Aadhar (Identity Layer): Served as a nationwide security and biometric unique identity scheme that created the world’s largest digital public infrastructure.
#Unified Payments Interface (Payment Layer): Enabled simple digital transactions between two mobiles to transition into a cashless economy with additional financial schemes such as demonetization and zero-cost bank accounts.
#DigiLocker(Data Layer): A secure cloud storage space run by the government to secure personal data documents for official purposes without physical paper dependency.
<p>While being praised due to its efficiency and inclusionary potential, the stack’s increasing centrality in governance raises significant concerns. Significant concerns have been flagged as it relates to mass surveillance (https://www.giga-hamburg.de/en/publications/giga-focus/digital-surveillance-and-the-threat-to-civil-liberties-in-india) that consequently arises from the state's control over the network.</p>
<p>In addition, Section 69A of the IT Act (https://www.giga-hamburg.de/en/publications/giga-focus/digital-surveillance-and-the-threat-to-civil-liberties-in-india) bestows the Government powers over content, by ratifying the capacity to block on narrow grounds (sovereignty, security, public order, etc). Since 2023, though, the government has increasingly used a parallel channel, consisting of notice-and-takedown mechanisms through the "Sahyog" portal (operated by the Cyber Crime Coordination Centre of India) under Section 79(3)(b) (https://indiankanoon.org/doc/161852741/). This provision was intended for removal of content used for unlawful acts, and affected entities have claimed that the Government has attempted to extend its reach to override the restrictions built into Section 69A. This shift generated over 2,300 orders across 19 platforms (https://www.barandbench.com/amp/story/columns/section-69a-of-the-information-technology-act-2000-and-the-expanding-architecture-of-digital-censorship-in-india) in just one year (Oct 2024–Oct 2025) and is now being challenged in court (https://indiankanoon.org/doc/7614885/).</p>
<p>The dilemma presented above showcases a new tension within the Indian digital framework: while certain provisions allow the Central Government to maintain an effective control over the network and the contents shared through it, a significant risk for citizens privacy rights and individual freedoms is arising as a result.</p>
<p><br></p>
#Data sovereignty
<p>Finally, data sovereignty refers to “protecting and controlling information on and flowing through digital networks” (8). The Supreme Court's judgment in ''Justice K.S. Puttaswamy v. Union of India (https://indiankanoon.org/doc/127517806/) ''addressed the privacy concerns of the centralization of citizens’ data in Aadhaar, recognizing that the right to privacy would fall under Article 21 of the Constitution (originally reserved to the right to live). There has been much controversy around the societal ramification of a single identification mechanism including the exclusion of nonparticipants from fundamental public services.</p>
<p>The ''Puttaswamy'' decision formed the material foundation (9) of what would later be the Digital Personal Data Protection Act (https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf), issued in 2023. It delineated two groups (the “Data Fiduciaries”):</p>
*- Processors of data in the Indian territory or
*- Processors of data outside of India, in the condition such processing is in connection with any activity related to offering of goods or services to Data Principals within Indian territory.
<p>This is one of the main elements that is worth mentioning about this framework, as the extraterritorial reach of the law attempts to extend India’s sovereignty over its data beyond the borders of the country.</p>
<p>Furthermore, Section 16(1) established that The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.</p>
<p>To complement the Act, additional Rules were issued in 2025 (https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) following the objections and suggestions received from the public by the Central Government. According to Section 13 (4), a Data Fiduciary shall undertake measures to ensure that personal data specified by the Central Government, on the basis of the recommendations of a committee constituted by it, is processed subject to the restriction that the personal data and the traffic data pertaining to its flow is not transferred outside the territory of India.</p>
<p>The abovementioned provisions are a clear indicator of India’s attempt to strengthen the control over their citizen’s data. While international transfers are less restricted than under the EU approach, foreign Data Fiduciaries would still be subject to Indian law, and the Central Government is in position of both banning transfers to specific countries as well as establishing data localization requirements for certain data elements. This structure, while not identical to the GDPR, still manages to reinforce the country’s data sovereignty claims.</p>
<p><br></p>
*Comparison with the EU
<p>Although India and the EU both acknowledge technological sovereignty as a key objective, the corresponding frameworks, prioritization and approaches in the direction of achieving this starkly vary.</p>
<p>For instance, as it pertains to the domain of data governance and data protection, the EU has a comprehensive regulatory landscape that gives high-priority to the safeguarding of rights as evidenced with General Data Protection Regulation (“GDPR”) and the Digital Services Act, which institute well-defined rules on data privacy, and cross-border data flows. A distinguishing element of approaches relates to paradigms in place. The EU has adopted the ''‘allowed list’'' model that is rooted in adequacy decisions, while India has a ‘''negative list''’ model, meaning it permits cross-border data transfers unless specifically restricted. Both paradigms present different challenges and opportunities respectively. The European approach encourages third countries towards benchmarking for adequacy decisions, while India encourages strong relations to avoid a ban. This could explain the fact that India lacks an adequacy decision from the EU.</p>
<p>However, these two nations share similarities regarding their digital infrastructure policy goals. In a shared statement on the second meeting of the EU-India Trade and Technology Council (https://www.eeas.europa.eu/delegations/india/joint-statement-second-meeting-eu-india-trade-and-technology-council_en), both countries agreed to “collaborate on working towards interoperability of their respective DPIs that respect human rights and protect personal data, privacy, and intellectual property rights” and “promote the strengthening of the EU and Indian semiconductor ecosystems to enhance technological capabilities and ensure supply chain resilience by developing sustainable, secure and diversified semiconductor production capacities”. Both countries also attempt to extend the effect of their infrastructure regulations beyond its borders, with India’s IT Act applying to any offence or contravention committed outside India if the act or conduct involves a computer, computer system or computer network located in India (Section 75 https://indiankanoon.org/doc/576992/) and the EU requiring non-EU digital infrastructure and service providers offering services in the Union to appoint an EU representative (NIS2 Art. 26(3)).</p>
<p>Their main differences in that regard stem from the robustness of their legislation. While the EU has developed a strong sectorial cyber security framework in the form of the NIS 2 Directive (with the corresponding transpositions across Member States), India’s framework relies on an outdated law that generally applies to IT services (the IT Act) without the same degree of harmonized regulatory density. Furthermore, from a policy point of view, India has attempted to foster foreign innovation in developing digital infrastructures for data centers, favoring the presence of hyperscalers, whereas the EU has attempted to steer into the opposite direction and “support the development of European cloud computing offerings (https://oeil.europarl.europa.eu/oeil/en/document-summary?id=1656816)”. This showcases a major difference in addressing an already identified issue regarding their respective technological dependencies.</p>
<p><br></p>
<p>References:</p>
*(1) Biswajit Maitra and Moutushi Chakraborty, 'Foreign Trade, Human Capital and Economic Growth in India under the Liberalised Trade Regime' (2023) 5(1) Journal of Asian Economic Integration 29, doi:10.1177/26316846221147581.
*(2) Plixavra Vogiatzoglou and Joris van Hoboken, 'The EU's Digital Sovereignty and Quantum Technologies: To What End?' (2026) 18(2) Law, Innovation and Technology, doi:10.1080/17579961.2026.2705118, 2.
*(3) Stéphane Couture and Sophie Toupin, ‘What Does the Concept of “Sovereignty” Mean in Digital, Network and Technological Sovereignty?’ (Social Science Research Network, 22 January 2018) 5 https://doi.org/10.2139/ssrn.3107272
*(4) Vinit Ravishankar, 'Sovereignty After the Boom' (''Disjunctions'') https://disjunctionsmag.com/articles/sovereignty-after-boom/ accessed 24 September 2026.
*(5) Vogiatzoglou and van Hoboken (n 2) 6.
*(6) Snehal A. Bagul, 'Guarding the Digital Gateway: An In-Depth Analysis of Cybersecurity Challenges in India' in Faisal Rehman and others (eds), ''Emerging Trends in Information System Security Using AI & Data Science for Next-Generation Cyber Analytics'' (Springer 2025) 69–71.
*(7) Sezgin Sönmez, 'The India Stack – Between Networked Growth and Territorial Control' (2025) 50(4) Historical Social Research 318, https://www.jstor.org/stable/27426713.
*(8) Vogiatzoglou and van Hoboken (n 2) 6.
*(9) Committee of Experts under the Chairmanship of Justice B N Srikrishna, ''A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians'' (Ministry of Electronics and Information Technology, 27 July 2018) https://www.thehinducentre.com/resources/article24561547.ece/binary/Data_Protection_Committee_Report-comp

= United States =
== The Concept of Digital Sovereignty ==
<p>The idea of “digital sovereignty” is not a single concept. There are a number of scholars who attempted to define digital sovereignty. [https://www.academia.edu/99043334/What_does_the_notion_of_sovereignty_mean_when_referring_to_the_digital Couture and Toupin] and [https://www.researchgate.net/publication/343611573_The_Fight_for_Digital_Sovereignty_What_It_Is_and_Why_It_Matters_Especially_for_the_EU Floridi] emphasized the '''control''' over the digital realm, in which Floridi saw a combination of democratic legitimacy with innovative flexibility by a hybrid system of control. On the other hand, [https://techreg.org/article/view/23778?articlesBySimilarityPage=1 Chung] looked into the aspect of '''authority''' by defining digital sovereignty as a state’s ability to define, implement and enforce political and legal decisions across digital systems, platforms and data infrastructures. She also reconceptualized the term by asserting that sovereignty should be understood as governance '''capacity''' rather than exclusive control. There is a variety of perspectives in determining what digital sovereignty means and conflicting definitions based on varying national strategies.</p><p>The definition of digital sovereignty adopted throughout this study is a merge of authority and practical capacity of a state to set, apply and defend its own rules governing the digital infrastructure, data flows and algorithmic systems that shape its legal and political orders, against interference by outside actors, whether public or private, including other levels of government within the same state.</p>
=== The United States Sovereignty Strategy: AI Dominance ===
<p>Unlike the EU who attempts to maintain digital sovereignty under its regulatory control, the idea of securing digital sovereignty is not its priority for the US. Their goal is to ensure geopolitical dominance by entrenching American advantage in the technologies that determine their economic and military standing, against a field of competitors, namely China as the principal one.</p><p>From ''[https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf Winning the Race: America’s AI Action Plan]'', Issued on 23 July 2025, the US outlines 103 recommended actions by three pillars:</p>

*Pillar 1: Accelerate AI Innovation – removing “bureaucratic red tapes” which hinder technological advancement by deregulation
*Pillar 2: Build American AI Infrastructure – fostering an environment conducive to AI innovations
*Pillar 3: Lead in International AI Diplomacy and Security – Ensuring its global hegemonic position in AI technology<p>As explicitly stated from the plan, their core interest is in winning the race and securing its geopolitical primacy relative to other competitors rather than enhancing its authority and capacity over its domestic digital governance. The Plan itself has no legal force, yet the actual implementation is played by executive orders and procurements.</p>
== The Four Registers ==
<p>American digital policy has an organising purpose, and it is not regulation. It is primacy: maintaining American advantage in the technologies that determine economic and military standing, against a field of competitors, of which China is the principal one. The framing is stated in the instruments themselves — the order that set the current course is titled Removing Barriers to American Leadership in Artificial Intelligence, and the strategy it produced is titled Winning the Race. Beneath that strategy, the United States steers digital developments through four registers, descending in legal formality and ascending in speed.</p><p>'''Statute''' is the thinnest register. The [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] and the [https://www.congress.gov/bill/118th-congress/house-bill/7521 Protecting Americans from Foreign Adversary Controlled Applications Act] are both narrow and adversary-specific, and general legislation has failed: the Senate stripped a ten-year moratorium on state enforcement of AI laws from the One Big Beautiful Bill Act by a vote of 99 to 1.</p><p>'''Executive orders''' carry the load. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] produced the Data Security Program, an export control keyed to adversary identity rather than to any standard of protection; Executive Order 14320 finances the export of full-stack American AI packages; Executive Order 14365 asserts a national AI framework and directs litigation against inconsistent state laws.</p><p>'''Procurement''' is quieter and probably more effective, and is illustrated below by the cloud and semiconductor sectors.</p><p>'''Announcement''' is the fastest register and the least examined. On 19 January 2025 the President posted on Truth Social that he would issue an order extending the statutory TikTok divestment deadline, and [https://www.theguardian.com/us-news/2025/jan/19/trump-tiktok-ban-executive-order TikTok restored service] in the United States the same day, before any instrument existed. A platform serving some 170 million US users changed its conduct based solely on anticipated legality.</p>
=== Direction of Travel ===
<p>The direction of policy is consistent across all four registers and runs four ways. Outward, the export programme pushes the domestic AI stack into third markets. Inward, the Data Security Program and Team Telecom review screen foreign access based on a counterparty's identity rather than the safeguards it offers. Homeward, subsidy builds domestic capacity. Downward, federal policy presses on the states, and it is working even though preemption ordinarily requires a congressional enactment: Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower automated decision-making statute stripped of deployer impact-assessment duties, while California's frontier AI statute (SB 53) contains a federal-deference clause under which compliance with a comparable federal framework discharges the state obligation. States are deferring in advance to a federal standard that does not yet exist.</p><p>Outward and homeward movement build the US position; inward and downward movement defend it against interference, foreign in the former case and domestic in the latter. The same adversary-identity test recurs in an export control, a subsidy condition, and a screening review alike.</p>

== US Infrastructure and Resources efforts for AI dominance ==

=== Supply Chain management and the Cloud ===

The United States aims to maintain its position in the [https://www.cambridge.org/core/journals/international-organization/article/digital-disintegration-technoblocs-and-strategic-sovereignty-in-the-ai-era/DD86C6FD3FDD7FBBADEF100C6935D577 international order, seeking to surpass and constrain rival powers]. Technological dominance constitutes one of the principal means of pursuing this objective, and in recent years this pursuit has centred increasingly on artificial intelligence, a domain heavily dependent on underlying industrial capacity and resource access.

Cloud service dependency describes a form of [https://www.cambridge.org/core/journals/review-of-international-studies/article/susan-strange-meets-the-everyday-the-mundane-sources-of-structural-power/1D23361D622C523F7EB785EA54105858 structural power] exercised not through territorial control but through infrastructural ownership. Because US firms hold roughly [https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 two-thirds of the EU cloud market], a majority of European data, public and private, resides within entities potentially subject to US jurisdiction, irrespective of the server's physical location. This constitutes strategic advantage precisely because it requires no conventional projection of power abroad: dominance is achieved by occupying the infrastructural layer itself, converting market position into jurisdictional reach and, in turn, translating informational access into epistemic and strategic advantage. The [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] grants the United States access to foreign data provided this is held by a US cloud service provider, access guaranteed only through a defined legal process, the issuance of a judicial warrant subject to probable cause. [https://www.law.cornell.edu/uscode/text/50/1881a FISA Section 702], by contrast, authorises access to foreign data held in US clouds for intelligence purposes through compelled provider assistance, and in this instance no comparable judicial procedure is required by law. These divergent standards of authorisation, and the reach they enable, stand in direct tension with the protections EU law seeks to guarantee.

The United States nonetheless maintains mechanisms to protect itself from equivalent foreign control over its own data, an arrangement not without irony. Through these safeguards, the United States continues to consolidate a form of dominance that might properly be termed digital sovereignty, in that it is the party setting the terms of engagement, monitoring others' data while shielding its own from comparable scrutiny.

[https://www.fedramp.gov/ FedRAMP] establishes the conditions under which any cloud provider, including foreign entities, may process US federal government data, asserting sovereign gatekeeping over access to its own infrastructure even as it resists equivalent constraints abroad. [https://www.federalregister.gov/documents/2024/03/01/2024-04573/preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related Executive Order 14117] and the accompanying [https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern DOJ rule (2025)], although criticised for their generalistic scope, restrict the outbound transfer of bulk sensitive data to designated "countries of concern." The asymmetry is instructive when set against the EU's broadly equivalent instruments: both regimes exercise control, but over opposite targets, the United States restricts flows to named adversaries, while the EU restricts flows to any third country whose legal framework it deems inadequate, a criterion of general application rather than one confined to a defined list of hostile states.

The EU's principal instrument of power has consequently been regulatory rather than infrastructural, expressed through the [https://gdpr-info.eu/art-48-gdpr/ GDPR (Art. 48)] and the [https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng Data Act], mechanisms of constraint and protection rather than instruments of reach comparable to the [https://www.justice.gov/d9/pages/attachments/2019/04/09/cloud_act.pdf CLOUD Act] or [https://www.law.cornell.edu/uscode/text/50/1881a FISA]. There is a clear divergence in objective these reflect, and it is rooted in the different conception the EU has of human rights, values and norms, related to data protection and privacy in comparison to the US'. Worth mentioning, the EU's position is further constrained by a material deficit, limited infrastructural capacity, financial resources.

As of right now, the United States can circumvent the normative safeguards the EU has imposed in some cases (through [https://www.law.cornell.edu/uscode/text/50/1881a FISA]), and it already possesses the infrastructural capacity the EU lacks ([https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15 only 13 to 15 percent of the market is EU-owned]). This gives the US vast dominance in the field, which could be equated to what the EU coins as cloud sovereignty. Aware of the risks this dependency poses, both to data access and to the strategic advantage it affords the US, the EU has sought to reduce it through a succession of initiatives. [https://www.enisa.europa.eu/publications/eucs-cloud-service-scheme EUCS] was one such attempt, and remains only a non-legally-binding standard, stalled, per the [https://www.iss.europa.eu/publications/briefs/technical-political-when-cloud-certification-scheme-divides-europe EUISS], by Member States divided over their reliance on US providers; whether the [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52026PC0502 Cloud and AI Development Act] fares better remains to be seen.

=== Supply Chain management and Semiconductors ===
The United States and the European Union are equally invested in developing a domestic semiconductor industry, what separates them is their approach, the risks willing to run, the tools willing to use, and, above all, the capabilities and resources each power has. The US specifially aims to develop a bigger industry in this sector to rival competing hegemonic powers, to then gain AI dominance, strategic advantage and a stronger position in the international order.

The centrepiece is the [https://www.govinfo.gov/content/pkg/PLAW-117publ167/pdf/PLAW-117publ167.pdf CHIPS and Science Act] of August 2022, a statute that funds domestic fabrication and research through grants, loans and awards administered by the Department of Commerce. Its force comes from its scale: $39 billion in manufacturing incentives (including $2 billion reserved for legacy chips) and $11 billion for R&D, a federal pool officials themselves [https://www.reuters.com/technology/us-picks-team-oversee-527-bln-semiconductor-funding-2022-09-20/ described at the time] as $52.7 billion, on top of a Section 48D investment tax credit set from 25 to 35 percent in 2025. This is a single, centralised federal pool, commanded and disbursed by one government. The [https://eur-lex.europa.eu/eli/reg/2023/1781/oj/eng EU Chips Act (Regulation (EU) 2023/1781)] pursues the identical objective, a resilient domestic semiconductor base, but with a wholly different reach: its own budget is capped at a "maximum indicative amount" of just EUR 3.3 billion and decentralised Member State state aid. The US pursues to clash with other powers and surpass them through several measures in this statute, none of which the EU has an equivalent to.

The [https://www.federalregister.gov/documents/2023/09/25/2023-20471/preventing-the-improper-use-of-chips-act-funding CHIPS guardrails rule] binds every recipient of the funds for ten years: the Expansion Clawback bars material expansion, defined as growth of more than 5 percent, of semiconductor manufacturing capacity in a "foreign country of concern". These are protection measures, converting a subsidy into standing control over where a funded firm may grow and with whom it may cooperate, minimising ties to rival powers while building US capacity unilaterally.

The [https://www.federalregister.gov/documents/2022/10/13/2022-21658/implementation-of-additional-export-controls-certain-advanced-computing-and-semiconductor BIS export-control rule] does two things. First, it blocks advanced chips and chip-making equipment from reaching ‘countries of concern’ even when made outside the US, if US' technology, software or tools were used somewhere along the way to make them. Second, it stops any American, wherever in the world they work, from helping build advanced chips for those countries, even in a support role like shipping or servicing. What the US rule shows, in a way cloud policy does not, is active separation: a deliberate policy of isolating adversary states from American inputs, expertise and even American citizens' labour, building domestic capacity at home rather than permitting it to leak abroad through investment, export or cooperation.

The [https://www.federalregister.gov/documents/2026/01/20/2026-01052/adjusting-imports-of-semiconductors-semiconductor-manufacturing-equipment-and-their-derivative Section 232 proclamation] of 14 January 2026 shows the same modus operandi differently: a 25 percent tariff on certain advanced chips, and, in August 2025, the [https://newsroom.intel.com/corporate/intel-and-trump-administration-reach-historic-agreement conversion of $8.9 billion owed to Intel into a 9.9 percent equity stake] in the company. Neither is a law of general application; both are one-off executive moves, using a tariff or an ownership stake to get what the government wants directly. The US reaches for leverage and deal-making, not just regulation, a tool the EU does not use.

CHIPS award recipients are also barred by law from using federal funds to pay shareholder dividends or buy back stock, a restriction the [https://www.nist.gov/document/approach-capital-allocation-policies CHIPS Program Office] has sought to extend for five years from the date of an award.

Each of these examples have the same objective, that federal money spent on the domestic industry should build capacity, not enrich shareholders or, worse, end up financing a rival through some indirect channel. Subsidy, clawback, denial, tariff, ownership and now buyback limits, each is a different tool, but each answers to the same objective, an America made big and sovereign enough to win the race for AI dominance.

=== Supply Chain Management and Rare Earth Minerals ===
<p class="mwt-heading">The United States' pursuit of AI dominance rests on a chain of physical dependencies: AI systems require advanced semiconductors, semiconductors require rare earth elements and critical minerals, particularly the neodymium, dysprosium, and gadolinium used in the magnets and components of chip fabrication and data-centre hardware, and the United States currently remains reliant on processing capacity concentrated in China. Where the [https://www.congress.gov/bill/117th-congress/house-bill/4346 CHIPS and Science Act] addresses the fabrication layer, a separate and more fragmented body of law addresses the mineral layer beneath it. Unlike the EU's [https://eur-lex.europa.eu/eli/reg/2024/1252/oj/eng Critical Raw Materials Act], the American framework layers a foundational statute, an executive order, and a narrower defense-procurement statute.<br></p>

==== Energy Act of 2020 ====
Section 7002 of the Energy Act of 2020 (codified at [https://www.law.cornell.edu/definitions/uscode.php?width=840&height=800&iframe=true&def_id=30-USC-185389929-22931526&term_occur=999&term_src= 30 U.S.C. §1606]) supplies the foundational definitions. It defines a "critical mineral" through a delegated standard: a "byproduct" is a critical mineral whose recovery depends on the production of a host mineral not itself designated critical, while a "critical material" is any non-fuel mineral, element, substance, or material the Secretary of Energy determines carries a high risk of supply-chain disruption. This is primarily an administrative and classificatory act: it does not itself compel production, but it creates the taxonomy (which of the 17 rare earth elements are legally "critical") on which subsequent executive and procurement action depends.

==== Executive Order 14241 (2025) ====
[https://public-inspection.federalregister.gov/2025-05212.pdf Executive Order 14241], entitled "Immediate Measures to Increase American Mineral Production," signed March 20, 2025, operationalizes that taxonomy. Its Section 1 purpose clause is unusually candid about the framing: national and economic security are now threatened by dependence on hostile foreign powers. Operationally, Section 3 directs every federal agency involved in permitting to submit to the National Energy Dominance Council a list of all mineral production projects for which a plan of operations or permit application has been submitted, after which agency heads must identify projects that can be immediately approved and expedite them. The Order invokes [https://www.law.cornell.edu/uscode/text/50/4533 Title III of the Defense Production Act] to mobilize financing, and tasks the NEDC, chaired by the Secretary of the Interior, with coordinating implementation across Defense, Energy, Interior, and Agriculture. Unlike the CHIPS Act, it required no congressional appropriation, and unlike the Energy Act, it does not merely classify inputs but seeks to physically build an alternative domestic supply chain, the mining-and-processing analogue to the CRMA's "strategic projects" mechanism. Executive Order 14241 has since been diluted by [https://www.whitehouse.gov/presidential-actions/2025/04/reinvigorating-americas-beautiful-clean-coal-industry-and-amending-executive-order-14241/ Executive Order 14261], which extends designation of criticality to sectorally unrelated materials such as coal.

==== 10 U.S.C. §4872 and the DFARS ====
The narrowest instrument is [https://www.law.cornell.edu/uscode/text/10/4872 10 U.S.C. §4872], which provides that the Secretary of Defense may not procure any covered material melted or produced in any covered nation, or any end item containing such material. [https://www.law.cornell.edu/definitions/uscode.php?def_id=10-USC-1197798417-780045830&term_src=title:10:subtitle:A:part:V:subpart:I:chapter:385:subchapter:III:section:4872 “Covered nations"] are defined as North Korea, China, Russia, and Iran, covered materials include samarium-cobalt and neodymium-iron-boron magnets. Implemented through [https://www.acquisition.gov/dfars/225.7018-2-restriction. DFARS 225.7018-2], the clause currently bars acquisition of any covered material melted or produced in any covered country, tightening in 2027 to cover the entire chain. This statute does not build supply; it leverages the federal government's own purchasing power to exclude adversary-sourced inputs from the defense industrial base, a tool with no direct EU parallel, since the CRMA's diversification targets operate through incentive rather than exclusion.

Infrastructures: Digital Sovereignty

2026-09-25T13:52:24Z

Fortuny Jané Mariona: /* Supply Chain management and Semiconductors */

Infrastructures: Digital Sovereignty

2026-09-25T13:51:47Z

Fortuny Jané Mariona: /* US Infrastructure and Resources efforts for AI dominance */

Infrastructures: Digital Sovereignty

2026-09-25T12:33:15Z

Fortuny Jané Mariona: /* US Infrastructure and Resources efforts for AI dominance */

Infrastructures: Digital Sovereignty

2026-09-25T12:33:00Z

Fortuny Jané Mariona: /* US Infrastructure and Resources efforts for AI dominance */

Infrastructures: Digital Sovereignty

2026-09-25T12:31:11Z

Fortuny Jané Mariona: /* US Infrastructure and Resources efforts for AI dominance */

Infrastructures: Digital Sovereignty

2026-09-25T12:28:43Z