Infrastructures: Digital Sovereignty

Infrastructures: Digital Sovereignty

Digital Sovereignty in the European Union is a term used to convey a broad array of policy ambitions in relation to digital technology development and use: the urgency to regain control over data, infrastructures, and (critical) technologies, the establishment of strategic autonomy, the conclusion of partnerships with geopolitical allies, and the reduction of critical dependencies. According to the Digital Decade Policy Programme Implementation Report of 2023, digital sovereignty refers to the EU's "ability to act independently in the digital world and therefore it constitutes a crucial means to safeguard [EU] values".

Brazil 

Words: 2142

1. Introduction: What Is Digital Sovereignty?

Digital sovereignty refers to the capacity of a state to exercise autonomy, self-determination, and control over data, digital infrastructure, and technologies. This encompasses three distinct but overlapping dimensions: internet sovereignty (control over networks and online content), data sovereignty (governance of data flows, privacy, and cybersecurity), and technological sovereignty (control over critical technologies such as artificial intelligence, semiconductors, and raw materials). The endeavor toward digital sovereignty was accelerated by the Snowden revelations. Brazil has developed its own discourse on digital sovereignty, shaped by its historical concerns about foreign surveillance, its position as a major emerging economy, and its ambition to become a global technology actor. 

2. Brazil's National Digital Sovereignty Outlook

Brazil's approach to digital sovereignty is rooted in a long-standing concern about technological dependence and foreign surveillance. The 2013 revelation that the National Security Agency had intercepted communications of Brazilian President Dilma Rousseff and surveilled Petrobras (Brazil's state oil company) served as a breakpoint moment. This urged the Brazilian political agenda to reduce reliance on foreign digital infrastructure, and prompted Brazil to accelerate its own digital infrastructure projects. The most notable infrastructure project is the EllaLink undersea cables, connecting Brazil to Portugal (and thereby South America to Europe), which was explicitly designed to circumvent internet routing controlled by the US and enhance Brazil's data sovereignty.

Brazil's national digital sovereignty discourse is also closely tied to its open-source tradition. Brazil has historically been a strong proponent of open-source software. In the early 2000’s, during the Lula administration, Brazil’s government promoted free and open-source software as a tool for reducing dependence on proprietary foreign technology and lowering costs. This open-source orientation remains an element of Brazil's digital sovereignty strategy today: the development of national AI models, open data ecosystems, and publicly governed cloud infrastructure all reflect this tradition.  

The Brazilian AI Plan (PBIA) explicitly includes the development of a national AI software stack and open training databases, reflecting the view that open-source tools are a vehicle for technological autonomy rather than a security risk. 

Brazil's national digital sovereignty strategy is therefore characterised by two core priorities: (i) reducing dependence on foreign digital infrastructure and proprietary technology and (ii) building domestic capacity in critical technology sectors (AI, semiconductors, critical minerals). 

3. Regulatory Framework: Artificial Intelligence

3.1 Brazilian AI Strategy (EBIA)

Brazil's first official national AI strategy, the Estratégia Brasileira de Inteligência Artificial (EBIA), established the country's overarching vision for AI governance. Based on the OECD's AI principles, EBIA is structured around pillars including ethical and responsible AI, data governance, innovation, education and workforce development, public sector use of AI, and international cooperation. It explicitly prioritises human-centred AI, the protection of fundamental rights, transparency, and risk mitigation. However, EBIA is a soft law instrument: it sets principles only, with no binding obligations, no enforcement mechanisms, and no dedicated budget. It functions as a normative framework that articulates values and directions rather than imposing legal duties. 

3.2 Brazilian AI Plan (PBIA, 2024–2028)

The Plano Brasileiro de Inteligência Artificial (PBIA), launched on 30 July 2024 under the motto "AI for the Good of All," builds on EBIA by translating strategic vision into a concrete investment and infrastructure roadmap. Approved by the National Council for Science and Technology and coordinated by the Ministry of Science, Technology and Innovation, the PBIA is a strategic non-binding soft-law policy framework with a planned investment of R$23.03 billion through 2028. 

The PBIA combines immediate-impact initiatives with structural actions organised into five axes. These actions aim to develop the capabilities and skills needed for sustainable AI development in Brazil, while strengthening national sovereignty, technological autonomy, competitiveness and responsible innovation. Approximately 98.1% of planned investment is directed towards these structural actions. AI for Business Innovation (59.9%), Infrastructure and AI Development (25.2%), and AI for Improving Public Services (7.6%) receive the largest shares, followed by Dissemination, Education and Training in AI (5.0%). Support for AI Regulation and Governance receives approximately 0.4%. This distribution indicates an emphasis on building technological and industrial capacity. It is also indicative that Brazil prioritizes developing the technology infrastructure over implementing regulation in the form of hard law. From a digital sovereignty perspective, several elements of the PBIA are particularly significant. The Infrastructure and AI Development axis includes a National AI Infrastructure Program aimed at investing in high-performance computing and autonomous AI hardware to support technological sovereignty. It also includes a Sustainability and Renewable Energy Programme for AI, supporting renewable-energy infrastructure and efficient resource use, and a Programme for Structuring the Data and Software Ecosystem for AI intended to reduce external dependence, improve training datasets and develop a national AI software stack. AI for improving public services axis provides for a Sovereign Cloud, private or community cloud infrastructure managed exclusively by public agencies or state-owned companies, to increase control, security and sovereignty over sensitive data and ensure it is stored on national territory. The AI for Business Innovation axis aims to support sectors within the AI production chain, including information and communication technologies (ICT) and microelectronics, and to position Brazil as a global data centre hub. The PBIA reports that Brazil currently operates only 168 data centres (ranking 13th globally, compared to over 5,000 in the United States). Its AI Value Chain Promotion Programme seeks to strengthen and expand the domestic AI value chain, from supporting startups to developing Brazilian companies supplying foundation models. 

Bill No PL 2338/2023, which proposes a comprehensive AI framework, has passed the Senate and remains under consideration in the Chamber of Deputies, the lower house of Brazil’s National Congress. Until it is enacted, Brazil's AI governance framework remains largely in the realm of soft law, creating legal uncertainty for investors, developers, and citizens alike. 

4. Regulatory Framework: Semiconductors and Critical Minerals 

4.1 Brasil Semicon (Law No. 14.968/2024) 

The Brazil Semiconductor Programme (Brasil Semicon), established under Law No. 14.968 of 11 September 2024, constitutes Brazil's principal hard law instrument for technological sovereignty in the semiconductor sector. It establishes a national strategy and guidelines to encourage research, development, innovation, production, and application of semiconductors, displays, and solar panels. Brasil Semicon updates and expands the instruments of PADIS (the Support Program for Technological Development of the Semiconductor Industry), extending tax incentives until the end of 2029 and broadening their scope to include software, specialised services, technical assistance, and other stages of the production chain. Decree No. 13.065 of 16 July 2026 activated the programme, establishing the rules for the semiconductor industry and facilitating access to PADIS tax incentives. The programme aims to attract investments in the national chip supply chain until 2029, directly addressing Brazil's dependence on foreign semiconductor manufacturing. 

4.2 National Policy on Critical and Strategic Minerals (Law No. 15.506/2026) 

Published on 16 September 2026, Law No. 15.506/2026 establishes a national policy and governance structure for critical and strategic minerals. It aims to promote research, extraction, processing, and transformation of critical and strategic minerals domestically, adding value to supply chains rather than exporting raw materials. The policy explicitly seeks to strengthen Brazil's economic and geopolitical security by ensuring a stable domestic supply of minerals essential to the digital economy — including those required for semiconductors, batteries, and AI hardware. It provides up to R$5 billion in tax credits (covering up to 20% of eligible expenses) from 2030 through 2034 for mineral processing, manufacturing, and recycling projects, and authorises a Mineral Activity Guarantee Fund with up to R$2 billion in federal contributions. This law is significant because Brazil holds some of the world's largest reserves of rare earth minerals and other critical inputs for the digital economy, and the policy represents a strategic decision to leverage these resources for domestic technological development rather than simply exporting them. 

5. The EU–Brazil Digital Partnership (2026) 

Signed on 12 June 2026, the EU–Brazil Digital Partnership is a soft law instrument establishing a framework for bilateral cooperation on issues that concern digital sovereignty.  

i) Article 2 commits both parties to fostering meaningful digital development and inclusion while preserving digital sovereignty, democratic principles, and human rights.  

ii) Article 3 provides for reciprocal recognition of data protection levels — based on the European Parliament's adequacy decision of January 2026 and Brazil's ANPD Resolution 32 — thereby easing cross-border data flows and building trust in bilateral data governance.  

iii) Article 15 commits both parties to developing national technology supply chains to ensure that global interdependence does not undermine their respective technological sovereignties.  

iv) Article 17 provides for cooperation on AI development and deployment, referencing the PBIA and comparable EU programmes.  

v) Articles 19 and 21 establish information-sharing mechanisms on data governance, data spaces, digital services, and digital markets, with an explicit commitment to preserving regulatory autonomy.  

vi) Article 23 references Brazil's EllaLink undersea cable project as a concrete expression of its digital sovereignty ambitions. 

The Digital Partnership is a precursor to harder legal instruments: it is future-facing, flexible, and oriented toward sharing know-how and building mutual trust. Its soft law nature is appropriate given the current rate of innovation in technology. 

6. Comparison with the EU 

Brazil and the EU share the same fundamental goal: reducing dependence on foreign (primarily US and Chinese) digital infrastructure and technology. However, they pursue it through different regulatory architectures. 

The EU has adopted a comprehensive, multi-layered hard law framework for digital sovereignty, encompassing the GDPR, the NIS 2 Directive, the Cybersecurity Act, the Chips Act, and the Critical Raw Materials Act, alongside the newly proposed EU Tech Sovereignty Package (June 2026) including the Cloud and AI Development Act (CADA) and an EU Open Source Strategy. The package therefore combines legislative proposals with non-binding policy instruments. The EU's approach combines binding regulation with substantial public investment, and it applies to both public and private sector actors. 

Brazil, by contrast, has followed a more strategy-led approach to developing its dedicated AI framework. Its AI governance framework remains largely in soft law (EBIA and PBIA), with binding legislation (PL 2338) still pending. Brazil’s hard law instruments are concentrated in the industrial and resource sectors (Brasil Semicon; the Critical Minerals Law), reflecting a Brazil’s priority being placed on supply chain sovereignty and infrastructure building (rather than regulatory compliance frameworks).  

In 2026 Brazil began developing the Nuvem Brasileira, a national cloud infrastructure designed to keep critical government data and control of the infrastructure under Brazilian jurisdiction, while favouring open standards and reducing dependence on foreign technology providers. Specifically, the Brazilian government decided that Microsoft and other foreign big tech providers would not be the preferred providers for the Nuvem Brasileira. The government is explicitly assessing dependencies on foreign suppliers and whether the State could continue operating critical services if an external provider became unavailable. Brazil’s model does not require everything to be Brazilian-made, but focuses on control over data, operations and technology.  This shifts sovereignty from simply where data is stored to who controls the infrastructure, keys, software, jurisdiction and ability to operate independently. It is alongside REDATA, which uses datacentre incentives to build domestic technological capacity. Brazil's open-source orientation also distinguishes it from the EU. Both jurisdictions promote open source as a means of strengthening technological autonomy. While the EU has adopted an Open Source Strategy and the CADA references open-source principles, Brazil's commitment to open-source software is deeper and more historically embedded, reflecting a political tradition that views proprietary technology as a vector of foreign dependence. The PBIA's emphasis on a national AI software stack and open training data reflects this tradition and represents a distinctive approach to technological sovereignty that merits attention in comparative analysis. 

Finally, both Brazil and the EU face the same structural challenge: the global digital economy is dominated by a small number of US and Chinese technology companies, and neither jurisdiction has yet succeeded in producing domestic alternatives at comparable scale. Brazil's ambition to become a global data centre hub and to develop sovereign AI models is bold, but the gap between aspiration and capacity remains large. The EU's more developed AI-specific regulatory architecture provides stronger protections for citizens and clearer rules for industry, but has been criticised for potentially hampering innovation. Brazil's softer approach may allow for faster initial development, but risks leaving citizens and the market without adequate legal protection in the interim. 

7. Conclusion 

Brazil's approach to digital sovereignty is characterised by a strong national discourse rooted in concerns about foreign surveillance and technological dependence, a soft law-dominant AI governance framework that is still evolving toward binding regulation, and hard law instruments in the semiconductor and critical minerals sectors that reflect a strategic prioritisation of supply-chain sovereignty. Brazil's open-source tradition adds a distinctive dimension to its digital sovereignty strategy, positioning it differently from both the. The EU–Brazil Digital Partnership represents a meaningful step toward bilateral cooperation, but its soft law nature means  its impact will depend on follow-through.  

United States

The Concept of Digital Sovereignty

The idea of “digital sovereignty” is not a single concept. There are a number of scholars who attempted to define digital sovereignty. Couture and Toupin and Floridi emphasized the control over the digital realm, in which Floridi saw a combination of democratic legitimacy with innovative flexibility by a hybrid system of control. On the other hand, Chung looked into the aspect of authority by defining digital sovereignty as a state’s ability to define, implement and enforce political and legal decisions across digital systems, platforms and data infrastructures. She also reconceptualized the term by asserting that sovereignty should be understood as governance capacity rather than exclusive control. There is a variety of perspectives in determining what digital sovereignty means and conflicting definitions based on varying national strategies.

The definition of digital sovereignty adopted throughout this study is a merge of authority and practical capacity of a state to set, apply and defend its own rules governing the digital infrastructure, data flows and algorithmic systems that shape its legal and political orders, against interference by outside actors, whether public or private, including other levels of government within the same state.

The United States Sovereignty Strategy: AI Dominance

Unlike the EU who attempts to maintain digital sovereignty under its regulatory control, the idea of securing digital sovereignty is not its priority for the US. Their goal is to ensure geopolitical dominance by entrenching American advantage in the technologies that determine their economic and military standing, against a field of competitors, namely China as the principal one.

From Winning the Race: America’s AI Action Plan, Issued on 23 July 2025, the US outlines 103 recommended actions by three pillars:

• Pillar 1: Accelerate AI Innovation – removing “bureaucratic red tapes” which hinder technological advancement by deregulation
• Pillar 2: Build American AI Infrastructure – fostering an environment conducive to AI innovations
• Pillar 3: Lead in International AI Diplomacy and Security – Ensuring its global hegemonic position in AI technology

  As explicitly stated from the plan, their core interest is in winning the race and securing its geopolitical primacy relative to other competitors rather than enhancing its authority and capacity over its domestic digital governance. The Plan itself has no legal force, yet the actual implementation is played by executive orders and procurements.

The Four Registers

American digital policy has an organising purpose, and it is not regulation. It is primacy: maintaining American advantage in the technologies that determine economic and military standing, against a field of competitors, of which China is the principal one. The framing is stated in the instruments themselves — the order that set the current course is titled Removing Barriers to American Leadership in Artificial Intelligence, and the strategy it produced is titled Winning the Race. Beneath that strategy, the United States steers digital developments through four registers, descending in legal formality and ascending in speed.

Statute is the thinnest register. The CHIPS and Science Act and the Protecting Americans from Foreign Adversary Controlled Applications Act are both narrow and adversary-specific, and general legislation has failed: the Senate stripped a ten-year moratorium on state enforcement of AI laws from the One Big Beautiful Bill Act by a vote of 99 to 1.

Executive orders carry the load. Executive Order 14117 produced the Data Security Program, an export control keyed to adversary identity rather than to any standard of protection; Executive Order 14320 finances the export of full-stack American AI packages; Executive Order 14365 asserts a national AI framework and directs litigation against inconsistent state laws.

Procurement is quieter and more effective, and illustrated below by the cloud and semiconductor sectors.

Announcement is the fastest register and the least examined. On 19 January 2025 the President posted on Truth Social that he would issue an order extending the statutory TikTok divestment deadline, and TikTok restored service in the United States the same day, before any instrument existed. A platform serving some 170 million US users changed its conduct based solely on anticipated legality.

Direction of Travel

Policy directionality is consistent across all four registers and runs four ways. Outward, the export programme pushes the domestic AI stack into third markets. Inward, the Data Security Program and Team Telecom review screen foreign access based on a counterparty's identity rather than the safeguards it offers. Homeward, subsidy builds domestic capacity. Downward, federal policy presses on the states, and it is working even though preemption ordinarily requires a congressional enactment: Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower automated decision-making statute stripped of deployer impact-assessment duties, while California's frontier AI statute (SB 53) contains a federal-deference clause under which compliance with a comparable federal framework discharges the state obligation. States are deferring in advance to a federal standard that does not yet exist.

Outward and homeward movement build the US position; inward and downward movement defend it against interference, foreign in the former case and domestic in the latter. The same adversary-identity test recurs in an export control, a subsidy condition, and a screening review alike.

US Infrastructure and Resources efforts for AI dominance

Supply Chain management and the Cloud

The United States aims to maintain its position in the international order, seeking to surpass and constrain rival powers. Technological dominance constitutes one of the principal means of pursuing this objective, and in recent years this pursuit has centred increasingly on artificial intelligence, a domain heavily dependent on underlying industrial capacity and resource access.

Cloud service dependency describes a form of structural power exercised not through territorial control but through infrastructural ownership. Because US firms hold roughly two-thirds of the EU cloud market, a majority of European data, public and private, resides within entities potentially subject to US jurisdiction, irrespective of the server's physical location. This constitutes strategic advantage precisely because it requires no conventional projection of power abroad: dominance is achieved by occupying the infrastructural layer itself, converting market position into jurisdictional reach and, in turn, translating informational access into epistemic and strategic advantage. The CLOUD Act grants the United States access to foreign data provided this is held by a US cloud service provider, access guaranteed only through a defined legal process, the issuance of a judicial warrant subject to probable cause. FISA Section 702, by contrast, authorises access to foreign data held in US clouds for intelligence purposes through compelled provider assistance, and in this instance no comparable judicial procedure is required by law. These divergent standards of authorisation, and the reach they enable, stand in direct tension with the protections EU law seeks to guarantee.

Ironically, the US maintains mechanisms to protect its data from foreign control while monitoring others’, consolidating digital sovereignty by setting the terms of engagement.

FedRAMP establishes the conditions under which any cloud provider, including foreign entities, may process US federal government data, asserting sovereign gatekeeping over access to its own infrastructure even as it resists equivalent constraints abroad. Executive Order 14117 and the accompanying DOJ rule (2025), although criticised for their generalistic scope, restrict the outbound transfer of bulk sensitive data to designated "countries of concern." The asymmetry is instructive when set against the EU's broadly equivalent instruments: both regimes exercise control, but over opposite targets, the United States restricts flows to named adversaries, while the EU restricts flows to any third country whose legal framework it deems inadequate, a criterion of general application rather than one confined to a defined list of hostile states.

The EU's principal instrument of power has consequently been regulatory rather than infrastructural, expressed through the GDPR (Art. 48) and the Data Act, mechanisms of constraint and protection rather than instruments of reach comparable to the CLOUD Act or FISA. There's a clear divergence in objective these reflect, and it is rooted in the different conception tof human rights, values and norms, related to data protection and privacy both actors have. Worth mentioning, the EU's position is further constrained by a material deficit, limited infrastructural capacity, financial resources.

As of right now, the United States can circumvent the normative safeguards the EU has imposed in some cases (through FISA), and it already possesses the infrastructural capacity the EU lacks . This gives the US vast dominance in the field, which could be equated to what the EU coins as cloud sovereignty. Aware of the risks this dependency poses, both to data access and to the strategic advantage it affords the US, the EU has sought to reduce it through a succession of initiatives. EUCS was one such attempt, and remains only a non-legally-binding standard; whether the Cloud and AI Development Act fares better remains to be seen.

Supply Chain management and Semiconductors

The United States and the European Union are equally invested in developing a domestic semiconductor industry, what separates them is their approach, the risks willing to run, the tools willing to use, and, above all, the capabilities and resources each power has. The US specifially aims to develop a bigger industry in this sector to rival competing hegemonic powers, to then gain AI dominance, strategic advantage and a stronger position in the international order.

The centrepiece is the CHIPS and Science Act, a statute that funds domestic fabrication and research through grants, loans and awards administered by the Department of Commerce. Its force comes from its scale: $39 billion in manufacturing incentives (including $2 billion reserved for legacy chips) and $11 billion for R&D, a federal pool officials themselves described at the time as $52.7 billion, on top of a Section 48D investment tax credit set from 25 to 35 percent in 2025. This is a single, centralised federal pool, commanded and disbursed by one government. The EU Chips Act (Regulation (EU) 2023/1781) pursues the identical objective, a resilient domestic semiconductor base, but with a wholly different reach: its own budget is capped at a "maximum indicative amount" of just EUR 3.3 billion and decentralised Member State state aid. The US pursues to clash with other powers and surpass them through several measures in this statute, none of which the EU has an equivalent to.

The CHIPS guardrails rule binds every recipient of the funds for ten years: the Expansion Clawback bars material expansion, defined as growth of more than 5 percent, of semiconductor manufacturing capacity in a "foreign country of concern". These are protection measures, converting a subsidy into standing control over where a funded firm may grow and with whom it may cooperate, minimising ties to rival powers while building US capacity unilaterally.

The BIS export-control rule does two things. First, it blocks advanced chips and chip-making equipment from reaching ‘countries of concern’ even when made outside the US, if US' technology, software or tools were used somewhere along the way to make them. Second, it stops any American, wherever in the world they work, from helping build advanced chips for those countries, even in a support role like shipping or servicing. What the US rule shows, in a way cloud policy does not, is active separation: a deliberate policy of isolating adversary states from American inputs, expertise and even American citizens' labour, building domestic capacity at home rather than permitting it to leak abroad through investment, export or cooperation.

The Section 232 proclamation of 14 January 2026 shows the same modus operandi differently: a 25% tariff on certain advanced chips, and, in August 2025, the conversion of $8.9 billion owed to Intel into a 9.9 percent equity stake in the company. Neither is a law of general application; both are one-off executive moves, using a tariff or an ownership stake to get what the government wants directly. The US reaches for leverage and deal-making, not just regulation, a tool the EU does not use.

CHIPS award recipients are also barred by law from using federal funds to pay shareholder dividends or buy back stock, a restriction the CHIPS Program Office has sought to extend for five years from the date of an award.

Supply Chain Management and Rare Earth Minerals

AI systems require advanced semiconductors, semiconductors require rare earth elements and critical minerals,  and the United States currently remains reliant on processing capacity concentrated in China. Where the CHIPS and Science Act addresses the fabrication layer, a separate and more fragmented body of law addresses the mineral layer beneath it. Unlike the EU's Critical Raw Materials Act, the American framework layers a foundational statute, an executive order, and a narrower defense-procurement statute.

Energy Act of 2020

Section 7002 of the Energy Act of 2020 (codified at 30 U.S.C. §1606) supplies the foundational definitions. It defines a "critical mineral" through a delegated standard: a "byproduct" is a critical mineral whose recovery depends on the production of a host mineral not itself designated critical, while a "critical material" is any non-fuel mineral, element, substance, or material the Secretary of Energy determines carries a high risk of supply-chain disruption. This is primarily an administrative and classificatory act: it does not itself compel production, but it creates the taxonomy (which of the 17 rare earth elements are legally "critical") on which subsequent executive and procurement action depends.

Executive Order 14241 (2025)

Executive Order 14241, entitled "Immediate Measures to Increase American Mineral Production," signed March 20, 2025, operationalizes that taxonomy. Its Section 1 purpose clause is unusually candid about the framing: national and economic security are now threatened by dependence on hostile foreign powers. Operationally, Section 3 directs every federal agency involved in permitting to submit to the National Energy Dominance Council a list of all mineral production projects for which a plan of operations or permit application has been submitted, after which agency heads must identify projects that can be immediately approved and expedite them. The Order invokes Title III of the Defense Production Act to mobilize financing, and tasks the NEDC, chaired by the Secretary of the Interior, with coordinating implementation across Defense, Energy, Interior, and Agriculture. Unlike the CHIPS Act, it required no congressional appropriation, and unlike the Energy Act, it does not merely classify inputs but seeks to physically build an alternative domestic supply chain, the mining-and-processing analogue to the CRMA's "strategic projects" mechanism. Executive Order 14241 has since been diluted by Executive Order 14261, which extends designation of criticality to sectorally unrelated materials such as coal.

10 U.S.C. §4872 and the DFARS

The narrowest instrument is 10 U.S.C. §4872, which provides that the Secretary of Defense may not procure any covered material melted or produced in any covered nation, or any end item containing such material. “Covered nations" are defined as North Korea, China, Russia, and Iran, covered materials include samarium-cobalt and neodymium-iron-boron magnets. Implemented through DFARS 225.7018-2, the clause currently bars acquisition of any covered material melted or produced in any covered country, tightening in 2027 to cover the entire chain. This statute does not build supply; it leverages the federal government's own purchasing power to exclude adversary-sourced inputs from the defense industrial base, a tool with no direct EU parallel, since the CRMA's diversification targets operate through incentive rather than exclusion.