Infrastructures: Digital Sovereignty

Infrastructures: Digital Sovereignty

Digital Sovereignty in the European Union is a term used to convey a broad array of policy ambitions in relation to digital technology development and use: the urgency to regain control over data, infrastructures, and (critical) technologies, the establishment of strategic autonomy, the conclusion of partnerships with geopolitical allies, and the reduction of critical dependencies. According to the Digital Decade Policy Programme Implementation Report of 2023, digital sovereignty refers to the EU's "ability to act independently in the digital world and therefore it constitutes a crucial means to safeguard [EU] values".

Brazil

In progress

= China =

Introduction

'

“Digital Sovereignty” is an increasingly important concept for understanding how States exercise political and economic control over digital infrastructures and technologies. Since the massive introduction of the Internet in 1994, Chinese academic and political discourse has formulated notions of cyber, information, and network sovereignty in direct relation to digital and technological independence.

In the early 2000s, Chinese authorities focused primarily on controlling data flows rather than developing national technological champions. Indeed, at the time Google held 40% of the Chinese Internet search market and companies like Yahoo maintained substantial equity participation in Chinese firms like Alibaba, all of which ended in 2009 when the Urumqi riots triggered China’s decision to permanently block platforms like Facebook and YouTube, prompting Google’s withdrawal from the Internet search market.

In 2010 “Cyber Sovereignty” was crystallized as an organizing principle of Chinese digital policy following historical concerns about information control and a national determination to resist foreign influence over China. This political and economic landscape cemented the nation’s ambition to achieve full digital sovereignty.

Today Chinese digital sovereignty is incorporated into its legal framework, particularly in the Cybersecurity Law and the Data Security Law (both from 2017). These laws establish data localization requirements and security assessments mechanisms for cross-border transfers. Moreover, they aim for China to develop the autonomy and capacity necessary to exercise full control over its data.

Cybersecurity Law

The Cybersecurity Law is a comprehensive legal framework that regulates cyberspace and information infrastructure security in China, governing information networks build, operation, and use within its territory (article 2). The law covers a wide range of issues, including critical information infrastructure management, cybersecurity, and data protection.

In the area of critical information infrastructure management, the law applies to “Critical Information Infrastructures” (CIIs) and “Critical Information Infrastructure Operators” (CIIOs) which include information infrastructure and its operators in sectors such as energy, finance, healthcare, telecommunications, transportation, and governmental services.

CIIOs have the obligation to adopt enhanced security measures and protocols to safeguard information infrastructure and their data. Additionally, CIIOs must perform regular security assessments and report their results to State agencies, implement protective measures and protocols, and cooperate with State agencies, among others (articles 23, 36, 37, 38, and 40).

In the area of cybersecurity, the law applies to all information infrastructure operators (not only to CIIOs) which have the obligation to adopt comprehensive cybersecurity measures which include monitoring their infrastructure security, safeguarding against data breaches, impeding misuse of their infrastructures for illegal activities, prepare incident response plans, report cybersecurity incidents, and cooperate with State agencies (articles 23, 27, 30 and 51).

Finally, in the area of data protection, the law applies to CIIOs in the case of data localization, and to all information infrastructure operators in the case of personal information.

CIIOs have the obligation to store within China all critical data and personal information they collect or generate in the country’s territory. Additionally, CIIOs must pass a security evaluation and get State authorization to transfer data abroad (article 39).

Moreover, all information infrastructure operators have the obligation to follow guidelines for collecting, processing, and storing personal information. In that sense, information infrastructure operators must secure user consent for gathering personal information and disclose it, and warrant its protection by implementing measures to guard against unauthorized or illegal access and misuse including breach notification (article 42).

Additionally, the law establishes obligations for the State including to balance cybersecurity and information infrastructure development (article 4), continuously improve the national cybersecurity strategy (article 5), and deal with cybersecurity risks and threats (article 6).

In general, the law provides the State extensive powers to access data held by information infrastructure operators functioning within China, including the authority to require assistance and support in matters of national security or criminal investigations.

Infringing the law can result in sanctions for information infrastructure operators which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a threat to public order or national security, infringements can result in criminal prosecution and career suspension (articles 61, 63, 64, 65, 66, 68, 69, 71, and 76).

Data Security Law

The Data Security Law is a comprehensive legal framework that regulates data management for the purposes of national sovereignty, security, and social and economic development.

It establishes the obligation of the State to develop a data classification system based on its importance to social and economic development and the damage its alteration, destruction, leakage, or illicit use would cause to national security, public interest, or people or organizations’ rights and interests. Such classification allows the State to apply varying protection levels depending on the data’s sensitivity and relevance, where “central data of the State” or data deemed important to national security, major public interests, critical economic sectors, or important aspects of people livelihood is given the highest level of protection (article 21). Other categories of data are “important data” and “general data” which are not defined or developed in the law but in complementary regulations.

The law applies to data management carried out within China’s territory, and generates legal responsibility for data management outside if it harms national security, public interest, or people or organizations’ rights and interests (article 2). Data processors of “important data” have the obligation to designate officers responsible for data security, to conduct risk evaluations periodically reporting the results to State authorities, and to report security incidents to users and State authorities, among others (articles 27, 29 and 30). Moreover, data processors are impeded to transfer data to foreign judicial authorities without authorization (article 36).

Additionally, the law establishes obligations for the State including to encourage the use of data for economic and innovation purposes, specifically for the development of new data-driven industries as long as they comply with the law (article 1). Also, it has the obligation to coordinate the national data security, and draft and implement the national data security strategy (article 5).

In general the law enables the State to collect data if it is necessary to safeguard national security or investigate crimes, subject to approval procedures (article 35). Data processors and individuals are obliged to cooperate, and refusal is subject to fines (article 48).

Infringing the law can result in sanctions which include fines, operational suspensions, and business license revocations (individuals may face personal responsibility). In more extreme cases, where there is a crime or a threat to national sovereignty, security, or economic development interests, infringements can result in criminal prosecution (articles 45 and 52).

Personal Information Protection Law

The Personal Information Protection Law of 2021 is a comprehensive legal framework that protects personal information similarly to the European General Data Protection Regulation (GDPR). Although the law is not directly related to China’s digital sovereignty, it establishes obligations relevant to it: State agencies, critical infrastructure operators, and data processors that collect, process, or use data above a certain threshold (defined by State authorities) must store within China all personal information they collect or generate in the country’s territory. Additionally, they must pass a security evaluation and get State authorization to transfer data abroad (article 36 and 40).

Moreover, the State is allowed to blacklist individuals and organizations and deny them access to personal information generated or collected in China if it deems that they acted against Chinese people rights or interests, as well as to adopt reciprocal measures against foreign States if it deems that they discriminated against China regarding the protection of personal information (articles 42 and 43).

China’s State Centered Concept of Digital Sovereignty

The Cybersecurity Law and the Data Security Law are integral parts of China’s strategy to strengthen its digital sovereignty.

China’s concept of digital sovereignty is characterized for its strong State-centered approach in which the State holds ultimate and supreme authority in the digital space, controlling data flows and content sharing within its borders. In a sense, China’s concept of digital sovereignty is defensive: it is essential to protect China’s social, political, and economic architecture from destabilization attempts by foreign actors (particularly the United States), which explains why the Cybersecurity Law establishes the obligation of private actors to “abide by the Constitution and laws, observe public order, respect social morality, and (...) not (...) use the Internet to engage in activities that endanger national security, honor, or interests (...), incite subversion of State power or overthrow of the socialist system (...), incite secession or undermine national unity (...), (or) fabricate or disseminate false information to disrupt economic and social order” (article 13), and why the the Data Security Law establishes as an objective to “preserve State sovereignty, security, and development interests” (article 1).

Such a concept requires the achievement of two policy objectives: territorialization and indigenization. Through territorialization China seeks to replicate its national borders in cyberspace, ensuring that online processes impacting important national interests take place within Chinese boundaries, and unwanted practices or operations can be barred from entering. Through indigenization, in turn, it strives to replace foreign actors and technologies with local equivalents, reducing foreign dependence.

In this context, the Cybersecurity Law and the Data Security Law aim to protect China’s digital sovereignty through both policy objectives. In the case of territorialization, they establish the objective of protecting sovereignty in cyberspace and preventing and responding to cybersecurity risks and threats coming from inside and outside China; the obligation of CIIOs to store in China all personal information and important data that they generate or collect inside the country’s borders, and to conduct security evaluations and obtain State permission before transferring them abroad; the obligation of data processors to not transfer data to foreign judicial authorities without State authorization; the responsibility of data processors for activities carried out outside China; and the capacity of the State to block prohibited information, to temporarily restrict communications in specific areas for national security reasons, and to adopt countermeasures against foreign States that discriminate against China in data investment or trade (Cybersecurity Law articles 1, 6, 39, 50 and 60, and Data Security Law articles 2, 26 and 36).

In the case of indigenization, the laws establish mechanisms of promotion and access control that indirectly privilege national providers. As an example, they establish the obligation of critical infrastructure operators to purchase information network products and services approved by a national security assessment; the obligation of critical information network products providers to offer products that are certified or comply with national standards; the obligation of the State to support Chinese cybersecurity industries and projects, to support Chinese Artificial Intelligence (AI) industries, to support data development and security industrial systems, to support the creation of national data markets, and to develop a national strategy for big data and data infrastructure (Cybersecurity Law articles 17, 20, 25 and 37, Data Security Law articles 14, 16 and 19).

These efforts are related to the “Great Firewall”, the Chinese State system for censoring and controlling Internet traffic within its borders which is, arguably, its most visible instrument of territorialization, drawing an effective Internet frontier between China and the rest of the world.

In summary, China's digital sovereignty concept demands asserting control over data generated within its borders and to protect sensitive information from foreign interference and cyber-attacks while simultaneously reinforcing its surveillance capacity and its ability to manage information flows for “social stability”.

In this sense, China's data localization mandates are designed to nurture domestic technological independence, and they achieve this by ensuring that valuable data generated within China remains in the hands of Chinese firms rather than foreign competitors. This treats data itself as a strategic economic asset. China simultaneously fuels domestic innovation and strengthens its digital economy and denies foreign firms the informational advantage they would otherwise hold by keeping the economic advantage within its borders.

Finally, on the regulation of foreign companies, laws such as the Data Security Law gives Chinese authorities a direct enforcement mechanism over foreign entities operating domestically, compelling compliance with localization requirements and government data access provisions.

Therefore, each Chinese law was built to accomplish a specific stated goal, and each demonstrably does so, which makes China’s digital sovereignty regime distinct because China’s legal scheme was constructed with sufficient State control to ensure regulatory instruments and its sovereignty goals remained tightly aligned.

China vs. the European Union: Major Digital Sovereigns

The European Union (EU) and China represent two distinct approaches to digital sovereignty. The EU contrasts to China’s reactive, security-driven model, since EU digital sovereignty emerged from a supranational, rights-based traditional rather than an authoritarian one. The EU’s push to digital sovereignty began after 2013 when Edward Snowden’s revelation of NSA interception of European communications exposed the EU's dependence on foreign technology and triggered a wave of regulatory safeguards. This led to the creation of the GDPR adopted in 2016, which enshrined enforceable individual rights, including access to, and objection to, the processing of European customer data. The EU continued its trajectory by developing two consumer protection directives in 2019, in addition to a series of antitrust proceedings against hyperscale’s such as Google, Amazon, and Apple between 2015 and 2020. In 2024, the AI Act was created to harmonize AI development and deployment rules according to EU values and fundamental rights. More recently, the EU initiated infrastructure initiatives such as Gaia X for cloud sovereignty and the Chips Act for semiconductor independence.

Despite this extensive regulatory framework, China's claim to digital sovereignty may be considered more consolidated than the EU's because it fuses legal codification with direct State control over technology, information, and infrastructure in a way the EU market-correcting model does not.

As European Commission President von der Leyen stated in 2019, ‘it is not too late to achieve technological sovereignty in some critical technology areas’. In actuality, the EU has been catching up to China, which spent the last decade tightening its state authority over its digital infrastructure before the EU began treating its own technology dependence as a vulnerability. China's more recent legislative activity has extended this consolidation into the international stage as well as domestically. In 2024, the Shanghai Declaration on Global AI governance, issued by China's Ministry of Foreign Affairs, committed signatories to developing AI under principles of safety, reliability, and controllability, while asserting each country's right to regulate AI according to its own national conditions. This language simultaneously projects openness to international cooperation while defending non-foreign interference, the logic underpinning China's cyber-sovereignity doctrine.

This declaration is not merely aspirational: it is anchored in binding domestic law, specifically Article 20 of China's 2025 amended Security Law, which directs the state to support AI research, infrastructure, ethical norms, and risk supervision.

Therefore, where the EU’s sovereignty is exercised primarily through regulating outside actors within its internal market, China's sovereignty is exercised through direct state-led development, information control, and an explicit fusion of domestic statute and international declaratory positioning. This makes China's model arguably more total in its sovereignty, though less extensive in scope, over the digital domain it governs compared to the EU.

References

'

(1) Thumfart, J. & Cong. W., “A Chinese Precursor to the Digital Sovereignty Debate: Digital Anti-Colonialism and Authoritarianism from the Post–Cold War Era to the Tunis Agenda”, Global Studies Quarterly (2022) 2, 1–13.

(2) Rivaton, R., “The Origins and Fate of Digital Sovereignty”, Fondation pour L’Innovation Politique, 21 may 2026, https://www.fondapol.org/decryptage/the-origins-and-fate-of-digital-sovereignty/

(3) Jiang, M. Models of State Digital Sovereignty From the Global South: Diverging Experiences From China, India and South Africa, Policy & Internet, 15 December 2024, https://doi.org/10.1002/poi3.427'

India

In progress

United States

The Four Registers

American digital policy has an organising purpose, and it is not regulation. It is primacy: maintaining American advantage in the technologies that determine economic and military standing, against a field of competitors, of which China is the principal one. The framing is stated in the instruments themselves — the order that set the current course is titled Removing Barriers to American Leadership in Artificial Intelligence, and the strategy it produced is titled Winning the Race. Beneath that strategy, the United States steers digital developments through four registers, descending in legal formality and ascending in speed.

Statute is the thinnest register. The CHIPS and Science Act and the Protecting Americans from Foreign Adversary Controlled Applications Act are both narrow and adversary-specific, and general legislation has failed: the Senate stripped a ten-year moratorium on state enforcement of AI laws from the One Big Beautiful Bill Act by a vote of 99 to 1.

Executive orders carry the load. Executive Order 14117 produced the Data Security Program, an export control keyed to adversary identity rather than to any standard of protection; Executive Order 14320 finances the export of full-stack American AI packages; Executive Order 14365 asserts a national AI framework and directs litigation against inconsistent state laws.

Procurement is quieter and probably more effective, and is illustrated below by the cloud and semiconductor sectors.

Announcement is the fastest register and the least examined. On 19 January 2025 the President posted on Truth Social that he would issue an order extending the statutory TikTok divestment deadline, and TikTok restored service in the United States the same day, before any instrument existed. A platform serving some 170 million US users changed its conduct based solely on anticipated legality.

Direction of Travel

The direction of policy is consistent across all four registers and runs four ways. Outward, the export programme pushes the domestic AI stack into third markets. Inward, the Data Security Program and Team Telecom review screen foreign access based on a counterparty's identity rather than the safeguards it offers. Homeward, subsidy builds domestic capacity. Downward, federal policy presses on the states, and it is working even though preemption ordinarily requires a congressional enactment: Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower automated decision-making statute stripped of deployer impact-assessment duties, while California's frontier AI statute (SB 53) contains a federal-deference clause under which compliance with a comparable federal framework discharges the state obligation. States are deferring in advance to a federal standard that does not yet exist.

Outward and homeward movement build the US position; inward and downward movement defend it against interference, foreign in the former case and domestic in the latter. The same adversary-identity test recurs in an export control, a subsidy condition, and a screening review alike.

== The Concept of Digital Sovereignty ==

The idea of “digital sovereignty” is not a single concept. There are a number of scholars who attempted to define digital sovereignty. Couture and Toupin and Floridi emphasized the control over the digital realm, in which Floridi saw a combination of democratic legitimacy with innovative flexibility by a hybrid system of control. On the other hand, Chung looked into the aspect of authority by defining digital sovereignty as a state’s ability to define, implement and enforce political and legal decisions across digital systems, platforms and data infrastructures. She also reconceptualized the term by asserting that sovereignty should be understood as governance capacity rather than exclusive control. There is a variety of perspectives in determining what digital sovereignty means and conflicting definitions based on varying national strategies.

The definition of digital sovereignty adopted throughout this study is a merge of authority and practical capacity of a state to set, apply and defend its own rules governing the digital infrastructure, data flows and algorithmic systems that shape its legal and political orders, against interference by outside actors, whether public or private, including other levels of government within the same state.

=== The United States Sovereignty Strategy: AI Dominance ===

Unlike the EU who attempts to maintain digital sovereignty under its regulatory control, the idea of securing digital sovereignty is not its priority for the US. Their goal is to ensure geopolitical dominance by entrenching American advantage in the technologies that determine their economic and military standing, against a field of competitors, namely China as the principal one.

From Winning the Race: America’s AI Action Plan, Issued on 23 July 2025, the US outlines 103 recommended actions by three pillars:

• Pillar 1: Accelerate AI Innovation – removing “bureaucratic red tapes” which hinder technological advancement by deregulation
• Pillar 2: Build American AI Infrastructure – fostering an environment conducive to AI innovations
• Pillar 3: Lead in International AI Diplomacy and Security – Ensuring its global hegemonic position in AI technology

  As explicitly stated from the plan, their core interest is in winning the race and securing its geopolitical primacy relative to other competitors rather than enhancing its authority and capacity over its domestic digital governance. The Plan itself has no legal force, yet the actual implementation is played by executive orders and procurements.

US Infrastructure and Resources efforts for AI dominance

Supply Chain management and the Cloud

The United States aims to maintain its position in the international order, seeking to surpass and constrain rival powers. Technological dominance constitutes one of the principal means of pursuing this objective, and in recent years this pursuit has centred increasingly on artificial intelligence, a domain heavily dependent on underlying industrial capacity and resource access.

Cloud service dependency describes a form of structural power exercised not through territorial control but through infrastructural ownership. Because US firms hold roughly two-thirds of the EU cloud market, a majority of European data, public and private, resides within entities potentially subject to US jurisdiction, irrespective of the server's physical location. This constitutes strategic advantage precisely because it requires no conventional projection of power abroad: dominance is achieved by occupying the infrastructural layer itself, converting market position into jurisdictional reach and, in turn, translating informational access into epistemic and strategic advantage. The CLOUD Act grants the United States access to foreign data provided this is held by a US cloud service provider, access guaranteed only through a defined legal process, the issuance of a judicial warrant subject to probable cause. FISA Section 702, by contrast, authorises access to foreign data held in US clouds for intelligence purposes through compelled provider assistance, and in this instance no comparable judicial procedure is required by law. These divergent standards of authorisation, and the reach they enable, stand in direct tension with the protections EU law seeks to guarantee.

The United States nonetheless maintains mechanisms to protect itself from equivalent foreign control over its own data, an arrangement not without irony. Through these safeguards, the United States continues to consolidate a form of dominance that might properly be termed digital sovereignty, in that it is the party setting the terms of engagement, monitoring others' data while shielding its own from comparable scrutiny.

FedRAMP establishes the conditions under which any cloud provider, including foreign entities, may process US federal government data, asserting sovereign gatekeeping over access to its own infrastructure even as it resists equivalent constraints abroad. Executive Order 14117 and the accompanying DOJ rule (2025), although criticised for their generalistic scope, restrict the outbound transfer of bulk sensitive data to designated "countries of concern." The asymmetry is instructive when set against the EU's broadly equivalent instruments: both regimes exercise control, but over opposite targets, the United States restricts flows to named adversaries, while the EU restricts flows to any third country whose legal framework it deems inadequate, a criterion of general application rather than one confined to a defined list of hostile states.

This divergence reflects an underlying clash in normative orientation toward data access and privacy. The EU's position is further constrained by a material deficit, limited infrastructural capacity, financial resources, and jurisdictional reach, which restricts both its regulatory leverage and its practical ability to access data absent the underlying infrastructure to do so. The EU's principal instrument of power has consequently been regulatory rather than infrastructural, expressed through the GDPR (Art. 48) and the Data Act, mechanisms of constraint and protection rather than instruments of reach comparable to the CLOUD Act or FISA. The two approaches are not, however, commensurable variations on a shared objective; their objectives differ in kind. This difference in objective is the decisive variable, since it derives from divergent conceptions of human rights, data protection and privacy, as much as from an underlying asymmetry in capability. Because the United States can, in practice, circumvent the normative safeguards the EU has imposed upon itself and sought to extend to others, and because it already possesses the infrastructural capacity the EU lacks (only 13 to 15 percent of the market is EU-owned), it approaches, in substance, the condition of cloud sovereignty that the EU has named as an aspiration but has not yet achieved. Aware of the risks this dependency poses, both to data access and to the strategic advantage it affords the United States, the EU has sought to reduce it through a succession of initiatives. EUCS was one such attempt, and remains only a non-legally-binding standard, stalled, per the EUISS, by Member States divided over their reliance on US providers; whether the Cloud and AI Development Act fares better remains to be seen.

== Supply Chain Management and Rare Earth Minerals ==

The United States' pursuit of AI dominance rests on a chain of physical dependencies: AI systems require advanced semiconductors, semiconductors require rare earth elements and critical minerals, particularly the neodymium, dysprosium, and gadolinium used in the magnets and components of chip fabrication and data-centre hardware, and the United States currently remains reliant on processing capacity concentrated in China. Where the CHIPS and Science Act addresses the fabrication layer, a separate and more fragmented body of law addresses the mineral layer beneath it. Unlike the EU's Critical Raw Materials Act, the American framework layers a foundational statute, an executive order, and a narrower defense-procurement statute.

Energy Act of 2020

Section 7002 of the Energy Act of 2020 (codified at 30 U.S.C. §1606) supplies the foundational definitions. It defines a "critical mineral" through a delegated standard: a "byproduct" is a critical mineral whose recovery depends on the production of a host mineral not itself designated critical, while a "critical material" is any non-fuel mineral, element, substance, or material the Secretary of Energy determines carries a high risk of supply-chain disruption. This is primarily an administrative and classificatory act: it does not itself compel production, but it creates the taxonomy (which of the 17 rare earth elements are legally "critical") on which subsequent executive and procurement action depends.

Executive Order 14241 (2025)

Executive Order 14241, entitled "Immediate Measures to Increase American Mineral Production," signed March 20, 2025, operationalizes that taxonomy. Its Section 1 purpose clause is unusually candid about the framing: national and economic security are now threatened by dependence on hostile foreign powers. Operationally, Section 3 directs every federal agency involved in permitting to submit to the National Energy Dominance Council a list of all mineral production projects for which a plan of operations or permit application has been submitted, after which agency heads must identify projects that can be immediately approved and expedite them. The Order invokes Title III of the Defense Production Act to mobilize financing, and tasks the NEDC, chaired by the Secretary of the Interior, with coordinating implementation across Defense, Energy, Interior, and Agriculture. Unlike the CHIPS Act, it required no congressional appropriation, and unlike the Energy Act, it does not merely classify inputs but seeks to physically build an alternative domestic supply chain, the mining-and-processing analogue to the CRMA's "strategic projects" mechanism. Executive Order 14241 has since been diluted by Executive Order 14261, which extends designation of criticality to sectorally unrelated materials such as coal.

10 U.S.C. §4872 and the DFARS

The narrowest instrument is 10 U.S.C. §4872, which provides that the Secretary of Defense may not procure any covered material melted or produced in any covered nation, or any end item containing such material. “Covered nations" are defined as North Korea, China, Russia, and Iran, covered materials include samarium-cobalt and neodymium-iron-boron magnets. Implemented through DFARS 225.7018-2, the clause currently bars acquisition of any covered material melted or produced in any covered country, tightening in 2027 to cover the entire chain. This statute does not build supply; it leverages the federal government's own purchasing power to exclude adversary-sourced inputs from the defense industrial base, a tool with no direct EU parallel, since the CRMA's diversification targets operate through incentive rather than exclusion.