Airbus's AI Sovereignty Move Shows What CIOs Must Map

In the spring of 2025, Karim Khan lost access to his work email. He was the chief prosecutor of the International Criminal Court, a court in the Netherlands that tries war crimes cases. Like millions of organizations, the court used Microsoft for email. 

In February 2025, the U.S. government sanctioned Khan. A few months later, the Associated Press reported that Microsoft had cancelled his email account, and that he switched to a Swiss email service. Microsoft denied this, but the cautionary tale still stands: a decision made in the U.S. can legally cut off access to a tool in Europe because an American company supplied that tool. 

For any company that runs AI, this is the core question of AI governance and AI sovereignty: who really controls the tools you depend on?

The court took the warning seriously. In October 2025, it began replacing Microsoft Office with openDesk, a German alternative. On October 9, 2026, the United States sanctioned the entire court, cutting it off from tools made by American companies.

Your company isn't a war crimes court, but it probably runs its AI the same way the court ran its email: using software owned by companies from another country and subject to that country's laws. If that government changes its rules, your data can be demanded, your systems can be shut off, and the AI models you rely on can be restricted.

This article shows where the world's AI actually runs, the three ways that can hurt your business, and how France's national health data platform, Airbus, and BNP Paribas each dealt with one of those issues.

Where Does the World's AI Actually Run?

AI sovereignty picks up where AI vendor management strategy leaves off. AI runs in data centers, which are large buildings packed with computers. The biggest ones, called hyperscale data centers, belong to giant cloud and internet companies. They cluster in a small number of places, and that matters for AI sovereignty.

Just 20 regions hold 60% of the world's hyperscale data center capacity, according to Synergy Research Group. Fifteen of those 20 are in the United States. Only one is in Europe. Northern Virginia and the area around Beijing hold 17% of the world's total between them.

‍

‍

Ownership is concentrated too. Amazon, Microsoft, and Google control 57% of that capacity, and 62% of all hyperscale operators are based in the United States.

That means a European bank, an Asian manufacturer, or a Canadian hospital using AI is very likely running it on computers owned by a U.S. company. Some of those computers may sit inside the customer's own country, but under the U.S. CLOUD Act, American authorities can require U.S. companies to hand over data they control, even when that data is stored abroad. That is why data sovereignty, strategically considering which laws apply to your data, has become a board-level issue.

Companies are starting to respond, and Gartner has a name for the trend: geopatriation, which means moving data and applications out of global clouds and into local ones because of political risk. And while fewer than 5% of European and Middle Eastern enterprises did this in 2025, Gartner predicts more than 75% will by 2030. Spending is increasing in parallel with geopatration: Gartner expects sovereign cloud spending to reach $80 billion in 2026, up 35.6% from 2025.

"Shifting workloads to providers with an increased sovereignty posture can help CIOs gain more control over data residency, compliance and governance."

—Gene Alvarez, Distinguished VP Analyst, Gartner

What Is a Digital Embassy?

In 2017, Estonia signed an agreement to store its key government data in a secure facility in Luxembourg. The data sits in Luxembourg, but Estonian law governs it. The World Economic Forum calls this kind of setup a digital embassy, a way to protect AI sovereignty across borders. In May 2026, it published an AI sovereignty framework to help countries build them with clear legal and technical protections.

‍

‍

The idea is now spreading to businesses. Saudi Arabia's draft Global AI Hub Law describes "extended hubs" where companies and their users can run AI work under their home country's laws. Bahrain already lets some data in its cloud centers stay under Swiss law.

Enterprise leaders do not need a treaty to use this idea. Every company can decide which data and AI must stay under home-country control, which can sit with a trusted partner, and which can run anywhere. Most companies never make that choice intentionally; they pick where their AI runs based on price and speed. But companies that understand the importance of AI sovereignty sort their data and AI models by sensitivity, then decide where each one lives before signing contracts. In many cases, backing out after the fact can take years.

The Three AI Sovereignty Problems Enterprises Face

Where your AI runs creates three separate AI sovereignty risks. Each one has a different cause, and each one needs a different fix.

1. Legal Reach: A foreign government's laws can reach your data even when it is stored in your own country. This happens when your cloud provider is based abroad. Keeping data on local servers doesn't fix this on its own.

2. The “Kill Switch” Problem: Your most important systems could stop working if a foreign government or a provider cuts off access. This is what the ICC faced with its email. The question here is whether your business can keep running.

3. Single Model Risks: Your AI tools may depend on one outside company's models. But if that company changes its prices or terms, or if its home government restricts it, your AI tools are stuck. Dependence on foreign models can build up fast. Chinese open models made up as much as 30% of all AI usage in some weeks of 2025, according to research from a16z and OpenRouter.

The three case studies below show one organization working through one of these problems.

France Brings Patient Data Home

France's health data platform shows the cost of weak data sovereignty. It launched its Health Data Hub in 2019 to give researchers, including those building AI tools, access to national health data. The platform chose Microsoft Azure as its host.

That choice caused trouble almost right away. Microsoft is a U.S. company, so U.S. law could reach the data even though it was stored in France. Privacy groups and regulators pushed back for years. In 2024, France passed a law requiring sovereign hosting for sensitive data like this.

In April 2026, the platform chose Scaleway, a French cloud provider, as its new host. A copy of the main national health database is set to move between late 2026 and early 2027. The platform's 150 research projects will begin moving in 2027, and a few complex projects will stay on Azure longer.

This is both a solution and a cautionary tale. The platform says it planned for a possible exit from the start. Even so, the full move will take about eight years from launch. For most of that time, health records covering tens of millions of French citizens stayed within reach of a foreign legal system.

The AI governance lesson is simple. Before any sensitive data moves, ask where your provider is based as well as where your servers sit. Fixing this issue after launch is slow and expensive.

Airbus Avoids the “Kill Switch” and Keeps Planes Flying

Airbus treated sovereign AI as a question of staying in business. It started with a hard question: which applications does the company need to keep running no matter what? Airbus calls this its "minimum viable company." It covers about 900 applications, spanning aircraft design, engineering, factory production, and day-to-day business operations.

Airbus needed to move many of these systems to the cloud. Software makers like SAP now release new features only in the cloud, so staying on its own servers meant falling behind. But moving to a U.S. cloud created a new risk. The industry calls it a kill switch: the power to shut off a service from outside the company. If Washington ordered American providers to stop serving a customer, as it later did with the ICC, those providers would have to comply. For Airbus, that could mean losing access to its aircraft designs and its factory systems overnight. Production lines would stop.

In December 2025, Airbus said it would look for a European cloud provider for these systems. Catherine Jestin, Airbus's executive vice president of digital, was candid about the odds. She put the chance of finding a provider that met Airbus's needs at only 80%.

In July 2026, Airbus chose Scaleway after checking providers against more than 150 technical and legal requirements. Airbus has not disclosed the contract's value, but press reports put it at more than €50 million over up to 10 years. About 70 critical applications will move by the end of 2028. The full program could cover up to 900 applications over the next five to six years. Airbus also plans to run AI tools built with French AI company Mistral on the same platform.

"The second set of criteria concerned legal requirements, in particular the much-discussed protection against the kill switch and against the application of extraterritorial laws."

—Catherine Jestin, Executive Vice President Digital, Airbus

It’s important to note that Airbus did not completely cut ties with U.S. providers. It will keep working with AWS and other American software companies for less sensitive work.

Airbus judged legal protection as seriously as price and performance. It also sorted its systems by importance first. That sorting made the move manageable, because only the systems that truly needed protection had to change hosts.

BNP Paribas Builds a Multi-Model Bank

BNP Paribas operates in 64 countries and handles large amounts of sensitive customer data. It needed AI that could work with that data without locking the bank into one model provider. For BNP Paribas, AI sovereignty means being able to switch models.

The bank built its own internal AI platform. In May 2026, it renewed a three-year partnership with Mistral, a French AI company. The deal is part of a broader plan: BNP Paribas uses several models and chooses based on performance, data sensitivity, and data location.

For the most sensitive work, such as verifying new customers' identities, the bank is building AI that runs on its own computers. On the customer side, the latest version of Hello bank!'s virtual assistant uses Mistral's models and has reached more than one million clients since January 2026.

"Financial services operate in highly complex, data-intensive environments, where timely access to the right information is essential." 

—Olivier Osty, Deputy Chief Operating Officer, BNP Paribas, and Chief Executive Officer, Corporate and Institutional Banking

BNP Paribas has not published hard numbers on time or money saved. It says the main benefits so far are time saved by employees and more reliable answers to complex questions.

The lesson is that model choice should follow data sensitivity. A bank that can swap models without rebuilding its tools has an exit if any one provider becomes a risk.

How to Draw Your Own Digital Embassy Map

The International Criminal Court changed its tools after a disruption. Now the whole court is under U.S. sanctions, and U.S. companies have about six months to wind down their business with it. Your company can act before something like this happens.

AI sovereignty starts with knowing what you have. Sort every AI system and dataset into three groups. Keep the first group under your home country's laws and with providers you trust. This group includes things like patient records, product designs, and customer identity checks. The second group can sit with a trusted partner if strong legal and technical protections are in place. The third group can run anywhere.

Then take three questions to your next leadership meeting: 

1. Which countries' laws can reach our most sensitive data? 
2. If one provider cut us off tomorrow, which systems would stop? 
3. How many of our AI tools depend on a single model company?

Your answers will show where your AI sovereignty is strong and where it is exposed. The Health Data Hub, Airbus, and BNP Paribas each found their answers. The ICC found its answer the hard way.