The AI Age Needs A New Definition Of Sovereignty – OpEd

Key Takeaways:

• The author redefines sovereignty for machine decision systems: not only borders and force, but whether a state can keep deciding when software, models, and updates live under a foreign vendor and that vendor’s law—possession vs. permission (ICC’s 2025 turn toward Germany’s openDesk; China’s July 2025 Nvidia H20 questions; a June 2026 U.S. export control that blanked two frontier models worldwide for 19 days).
• Autarky is rejected. Five retained capabilities: continue if the license heartbeat dies; constrain with a national authority envelope; inspect remote channels without seizing every secret; revoke machine authority faster than the vendor can; recover via portability, fallbacks, and rehearsed migration.
• Those become procurement and alliance specs—offline grace, audit rights, notice of changes—so partners are not operationally disarmed by another capital’s legal switch. Formal flags without that layer are “sovereignty on paper.”

Sovereignty is coming to include the ability to continue, constrain, inspect, revoke and recover essential machine decision systems without depending on a foreign vendor’s continuing permission.

For most of the modern era, sovereignty was a question of borders, currency and the monopoly on force. A state was sovereign if it could decide within its territory and defend that territory against others. The definition served well because the instruments of state power were physical and, in the last resort, national. A government might buy its rifles abroad, but once delivered the rifles belonged to it.

Machine decision systems have broken that assumption. A modern state now runs essential functions through software it does not own, on models it cannot inspect, under licenses it cannot enforce, and with updates it cannot refuse. Border control, hospital triage, tax processing, power dispatch, air traffic, targeting support and financial supervision are increasingly executed or advised by systems whose behavior is fixed somewhere else and can be changed from somewhere else.

The rifles now come with a subscription, and the subscription can be canceled

States have always relied on outside suppliers. The difference is that a physical asset normally remains where it was delivered while a digital capability can be altered, restricted or withdrawn after adoption, sometimes instantly and at scale.

The question a modern definition of sovereignty has to absorb is therefore no longer only whether a state can decide. It is whether a state can keep deciding when a foreign vendor, or the vendor’s home government, decides otherwise.

Three episodes from the past eighteen months show the shape of the problem, and none required hostility.

In 2025 the chief prosecutor of the International Criminal Court reportedly lost access to his Microsoft email after Washington sanctioned him. Microsoft has denied that it suspended services to the court, and the exact sequence remains disputed. That dispute matters and should not be collapsed into a cleaner story than the evidence supports.

What is not disputed is what the court did next. In October 2025 it decided to migrate its office software to openDesk, an open-source suite developed by a German government agency created for digital sovereignty. The important fact is not whether one specific mailbox was switched off. It is that an international institution headquartered in the Netherlands concluded that a critical administrative function should not rest on infrastructure whose availability could become entangled with the policy of another capital.

The second episode came from the other side of the geopolitical divide. In July 2025 China’s cyberspace regulator summoned Nvidia to explain whether its H20 chips could be tracked or shut down remotely. Nvidia said its chips carry no backdoors. Beijing’s suspicion was not proof of a hidden control mechanism.

But the question China asked was prompted by something real: legislation proposed in the United States Congress that would require location verification and security mechanisms in exported advanced chips. The concern was not that the hardware might perform badly. It was that hardware purchased as a national capability might retain a control relationship with someone outside the country that bought it.

That is a sovereignty question even when Beijing asks it.

The third episode was revealing because the vendor did what a law-abiding company is supposed to do. In June 2026 the U.S. Commerce Department placed export controls on two frontier AI models, and their developer disabled them for users worldwide because it could not verify user nationality in real time.

Access was restored on July 1, after nineteen days. The security concern was directed at restricted access, not at allied governments, universities or companies. Yet those users lost the models too. The developer complied fully and immediately with its own government, as it had to. A subsequent CSIS analysis examined the breadth and consequences of the restriction. The disruption was not evidence of corporate malice or allied unreliability. It was evidence of architecture: the supplier possessed a control lever over a capability that customers had integrated into their own operations.

Read together, the three cases have a common structure. In each, a state or institution confronted the possibility that a capability it treated as its own was actually a permission. The permission was granted by a vendor, the vendor was subject to a foreign jurisdiction, and the permission could be withdrawn, altered or conditioned without the user’s consent.

That distinction, between possession and permission, is becoming central to sovereignty in the AI age.

The wrong response would be technological autarky. No serious state can reproduce every frontier model, accelerator, cloud platform, software library, chipmaking tool and data center domestically. A sovereignty doctrine that requires self-sufficiency would make most countries poorer, slower and less capable.

The better approach is to define sovereignty in terms of capabilities a state retains over the systems it depends on, whoever built them.

Five matters most

The first is the ability to continue.

A system that stops when a license server abroad stops responding, when a vendor changes an access policy, or when a sanctions list changes is not a fully sovereign capability if the function it performs is essential to government. Continuity means the state should have enough operational independence to decide what happens next rather than having that decision made for it by an outage, contract change or foreign legal order.

For some systems that may mean local execution. For others it may mean an offline grace period, a degraded but safe mode, or a fallback process that preserves the essential function. The design question is simple: if the external heartbeat disappears tonight, does the state still have a tomorrow morning?

The second is the ability to constrain.

A state should be able to bound what a machine decision system may do inside its territory and institutions independently of the vendor’s own guardrails. A foreign developer is entitled to define the conditions under which it supplies a product. But a government relying on that product in hospitals, courts, police, energy systems or armed forces needs an enforceable national authority envelope sitting outside the vendor’s preferences.

That envelope should specify what the system may access, which actions it may take, what decisions require human authorization and which conditions force it to abstain. National law cannot be sovereign if the decisive technical permissions are controlled somewhere else.

The third is the ability to inspect.

Beijing’s question to Nvidia was blunt, but the right to ask it was legitimate. A state should be able to establish, with evidence it can examine, what an essential system does, what information it transmits, what remote management channels exist and whether declared behavior matches observed behavior.

Inspection does not require a government to seize trade secrets or demand source code for every product. It does require meaningful verification. A state forbidden to test whether a critical system contains an undeclared external dependency is being asked to substitute trust for governance. That may be acceptable for an office convenience. It is harder to defend for infrastructure, defense, intelligence or public administration.

The fourth is the ability to revoke.

Sovereignty requires attention to both directions of revocation. A state must be able to withdraw a system’s authority over a national function quickly, cleanly and without asking the supplier for permission.

If a model behaves unexpectedly or a foreign update becomes unacceptable, the state should be able to remove credentials, isolate interfaces, stop remote management and return the affected function to another mode of control. In the June 2026 episode, the supplier’s side of revocation worked almost instantly. The sovereign design question is whether the customer’s side can work faster.

The fifth is the ability to recover.

Recovery is different from continuity. Continuity keeps the lights on during disruption. Recovery determines whether the dependency can actually be replaced.

When a system is withdrawn, degraded or found to be untrustworthy, a state should be able to restore the essential function on another basis within a time it has chosen in advance. That may require data portability, documented interfaces, trained personnel, an alternative supplier, local technical competence and rehearsed migration procedures. It is expensive, slow and unglamorous.

It is also the one capability that cannot be improvised when needed.

The International Criminal Court’s move toward openDesk illustrates the point. Whatever the precise facts of the Microsoft dispute, the court’s response was not merely to complain about dependency. It began changing the dependency.

That is what recovery looks like in practice.

None of these five capabilities is exotic. Each has a precedent in the way states already think about physical infrastructure.

A government would not knowingly allow a foreign contractor to hold the only key to a power station. It would not accept a bridge it was forbidden to inspect or a military communications system that could not be disconnected from an external administrator. Regulators expect fallback procedures and clear chains of authority where failure carries public consequences.

Machine decision systems have escaped comparable treatment not because the principles are obsolete, but because the technology arrived faster than the vocabulary for governing it.

Vocabulary matters because it changes procurement.

An official thinking only in terms of features asks whether a system is accurate, fast and inexpensive. An official thinking in terms of sovereignty asks additional questions. Will it continue if the supplier becomes unavailable? Can national authorities impose their own limits? Can they verify critical behavior? Can they remove the system’s authority immediately? Can the function be transferred elsewhere within an acceptable period?

Those are not speeches about strategic autonomy. They are procurement requirements.

Contracts for essential machine decision systems can specify offline operating periods, notice for material changes, audit and testing rights, control over remote-access pathways, portability of data and operational records, transition assistance and rehearsed fallback procedures. They can identify which dependencies are technically unavoidable and which exist merely because nobody required an alternative.

The point is not to make foreign suppliers powerless. It is to prevent the customer from becoming powerless.

The same logic should shape alliances. The countries exposed to the June 2026 model restriction were not necessarily adversaries of the United States. Some were partners that had adopted American systems in good faith and discovered that adoption was not the same as possession.

Alliances will increasingly share AI-enabled command tools, intelligence platforms, logistics systems and decision support. That integration is strategically valuable, but one member’s domestic legal decision can propagate through another member’s operational architecture faster than diplomacy can respond.

A resilient alliance should therefore care about the sovereignty of its partners, not merely the market share of its suppliers. Shared systems should be designed so allies can continue essential functions, impose lawful constraints, inspect what matters, revoke machine authority when necessary and recover from disruption.

That is not distrust among allies. It is how mature alliances make trust survivable when governments, laws and political priorities change.

The old definition of sovereignty asked whether a state could decide within its borders. The new one has to ask whether the state can keep deciding when the machines it depends on answer, technically or legally, to someone else.

This is not a decorative digital dimension of sovereignty. It is an operational layer that increasingly determines whether formal authority can be exercised at all.

A country can possess territory, currency, armed forces and internationally recognized legal authority while still discovering that an essential decision system cannot run without foreign permission, cannot be constrained by national rules, cannot be independently inspected, cannot be dismissed cleanly and cannot be replaced in time.

Formally, that country remains sovereign.

Operationally, it has outsourced part of the machinery through which sovereignty is exercised.

The AI age therefore needs a more demanding definition. Sovereignty is no longer only the right to decide. It is the retained capacity to continue, constrain, inspect, revoke and recover the machine systems through which decisions are increasingly made.

The decisive question is not who built the system. It is who can still say no when the system, the supplier or the supplier’s government says otherwise.