Digital sovereignty: not a slogan, an architecture

Where the method becomes real. The infrastructure that holds the project up in production.

(Article X of the series. The previous one built the method. This one builds what lies beneath it.)

Article IX closed with a door left open. Discerning the regimes, seeing where they collide, mapping the deliverables, turning them into an estimated plan: all of this tells you what must be true for an AI system to hold up on the day it is challenged. But a gap analysis, however precise, is paper. It says what is missing. It does not build it.

The real work starts afterwards: making that "what must be true" true, and keeping it true for ten years, in production, while the system runs and processes the data of real people. This is no longer a problem of method. It is a problem of infrastructure.

And this is where an overused word — sovereignty — stops being a conference slogan and becomes a list of precise architectural requirements. It is a word I have heard used in recent months to sell anything: a model with the Italian flag on it, a datacentre with the right address, a declared compliance. Almost always it means just one of the things it should mean, and passes itself off as all three.

The three sovereignties almost nobody distinguishes

When a regulated company says "I want sovereign AI", it is actually asking for three different things, which must be kept separate because they are achieved in different ways.

Residency. The data is physically stored in the European Union. It is the most quoted level and the easiest to reach: a European datacentre is enough. It is necessary. It is not sufficient, and confusing it with sovereignty is the most common mistake.

Jurisdiction. Who can legally force you to open up that data. A non-EU-owned cloud with datacentres in Europe is resident in the EU but subject to the jurisdiction of the parent company's country: a foreign law can compel access to data that physically sits in Frankfurt. Residency without sovereignty. It is the difference the server's postcode does not tell you.

Continuity. Can someone, from outside, switch it off? Three weeks ago we saw it in almost textbook form: a government had a frontier model switched off within hours, for every customer worldwide, cutting off not only adversaries but its closest allies. No shared rules, no notice. If your critical function rests on something a foreign decree can deactivate overnight, you do not control that function: you use it for as long as you are allowed to.

Real sovereignty means all three together. And for the critical functions of a regulated company, only one architecture guarantees all three: the one that lives inside the perimeter you control, not in a perimeter that is rented to you and that someone else can close.

What goes wrong when even one is missing

This is not theory. Take the most common and apparently harmless case: a lawyer, or a doctor, who subscribes to a top-tier consumer AI tool — Claude Max, or whatever the equivalent of the moment is — and works with it. They upload a client's case files to get a summary of the case. They paste in a patient's medical record to get a second opinion. Convenient, powerful, cheap. And a disaster on all three levels, in one stroke.

Residency and control. Since September 2025, the consumer accounts of these services — the personal tiers, including paid ones — as a rule process data under terms that allow it to be retained, and in some cases used to improve the models, unless the user actively opts out, with retention windows of up to five years. The professional almost never knows this. That health data, that defence strategy, leave their control and end up in a system whose retention and usage rules they have not negotiated, and which can change with an update to the terms.

Jurisdiction. That data runs on infrastructure under foreign jurisdiction. A law of that country can compel access to it, and Italian professional secrecy — which for doctors and lawyers is not good practice but a criminal-law obligation (Art. 622 of the Italian Criminal Code, which punishes the disclosure of professional secrets) — does not stop at the right border. The professional has just exported their client's secret into a jurisdiction that is not theirs, without anyone asking them to.

Continuity. Tomorrow that service can be suspended, restricted, or made unavailable in their country — we have seen it happen within hours. The professional who built their workflow on top of it finds themselves without it, with matters half-finished inside a system they do not control.

The point is not "that model is bad": the model may well be excellent. The point is that it is the wrong tool for that data, because the architecture around it — consumer-grade, in the cloud, under someone else's jurisdiction — offers none of the three sovereignties. And the professional who used it carries the GDPR (health data, a special category), professional secrecy, and liability under their professional code of conduct. Three signatures on three exposures, for a subscription of a few tens of euros a month. This is what not having a sovereign infrastructure means in concrete terms: not an abstract conference risk, but a lawyer who has put their client's case files in the wrong place.

And this is the small case: a professional who makes a mistake through carelessness. The same defect, on a larger scale, stops being an oversight and becomes a business model.

A generation of strategic advisory platforms for business decision-makers is emerging: you upload financial statements, contracts, organisation charts, and the AI gives you back a "reading" on high-impact decisions, citing laws and court rulings. Built, almost always, on cloud models under foreign jurisdiction. Here the failure of the three sovereignties is not a user accident: it is designed into the product.

Two examples of why. First: they invite you to upload organisation charts and contracts — documents full of the personal data of third parties (employees, counterparties) who have never given consent or received a privacy notice. That data leaves the perimeter, ends up on foreign infrastructure, and the obligation towards those third parties is practically impossible to fulfil by design: it is not a forgotten obligation, it is the flow itself that makes it impossible. Second: many of these platforms promise "the decision you cannot get wrong" on choices they themselves describe as high-downside and low-reversibility — only to disclaim all liability in a buried disclaimer. But the maximal promise and the full exemption are the two blades of the same pair of scissors: and in between, from 9 December, there is product liability, which an erroneous output causing damage triggers regardless of the disclaimer.

From the careless professional to the platform that industrialises the same mistake, the defect is identical and always has the same shape: other people's data, outside the perimeter, under a jurisdiction that is not yours, on a system you do not control, with a liability that remains yours. It is exactly what a sovereign infrastructure exists to prevent.

What a sovereign infrastructure has to do

Before any technology, the requirements. An infrastructure that holds up the project of Article IX — in healthcare, in finance, in regulated dropshipping — must do five things, and they are the same five this whole series has circled around.

Keep the data where it belongs. Not just residency: jurisdiction. The data of the patient, the client, the fund must not be reachable by a law that is not yours.

Make every decision reconstructable. The audit trail not as an add-on feature, but as a native property: what the system decided, on which data, with which version, when, and who approved it. What you cannot reconstruct, you cannot defend — and from 9 December, with product liability, the indefensible becomes exposure.

Run under your control. No external switch on critical functions. Continuity is not uptime guaranteed by a contract: it is not depending, for what you cannot afford to lose, on a party that can disappear or be forced to disappear.

Orchestrate the best models without depending on them irreplaceably. Here lies the nuance that separates sovereignty from autarky. Sovereignty is not "do not use foreign models" — that would mean giving up the state of the art. It is not being irreplaceably dependent on any of them: being able to change them, run them side by side, replace them, without the system collapsing. The difference between using a tool and being held hostage by it.

Keep the human in the loop, and the chain of responsibility intact. Whoever signs remains a person, not an anonymous process. The infrastructure must make that signature possible and traceable, not dissolve it into automation.

Five requirements. None of them talks about which model you use, or how powerful it is. They talk about where, how, under whom. It is the level that matters — and almost nobody guards it, because it is less spectacular than a benchmark.

Nexus: the infrastructure I built on these requirements

I gave these five requirements a built answer, not a theoretical one. It is called Nexus MDS Core, and it is the sovereign AI platform I use to take the projects this series talks about into production: 27 containerised services on Docker (count as of October 2026), moving to Kubernetes when scale requires it, inside the client's perimeter. Already in production, since before sovereignty became a conference topic.

I describe it by what it does, not by its technical bill of materials — because the point is not "look what software I have", it is "look which requirements it meets".

Nexus lives inside the client's perimeter, containerised. Indexing, retrieval, identity and audit stay within the perimeter; generation runs on a local model or on a replaceable EU endpoint, chosen for each workload — residency and jurisdiction are decided in the architecture, not only in the contract. It orchestrates agents, RAG and models under the client's control, able to run them side by side and replace them, so that none of them becomes the single point of failure. It keeps security and traceability as native properties — Zero-Trust access, every decision of the system reconstructable and attributable. And it designs continuity into the architecture: the only external dependency, the generation endpoint, is replaceable, and the fallback to a local model can bring that step in-house too.

One thing Nexus is not, and it is important to say so: it is not a model. It does not compete with the big frontier LLMs, it does not want to, and be wary of anyone who sells sovereignty by promising you a model of "our own" that competes with the best — that is exactly the misunderstanding that has made the market laugh in recent weeks. Sovereignty is not a model with a flag. It is the layer that makes models — the best ones, whichever they are — usable in a sovereign, traceable, defensible way. It is the architecture around, not the engine inside.

The proof: that it actually runs

An infrastructure described on a slide is worth as much as a gap analysis on paper: nothing, until it is in production. Nexus is.

The first implementation I can talk about publicly is the one for Federfarma Lombarda: a RAG pipeline over more than ten thousand regulatory documents, serving more than a thousand pharmacies, on Nexus MDS Core — local retrieval, personal data excluded already at ingestion, final generation on a replaceable EU endpoint, Zero-Trust access, a dedicated interface. In a context where data and its governance are not a detail but the heart of the problem. Not a proof of concept in a lab: a system that works, on real numbers. The other implementations — healthcare, energy, enterprise — remain confidential, as is right for the clients who commissioned them. But the difference between "I have an infrastructure" and "I have an infrastructure that holds up in production, in a regulated sector, across a thousand pharmacies" is exactly this.

Two halves of the same work

At this point the two pieces of the series close on each other.

The Compliance-Epistemic Project Framework (CEPF) — Article IX — tells you what must be true: which of the regimes apply to you, which deliverables you are missing, in what order, with what effort, and who signs. It is the map, and it is the method.

Nexus — this article — is where that truth happens and stays true: the infrastructure in which the deliverables stop being items in a plan and become properties of a running system, for the ten years in which liability lives.

One without the other is not enough. A perfect method on an infrastructure that lets the data out is a defence that is well written and never executed. A solid infrastructure without the method that tells it what it must guarantee is a bunker built in the wrong place. Together — the map and the territory, the what and the where — they are how a regulated company stops being on the receiving end of AI and starts governing it.

The difference, in one line

This series started from a frightened question — "E mò?", "And now what?" — from people suddenly discovering what changes from 9 December. It went through the method: what to do on Monday morning. And it ends here, underneath, where words become architecture.

Because in the end digital sovereignty is not a flag on a model, nor a datacentre's postcode, nor a compliance declared on a slide. It is one thing, and verifiable: the data stays where it must, every decision is reconstructable, and the switch is yours. Everything else is someone else deciding in your place — and letting you believe it is sovereignty.

Note. The PLD 2024 has not yet been transposed in Italy (deadline: 9 December 2026): I am describing the structure of risk that the rules lay out, not existing case law. The data-processing conditions of the consumer AI tools mentioned are based on the terms and privacy notices published by the providers (2025 updates) and may vary by plan and configuration: they must be checked case by case. Nexus is described at architectural level, by the requirements it meets; I am not a lawyer — I bring the architecture of the problem, and qualifying the specific case is a job for a lawyer. The implementation mentioned is reported within the limits of the authorisation received to make it public.

If the question "where does my data live, who can switch off what I rely on, who answers when it gets things wrong" does not yet have an answer in your organisation, that is where the work starts. Write to me.

The complete path: from diagnosis to solution

This article closes a line of reasoning that began months ago. For anyone arriving now, or wanting to reread the whole thread — from the diagnosis of the risk to the method, all the way to the infrastructure (the original articles are in Italian, on LinkedIn):

• I–VII · The diagnosis — what changes with the PLD 2024, the AI Act and the GDPR, and why the regimes add up instead of excluding each other: 1. https://www.linkedin.com/pulse/pld-2024-i-sette-cambi-strutturali-che-ridefiniscono-il-patierno-avhrf 2. https://www.linkedin.com/pulse/pld-2024-i-5-1-scenari-di-sviluppo-software-e-le-che-per-patierno-ffvue 3. https://www.linkedin.com/pulse/pld-2024-il-decennio-che-cambia-tutto-responsabilit%C3%A0-della-patierno-mwe1f 4. https://www.linkedin.com/pulse/pld-2024-vulnerability-management-e-gestione-cve-corrado-patierno-gipff 5. https://www.linkedin.com/pulse/la-fuga-giurisdizionale-e-perch%C3%A9-non-esiste-corrado-patierno-vmlnf 6. https://www.linkedin.com/pulse/contratti-e-polizza-nel-regime-pld-2024-venti-tre-una-patierno-pucxf 7. https://www.linkedin.com/pulse/laltra-met%C3%A0-del-problema-corrado-patierno-whmnf
• VIII · "E mò?" ("And now what?") — from awareness of the risk to the operational question: 8. https://www.linkedin.com/pulse/e-m%C3%B2-corrado-patierno-9fmof
• IX · What to do on Monday morning — the method: discern, see the collisions, build a defensible project. Where CEPF comes from: 9. https://www.linkedin.com/pulse/cosa-faccio-luned%C3%AC-mattina-corrado-patierno-arx1e
• X · Digital sovereignty: not a slogan, an architecture — the infrastructure that makes the method real, in production (this article)

The diagnosis frightens, the method orients, the infrastructure holds. The point was never to alarm: it was to get here.