Who controls data controls the future

# Who controls data controls the future

Governments have treated data and compute as commercial matters for most of the last decade. Privacy and marginal regulation were the main levers. That approach no longer matches how these technologies operate in finance, defense, health care, and public administration. These systems run on two resources many states do not control: the training data and the processing power that produce outcomes.

Many countries are reacting. Global spending on sovereign compute is large, with national compute funds and GPU allocations emerging in places like Canada, France, Saudi Arabia, and the United Arab Emirates. The European Union has backed projects to build European data infrastructure, including support for Gaia-X and investments around regional data centers.

These moves look like sensible diversification, but they carry a downside. If every country builds an isolated fortress of compute and data, the result could be a brittle patchwork with poor interoperability. That outcome would make it harder for systems to verify compliance across borders and for smaller countries to access advanced compute capacity.

Sovereignty has three components that require coordinated policy:

• Data residency: laws that keep citizens' data within national borders. This is the best-understood and easiest to legislate.
• Compute sovereignty: ownership and control of chips and data centers that process data. A nation can keep data in-country but lose control when processing happens on foreign-owned infrastructure.

Fragmented regulation encourages jurisdictions to compete on permissiveness. Companies already shop for favorable rules when deploying high-risk systems. That dynamic can produce a "race to the bottom" unless oversight mechanisms gain real force.

The author lays out four practical requirements for effective sovereignty:

• Treat data infrastructure like power grids: assign clear responsibility for physical and digital security.
• Build shared interoperability standards: enable verification and portability so a hospital in Lagos or a ministry in Warsaw can confirm baseline safety regardless of infrastructure owner. Gaia-X's work on data portability offers a template.
• Give oversight teeth: mandatory audits, incident reporting, and licensing for frontier models that could affect critical infrastructure or financial stability. These models should face stricter controls than ordinary software.
• Prevent inequality in access: most sovereign compute investment is concentrated in wealthy countries. Pooled regional compute, jointly financed and governed by smaller states, can be more effective than isolated national efforts.

A grand global treaty is not required. Existing elements—regional laws, multi-country projects, and international panels—can be connected into workable scaffolding. The cost of delay grows each year as more capital flows into fixed infrastructure that is harder to reconfigure.

Practical policy choices now will influence whether national futures are decided in democratic institutions or in corporate boardrooms that set de facto rules by virtue of owning data and compute.