Why this year's disruptions are quietly redefining what it means to be in control
By Louize Clark · Oct 13, 2026
Ask most people what sovereignty means in a technology context and the answer comes back in terms of place and ownership. Where the data is held. Whose soil the data centre sits on. Which country's law the provider answers to. It's the definition behind the sovereign cloud offerings now arriving on the market, behind a good deal of procurement guidance, and behind much of the national conversation about compute and capability.
It's a reasonable definition, and I don't want to dismiss it. Where data lives and whose law applies to it genuinely matter, particularly for organisations handling anything sensitive, and a country that wants a say in its own future does need infrastructure it can rely on.
What that definition assumes, though, is that the main threat to control is somebody else owning the thing you depend on. This year has offered a run of reminders that control can be lost in quite different ways, and that owning something and being able to keep using it are not the same thing.
In June, a few days after it launched, one of the most capable AI models available anywhere was switched off. Nobody hacked it. The US Department of Commerce, citing national security, used export control powers to bar access by any foreign national, whether inside the United States or out, and the only way the provider could comply was to switch the model off for every customer. For eighteen days it simply wasn't there. Then the controls were lifted and it came back.
It would be easy to file that away as an American story, or an AI-industry story, or a one-off. But it's worth noticing what didn't matter. It didn't matter where a British organisation's data was stored, how sound its contract was, or how carefully it had chosen its supplier. The restriction followed the nationality of the people using the model, not the location of any server. Every test we usually apply to sovereignty would have been passed, and access would have gone anyway.
Then, in August, it emerged that a small British power plant had been knocked offline for four days earlier in the summer, by a cyberattack that reports linked to hackers affiliated with Iran. The government has been careful not to formally attribute it, and clear that the wider energy system was never at risk. But the plant was British, on British soil, run in Britain. Ownership and location were never in question. It stopped regardless, and it took four days of work by people who understood it to bring it back.
Over the same summer, a credential-harvesting campaign that researchers called FortiBleed turned out to have compromised tens of thousands of firewalls worldwide, with logins belonging to Foreign Office staff and local council workers here in the UK reportedly offered for sale on criminal forums. Who was behind it is still disputed. Fortinet's own position is that it wasn't a new flaw in its products at all, but weak passwords, which in some ways is the more unsettling explanation. The device organisations had installed to keep people out became the way in, and the reason had less to do with the technology than with how it had been looked after.
Three very different hands on three very different switches: an allied government acting entirely within its own law, a hostile state, a criminal market. Only one of them looks like what we'd normally call an attack. But they share a shape. In each case, something organisations depended on stopped, the decision about whether it stopped was made somewhere else, and the usual measures of sovereignty would have offered no protection at all.
So I think there's another question underneath the sovereignty conversation, and it isn't about who owns the switch. It's about what you can still do once it's been flipped.
Picture a small professional services firm, twenty or so people, arriving on a Monday morning to find that one of the tools it relies on has gone. It might be an outage, a supplier suspending an account, a regulator's decision made on another continent, or a breach three steps up a supply chain nobody has ever drawn. From inside the office, the cause barely matters.
In the first hour, the question is simply what has stopped. That sounds straightforward, and it rarely is, because most of what a business depends on was never formally chosen. It arrived through a platform update, or settled so deeply into a workflow that nobody thinks of it as a separate thing any more. Some firms will know within minutes. Others will spend the morning finding out, one stalled task at a time.
By the afternoon, the question becomes whether the work can carry on. That depends far less on whether a continuity plan exists than on whether anyone still remembers how the work was done before the tool arrived. The four days at that power plant weren't recovered by a document. They were recovered by people. And the knowledge a plan relies on has a habit of migrating, quietly, into the very tools the plan assumes might fail.
By the end of the week, if the tool still isn't back, the firm has to change how it works. This is where the questions from the last two papers in this series return. A team that has let a system do the checking for eighteen months still has the authority to check. Whether it still has the habit, the confidence and the time to do it under pressure is another matter.
And if, a month in, it becomes clear the tool isn't coming back, the firm has to move. In principle that's a procurement decision. In practice it means unpicking every workflow redesigned around the old system, every saved prompt, every automation, every habit. None of those was a bad decision when it was made. Each simply added a little to the cost of ever leaving, which is how freedom to move tends to go: a little at a time, while everyone is busy doing something sensible.
Understand what you depend on. Continue when it stops. Adapt how the work is done. Transition if you have to. Those four, in that order, are what I think sovereignty actually means for an organisation, and seen this way it stops being something only nations have. A ten-person accountancy practice has no data centre and never will. It still has a sovereignty position, whether or not anyone has ever asked it the question.
That matters, because sovereignty is now being sold. Some of what's on offer is genuinely valuable, and keeping sensitive workloads within UK jurisdiction is a reasonable choice for many organisations. Some of it is existing services with a new label, which analysts have already started calling sovereignty washing. But even the best of it can only deliver part of the picture. Infrastructure that is harder for someone else to switch off can be bought. Knowing what you depend on, keeping people who can work without it, and holding on to the freedom to move cannot. Those have to be built inside the organisation and kept up, which makes sovereignty less like something you own and more like something you practise.
None of this year's incidents is a reason for alarm. Eighteen days isn't long, the power plant was small, and the firewall campaign was, on Fortinet's account, preventable with ordinary password discipline. In every case the wider system held.
What stays with me is the timing of the AI suspension. The model had only been available for a few days, so hardly anyone had built anything around it, and when it vanished very little stopped. The next switch to be flipped may not be on something so new. It may be on something an organisation has spent years building its working day around, without anyone ever quite deciding that it should.
Sovereignty may begin with infrastructure. It's proved in the moment something stops.
So the question I'd leave with you isn't whether your organisation is sovereign. It's whether, if something you rely on stopped tomorrow, you'd know what had stopped, and who would still know how to carry on.
AI Policies UK helps organisations see the AI infrastructure they're already standing on, chosen, inherited and embedded, before decisions like this one have to be made under pressure. Get in touch: louize@aipolicies.uk