Glossary

Application-Specific Integrated Circuit: an integrated circuit designed for a specific function (networking, signal processing, AI acceleration, mining). It offers superior performance and energy efficiency compared to a general-purpose processor when performing that task, at the expense of flexibility and high design costs.

A model for the provision of IT resources (computing, storage, networking, software) on demand, shared and billed on a pay-as-you-go basis, and operated by a third party. Three levels: IaaS (raw infrastructure), PaaS (execution platform), SaaS (ready-to-use software). The higher up the levels you go, the more you delegate operational management, and the more access to your data you entrust to others.

The ability of an organisation or a state to maintain control over its data, data processing and technological dependencies, free from the constraints of foreign law and the risk of disruption imposed by a third party. It is not measured by a brand’s nationality, but by verifiable characteristics: applicable law, location, conditions of access and reversibility.

Domain Name System: a system that translates human-readable domain names (e.g. example.fr) into IP addresses. A hierarchical and distributed service in which certain components (root servers, top-level domain registries, resolvers) constitute critical dependencies and control points that are rarely monitored.

The application of a legal framework beyond national borders. The CLOUD Act (United States, 2018) authorises US authorities to require a service provider falling within their jurisdiction to disclose data in its possession, regardless of where it is stored. Direct consequence: locating one’s servers in Europe is not sufficient to protect against foreign access; it is the operator’s legal domicile that determines the outcome.

An integrated circuit manufacturing plant (foundry) that produces chips designed by third parties, in line with the fabless model. Cutting-edge capabilities are concentrated amongst a few players, foremost among them TSMC in Taiwan, making this a major source of strategic dependence.

General Data Protection Regulation (EU 2016/679), in force since 2018. It sets out the framework for the processing of personal data: legal basis, purpose, retention period, data subjects’ rights and the obligations of data controllers. It is a matter of individual rights, not industrial policy: it does not determine where data is hosted, nor who controls the technology.

Graphics Processing Unit (GPU): a massively parallel architecture that has become the standard hardware for training and inference of AI models. The high-end market is dominated by Nvidia, and access to large quantities of these chips is a prerequisite for cutting-edge research.

A very large-scale cloud operator, whose scope (number of services, capacity, global reach) exceeds that of regional players by one or more orders of magnitude. The term refers primarily to AWS, Microsoft Azure and Google Cloud. This should be distinguished from an integrated provider such as OVHcloud: despite the shared term ‘cloud’, they are not in the same line of business.

Infrastructure as a Service: on-demand provision of virtualised infrastructure resources (compute, storage, network). The provider manages the hardware and virtualisation; the customer manages the system, middleware and applications. This is the layer that delegates the least, and therefore leaves the most control.

The phase in which a trained model is used to generate an output from an input. Distinct from training, it represents an ongoing cost and raises issues of sovereignty when it is to be carried out within a given territory, under a given legal framework, on equipment under that jurisdiction’s control.

The ability of a third party (supplier, parent company, country of origin) to suspend, restrict or interrupt access to a service or technology, by virtue of a technical, commercial or regulatory decision. This is the blind spot in most analyses of sovereignty: a compliant contract does not prevent a service from being cut off if the technology and its operation remain under foreign control.

Extreme ultraviolet photolithography (wavelength of 13.5 nm), which is essential for etching the most advanced nodes. The equipment is produced by a single supplier, the Dutch company ASML, making it one of the most frequently cited bottlenecks in the silicon supply chain.

An AI model that was state-of-the-art at the time of its release, in terms of both its size and capabilities. Developing it is a major industrial undertaking: tens of thousands of GPUs, training campaigns lasting several months, computing costs running into the hundreds of millions, followed by continuous inference. Not all applications require this.

Network Time Protocol: a protocol for synchronising the clocks of networked systems. An invisible but critical building block on which authentication, certificate validity, log timestamps and transaction consistency all depend. Its reference time sources are few in number and form a control point that is rarely monitored.

Software whose source code is published under a licence that permits use, study, modification and redistribution. Openness reduces dependence on a single publisher and enables auditing. However, it is not in itself sufficient to ensure sovereignty: maintenance, project governance and the underlying hardware layers remain to be addressed.

Platform as a Service: a managed execution environment (databases, runtimes, message queues, deployment tools) on which the customer deploys their applications without administering the infrastructure. More convenience, but greater dependency on the platform's proprietary services, and therefore a higher lock-in risk than IaaS.

Public release of a model’s parameters (weights), enabling it to be run, fine-tuned and audited outside the creator’s organisation. This is distinct from strictly open source: the weights may be made available under a restrictive licence. This significantly reduces the risk of service disruption and vendor lock-in associated with a model accessible only via an API.

The technical and contractual ability to retrieve one’s data and processing operations in a usable format, and then to transfer them to another provider or in-house, within a reasonable timeframe and at a reasonable cost. This is the true measure of control: without reversibility, dependence remains total, even under a compliant contract.

Software as a Service: a complete application operated by a third party and consumed through the browser. The customer manages neither the infrastructure nor the software, only their data and settings. Maximum delegation, and maximum exposure: the data lives with the provider, under their law.

A security qualification issued by ANSSI (standard 3.2). It certifies that a cloud service (IaaS, PaaS or SaaS) meets the highest technical, operational and legal standards, including immunity from extraterritorial laws. It is a qualification (a security endorsement), not merely a certification. The CNIL regards it as the only recognised marker of a sovereign cloud; the SREN Act (Article 31) makes it mandatory for government cloud projects involving sensitive data.

A material, most commonly silicon, whose conductivity can be precisely controlled, and which forms the basis of all integrated circuits. Its manufacture involves a long and specialised industrial process: design, etching at the foundry, lithography equipment, assembly and testing, almost none of which is carried out entirely within Europe.

Law on securing and regulating the digital space, enacted in 2024. It complements the European framework and introduces cloud-specific provisions: limits on transfer and exit fees, portability and interoperability requirements, controls on commitment credits — all aimed at reducing lock-in and facilitating reversibility.

A situation in which dependence on a supplier becomes difficult or costly to break free from, due to proprietary formats, specific interfaces, high migration costs or ecosystem effects. Lock-in transforms an initial choice into a lasting constraint and renders competition ineffective, even when several suppliers exist in theory.