Sovereign AI, American law

**Snigdha Sharma** (0:01)
Hello. Today's episode is a little bit different from our usual programming because I will be reading aloud a newsletter edition of Make India Competitive Again by my colleague, The Ken reporter, Mrunmayee Kulkarni. And it is worth your full attention.
This piece is about a word that you've been hearing a lot lately, sovereign. Sovereign AI, sovereign cloud, sovereign compute. India is spending over 10,000 crore rupees building it. But Mrunmayee's argument is quite pointed. She says, nobody has actually defined what this word means.
Welcome to Daybreak, a business podcast from The Ken. I'm your host, Snigdha Sharma, and I don't chase the news cycle. Instead, every day of the week, my colleague Rachel Varghese and I will come to you with one business story that's worth understanding and worth your time. Today is Tuesday, the 16th of July.
Humans have always wanted to own things. Land, resources, gold, oil, now apparently AI.
Ever since we learned to make weapons out of pointy objects, we have built empires just to stay independent of someone else's influence. Different currencies, strict immigration controls, data localization laws, all of it at its core, an attempt to stay in charge of our own resources, to become quote unquote sovereign. The AI universe is no different. The problem is, no one quite knows what the term means. What even is sovereign an analyst at a VC firm asked me? Is it when data is stored in India? Is it when startups use India AI missions compute?
An undefined standard means that the gaps get filled by someone else.
Let's say an American cloud provider gets a US warrant for data stored in India. It has two options, comply and potentially violate Indian law or refuse and violate US law.
That's a contradiction that already exists inside every hyperscaler like AWS, Google and Meta operating in India. It just hasn't been tested yet. Meanwhile, India is still figuring out what sovereign AI even means. On the 13th of April, the government set up the Technology and Policy Expert Committee or TPEC, which is a six-member council tasked with designing India's AI governance framework. Among other things, it will identify regulatory gaps and define the contours of India's AI policy. There is no deadline for its first report. Even though India is already spending 10,300 crore rupees on building what it calls sovereign AI. And it's calling a lot of things sovereign. At India's AI Impact Summit 2026 in February, it was the word of the season. Ashwini Vaishnav said it, Modi said it, Hardeep Puri said it, and in its pavilion, NASA, the company entrusted with building India's AI infrastructure, promised, and I'm quoting, instant sovereign GPU access. NVIDIA put out a press release soon after, calling India's AI infrastructure sovereign, ironically, on NVIDIA's Blackwell GPUs.
There is no legal standard or technical requirement to be classified as sovereign. So the hyperscalers and Indian companies self-certify in a way. Microsoft calls its India offering a sovereign cloud. Google offers in-country data processing. Amazon has compliance zones. Because the bar does not exist, clearing it is easy. And all of it runs on chips from a single American company. If NVIDIA changes its pricing, restricts its exports or decides India is a lower priority market, the entire sovereign compute program feels it.
Here is how the sovereign cloud pitch works.
Microsoft, Google and Amazon have all made elaborate sovereignty promises to their Indian customers. Data residency, customer-managed keys, operational transparency and pledges to legally challenge any foreign government order that threatens customer data. Seemingly airtight stuff. There is, however, a telling detail in the fine print. Their infrastructure is connected to global systems operated by US headquartered companies and subject to US law. And US law, since 2018, includes the Cloud Act, which compels American tech companies and any company with a legal presence in the US to hand over stored data to American authorities, regardless of where that data physically sits. Technically, a subpoena can reach data in Microsoft's Mumbai data center. The server's postcode might be Indian, but its legal obligations are not. Microsoft has been here before. When the US government demanded access to emails stored on its servers in Dublin, Microsoft refused and fought it all the way to the Supreme Court. They won at the applet level. Then, while the Supreme Court was still deliberating, Congress passed the Cloud Act, which explicitly extended US warrants extra-territorially. The case was dismissed as moot, and Dublin's data was never quite as Irish as it looked.
Mumbai is in a similar position. In June 2025, Microsoft's France Director of Public and Legal Affairs appeared before the French Senate and admitted under oath that he could not guarantee French citizen data would never reach US authorities without French authorization. If Microsoft cannot make that promise in France, which is a country with the full force of European data protection regulation behind it, it cannot make it in India either.