Loading story…
A Lawfare analysis says the push for AI sovereignty is intensifying a long-running dispute over whether unauthorized cyber intrusions into another state’s networks violate sovereignty under international law. The article contrasts a pure sovereignty position associated with France and the African Union, an effects-based approach reflected in the Tallinn Manual and many Western states, and an operational-latitude posture linked to the U.K. and, in a different form, the U.S. It argues that governments have historically preserved room for intelligence collection and offensive cyber operations by resisting a broad sovereignty rule, even as AI systems become more central to national security.
The piece warns that this legal posture leaves AI assets such as training data, compute infrastructure, and model weights exposed to low-level but strategically significant intrusions including data theft and data poisoning. Drawing on examples such as the OPM breach, Volt Typhoon activity, and security cooperation under AUKUS Pillar II, it says current thresholds focused on physical damage, loss of functionality, or coercive interference do not clearly cover covert compromise of AI systems. Background references to France’s formal cyber-law position and a U.K. government speech on international law underscore the divide among states as customary international law appears to be moving toward stronger sovereignty protections in cyberspace.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
A Lawfare article published on 2026-07-28 argued that the rise of AI sovereignty is intensifying the debate over whether unauthorized cyber intrusions violate state sovereignty, and that U.S. and U.K. legal positions may leave AI infrastructure insufficiently protected against low-level intrusions.
In a 2022 government speech, the United Kingdom argued that there is no specific prohibition in international law on cyber activity that falls short of intervention or use of force, reflecting its operational-latitude position in the sovereignty debate.
France's 2019 national position stated that any unauthorized penetration of French systems or production of effects on French territory by cyber means can constitute a violation of sovereignty, articulating a broad legal view in international cyber law.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
lawfaremedia.org
Open sourcecyberlaw.ccdcoe.org
Open sourcegov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Governments are increasingly treating **technology and data sovereignty** as a national security risk factor, weighing dependence on foreign-controlled platforms and supply chains against operational capability. Switzerland ended its use of **Palantir** not over performance, but over residual sovereignty concerns tied to proprietary opacity, foreign legal jurisdiction, and remote update/control mechanisms that could enable remote access, unintended exposure, or service disruption during geopolitical crises. In parallel, U.S. policy discussions are framing “**sovereign AI**” as a strategic export and partnership model, even as partners pursue sovereignty specifically to reduce reliance on the United States amid concerns about shifting rules, access restrictions, and leverage. Separately, reporting on potential U.S. moves to ease certain China-tech restrictions (including around Chinese telecoms and consumer networking products) underscores how quickly policy can change and how those shifts can reshape risk postures for critical infrastructure and technology procurement decisions.
Jul 12, 2026
Trisha Ray, associate director at the Atlantic Council's GeoTech Center, emphasized the growing importance of AI sovereignty as nations seek to control their own artificial intelligence infrastructure, data, and talent. The push for sovereign AI is driven by concerns over national power, trust, and resilience, as countries aim to reduce dependence on foreign technology providers and assert greater control over their digital futures. Ray highlighted that achieving true AI sovereignty is challenging due to the lack of diverse, high-quality datasets and the limited digitization of many languages, which hampers the development of inclusive and effective AI models. The discussion also explored the broader geopolitical landscape, outlining four possible futures for national AI ecosystems and the foundational elements required for AI sovereignty, such as data, computing power, and skilled personnel. The interview underscored that AI sovereignty is no longer a theoretical concept but a pressing issue at the intersection of geopolitics, technology, and national security, with significant implications for cyberwarfare, fraud management, and the global balance of power.
Jun 29, 2026
Governments, regulators, and major AI developers moved to formalize oversight of advanced AI systems as concerns grew that frontier and agentic models could accelerate cyberattacks, create liability exposure, and outpace existing governance. In the United States, **NIST** expanded work on AI security through its `AI Agent Standards Initiative`, the `Cyber AI Profile`, and the Commerce Department’s **Center for AI Standards and Innovation (CAISI)**, while Google, Microsoft, xAI, OpenAI, and Anthropic agreed to voluntary pre-release model testing with the government. The White House debated a broader executive order after reports that models such as Anthropic’s **Mythos** and OpenAI’s cyber-focused systems could rapidly identify vulnerabilities and support complex offensive operations; the final order reportedly shortened the review window and paired model access with an AI cybersecurity clearinghouse and vulnerability-sharing measures for critical infrastructure defenders. At the same time, Europe and U.S. states advanced a patchwork of AI governance rules that mixed delayed enforcement with tougher operational expectations. The EU agreed to simplify parts of the **AI Act**, delaying some high-risk obligations while banning nudification tools and preserving strong powers for the Commission’s AI Office over general-purpose AI, even as guidance on high-risk classification and logging requirements continued to emerge. States including Illinois, Utah, Maryland, and San Jose expanded governance-first programs through chief AI officers, sandboxes, incident-investigation frameworks, red teaming, and procurement controls, while insurers, auditors, and legal experts warned that **AI-washing**, weak board oversight, poor logging, and inadequate vendor controls are increasing D&O, regulatory, and tort risk. Across policy, industry, and academia, the direction of travel was toward stronger **auditing, verification, incident reporting, and lifecycle governance** rather than reliance on voluntary model promises alone.
Aug 1, 2026