Operationalizing Digital Sovereignty: The African Blueprint

François Rodriguez argues that digital sovereignty begins with knowing where data is physically stored, which jurisdiction governs the service provider, and what third-party software is involved in data transit. These three layers form the foundation of any meaningful sovereignty framework. Without clarity on all three, a country cannot claim genuine control over its digital environment.

He explained that cloud data is not abstract but sits on physical servers somewhere, and the first question is where those servers are located . The second is the jurisdiction of the cloud service provider , and the third is whether data transits through third-party software providers operating under a different jurisdiction, which creates a sovereignty gap .

François Rodriguez distinguishes between the subjective sense of being sovereign and the objective, verifiable reality of it. He argues that governments must be able to audit their sovereignty claims rather than simply assume them. This distinction is central to his framing of digital sovereignty as a practical, measurable condition.

He stated that there are two notions: the willingness of feeling sovereign and the reality of really being sovereign in the field . He emphasised that the first dimension of sovereignty is verification - whether a country can really audit that it is truly sovereign .

François Rodriguez warns that reliance on a single vendor creates a critical vulnerability: if that vendor withdraws services, stops providing updates, or is subject to geopolitical decisions, the country's entire digital operations may cease. This makes operational independence a core component of digital sovereignty. He frames this as a direct threat to citizens and national functioning.

He cited recent real-world examples of governments having access to certain AI tools switched off , and noted that if a provider stops supporting a country or decides not to provide services, operations stop and citizens are affected . He also referenced the broader question of whether a country is truly in control of its independence and autonomy .

François Rodriguez argues that during procurement, governments must verify that they retain control over encryption keys, data, and operational continuity. He frames this as a checklist of sovereignty conditions that must be satisfied before entering into any digital service agreement. Failing to ask these questions during procurement leads to dependency and loss of sovereignty.

He stated that when doing procurement, governments need to pay attention to whether they are really in control of the keys, in control of their data, and in control of their destiny . He linked this directly to the broader data governance framework he was presenting .

François Rodriguez cautions against simply copying regulatory frameworks from one region and applying them to another without considering whether they are architecturally and contextually appropriate. He uses the EU as an example of a region with strong regulations that may not translate directly to other contexts. He calls for harmonisation that is fit for purpose in each destination.

He noted that Africa has seen implementation of regulations mimicking the EU, which has been at the forefront of strict regulation, but that a balance must be found because the architecture might not fit certain destinations . He used the example of EU-proposed trade corridors that were designed for raw materials but do not reflect today's digital economy routes in agriculture, healthcare, and finance .

François Rodriguez presents a data lifecycle framework that covers collection, storage, use, and deletion as the four pillars of effective data governance. He emphasises that data minimisation — deleting data that is no longer needed — is particularly important because it reduces the attack surface in the event of a breach. He also stresses the need to classify data and apply appropriate encryption levels.

He outlined the framework as: understanding what data is collected and ingested, how it is stored with appropriate protection for sensitive data , how it is used in workflows , and what data should be deleted, noting that less stored data means less exposure in case of breaches . He also stressed the need to classify data and apply the right encryption level .

François Rodriguez argues that governments and organisations are unnecessarily exposing data by routing simple AI queries through cloud-based AI systems when these could be handled on-device. He cites statistics suggesting that more than half of AI queries are simple enough to run locally. This unnecessary cloud dependency compounds sovereignty risks.

He stated that more than 50% of AI queries are simple queries that can be run on-device - such as summarising, translating, and workflow integration - and can be run on a mobile phone . He warned that by dumping all data into cloud AI, users lose control of what they put in the cloud, mirroring the sovereign risks already discussed .

François Rodriguez describes a multilateral capacity building effort that has trained more than 50 countries on digital sovereignty, post-quantum cryptography, and secure government communications. He outlines the partnerships formed with ITU, Smart Africa, and the newly announced agreement with AICTO. These programmes aim to translate theoretical frameworks into practical implementation.

He explained that Real Time has been training more than 50 different countries on capacity building covering digital sovereignty, post-quantum transition, and secure government communications . He noted the partnership with Smart Africa and announced the signing of an agreement with the Arab ICT organisation at the session itself .

François Rodriguez argues that the threat from quantum computing to existing cryptographic systems is no longer a distant theoretical concern but an imminent one, with timelines now pointing to 2030–2031. He frames this as a door that is already being knocked on, requiring urgent action. Failure to migrate to post-quantum encryption leaves sensitive government data vulnerable to future decryption.

He stated that quantum computing was previously expected to be implemented ten years from now, but the timeline has moved to 2030-2031 at the latest, meaning it is already knocking at the door . He also noted that without post-quantum encryption, foreign adversaries could gain access to unencrypted data .

François Rodriguez highlights the Quantum Act as a policy and investment signal that quantum computing development is being actively accelerated, which in turn shortens the time governments have to migrate their cryptographic infrastructure. He presents this as a further reason for urgency in post-quantum migration planning. The Act represents a structural shift in the threat landscape.

He referenced the Quantum Act, noting that a lot of investment has been put into quantum computing to accelerate the development of this technology, which will be capable of breaking existing cryptography .

François Rodriguez warns that so-called free digital infrastructure offers often conceal business models that extract value in non-monetary ways, including data and intellectual property. He argues that auditability is essential to detect what is being extracted behind the scenes. He raises the alarming possibility that AI models could be built from a country's data to simulate strategic scenarios against that country.

He outlined several business model structures, including freemium models where costs kick in at certain thresholds, and time-limited free periods that eventually convert to paid arrangements . He also warned that data and IP can be extracted covertly, and gave the example of healthcare data being used to build an AI model that could simulate how an infection would affect a country's population, which could be used for strategic or threatening purposes .

H.E. Eng. Mohamed Benamor offers a concise, one-sentence definition of digital sovereignty as the full capability of a country to control its own data. This definition centres sovereignty on data control as the primary measure. It aligns with the broader discussion's emphasis on data as the foundation of digital independence.

When asked for a one-sentence definition, he stated directly that sovereignty means the capability of one country to have full control of their data .

H.E. Eng. Mohamed Benamor argues that the perceived tension between national sovereignty and regional cooperation is a false dichotomy. Countries can retain full control over their critical infrastructure and national policies while choosing to collaborate regionally in areas where collective action adds value. He presents this as a balance rather than a binary choice.

He stated that this is an issue of balance rather than choosing between two opposing positions, and that both full national control and shared regional capabilities are legitimate perspectives . He listed areas where regional collaboration creates greater value, including cybersecurity, AI research, digital public infrastructure, interoperability, capacity building, and shared technical standards .

H.E. Eng. Mohamed Benamor describes AICTO's function not as an advocate for centralisation but as a facilitator of consensus among member states with differing priorities. The organisation provides a platform where governance frameworks and common standards can be jointly developed. This approach is designed to respect national sovereignty while enabling regional solidarity.

He stated that the role of AICTO is not to advocate for centralisation but to facilitate consensus , and that the organisation provides a multi-stakeholder platform where member states can jointly develop governance frameworks, common standards, and trusted cooperation mechanisms that respect national priorities while advancing common values . He also noted that the objective is to strengthen national digital sovereignty through regional solidarity .

H.E. Eng. Mohamed Benamor uses the Trojan Horse analogy to caution governments against accepting free digital infrastructure offers without scrutinising the conditions. He then pivots to describe how AICTO translates regional dialogue into concrete policy actions. He presents specific initiatives as evidence of this approach in practice.

He invoked the mythic history of the Trojan Horse to illustrate that a free gift always warrants deeper scrutiny . He then described AICTO's concrete actions, including the Arab Cybersecurity Strategy developed in 2023 and the Arab AI Ethics Pact developed the following year, as examples of translating regional dialogue into action .

Gallo Fall argues that a significant number of countries, particularly in the Global South, have already lost meaningful control over their data and digital infrastructure, but are unaware of this because they lack the tools to assess their own sovereignty posture. He distinguishes between cybersecurity as a technical discipline and digital sovereignty as a broader strategic concept. The absence of self-knowledge is itself the core problem.

He noted that cybersecurity focuses on protecting systems from unauthorised access, which is largely a technical discipline, whereas digital sovereignty is a broader strategic concept - a system can be perfectly secure and yet not be under the country's control . He stated that many countries in the Global South have already lost control of their data and digital infrastructure because they do not know where they stand or what their digital sovereignty posture is .

Gallo Fall describes his digital sovereignty intelligence platform as a tool purpose-built for governments, ministries, and critical infrastructure institutions that want to regain strategic control. The platform maps cybersecurity frameworks against sovereignty pillars and generates KPIs, reports, and recommendations. Its primary value is giving governments a clear picture of where they currently stand so they can begin to close gaps.

He described the platform as a continuous unified intelligence ecosystem purpose-built for government ministries and critical infrastructure institutions that refuse to lose strategic control of their data, infrastructure, and AI features . He explained that he built it by mapping all cybersecurity frameworks and different sovereignty pillars, and developed digital tools that provide KPIs, reports, and recommendations to help governments that have already largely lost digital sovereignty .

Gallo Fall argues that not all data carries the same strategic risk, and that certain categories — which he calls crown jewels — must be treated as non-negotiable and kept within national borders at all times. He frames this as a matter of national security and democratic integrity. He warns that adversaries are actively targeting this data to manipulate elections and build strategic advantage.

He stated that African nations should start classifying their data and that certain data should never leave the country, specifically naming national ID systems, biometric data, and electoral rolls as examples . He warned that adversaries are currently manipulating elections using such data and that these crown jewels must not leave the country .

Gallo Fall introduces the concept of data colonisation to describe the systematic extraction of African data by powerful external actors for their own strategic benefit. He argues that this is not merely a commercial phenomenon but a geopolitical one, with adversaries using the data to manipulate elections and build AI models that serve their interests. He calls on African nations to be realistic and vigilant about what data they hand over.

He stated that there is a thirst for getting especially African data, which he calls data colonisation, and that powerful countries are building models to manipulate data to their own advantage . He warned that adversaries are manipulating elections using this data and that African nations must be very careful about what they hand to these powerful countries .

Thelma Efua Quaye reframes sovereignty not as total isolation or absolute control but as transparency and informed consent over data use. She argues that a government's sovereignty is meaningful when it knows what its data is being used for and retains the power to approve or refuse that use. This is a more pragmatic and achievable definition than full national control.

She stated that in today's world, total isolation is not realistic, and that for her, sovereignty for a government should be transparency and the ability to know where their data is and what it is being used for, with the ability to say no or yes .

Thelma Efua Quaye draws on her experience as a CTO to illustrate that ownership of infrastructure does not automatically translate into effective operation. She identifies three root causes of failure: lack of government investment, lack of understanding of the infrastructure's strategic importance, and absence of market demand. She uses a real-world example of a national backbone with below 10% utilisation to make the point concrete.

She recounted her experience running a network where the country owned the infrastructure but utilisation was below 10%, maintenance was poor, and no one responded to service calls . She attributed this to the government not investing because it did not understand why it should, particularly when the private sector was already running a backbone . She also noted that sovereign data centres built in several countries had low utilisation because the investment was driven by the feeling of sovereignty rather than actual market demand .

Thelma Efua Quaye proposes a three-step framework for governments to transition from merely owning digital infrastructure to actively and effectively running it. The steps are: first, understanding the strategic importance of the infrastructure so that investment follows; second, building the capacity of people to operate it; and third, stimulating market demand to ensure the infrastructure is actually used. She presents these as sequential and interdependent.

She outlined the three steps explicitly: understanding the importance of the infrastructure so that investment is made , capacity building to enable operation , and stimulating market demand through mechanisms such as startups and AI factories . She summarised these as the three things a government should do to move from owning to running infrastructure .

Thelma Efua Quaye argues that any offer of free digital infrastructure must be treated with deep scepticism because the cost is always present, even if not monetary. She frames this as a fundamental principle: if you are not the one eating, you are probably being eaten. Governments must identify what they are giving up in exchange for the apparent gift.

She stated plainly that she does not believe there is anything free, and that if you are not the one eating, you are probably being eaten . She then asked governments to consider what they are giving in exchange - whether it is data, sovereignty, or freedom - even if no money changes hands .

Thelma Efua Quaye uses a concrete recent example from Ghana to illustrate the importance of reading the fine print of any free digital offer. In this case, a grant from the US government to Ghana's health service appeared free but required citizen data as the cost, leading Ghana to cancel the agreement. She presents this as a model of the kind of scrutiny all governments should apply.

She described a recent situation in Ghana involving the health service and the US government, where a grant was offered for free but the catch was citizen data . The Ghanaian government identified this condition and cancelled the agreement . She used this as an example of the fine print that governments need to look at carefully .

Maryna Veuthey uses an interactive audience exercise to highlight a critical awareness gap: most governments and officials do not know the contractual terms governing their cloud or software provider relationships, including whether they can terminate within 30 days and what the legal implications for their data would be. This lack of awareness is itself a sovereignty risk. She frames it as a practical test of whether sovereignty is real or merely assumed.

During the audience exercise, she asked participants to raise their hands if they could switch or terminate a cloud or software provider contract within 30 days and know what happens to their data and the legal implications . The exercise was designed to reveal how few officials actually know the answer to this question, illustrating the contractual awareness gap in practice .

Maryna Veuthey uses the audience exercise to reveal that post-quantum migration is not yet being budgeted by governments, despite the urgency of the timeline discussed earlier in the session. She contrasts the widespread discussion of AI with the relative neglect of post-quantum preparedness. She frames post-quantum as the next major challenge that governments are not yet taking seriously in financial planning terms.

During the exercise, she asked participants to raise their hands if post-quantum migration was already budgeted and not just discussed , and anticipated that there would be no hands raised . She noted that while AI is everywhere and people are getting used to it, post-quantum is another animal that has yet to be addressed in budgeting .

An audience member intervenes during the interactive exercise to clarify and sharpen the question being posed, pointing out that the critical issue is not merely whether a contract can be terminated but what legal rights a government retains over its data after termination. This contribution highlights that contractual awareness must extend beyond exit clauses to encompass data retrieval rights and legal consequences. It underscores the complexity of vendor relationships that governments often overlook.

During the audience exercise, a participant echoed and reinforced the moderator's question by restating it: if you can terminate the contract, what happens to the data and what are the legal implications .