The Sovereignty Gap: Who Controls the Technology That Runs Africa?

Switzerland is paying a small price for a credible way out of Microsoft. Africa is paying for data residency and foreign-built capacity while the harder things that make an exit possible remain unbuilt: power, people, institutions and bargaining power.

On 2 September 2026, the Swiss Federal Council was told the result of a small experiment. For more than a year, 172 federal employees drawn from several departments had been doing their ordinary work on an open-source, browser-based office suite instead of Microsoft 365. They wrote documents, filed them, sent email, kept calendars and collaborated. The Federal Chancellery’s conclusion was a qualified yes. The software was, in principle, suitable for core standard processes, and it could make a substantial contribution to an emergency solution if Microsoft 365 became unavailable. Large video conferences did not hold up.

On the strength of that answer, the Chancellery launched a programme to give roughly 3,000 employees in particularly critical business processes a sovereign workplace from the end of 2027. The first phase is estimated to cost about CHF 9 million, drawn from funds Parliament had already approved for a sovereign Swiss open-source office platform. The system will run as a standalone environment in parallel with Microsoft 365, not instead of it.

The timing is what makes the decision interesting. The Swiss federal administration had finished rolling Microsoft 365 out to around 54,000 seats only in mid-December 2025, less than nine months earlier. Swiss public radio had reported the year before that the federal government had spent about CHF 1.1 billion on Microsoft licences. Switzerland did not decide that Microsoft was bad software. It decided that depending on it without an alternative was a risk worth pricing.

That distinction is the subject of this report, and it is the question Africa has not yet answered. Across the continent in 2026, governments have announced sovereign clouds, ordered data onshore, launched national AI strategies and pledged compute centres. Almost all of this activity concerns where things are located. Very little of it concerns whether a country could walk away, renegotiate or keep functioning if a supplier changed its terms. Those are different capabilities, and the gap between them is what this series calls the sovereignty gap.

How to read this report. Villpress distinguishes four kinds of statement. Facts are what documents and records establish. Claims are what a government, company or institution says about itself, and are attributed as such. Analysis is Villpress’s interpretation of the documented evidence taken together, and is signalled in the prose. Uncertainty is named wherever the evidence runs out. An announced investment is not treated as deployed infrastructure, and a policy is not treated as an implemented one.

What Switzerland actually bought for CHF 9 million

The Swiss programme is easy to misread as a country escaping Microsoft. The government’s own framing rules that out. The feasibility study, known as PoC BOSS (a proof of concept for office automation with open-source software), was scoped with four explicit limits: it would not replace Microsoft 365, would not offer one-to-one functionality, would not promise full compatibility and would not become permanent infrastructure. Whether the federal workplace should eventually be provided entirely by a sovereign solution will, in the Chancellery’s words, be examined and decided later. It names the main obstacle plainly: the many applications and specialist systems closely tied to Microsoft’s architecture.

What Switzerland bought, then, is optionality. For less than one per cent of what it reportedly spends on Microsoft licences, it is building a second set of keys to its own building: a working environment that critical staff can use if the primary one fails, becomes legally untenable or becomes commercially unreasonable. Officials have described a decision window. The administration intends to equip the 3,000 workplaces from next year and judge, after roughly two years of practical experience, whether full replacement is realistic.

The software choice matters. The Chancellery tested openDesk, a browser-based suite assembled for public administrations by ZenDiS, the German federal centre for digital sovereignty. The same suite is being adopted by German states, and the Chancellery consulted Schleswig-Holstein, which has already largely introduced open-source workplace software. Switzerland is therefore not building from nothing. It is joining a cross-border commons that other governments fund and maintain. That is one of the least discussed features of successful sovereignty strategies: they rarely succeed alone.

The legal and political scaffolding underneath

The programme did not appear out of a single decision. Since 1 January 2024, Article 9 of the federal law on electronic means for government tasks, known as EMBAG, has required the federal administration to publish software it develops, or commissions, as open source, unless third-party rights or security considerations prevent it. That rule took roughly twelve years of parliamentary lobbying to secure. The Federal Council then made digital sovereignty a focus theme of its Digital Switzerland strategy. Swiss data protection authorities had meanwhile declared international cloud services unsuitable for handling certain personal data.

Even here, sovereignty is layered rather than absolute. The Swiss Federal Office of Energy, implementing Article 9, publishes its source code on GitHub, a platform owned by Microsoft. This is not hypocrisy. It shows that openness and independence are different properties. Open code can be moved; a proprietary contract cannot be moved as easily. The point of the Swiss approach is not to avoid every foreign platform. It is to make sure that nothing essential is impossible to move.

Why a rich, technically capable country bothers

The Chancellery’s stated goals are two: strengthening digital sovereignty and keeping the administration functioning in a crisis. Three pressures sit behind that language. The first is jurisdictional: data held by a US provider can, in principle, be reached by US legal process regardless of where the servers sit. The second is commercial: a supplier that knows a customer cannot leave has little reason to price moderately. The third is geopolitical. Transatlantic trust has become less automatic, and European governments have begun to treat productivity software and collaboration tools as infrastructure rather than as office supplies.

The Swiss armed forces are moving faster than the civilian administration. According to reporting by the Swiss publication Republik, relayed by The Register, the military’s cyber specialists aimed to complete their own move away from Microsoft by October 2026.

Microsoft’s position

No Microsoft statement specific to the Swiss programme was identified in the public record reviewed for this report. Microsoft’s broader position in Europe is documented. In April 2025 the company announced a set of European digital commitments, including a contractual promise to European governments to contest in court any order, from any government, to suspend or cease its cloud operations in Europe. According to Arvato Systems, a Microsoft partner, the commitments also include keeping backup copies of code in Switzerland for partners to use in a continuity emergency.

This deserves to be taken seriously on its own terms. A contractual obligation to litigate is not nothing. But it is a promise from the dependency, not an alternative to it. It reduces one risk without restoring the customer’s ability to leave. Switzerland’s decision can be read as the difference between being reassured and being prepared.

Five words that are not synonyms

The Swiss case makes it possible to separate five ideas that African policy debate often collapses into one. Technology adoption is using a tool. Technology dependence is being unable to function without a specific supplier. Technological capability is having the people, institutions and knowledge to operate, adapt, secure and replace systems. Digital sovereignty is the legal and practical authority to decide the terms on which critical technology is used, including the terms of leaving. Strategic autonomy is the ability to act on national priorities even when suppliers or their governments disagree.

A country can adopt foreign technology heavily and still be sovereign, if it can credibly exit or renegotiate. A country can host every server on its own soil and remain deeply dependent, if it cannot. The test this report applies throughout is simple: if the supplier changed its terms tomorrow, what could this country actually do?

Five ways out, and one way back

Switzerland’s decision sits in a long line of attempts by governments to reduce dependence on dominant technology suppliers. They do not tell a single story. Some worked, one reversed, and at least one has triggered retaliation. Taken together, they show what a credible exit actually requires.

Munich: the exit that was reversed

Munich decided in 2003 to move its administration to Linux. The LiMux programme eventually put a customised Linux on about 14,800 of the city’s roughly 29,000 desktops and LibreOffice on more than 15,000. In 2012 the then mayor said the project had saved more than €4 million in licensing. After a political change, the city council voted in 2017 to end the programme and approved €49.3 million to move to Windows 10 as part of a wider €89 million IT overhaul. Officials cited compatibility problems with external partners and software designed only for Windows. Supporters argued the reversal was political rather than technical.

Both explanations point to the same lesson. The exit failed where it depended on the rest of the ecosystem, including suppliers, partner agencies and specialist applications, continuing to assume Microsoft. A single city cannot change the defaults of an entire software market. Sovereignty that exists only inside one organisation is fragile.

Schleswig-Holstein: the exit that compounded

The German state of Schleswig-Holstein, with about 30,000 public employees, took the opposite path: slow, staged and backed by rules. It made the Open Document Format the official format for its administration in August 2024, making LibreOffice the practical default. It moved more than 40,000 mailboxes and over 100 million emails and calendar entries from Microsoft Exchange and Outlook to Open-Xchange and Thunderbird, completing the move on 2 October 2025 after six months. The digital minister acknowledged downtime and delays along the way. The state says it will save more than €15 million in licence costs in 2026, against a one-time investment of €9 million budgeted for the same year. Around a fifth of workplaces outside the tax administration still depend on Microsoft programmes because specialist applications require them.

The Schleswig-Holstein claim of savings is the state’s own figure and has not been independently audited in the sources reviewed. What is verifiable is the sequencing: mandate a format, change the defaults, migrate the largest single dependency (email), then work through the exceptions. That is how an exit is built.

France: sovereignty as a procurement standard

France has turned sovereignty into a certification and a product. In January 2026 the government announced that Visio, a videoconferencing tool built by the interministerial digital directorate DINUM, would become the default for all state services by 2027, replacing Microsoft Teams, Zoom and similar platforms. Visio had been tested for about a year with some 40,000 regular users and is hosted by Outscale, a Dassault Systèmes subsidiary certified under SecNumCloud, the security standard of France’s cybersecurity agency ANSSI. The government estimates savings of about €1 million a year for every 100,000 users moved off paid services. That estimate is a government claim.

The French lesson is that sovereignty scales when it becomes a procurement rule with a certification behind it, so that domestic and foreign providers alike know what they must meet. A slogan becomes enforceable when a buyer can test it.

Estonia: sovereignty through legal architecture

Estonia’s approach is the least intuitive and possibly the most instructive. Its digital state runs on X-Road, a decentralised data exchange layer, and a universal digital identity. Recognising that its territory could not guarantee the survival of its data, Estonia agreed with Luxembourg in 2017 to host copies of its most critical databases in a data embassy on Luxembourg soil, protected by the same kind of immunity as a physical embassy. The backed-up registers include the treasury, pensions, business and population registers, land cadastre and identity documents. Estonia had earlier experimented with storing state data in the cloud with Microsoft.

Estonia shows that sovereignty is not the same as localisation. Its most critical data is deliberately stored abroad. What makes that sovereign is control: Estonian-cleared personnel, legal immunity and the ability to restart the state from those copies.

India: the state subsidises, the market builds

India’s IndiaAI Mission, approved in March 2024 with about ₹10,372 crore (around $1.25 billion) over five years, takes a different route. Rather than building state data centres, it empanels private GPU operators and subsidises the hourly price paid by Indian users. More than 38,000 GPUs are reported to be available under the scheme, owned by private partners including Jio, Tata, Yotta and CtrlS, and the government announced plans at its 2026 AI summit to add more than 20,000. It has also selected domestic companies, beginning with Sarvam AI, to build Indian foundation models. Critics have asked whether this builds sovereign capability or simply subsidised cloud.

The Indian case is relevant to Africa because it refuses the false choice between state ownership and foreign dependence. It uses public money to create demand for domestic capacity and domestic models while leaving ownership and operation to firms. Whether it produces durable capability is still unproven.

Brazil: when sovereignty becomes a trade dispute

Brazil’s central bank launched Pix, a free instant payment system, in November 2020. By 2025 it was used by around 160 million people and handled close to half of domestic transactions by volume. Pix is publicly owned digital infrastructure that displaced, in part, the fee-based services of foreign payment firms. In July 2025 the US Trade Representative opened a Section 301 investigation into Brazil’s digital trade and electronic payment practices. On 1 June 2026, it determined that Brazil’s practices in six areas were actionable, found that Brazil had unfairly advantaged Pix, and proposed 25 per cent tariffs on Brazilian goods, subject to exemptions.

Brazil proves something none of the other cases does. Building a genuine alternative is not only a technical and financial undertaking. It can be treated by a powerful trading partner as a trade barrier. Sovereignty has a price, and that price is sometimes set outside the country.

Table 1. What the precedents required, and what they teach

Source: Villpress Intelligence analysis of sources cited in the text and appendix. Savings figures are government claims.

Read together, the precedents separate the successes from the failures on one variable. Where governments paired technology choices with rules, shared commons, certification and patient sequencing, dependence fell. Where a single organisation tried to leave alone, the surrounding ecosystem pulled it back. Where a country built something better than what it replaced, it discovered that the displaced suppliers’ government had a view. None of these outcomes was decided by where the servers were.

Africa’s starting point is not Switzerland’s. The Swiss question is how to reduce dependence on one supplier inside a mature, well-funded, highly skilled state. Africa’s question is how to build enough capacity to have any bargaining position at all, while demand grows faster than supply.

The physical gap is stark. According to the Africa Data Centres Association and Rising Advisory, the continent had about 360 megawatts of active data-centre capacity in early 2026, roughly 0.6 per cent of the global total, for a continent holding about a fifth of the world’s population. Another 238 megawatts was under construction and 656 megawatts sat in the announced pipeline. The distance between those numbers matters. Announcements are not capacity, and a great deal of Africa’s sovereignty debate is being conducted in the currency of announcements.

Figure 1. More capacity has been announced than is running. Treat pipeline figures as intentions, not infrastructure. Source: Africa Data Centres Association & Rising Advisory, Data Centres in Africa 2026 Economic Report, reported by ITWeb, 23 February 2026.

The ownership picture is starker still, and less discussed. South Africa’s largest data-centre platform, Teraco, which also owns NAPAfrica, the continent’s largest internet exchange point, has been majority-owned since August 2022 by Digital Realty, a US-listed real estate investment trust, in a deal valuing Teraco at about $3.5 billion. In Nigeria, the data centres of MainOne, a Nigerian company, have belonged to the US operator Equinix since its $320 million acquisition of MainOne in 2022. Digital Realty entered Nigeria by acquiring Medallion. The largest facility under construction in Lagos, a campus of more than 30 megawatts, belongs to Nxtra, the data-centre arm of India’s Bharti Airtel group. The hyperscale regions in South Africa belong to Microsoft, Amazon and Google.

None of this is sinister. Foreign capital built most of this capacity because domestic capital was not available at the required scale and cost. These facilities employ local people, pay local taxes and serve local customers. But it does mean that when an African regulator orders data onshore, much of that data will move into buildings whose owners, boards and ultimate shareholders sit outside the continent. “Made in Africa” and “controlled by Africa” are not the same thing.

The residency trap

Across the evidence reviewed for this report, one pattern recurs often enough to name. Villpress calls it the residency trap: the policy error of treating data residency, keeping data inside national borders, as if it were data control.

Senegal is the clearest illustration. In 2021 President Macky Sall ordered all state data and platforms repatriated to the new Diamniadio National Datacenter, declaring that the state would now be sovereign in data storage. The $18.2 million facility was financed by a Chinese loan and built with equipment and technical support from Huawei. Senegal’s data came home, into infrastructure whose hardware, firmware and support depend on a foreign supplier and whose construction created a foreign debt. Nigeria and South Africa, discussed below, show versions of the same pattern with different suppliers.

The residency trap is not a reason to oppose localisation. Residency brings real benefits: lower latency, clearer legal jurisdiction, local jobs and a stronger case for local investment. It works when it is paired with the capacity to exit, meaning multiple competing providers, contractual data portability, local operators with genuine skills and open standards that allow workloads to move. It fails when it simply relocates a dependency onshore and relabels it sovereignty.

Figure 2. In 2026, African and European governments converged on sovereignty measures within months of each other. Source: Villpress Intelligence compilation from official statements and reporting cited in the source appendix.

Nigeria is legislating demand before it has built supply

No African country has moved as quickly on cloud sovereignty in 2026 as Nigeria, and no case shows the residency trap’s risks and opportunities more clearly.

The starting point is dependence. Kashifu Inuwa Abdullahi, director-general of the National Information Technology Development Agency (NITDA), has said that more than 85 per cent of Nigerian workloads now run on public clouds. According to the same reporting, Nigeria hosts only 22 per cent of its 1,000 most-visited websites locally, below the sub-Saharan African average of 34 per cent. Those figures come from the regulator and have not been independently verified here, but they describe a digital economy that runs substantially on infrastructure located, and billed, abroad.

85% Share of Nigerian workloads running on public clouds, according to NITDA’s director-general (August 2026). Most public cloud capacity serving Nigeria sits outside the country.

Three instruments in ten weeks

Nigeria’s response arrived in quick succession. On 15 June 2026, the Central Bank of Nigeria issued a circular requiring banks, mobile money operators, switching companies and other licensed payment operators to store and manage payment transaction data generated in Nigeria within the country from 1 January 2027. The same circular introduced market concentration caps and ultimate beneficial ownership disclosure.

On 5 August, NITDA signed the regulatory instruments of the National Sovereign Cloud Initiative with Galaxy Backbone, the government-owned ICT infrastructure provider. The instruments cover data classification, technical requirements for cloud providers, digital infrastructure assurance and a cloud investment strategy, and were developed through a working group that included both local operators and global cloud companies. Providers will need to meet defined standards to host certain categories of services.

On 17 August, the Ministry of Communications, Innovation and Digital Economy unveiled the National Digital Cloud Policy. It targets $250 million of private investment within twelve months and $750 million within twenty-four, makes cloud the default for federal agencies, and places regulation with NITDA, delivery with Galaxy Backbone and procurement compliance with the Bureau of Public Procurement. Crucially, the ministry says the policy keeps the cloud market open to domestic and international providers and does not impose general data localisation on commercial activity. Its residency requirements apply to defined categories of government and regulated data.

Read as a set, the design is more careful than headlines suggested. Nigeria is not trying to evict hyperscalers. It is trying to use government and financial-sector demand to pull capacity onshore and make the market large enough for local operators to compete. That is closer to India’s model than to Senegal’s.

The supply question

The difficulty is timing. The CBN gave the industry roughly six and a half months to comply. A Daily Trust editorial argued that the regulator had asked the industry to drive on roads not yet built, and pointed to a foreign central bank whose earlier localisation deadline did not hold. Local operators disagree: the chief executive of Open Access Data Centres told Vanguard that the necessary infrastructure is available.

Capacity data does not settle the argument, because sources disagree. Estate Intel’s Lagos pipeline report put installed data-centre capacity in Lagos at 78.6 megawatts, with more than 146 megawatts in the pipeline. TechCabal Insights, mapping individual facilities, counted about 50 megawatts of declared IT capacity across live colocation sites nationally, noting that several operators do not publish figures. The African Energy Chamber reported 17 facilities requiring about 137 megawatts of power in 2025. These measure different things (IT load, total power, declared versus designed capacity), and Villpress does not treat any one as definitive. What they agree on is that Nigeria’s installed base is small relative to the demand now being mandated into it, and that much of the new capacity belongs to foreign-owned operators.

That makes the domestic exceptions important. Kasi Cloud, backed by the Nigeria Sovereign Investment Authority, is building a $250 million campus in Lekki. Galaxy Backbone has begun offering startups in NITDA’s iHatch programme subsidised hosting on its own cloud platform, with post-subsidy billing in naira rather than dollars, which removes a currency risk that has pushed some startups to cut back or close. These are small relative to the market, but they are the parts of the stack Nigeria actually controls.

What Nigeria owns, and what it uses

Nigeria’s human-capital programme is large in ambition and early in outcomes. The 3 Million Technical Talent programme (3MTT) had seen more than 135,000 Nigerians complete training across three pilot cohorts, according to the minister, with about 1.8 million in the pipeline toward the three-million target. Training counts are inputs. Villpress found no published data on how many graduates hold technical jobs, build Nigerian products or operate Nigerian infrastructure, which are the outcomes that matter for sovereignty.

The country’s flagship AI project shows how layered ownership is. N-ATLAS, launched by the ministry in September 2025 with the Lagos startup Awarri and the National Centre for Artificial Intelligence and Robotics, is an open multilingual model covering Yoruba, Hausa, Igbo and Nigerian-accented English. Its language model is a fine-tuned version of Meta’s Llama-3 8B, and its speech component builds on OpenAI’s Whisper. Commercial deployments above 1,000 end-users require a separate licence. The Nigerian contribution, the data, the language work and the fine-tuning, is real and valuable. The foundation it stands on is licensed from a US company.

A smaller episode shows where value sits. In May 2024, Microsoft closed the engineering operation of its Africa Development Centre in Lagos, which had been set up to do high-end engineering work from Nigeria. The company said it would continue to operate in Nigeria, and its sales operation remained. The layer that left was the one that created intellectual property. The layer that stayed was the one that sells it.

South Africa has the continent’s deepest stack, and its sharpest warnings

South Africa is the most technologically developed country in this study. It has hyperscale cloud regions from Microsoft, Amazon and Google, the continent’s densest interconnection market, a national research network, a national supercomputing centre and strong universities. If any African country can bargain as a peer, it should be South Africa. The evidence suggests its binding constraint is not infrastructure but institutional capability.

From building a state cloud to buying one

The clearest signal is how its cloud policy changed. A 2021 draft proposed a new State Digital Infrastructure Company using spare state-owned fibre capacity and a High-Performance Computing and Data Processing Centre that would consolidate public data centres and sell cloud services across government. The final National Policy on Data and Cloud, gazetted on 31 May 2024, abandoned that ambition. It acknowledged that a single government-owned data centre may not be feasible, given funding constraints, specialised skills requirements and private-sector competition for talent. Instead, the State Information Technology Agency (SITA) is to source cloud services from private providers, set and monitor service-level agreements and develop standards. Government data relating to national security and sovereignty must be stored within South Africa’s borders.

That is a rational choice. It is also a shift from ownership to governance. Sovereignty now depends on SITA’s ability to negotiate, specify and enforce, a capacity law firms reviewing the policy identified as the determinant of whether it works.

Microsoft as infrastructure

Microsoft was the first hyperscaler to open data centres in South Africa, in March 2019. In March 2025 it announced a further R5.4 billion investment by the end of 2027, on top of R20.4 billion it says it invested over the previous three years. President Cyril Ramaphosa welcomed it as a vote of confidence. When asked about GPUs, the processors that power AI, Microsoft’s president Brad Smith said the company does not publish the numbers. South Africa’s most important commercial AI compute capacity is, in other words, undisclosed to the country that hosts it. That is not unusual for a private company. It is a structural fact for a country trying to plan its AI future.

Two warnings from 2026

The first warning came from the national supercomputer. Between May and June 2026, attackers gained access to Lengau, the decade-old system at the Centre for High Performance Computing, and deployed cryptocurrency-mining malware. The science minister told Parliament that ageing, technically constrained components made the breach possible and that the wider national cyberinfrastructure was not affected. A four-petaflop replacement is being commissioned in phases, with the first phase due by the end of November 2026 and completion by March 2027, supported by a ring-fenced R292 million budget for 2026/27. MyBroadband reported that components for the new system were already in the country but in storage. For scale, Switzerland’s Alps system, funded by the Swiss Confederation, ranked eighth in the world in June 2025 with measured performance of about 435 petaflops. The two figures are not perfectly comparable, because one is a theoretical peak and the other a benchmark result, but the difference is roughly two orders of magnitude.

The second warning came from the policy process itself. On 26 April 2026, communications minister Solly Malatsi withdrew South Africa’s draft national AI policy, approved by Cabinet the previous month, after it emerged that its reference list contained fictitious sources. He said the most plausible explanation was that AI-generated citations had been included without verification. The minister’s response was candid and swift, which counts in the department’s favour. But the episode is a precise illustration of the difference between adoption and capability: a state that uses AI tools without the institutional capacity to check them is not governing the technology. It is being governed by it.

South Africa lacks leading-edge semiconductor fabrication, as does every African country, and all AI accelerators in its data centres are imported. That constraint is shared globally by most countries and is unlikely to change within the timeframe of this report. The more tractable gaps are the ones 2026 exposed: maintenance of public research infrastructure, verification discipline and procurement capacity.

Kenya learned that sovereignty runs on electricity

In May 2024, during a state visit to Washington, President William Ruto announced that Microsoft and G42, the Abu Dhabi AI company, would build a $1 billion data centre powered by geothermal energy at Olkaria in the Rift Valley. It would host a new East Africa Azure cloud region, start at 100 megawatts and scale to 1,000 megawatts. It was presented as the largest private digital investment in Kenya’s history.

Two years later it is on pause. Government officials told Semafor that a concept note submitted to the National Treasury did not receive clearance, and that by August 2025 it was clear the facility would miss its May 2026 target. Reporting cited by Ubergizmo and others says negotiations stalled after Kenya declined Microsoft’s demand for guaranteed annual capacity payments. In May 2026 Ruto said powering the project at full scale would require switching off half the country. Kenya’s installed generation is roughly 3,000 to 3,200 megawatts, and national peak demand reached a record 2,444 megawatts in January 2026. Kenyan officials say the project has not been withdrawn.

Figure 3. At full build, one data centre would have required power equal to about a third of Kenya’s installed generation. Source: Presidential statements as reported by Semafor, ThinkGeoEnergy and Techish Kenya (May 2026); Datacenter Dynamics (July 2026).

The Kenyan episode is usually told as a failure. It is more usefully read as a negotiation in which Kenya, for once, held information that changed the terms. A hyperscale AI facility is not simply a building that arrives. It is a claim on national electricity, transmission and fiscal capacity. When the requested guarantees would have shifted risk to the Kenyan state, the Treasury declined. That was an exercise of sovereignty, even if it produced no data centre. The deeper lesson is that the scarce input for AI infrastructure in Africa is often not capital but firm, transmitted power, and whoever controls that input holds bargaining power.

Strategy written with others’ money, data labelled for others’ models

Kenya’s National AI Strategy 2025–2030, launched in March 2025, is built on three pillars: AI digital infrastructure, a data ecosystem, and research and innovation. It was produced with financial support from the European Union and Germany’s development ministry, implemented by GIZ. That is common and not in itself a problem, but it is a reminder that even the documents defining national technology priorities are often co-financed from abroad.

Kenya also illustrates where Africa sits in the AI value chain today. A 2023 TIME investigation found that Kenyan workers employed by Sama, a San Francisco-based outsourcing firm, labelled toxic content used to build a safety filter for ChatGPT for take-home pay of roughly $1.32 to $2 an hour. Kenyan labour contributed to one of the most valuable AI products in the world at the lowest-margin layer of its production. Kenya has a strong local ecosystem, anchored by Safaricom and a cluster of Nairobi data centres operated by Safaricom, iXAfrica and Digital Realty, with Airtel’s Nxtra building a 44-megawatt facility at Tatu City. This review did not find sufficient public evidence to assess Kenyan-language foundation models or national datasets in depth, and flags it as a question for a future edition.

Ghana is reclaiming control of its digital assets first

Ghana’s sovereignty agenda has begun with the assets most directly tied to national identity. The .gh country-code domain has been managed privately since 1996 by Ghana Dot Com, the company of internet pioneer Nii Narku Quaynor. The Ghana Domain Name Registry, a government body, had spent years seeking redelegation. In August 2025 communications minister Samuel Nartey George inaugurated a new registry board and called private management of the domain a national security risk. In January 2026 he announced that the root server would move to government control. A draft Ghana Domain Name Registry bill, consulted on in late 2025, would require entities operating in Ghana to maintain an active .gh domain for official websites.

Control over a country-code domain is meaningful: it governs the integrity of government web addresses and email, and the revenue from registrations. The proposed mandate to use .gh is more debatable, since it compels businesses to buy a product from a state registry that has yet to demonstrate service quality at scale. It is a sovereignty gain that also carries a compliance cost for firms.

Identity built by a private partner

The Ghana Card, the national biometric identity at the centre of the country’s digital public infrastructure, shows a subtler form of dependence. It was built under a fifteen-year public-private partnership between the National Identification Authority and Identity Management Systems, a subsidiary of the Ghanaian Margins Group. According to the authority, the state’s initial contribution was $124 million and the partner’s $169 million, with the partner recovering its investment from project revenues over the contract term. Commentators note that the arrangement includes revenue-sharing and exclusive infrastructure rights that any reform must work around. This is local ownership, not foreign ownership, but it is private ownership of a core state function under long-term exclusivity. Sovereignty questions do not only concern foreign firms.

Compute, announced

In April 2026 President John Dramani Mahama launched Ghana’s National AI Strategy for 2025–2035 and announced $250 million for a national AI computing centre, with a further $20 million for implementation. The One Million Coders programme, launched in 2025, had processed more than 100,000 applications and was targeting at least 300,000 trainees in 2026. The financing structure, ownership model, hardware supplier and timeline for the computing centre had not been published at the time of writing. Until they are, it should be treated as an intention.

Two African comparisons that sharpen the picture

Ethiopia: sovereignty built on an open commons

The strongest African example of controlled capability in this review comes from Ethiopia. Its Fayda national digital ID runs on MOSIP, the Modular Open Source Identity Platform, an open-source framework that originated at India’s IIIT Bangalore. Ethiopia’s national ID programme has said that using open technology is intended to avoid vendor lock-in. Enrolment rose from 16.4 million in June 2025 to 46.5 million by July 2026, with the programme targeting 90 million by 2027, and the system underpinned voter registration for the June 2026 election. In August 2026 the programme was converted into a public enterprise, FaydaVerse, which reports signed memoranda with twelve African counterparts and paying contracts so far with Ethiopia and Zambia.

Ethiopia did not build every component itself: biometric matching uses technology from TECH5, and the World Bank finances the programme. But because the platform is open, Ethiopia owns its deployment, can switch integrators and is now selling its implementation experience to other governments. That is the difference between installing technology and accumulating capability that can be exported.

Senegal: residency without control

Senegal, discussed earlier, is the counterpoint. Its data repatriation was real, but the infrastructure receiving the data was financed by Chinese debt and built with Huawei’s equipment and support. Residency improved. Dependence changed supplier.

Rwanda, Egypt, Mauritius and Tanzania were considered for this edition. The public evidence reviewed was not sufficient to make a comparison on the same six dimensions without speculation, so they are excluded here and flagged for future reports in this series.

Reading the six dimensions together

Villpress assesses technological sovereignty across six dimensions: software, infrastructure, data, human capital, institutional capability and economic value capture. The table below summarises the documented evidence for the four primary countries. It deliberately contains no scores or rankings. Each cell describes strengths, dependencies and gaps.

Table 2. Six dimensions of technological sovereignty: documented strengths, dependencies and gaps

Source: Villpress Intelligence qualitative assessment of documented evidence, September 2026. No scores or rankings are implied.

Three patterns emerge when the dimensions are read side by side. First, data rules are moving fastest in every country, because they are the cheapest instrument a government has: a regulation costs little to issue. Second, infrastructure is growing, but largely under foreign ownership or dependent on foreign announcements, and it is constrained everywhere by power. Third, institutional capability and value capture are the weakest and least measured dimensions in all four countries. Those are exactly the dimensions that determine whether a country can exit, renegotiate or govern what it hosts.

The economics of dependence: where the money goes

Every digital dependency is also a cash flow. A useful way to see the economics is to follow a single government workload through its layers. The chips come from the United States and East Asia. The servers are imported. The data-centre building may be owned by a US real estate trust or an Indian telecom group. The cloud platform and its margins belong to a hyperscaler. The productivity software and its annual licences belong to another US company. The AI model may be licensed from a third. What remains in the country is typically electricity purchases, construction, colocation rent paid to a local subsidiary, systems integration work, and the salaries of local staff.

That domestic share is not trivial, and localisation rules do increase it: the CBN directive, for instance, will move spending into local facilities and power contracts. But the highest-margin layers, software, platforms and intellectual property, remain offshore regardless of where the servers sit. This is why “local” and “sovereign” diverge in economic terms as well as legal ones.

The most striking finding in this area is an absence. Switzerland can say, approximately, what it pays Microsoft. None of the four African governments studied publishes a consolidated figure for public-sector spending on foreign cloud services and software licences. Without that number, a government cannot know its switching costs, cannot benchmark prices against peers and cannot negotiate as a single buyer. A country cannot bargain over a bill it has never totalled.

Switching costs are mostly human

The European cases show where switching costs actually sit. The software is often free or cheap. The costs are in migration, compatibility with specialist applications, training, support, and the political patience to absorb disruption. Munich’s reversal came from compatibility and organisational friction, not licence prices. Switzerland explicitly names know-how building as a condition of its programme. For African governments, which often rely on external consultants for core IT, this means the scarcest ingredient of an exit is a permanent cadre of public technologists who understand the systems they buy.

Currency is a further dimension specific to Africa. Most cloud and software contracts are priced in dollars. When local currencies fall, the cost of dependence rises without any change in usage. Galaxy Backbone’s decision to bill startups in naira after the subsidy period is a small but telling recognition that monetary sovereignty and digital sovereignty are connected.

The price of an exit

The global context is changing the value of an exit. Microsoft’s contractual commitment to contest orders to suspend its cloud services is scoped to Europe; this review did not identify a comparable published commitment for African public-sector customers. The United States has shown, in Brazil’s case, that it is prepared to treat a successful public alternative to US firms as an actionable trade practice. And AI has made the underlying dependencies deeper, because AI capability concentrates in a few companies that control models, chips and hyperscale compute together.

Villpress does not predict political outcomes. But the documented evidence supports four structural scenarios for the next five to ten years. They are possibilities, not forecasts.

In the first, onshore dependence, localisation rules succeed in moving data into the country, but into facilities and platforms owned and controlled abroad. Residency rises; bargaining power does not. This is the residency trap at national scale.

In the second, negotiated interdependence, governments aggregate demand, publish what they spend, require portability and open formats in contracts, certify multiple providers and pool procurement regionally. Foreign providers remain central but compete on terms African buyers set.

In the third, capability compounding, a few countries build open, reusable digital public infrastructure, as Ethiopia is doing with identity, and export it to neighbours, creating African-owned intellectual property and implementation expertise that grows with each deployment.

In the fourth, fragmented stall, power shortages, fiscal constraints and policy churn leave announced projects unbuilt, while each country pursues its own small sovereign cloud without the scale to sustain it.

These scenarios are not mutually exclusive. Most African countries will probably experience elements of several at once. The policy choices of the next three years will determine which dominates.

Implications for African businesses

For banks, fintechs, telecoms and enterprises, sovereignty rules are now a cost and an opportunity at once. The immediate task is architectural: classify workloads by regulatory sensitivity, and design hybrid systems in which regulated data sits onshore while less sensitive workloads remain on global platforms. Firms that treat Nigeria’s 2027 deadline as a one-off migration will pay twice; firms that build portability into their systems will be able to move again as rules and prices change.

Contracts matter as much as code. Businesses should insist on data export rights, open formats and exit assistance in every cloud and software agreement, and should price in currency risk explicitly. Local providers that can offer credible service levels, local-currency billing and regulatory certification have an opening in 2026 and 2027 that may not recur once the global providers complete their local build-outs.

Implications for governments

The first step is measurement. Governments should publish, at least annually, what public bodies spend on foreign cloud services, software licences and AI services, by supplier. That single act creates the basis for aggregated negotiation, price benchmarking and credible exit planning.

The second is to treat procurement as the main sovereignty instrument. The Swiss, French and Schleswig-Holstein cases all worked through defaults: mandated formats, certification standards, portability requirements and open-source publication of state-funded code. African governments can adopt these without building a single data centre. Pooling procurement regionally, through the African Union or regional economic communities, would add bargaining power no single mid-sized country has.

The third is to build and retain a permanent cadre of public technologists capable of specifying, auditing and operating what the state buys, and to fund the maintenance of public research infrastructure, not only its launch. South Africa’s supercomputer breach and its withdrawn AI policy both trace to this gap.

The fourth is to recognise power as digital infrastructure. AI and cloud strategies that are not integrated with electricity generation and transmission planning will produce announcements rather than capacity, as Kenya discovered.

Implications for investors

Sovereignty rules create regulated demand, and regulated demand is investable. Nigeria’s localisation directive guarantees a customer base for compliant local capacity; similar rules elsewhere would do the same. The attractive positions are likely to be those that sit where control is scarce: power supply for data centres, interconnection, local-currency cloud services, certification and compliance tooling, and systems integration for migrations.

The risks are equally specific. Deadlines may slip, as other localisation regimes have. Announced projects may not be built. Policies may change with ministers. And investors backing public alternatives to incumbent foreign platforms should note the Brazilian precedent: success can attract trade retaliation. Due diligence on African digital infrastructure should now include the grid, the regulator’s enforcement record and the geopolitical exposure of the business model.

Signals to watch

The following measurable developments would indicate whether African countries are genuinely increasing technological capability rather than only relocating dependence.

• Active versus announced capacity. Growth in operational data-centre megawatts, as tracked by the Africa Data Centres Association, relative to the announced pipeline.
• Ownership of new capacity. The share of new megawatts owned by African investors, sovereign funds or pan-African operators.
• Compliance with Nigeria’s 1 January 2027 deadline. Whether it holds, is extended or is enforced, and how many regulated firms migrate to locally owned facilities.
• Published public-sector technology spend. Whether any African government publishes consolidated spending on foreign cloud and software by supplier.
• Procurement rules with portability. The adoption of open-format mandates, data-export clauses and certification regimes in government technology tenders.
• Local compute that is disclosed. Publicly reported GPU capacity available to African researchers and startups, including the specifications and timeline of Ghana’s $250 million centre.
• Grid capacity for digital loads. New generation and transmission dedicated to data centres, and whether the Microsoft–G42 project in Kenya is restructured.
• Talent outcomes, not training counts. Employment and retention data for graduates of 3MTT and One Million Coders.
• Open-source contribution and reuse. Government code published openly, and the number of countries reusing African-built digital public infrastructure such as Fayda.
• Technology exports. Revenue from African digital infrastructure and services sold to other countries.

Questions Africa has not answered yet

1. Who, in each government, knows the total public-sector bill for foreign software, cloud and AI services, and why is that number not published?
2. If a major cloud provider suspended services to an African government tomorrow, which functions would stop, and how long would restoration take?
3. When data is localised into foreign-owned facilities, which jurisdiction’s law ultimately governs access to it?
4. Can African countries pool procurement across borders fast enough to matter, or will each negotiate alone with suppliers larger than its economy?
5. Who will generate and transmit the electricity that AI infrastructure requires, and at whose risk?
6. What share of the value created by Africans training, labelling and using AI systems returns to African firms and workers?
7. How many graduates of national skills programmes end up building and operating African infrastructure, rather than servicing foreign platforms remotely?
8. Should core state functions such as identity be operated under long-term exclusive private contracts, domestic or foreign?
9. How will African governments respond if a successful public digital alternative attracts trade retaliation, as Brazil’s did?
10. Which African institutions have the capacity to verify, audit and govern the AI systems their governments are beginning to use?

The terms of use

Africa will use foreign technology. That was never really the question, and the countries in this report are right not to pretend otherwise. Switzerland, one of the richest and most technically capable states in the world, still runs its administration on Microsoft 365 and will continue to do so. What it has decided is that it will not depend on Microsoft without also being able to leave.

The African question is the same question at a harder starting point. The continent is building data centres, writing localisation rules and announcing compute centres at an unprecedented pace. Those are necessary. But the evidence from 2026 is that the decisive capabilities lie elsewhere: in the electricity that powers the buildings, the public technologists who can specify and audit what the state buys, the published numbers that make negotiation possible, the open standards that make workloads movable, and the regional coalitions that give mid-sized states the weight of large ones.

The strategic question, then, is not whether Africa will use foreign technology. It is whether African countries will build enough infrastructure, talent, institutions, intellectual property, standards and bargaining power to set the terms on which that technology is used. A country that can set the terms can afford to depend on almost anyone. A country that cannot will find, sooner or later, that the terms are being set for it.

Source appendix

Sources are grouped by type. Publication dates are given where available; “n.d.” indicates an undated page. All links were accessed in September 2026.