Hans van Linschoten: Pass the washing test
The World Economic Forum has given buyers eight questions for spotting sovereignty-washing. A vendor that welcomes the checklist should be willing to answer it in public. We did.
A diagnosis that stops at the border of capacity
This month, the WEF’s Global Future Council on Data Frontiers published Data Sovereignty in Practice. It is a useful short text on the subject this year. It drops the question of where data sits and asks a harder one: does the party claiming authority over data actually hold the means to exercise it? That means the encryption keys, the audit logs, the compute, the update schedule and the right to leave. The paper’s central argument is that localisation alone cannot deliver sovereignty; sovereignty in practice requires alignment between legal authority and technical control across storage, compute, models and identity.
The paper is also candid about its limits. It takes a diagnostic rather than prescriptive approach, mapping the trade-offs between different forms of sovereignty rather than arguing that stronger data-protection law alone resolves them. For much of Africa, that distinction matters.
This column does two things with the paper. It places Africa on WEF’s own map. Then it takes WEF’s sovereignty-washing checklist and applies it to AfriQloud, the federated cloud we are building with partners across the continent. A vendor that cites the checklist without scoring itself is doing exactly what the checklist warns against.
Africa’s quadrant: rights without control
WEF plots authority against capability. Where both are high, sovereignty is credible. Where authority is high and capability low, the paper describes a situation in which rights may exist without the practical capability to exercise them. Where capability is high and authority low, control can exist without a corresponding mandate. The framework is intended to show trade-offs between different sovereignty positions rather than classify entire continents as occupying a single box.
Many African countries have legislated strongly on data protection. Egypt, Kenya, Nigeria, South Africa and Uganda all have national data-protection frameworks, and the AU’s Malabo Convention entered into force in 2023. Yet the existence of those laws does not by itself establish control over the infrastructure on which data and workloads run. The hyperscalers, meanwhile, can exercise substantial technical control over infrastructure, but that control is not the same thing as the legal or institutional authority claimed by a state, community or other sovereignty holder.
More law will not, by itself, move a country from rights without control to credible sovereignty. Capability will, and capability has to be operated by someone. Here WEF’s own framework has a revealing gap. It recognises multiple sovereignty claimants and layers, including governments, individuals, Indigenous groups, technology companies and regional blocs. Telecom operators are not identified as a distinct class.
In Africa that omission matters. Many operators own or control the fibre, connectivity and infrastructure relationships around the site, and they hold licences that regulators already know how to supervise. They are an actor that can sit naturally between state authority and technical capability. What they lack is often the cloud layer: the software, orchestration and federation that turn sites into a governable compute grid. That layer is what AfriQloud provides. Public AfriQloud material describes a federated network in which participating locations remain independently operated while sharing compatible cloud infrastructure, authentication, billing and automation.
Scoring ourselves: five by design, three not yet
Start with the obvious objection. whitesky.cloud, the platform beneath AfriQloud, is a Belgian company. A buyer in Kampala or Lagos is right to ask whether swapping an American hyperscaler for a European software vendor changes anything at all. whitesky.cloud publicly identifies its headquarters as being in Belgium.
Our answer is structural, not rhetorical. AfriQloud deploys through Build-Operate-Transfer with local country partners. The partner owns the site, the relationship with the regulator and, at transfer, the operation itself. Nor is the capability imported: the company says part of its team already works from within Africa, in Egypt, Uganda and Nigeria. The Belgian entity is where the software company is registered. It is not where the African cloud is run.
That is the claim. Here is how the company says it holds up against WEF’s eight tests.
| WEF test | How AfriQloud answers it | Status |
| No practical exit | Data, workloads and keys sit on in-country nodes run by the local partner. BOT goes further than exit: the operation itself transfers. | Pass by design |
| Compute and model control elsewhere | Compute is in-country. Open-weight models run on it, with weights under the customer’s control. | Pass, for open-weight models |
| Degraded service quality | One stack across Europe and Africa, so what is contracted can be measured. Per-site service levels still depend on local power and backhaul. | Partial |
| Opaque subcontractors | Hardware, including GPUs, is sourced globally. We can disclose that chain; no one in Africa or Europe can fully control it. | Partial |
| Vendor-controlled updates and continuity | Until transfer, platform releases originate with whitesky. Local partners share change control; the transfer ends the dependency. | Partial until transfer |
| Limited audit logs | Logs are held in-country and open to the operator and, where agreed, the regulator. | Pass by design |
| Illusory localisation | Localisation comes with a local operator, local law and local redress. | Pass, conditional on partner governance |
| Pricing penalties for localisation | In-country is the default, not a premium tier. There is no cross-border option to nudge customers toward. | Pass by design |
One caveat on the second row. A customer who runs sovereign infrastructure but calls a foreign proprietary model through an API has moved the problem, not solved it. No cloud, ours included, fixes that from below.
The three gaps, and why the answer is not 54 clouds
The three partial scores are not footnotes, so take them one at a time.
The supply chain will stay foreign. Nobody on the continent, or in Europe, fabricates frontier GPUs. Sovereignty here means disclosure and diversification, not self-sufficiency. That is consistent with WEF’s emphasis on trusted interdependence rather than digital isolation.
The update dependency is real until transfer. Today, a platform release still starts with engineers who are not employed by the local partner. The mitigation is shared change control during the operate phase, and a local team that already runs operations from Egypt, Uganda and Nigeria. The test of a transfer is simple: can the local team run the platform without us? If the answer is no, the transfer has not happened, whatever the contract says.
Service quality at the edge is uneven because power and backhaul are uneven. The honest response is to publish per-site service levels rather than a continental average that flatters the best sites.
On one point WEF’s paper supports the federated model more strongly than its authors may intend. It emphasises trusted interdependence and warns against treating sovereignty as isolation. Africa’s reflex answer to sovereignty is a national data centre per country. That can rebuild the over-provisioning problem up to 54 times, in the markets least able to pay for it.
Federation avoids that trade. Each country’s nodes stay under its own operator and its own law. Capacity can be shared across borders through wholesale agreements, much as mobile operators share networks through roaming. WEF notes that regional cooperation can increase leverage while raising questions about the balance between shared capacity and national control. Federation is the design that seeks to keep the first without surrendering the second.
WEF also recommends that organisations red-team their sovereignty: simulate a geopolitical blockade, a vendor outage or a unilateral administrative change, and see what survives. We would welcome partners and regulators running that exercise on us. Cut the link to Europe and see what keeps running.
What buyers should demand
WEF’s paper is deliberately diagnostic. It tells readers what to ask, not what to buy. For African ministries, banks, hospitals and universities, three demands follow from it.
First, put the eight tests in the tender and require written answers, scored per test, from every bidder. That includes hyperscalers, European vendors and us.
Second, ask for a transfer path, not only an exit clause. Exit protects you from a bad vendor. Transfer builds the capability that makes you a credible sovereign in the first place.
Third, run the stress test before signing, not after the first outage.
WEF closes on a line worth pinning above every procurement desk: what cannot be audited, measured or exited is not sovereignty but a promise. Africa has enough promises. It needs operated capability, and the discipline to verify it.
Hans van Linschoten is the CEO of whitesky.cloud, a European sovereign cloud platform, and Co-founder of AfriQloud, a pan-African sovereign cloud and edge AI infrastructure initiative.
Follow whitesky.cloud on LinkedIn
