Updated 10 October 2026, after reader feedback. Added a section on the data problem and the figures from the 2026 AI readiness index of the Institute of Public Administration.

The most sensitive AI in Europe’s public sector does not need gigawatt factories. It needs modest capacity under European control, and Bulgaria already has most of the pieces.

One of my previous articles left one point open. Under the Commission’s proposed Cloud and AI Development Act, AI factories that remain under non-EU ownership, in Bulgaria or in any other Member State, could host most of Europe’s public-sector work. They could not host the most sensitive part, such as public registers, health data, industrial data, and defence.

The debate about gigawatt-scale data centres rarely asks the obvious next question, which is how much capacity those sensitive areas need.

On an estimate built from public data, set out below, the answer is far smaller than the debate implies. A pooled AI assistant for the whole state administration would need tens to hundreds of GPUs rather than hundreds of thousands, and a fraction of a megawatt rather than gigawatts. That does not size every sensitive system a state runs, but it covers the office work that makes up most of the tier.

How that capacity is supplied is a separate decision, with one rule above all others. For the other 90% of public-sector work, cost and capability can decide. For this 10%, control decides first. Any route that leaves the model, its weights, or the machines it runs on under non-EU control is out, whatever it costs or however well it performs. The proposal allows one exception at the third level, where the Commission accepts a non-EU country’s safeguards. I would treat that as a concession, not a route. Within the rule, governments can run open-weight models, meaning models anyone can download and run, on European-controlled capacity. They can license proprietary models from European providers. They can let each public body make its own arrangements. Or they can keep the most sensitive work out of AI altogether. A combination is likely.

This article examines the open-weight route in most detail, because it shows that the sensitive tier may not require a factory. If so, controlling it becomes less a question of energy and investment than of procurement, governance, and use. Bulgaria serves as the worked example, because the figures are to hand, but the argument applies to every Member State.

What the sensitive tier is

The Cloud and AI Development Act, proposed on 3 June 2026 and still under negotiation, sorts cloud and AI services into four levels of sovereignty assurance, from the least to the most protected. Providers controlled from outside the EU can qualify for the first two. The third and fourth require a provider established in the EU and free of non-EU control, with a narrow possibility for the Commission to accept a non-EU country’s safeguards at the third level. The Commission’s impact assessment assumes that around 90% of public-sector use cases need Level 1 or 2, and around 10% Level 3 or 4.

That 10%, the use cases that need Level 3 or 4 under the proposed Cloud and AI Development Act, is what this article calls the sensitive tier. It is where the state handles information it cannot afford to expose, such as tax and social-security records, health data, judicial files, border and security information, and the internal deliberations of government. The proposal would also require each Member State to assess its sovereignty risks every two years, which means governments will have to say, in writing, which of their systems belong in that tier. For those systems, sovereignty is not one criterion among several. It is the entry condition.

The case for European control is not only legal, and it does not stop at the state. Christine Lagarde, President of the European Central Bank, put the economic argument in Vienna. Much of what a firm knows now lies in its data. A cloud only stores that data, but a model reads it, which puts the supplier of a model in a position to learn what an industry knows and to compete with it. According to Eurostat, almost half of the firms that considered AI and decided against it cited data-protection concerns. The proposal lets private operators of essential services in sectors such as energy, transport, banking, and health carry out the same assessments voluntarily, and allows the Commission to make them compulsory where it finds a need. Industry therefore has a sensitive tier of its own, which deserves separate treatment. This article concentrates on the public sector.

Running models, not training them

Much of the public discussion treats AI capacity as one thing. It is at least two. Training a frontier model takes vast, concentrated clusters of computers for months at a time. Running a model once it exists, known as inference, is what happens every time a civil servant asks a question, summarises a file, or searches a set of documents. McKinsey projects that inference will account for more than half of all AI computing by 2030, and notes that it is driving construction near cities, where fast connections matter, rather than in remote gigawatt campuses.

The sensitive tier is mostly a matter of inference. A tax authority does not need to train a new model. It needs to run a capable one on its own data, under its own control, and occasionally adapt it to its language and procedures. Christine Lagarde made the same point about the economy as a whole. In a world of many models, including open ones, a model a year behind the best will do the job for most of the economy. The public sector is perhaps the clearest example.

How much capacity

I have found no government that publishes the size of the infrastructure behind its public-sector AI service, so the figure below is an estimate from public inputs. The use case, an AI assistant for every civil servant, is deliberately broad and serves as an illustration; a real service would start narrower. It covers Bulgaria’s central and territorial administration, which the 2025 report on the state of the administration puts at roughly 133,000 staff in post, municipalities included, the Interior and Defence ministries excluded. The size of a real service depends less on headcount than on which processes it supports and how often they run. The scenarios below stand in for that inventory, which does not yet exist. The headcount runs from ministries to municipalities. The bodies that hold the most sensitive records, such as the National Revenue Agency, the National Social Security Institute, and the registers, are a small share of it, and they are where a real service would start.

Even on generous assumptions, serving that administration would take between a dozen and a few hundred GPUs, drawing about one megawatt at most, cooling included. The highest scenario is around a thousandth of the gigawatt-scale factories discussed in my previous article, and a small fraction of the 9.3 GW of grid connections that data-centre projects have applied for. The middle scenario is, by GPU count, two to four times the size of Discoverer+, the GPU section of the supercomputer already running at Sofia Tech Park.

Scenario Staff using AI daily Generated text per person per day GPUs, including a second site Power, including cooling
Low 25% about 5,000 tokens, roughly 4,000 words 12–23 0.02–0.04 MW
Middle 50% about 15,000 tokens, roughly 11,000 words 69–139 0.1–0.25 MW
High 75% about 40,000 tokens, roughly 30,000 words 278–555 0.5–0.95 MW

Scaled to the EU by population, a rough proxy, the high scenario comes to some 30 to 70 MW for the administrations of all Member States combined. That is less than half of one per cent of the 20 GW gap between EU data-centre demand and installed capacity that Christine Lagarde cites for 2036, and under 4% even if the estimate were out by a factor of ten. An assistant service for every administration in Europe would fit inside a single large data centre.

How the estimate was built

Users. Roughly 133,000 staff in post (145,623 posts, of which 12,348 vacant), per the 2025 report on the state of the administration.

Capacity. Published benchmarks show a single modern GPU serving a mid-sized open-weight model at roughly 1,500 to 3,000 tokens per second across many users at once, a token being about three-quarters of a word. The estimate assumes an eight-hour working day, peaks at twice the average, a 50% allowance for reading documents and search, and doubled capacity for a second site. The throughput figure is a scenario assumption drawn from two published benchmarks, not a measured rate. The GPU count covers generating text. Looking things up in registers and case files before the model answers, which engineers call retrieval, runs on ordinary servers and sits inside the 50% allowance for reading. The hard part of retrieval is the state of the records, not computing power.

Reality check. Neither OpenAI nor Anthropic publishes token use per person, but OpenAI’s own usage study reports that ChatGPT’s roughly 700 million weekly users send about 18 billion messages a week, around five per user per working day. At a few hundred words per reply, that is close to the low scenario; the middle and high scenarios allow for heavier document work, such as summarising files and drafting.

Limits. Usage per person is the least certain input. Larger models, or adding hospitals, courts, and the Interior and Defence ministries, would multiply the figure several times but leave it in single-digit megawatts. The estimate covers office work with text, not hospital, border, or defence systems, and it excludes training, which is occasional and could use European supercomputing capacity.

What open weights give, and what they do not

The models that make this feasible are published with open weights, meaning anyone can download them and run them on their own hardware. That gives a real form of resilience. Once downloaded, the weights cannot be taken back, and they can be adapted to a language or a field, as INSAIT, the Sofia-based Institute for Computer Science, Artificial Intelligence and Technology, has done with BgGPT.

Bulgaria already has a working case. In March 2026 the National Revenue Agency began rolling out BgGPT in its work, adapted to Bulgarian legal terminology and running on its own hardware, under its own control. After a pilot, the agency plans to integrate it into its internal processes with the state-owned IT company Information Services, with more than 7,000 staff expected to use it daily. It is the first Bulgarian administration to adopt BgGPT at scale, and it is a tax authority, exactly the kind of body the sensitive tier is about.

Open weights do not, however, guarantee independence. Three limits need stating.

The first is the licence. Open weights are not the same as open source. Some models come under permissive licences such as Apache 2.0, which place no restrictions on what the model may be used for. Others carry the publisher’s own terms. Google’s Gemma terms, which cover Gemma 3, the model BgGPT 3.0 is built on, reserve Google’s right to restrict any use it considers a breach. Meta’s Llama licence withholds its image-and-text models from individuals and companies in the EU, though not from end users of products built on them. Terms also change between generations. Google released Gemma 4 in April 2026 under the permissive Apache 2.0 licence, but BgGPT 3.0 stays bound by the older terms. A public administration should treat the licence as a procurement criterion in its own right.

The second is continuity. As Christine Lagarde noted, the best open models today are mostly Chinese. A laboratory can stop publishing new versions openly whenever it chooses, and licence terms can change with each release. A state that depends on a single publisher for its next generation has resilience today but limited autonomy tomorrow.

The third is hardware. Open models still run on chips that Europe does not make. That dependency applies equally to every other option, but it should be acknowledged. Who makes the chips is a different question from who controls the machines they sit in. The sensitive tier can insist on the second, not yet on the first.

Europe’s own supply of open models is growing but still thin. Mistral has released its recent models with open weights, and the EU-funded EuroLLM and OpenEuroLLM projects are building models that cover all official EU languages, but neither yet matches the largest open models from Chinese laboratories. That may be changing. On 6 October Mistral announced Mistral Large 4, trained in its own European data centres and covering every EU language, with benchmark claims that put it level with the largest Chinese models on some tasks. Its weights are promised for the end of the month and its licence is not yet published. The practical answer is therefore not to depend on any single model. Several permissively licensed ones, European ones among them, can sit behind one access point, as France’s Albert does, so that any one of them can be swapped out if its publisher changes course.

The Commission’s proposal, still being negotiated, already has most of the tools needed to make licence terms a condition of procurement. At the higher sovereignty levels, providers must list the software they depend on, have a plan to switch away from non-EU software if a supplier fails or is cut off, and show that it comes without unfair licence restrictions. The gap is that the proposal does not say whether an AI model counts as software for these purposes. One clarification would close it, that model weights and their licences fall under the same rules. Chips are a different matter. The sovereignty criteria leave them out, and no licence policy can fix that.

A working example: France’s Albert

Such a service is not hypothetical. France already operates one. Albert API, run by DINUM, the French state’s digital directorate, is a shared service that runs AI models for the whole public administration. It serves open-weight models, currently from Mistral and OpenAI’s open gpt-oss family, on infrastructure certified under SecNumCloud, France’s security standard for cloud hosting. Ministries build their own tools on top of it rather than each running its own AI infrastructure.

Two features of the French approach matter for Bulgaria. First, it is aimed squarely at the sensitive tier. DINUM states that Albert is meant mainly for contexts where the sovereignty of data and models is decisive, and that for non-sensitive data market tools already do the job. This is the same logic as the 90/10 split. Second, it is financed by pooling. In December 2025 DINUM asked other ministries to co-finance the infrastructure, because costs rise with the number of users and pooling spares each ministry a separate investment.

The software behind Albert, OpenGateLLM, is itself open source and maintained by the French state, which means another administration would not have to start from nothing.

Where it could run in Bulgaria

Bulgaria has four realistic options, and they are not mutually exclusive.

The first, and simplest, is for the state to buy and own the hardware, in its own data centres or in rented space. Bulgaria is not starting from zero. Its State Hybrid Private Cloud, run by the Ministry of e-Government across four data centres, already hosts systems of central and municipal administrations, and was upgraded with EU funds in 2024. The National Revenue Agency’s BgGPT deployment shows the approach works for a single agency. At the scale the estimate suggests, this is affordable. Hardware for the middle scenario would cost, on my rough estimate, a few million euros, and ownership gives the strongest control. The real cost lies elsewhere. The state has to run the service reliably, with skilled staff and round-the-clock support, which it already does for its cloud. GPUs age within three to five years and need a refresh budget. And an installation serving one administration risks being under-used, which is why France pools its service across ministries.

The second is the existing European computing stack at Sofia Tech Park. The Discoverer+ GPU section already operates, and BRAIN++, the AI factory backed by the EU’s supercomputing programme and developed with INSAIT, is meant to add a new supercomputer and services for public bodies. Ivan Vasilev, Minister of Innovation and Digital Transformation, put figures on it on 7 October: €90 million, around 700 GPUs, half of them for national projects, public or private. He expects even that to prove insufficient. For training and research he is probably right. For running a model for the administration, the national half alone is several times the middle scenario above. The same day he said the park’s supervisory board had been replaced in September over a lack of transparency about who had used its infrastructure, and why. That is the risk with this option, and the reason the service must be run as a service, with its use measured and published.

The third is a reserved, European-controlled share of any new capacity negotiated with investors. In my previous article, this appeared as one of the terms Bulgaria could seek. The estimate shows how modest that share would need to be, a fraction of a single hall in a gigawatt-scale site.

The fourth is joint procurement with other Member States, which the Commission’s preferred option in its impact assessment also supports. A smaller administration gains more from sharing a service than from building one alone, as the French co-financing model already shows within a single state.

Whichever route is chosen, the Bulgarian government has already pointed in a direction. At the informal meeting of EU finance ministers in Dublin that Kristalina Georgieva, Managing Director of the International Monetary Fund, addressed, Deputy Prime Minister and Finance Minister Galab Donev said that it is important for Bulgaria that scientific and computing capacity be accessible to more businesses and public administrations.

The AI-SAF reading

The AI Strategic Autonomy Framework that I am developing reads such choices along two axes. Resilience asks what still works if a supplier cuts off access. Autonomy asks who decides the technology path.

On that reading, an open-weight model on European-controlled capacity scores well on resilience. The weights stay and the service keeps running whatever a foreign supplier decides, so long as the licence allows the use. It scores only moderately on autonomy, because each new generation still depends on its publisher, and the chips on non-European makers. A portfolio of permissively licensed models, European ones included, with the domestic skill to adapt them, as INSAIT has shown with BgGPT, raises autonomy. The framework also separates capability from commitment. A working service with measured use counts. An announced platform does not.

The data problem

A model is only as useful as what it can read. For most of the sensitive tier the valuable work is not writing text but answering questions from the state’s own records, so the model has to look things up before it answers. That depends on the data, and the data are the weak point. The AI readiness index of the Institute of Public Administration, a survey of 5,475 civil servants run in June and July 2026, rates the administration at 49 out of 100, up from 45 a year earlier. The data indicators barely move within that. The share who say their institution’s data are structured and accessible is practically unchanged from 2025, when under three in ten said so, and the integration of systems, at 27.2%, is the lowest-rated item. The authors conclude that poorly managed data and limited integration may stop the administration moving from general language models for writing and search to AI for analysis, process support, and better services. Registers that disagree with each other, or hold errors, are not corrected by a model. They are copied by it, faster. A shared service therefore needs, alongside the GPUs, a plan to clean and connect the registers it draws on, process by process, starting with the two or three it serves first.

Back to adoption

Capacity alone does not make an administration use AI, and Bulgaria starts from a low base. In the same survey, 42.8% of civil servants say their institution does not use AI at all, and 3.4% report regular use, a share unchanged since 2025. Use by individuals runs ahead of use by institutions. Almost one in three, 29.8%, use a personal account with no institutional approval, against 4% with a licence their institution provides and 2.4% with a centrally deployed system. The authors call this bottom-up adoption, warn that official content may be entered into outside services with no risk assessment, and argue that the answer is not a ban but a permitted, visible, and secure channel. Among their priorities for the next stage is a national AI laboratory that gives every administration shared expertise and a protected place to test. That is a description of the service this article proposes. The National Revenue Agency’s rollout shows this can change quickly once a trusted tool exists. Kristalina Georgieva’s advice to EU finance ministers was that the state should lead by example, and she urged Europe to build digital public infrastructure. A shared, trusted service for sensitive work is exactly that. It lowers the barrier for each ministry and creates the domestic demand that European capacity needs, as Mario Draghi, former President of the European Central Bank and former Prime Minister of Italy, has argued.

What Bulgaria could do

  • A pooled inference service for the administration, built or procured on European-controlled capacity at the low scenario first, in place of separate arrangements in each ministry. The service comes before the inventory, because administrations that have never used AI cannot name the processes they would use it for.

  • Two or three anchor processes from bodies already moving, such as the National Revenue Agency, a public register, and one ministry, so that the service has real users from the first day rather than waiting for a study.

  • A model and licence policy for public use, with permissive licences for sensitive work, several models behind one access point, and a place for European models, including BgGPT.

  • A reserved Level 3 or 4 share of BRAIN++’s national half and of any capacity negotiated with investors, sized to actual need rather than to the headline figure, and linked to the existing stack at Sofia Tech Park.

  • Measurement of use rather than announcements, with regular publication of how many administrations use the service and for what. That record becomes the inventory of processes, and the basis for the next round of sizing and procurement.

The gigawatt debate is about Bulgaria’s economy and its grid, and it deserves to be had. The part of AI the state must control, the 10%, is a different matter. Sovereignty comes first there, and only then cost and capability. It is small. It can be built now with tools that already exist, namely open-weight models, the state cloud, the GPUs at Sofia Tech Park, and the open-source software behind France’s Albert. The hard part is not building it but putting it to use where it adds meaningful value.

Sources