Two of the largest AI companies outside the United States and China have signed a definitive business combination agreement, creating a vertically integrated enterprise AI stack that no layer of which falls under United States government data access authority. Canada’s Cohere and Germany’s Aleph Alpha announced the deal at the ALL IN 2026 conference in Montreal, pairing Cohere’s Command model family with Aleph Alpha’s PhariaAI orchestration platform and deploying both on STACKIT, a German sovereign cloud with no American parent company. The combined entity carries an enterprise valuation of approximately $20 billion.
Image credit: Cohere–Aleph Alpha business combination announcement, Tech Times, 17 September 2026. Source: Tech Times.
What the original report says
Tech Times reported on 17 September 2026 that Cohere and Aleph Alpha signed a definitive business combination agreement at the ALL IN 2026 conference in Montreal. The combined company, valued at about $20 billion, pairs Cohere’s Command models with Aleph Alpha’s PhariaAI enterprise orchestration platform, deployed on Schwarz Group’s STACKIT cloud, which has no United States parent and therefore sits outside the reach of the US CLOUD Act. Schwarz Group is leading Cohere’s Series E with roughly €500 million. The deal remains subject to regulatory approval in Canada and Germany, expected by the end of 2026. The report notes the sovereign cloud market reached $80 billion in 2026, growing 35.6 per cent year on year, according to Gartner.
THE SCENARIO: A bank’s risk committee meets on a Tuesday morning with a migration plan on the table. The institution has run its credit decisioning workload for two years on a United States hyperscaler, with data stored in a European region and a signed data residency agreement in the drawer. Counsel reports that a foreign production order served on the cloud provider’s parent company could compel access to that data, regardless of which region holds it. The committee has ninety days to decide whether the operational cost of moving is worth the legal exposure of staying. Nobody in the room built the model. Nobody in the room can switch it off. The question is whether that counts as a technology choice or an unmanaged dependency.
The Question
The question is not whether Cohere and Aleph Alpha can build a credible alternative to the American hyperscalers. The question is whether a regulated institution can now buy, at commercial scale, an AI stack in which the legal authority over its data, its models and its continuity sits in jurisdictions it can influence.
That question has been theoretical for three years. Enterprises have been told that data residency solved the sovereignty problem, that contract terms solved the jurisdiction problem, and that open weights solved the dependency problem. Each claim is partly true and dangerously incomplete on its own. Data residency answers where bytes are stored. It does not answer who can be compelled to hand them over. Contract terms bind the counterparty. They do not bind the counterparty’s government.
The Cohere–Aleph Alpha combination matters because it changes the shape of the answer rather than the strength of the promise. It offers a complete stack — model, orchestration, application, compute — in which no layer has an American parent company. That is a structural claim, not a marketing claim, and it can be audited.
For leaders, the practical issue is not whether to leave a hyperscaler. Most institutions will not, and should not. The practical issue is whether the board has priced the exit, documented the fallback, and tested that the fallback works. The deal in Montreal makes that question answerable for the first time in a way a procurement committee can actually score.
That matters because the market has moved faster than the governance. The sovereign cloud segment reached $80 billion in 2026, growing 35.6 per cent year on year, according to Gartner. Gartner also projects that 65 per cent of governments worldwide will introduce technology sovereignty requirements by 2028. Institutions that treat this as a vendor selection exercise will discover it is an institutional design exercise. The sovereignty test is whether the institution retains agency when the vendor relationship ends, whether that ending is chosen or imposed.
What Happened and Why It Matters
On Wednesday 16 September 2026, at the ALL IN 2026 conference in Montreal, Cohere and Aleph Alpha signed a definitive business combination agreement. Cohere holds approximately 90 per cent of the equity after the combination, with Aleph Alpha shareholders retaining approximately 10 per cent, reflecting the relative commercial scale of the two companies. Aidan Gomez remains chief executive. Aleph Alpha’s Ilhan Scheer becomes chief operating officer, and co-founder Samuel Weinbach becomes chief research officer, leading the Heidelberg research centre. The deal is subject to regulatory approval in Canada and Germany, which the companies expect by the end of 2026.
The financial architecture matters as much as the technology. Schwarz Group, the German retail conglomerate behind Lidl and Kaufland, is leading Cohere’s Series E with a commitment of roughly €500 million, and STACKIT sits at the centre of the new entity’s cloud infrastructure. The Globe and Mail reported on 11 September, citing four sources, that Cohere was in advanced talks to raise $2–3 billion in that round, with participation from the Canadian government and potentially the German government. The Canadian government has backed Cohere before, with a CA$240 million commitment in December 2024 through its Sovereign AI Compute Strategy.
The technical distinction that carries the whole deal is the CLOUD Act. The Clarifying Lawful Overseas Use of Data Act requires United States cloud providers to comply with government data requests for information stored anywhere in the world, including in European data centres. STACKIT has no United States parent company. Its infrastructure operates in its own data centres in Germany and Austria under German and European law. Customer data stored there sits outside that specific legal demand authority.
That is not a marginal difference in the market the combined company is chasing. Public sector, defence, finance, healthcare, energy and telecommunications buyers have been asking for exactly this distinction since the June 2026 Anthropic export control episode, when a letter from the United States Bureau of Industry and Security caused two frontier models to be disabled for every customer worldwide for close to three weeks. Any institution that had built a workflow on those models had no notice, no appeal and no local remedy. Data location would not have helped. The switch was thrown in Washington.
Two governments appeared on stage for the announcement, and that is not decoration. Canada’s Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, framed the choice bluntly: a country that does not build here must buy from someone else; a country that does not innovate here must rent from someone else; a country that does not make the rules here must follow someone else’s. Germany’s Federal Minister for Digital Transformation and Government Modernisation, Karsten Wildberger, argued that middle powers must convert anxiety into production capacity, warning that a contribution that is mainly philosophical will not hold a seat at the table.
The supporting evidence points the same way. Canada’s Mila research institute and the German Research Centre for Artificial Intelligence signed a cooperation agreement the same day, focused on safe AI systems in sectors such as energy. That matters because these are the institutions that train the evaluators, and evaluator capacity is a sovereignty asset in its own right. A jurisdiction that cannot independently test a model cannot independently govern it.
The competitive consequence lands first on Mistral, the French company that raised €3 billion in 2026 at a €21 billion valuation on a comparable sovereign positioning. Mistral has strong multilingual models and real regulated-sector traction. What it does not have is an equivalent to PhariaAI’s orchestration layer or to a sovereign cloud with no American parent and SEAL-3 certification under the EU Cloud Sovereignty Framework. The combined entity therefore competes less on benchmark scores and more on legal architecture — which is precisely the axis regulated buyers are now told to score.
The timing also sits inside a wider shift. A growing divide among leading AI companies over safety and release practice is translating into less predictable access for enterprise buyers, with vendors applying different release schedules, regional availability, access tiers and usage restrictions. Analysts now describe frontier models as a managed supply rather than a utility that simply shows up on schedule. When supply becomes managed, procurement becomes strategic, and continuity stops being an infrastructure question and becomes a governance one.
For leaders, the practical issue is that the deal changes what can be asked in a tender. A procurement team can now require, in writing, that no layer of the proposed stack carries exposure to a foreign access authority. Before this week that requirement had few compliant answers at enterprise scale. Now it has at least one, and that alone changes the negotiation.
Seven-Layer Stack Audit
The sovereignty test is not applied to a vendor. It is applied to a stack, layer by layer, because dependency accumulates unevenly and the weakest layer sets the institution’s exposure. Applying that audit to this news clarifies what the Cohere–Aleph Alpha combination does and does not solve.
The compute layer is where the deal is strongest on law and weakest on hardware. STACKIT provides infrastructure that operates under German and European law with no United States parent, which removes one specific legal exposure. It does not remove the silicon dependency. The chips running that compute are designed by American firms and, in most cases, fabricated in Taiwan. Legal sovereignty at the cloud layer coexists with material dependency at the semiconductor layer, and a board that conflates the two has not read the stack correctly.
The model layer is where the arithmetic is genuinely interesting. Cohere’s Command A family, its Aya Vision multilingual multimodal line and its Parse document intelligence model sit alongside Aleph Alpha’s Pharia family, trained on data in English, German, French, Spanish, Italian, Portuguese and Dutch. A unified Command–Pharia foundation model is planned for the fourth quarter of 2026. The strategic value is not that these models beat the frontier on benchmarks. The value is that the weights, the training pipeline and the operating entity sit in jurisdictions the buying institution can influence through ordinary political and contractual means.
The data layer is where most sovereignty programmes claim victory too early. Data residency satisfies regulators who ask where bytes rest. It does not answer who holds the keys, which jurisdictions the platform answers to, or what happens when a production order is served on a parent company in another country. A stack that is legally outside that demand authority closes the gap that residency agreements leave open. A stack that merely stores data in a local region does not.
The orchestration layer is the one procurement teams most often overlook, and it is the fastest-growing source of lock-in. Agent logic, workflow definitions, retrieval pipelines and tool integrations built inside a vendor’s proprietary environment are work that cannot be exported. PhariaAI’s value in this context is that it runs on-premises, in a private VPC or air-gapped, which means the orchestration artefact stays inside infrastructure the buyer controls rather than accumulating inside a vendor’s estate.
The governance evidence layer is where regulated institutions discover the true cost of leaving. Audit trails, compliance records and traceability history tied to one vendor’s model cannot be transferred; they must be reconstructed. PhariaAI’s source attribution and attention visualisation tools matter here because they generate evidence at the point of inference, in a form the buyer retains. For a regulated workload, that is the difference between a migration and a re-certification project with its own budget and calendar.
The application layer is where the human judgement sits, and no infrastructure decision substitutes for it. An institution can own every layer beneath and still deploy a system that makes unaccountable decisions. Sovereignty at this layer is a matter of approval rights, escalation paths, human-in-the-loop design for consequential outputs and the authority to refuse a deployment that cannot be explained to a supervisor or a court.
The talent layer ultimately determines whether any of the rest holds. A capability that no internal team can operate, tune, evaluate or audit is a rented capability, whatever the contract says. The bilateral research agreement between Mila and the German Research Centre for Artificial Intelligence points at the durable answer: evaluator capacity, model literacy and independent testing skill built inside the jurisdiction, so that sovereignty is exercised rather than merely declared.
The Sovereignty Risk
The sovereignty risk in this story is not that American technology is bad. It is that authority over continuity sits outside the institution’s reach, and that this condition was accepted as a technical default rather than decided as a governance choice.
The power shift is straightforward. When an enterprise runs its decisioning, its document intelligence or its customer operations on a model governed by another state’s law, three levers sit elsewhere. The vendor can change the model’s behaviour without notice, as happens when a foundation model is updated beneath an application. The vendor can withdraw or restrict the service, as happened in June 2026. The vendor’s government can compel access to data and, in defined circumstances, to model internals. Data residency agreements address none of these three levers, because they govern the storage of bytes rather than the authority over systems.
The dependency compounds in a way that is easy to misread. A single model choice looks reversible. The stack built on top of it is not. Prompt libraries, evaluation harnesses, retrieval pipelines, agent orchestration, audit history and the tacit knowledge of the team that assembled all of it are each individually survivable and collectively prohibitive. A real migration moves a working system onto a new substrate with controls and sign-offs intact. A rebuild starts from zero, with a new model, a new audit baseline and no transferable certification. For a regulated workload, that distinction is the difference between a project and a programme.
The accountability gap is the least discussed and most consequential. Boards sign off on AI deployments without a documented answer to who can switch the system off, on what notice, and what the fallback is. Concentration risk does not appear on the balance sheet because it is not a liability until it crystallises. When it crystallises, it arrives as an outage, a pricing shock or a regulatory order, and the institution discovers it has one option and no negotiating position. The South African governance commentary on AI lock-in makes this point sharply: the question is not where data is stored but who holds the power to switch off the model, the hardware it runs on, and the terms on which it may be used.
The institutional capability risk follows. An organisation that cannot evaluate a model cannot govern it. An organisation that cannot operate the orchestration layer cannot leave the vendor that supplies it. An organisation that keeps no independent record of how its AI reached a decision cannot defend that decision to a regulator, a court or a customer. Each of these is a capability deficit that no contract clause repairs, and each takes longer to build than the procurement cycle that created the exposure.
That matters because the regulatory direction is unambiguous. The European Commission’s AI Office enforcement powers over general-purpose AI models became applicable on 2 August 2026, and by 1 September 2026 the Commission had confirmed sending requests for information to more than 30 AI companies on safety and copyright grounds. Downstream providers now depend on the compliance of upstream model providers, which turns model documentation into a contracting and procurement issue. An institution that cannot obtain documentation, logging or transparency artefacts from its supplier cannot meet its own obligations, and no amount of internal policy fixes a supplier that will not cooperate.
The TEE Method Response
The TEE Method translates this story into three moves: Talent, Enterprise and Ecosystem. Each addresses a different failure mode, and the ordering matters because they reinforce one another.
Talent is the capability an institution must hold internally before any sovereignty claim is credible. In this context that means people who can evaluate a model against the institution’s own data rather than accepting a third-party badge, people who can operate and tune an orchestration layer, and people who can read a cloud contract for jurisdictional exposure rather than only for price. The Mila and German Research Centre for Artificial Intelligence agreement signals where this capacity is being built at scale, but institutions cannot outsource the internal version of it. A practical threshold: at least one named team must be able to run a substitution test on the institution’s own production workloads without vendor assistance.
Enterprise is the architectural and contractual work that turns intent into structure. That means separating business logic and application controls from the underlying model so that a model becomes a routable configuration rather than a structural dependency. It means keeping orchestration definitions, prompts, evaluation sets and audit records in formats the institution retains and can re-import elsewhere. It means contract terms that specify data and model export on reasonable notice, deprecation notice periods, pricing-change notice, termination-for-convenience rights, and disclosure of which foundation model sits beneath each vendor in the portfolio. Two vendors built on the same foundation model are one bet, not two.
Ecosystem is the part boards most often skip, and the part this news most directly changes. Sovereign capability is not built by a single institution acting alone; it is built through partnerships, standards bodies, research institutions and government procurement frameworks that create demand at a scale vendors respond to. The Cohere–Aleph Alpha combination is itself an ecosystem play: two mid-sized national champions, one national research partnership and two governments aligned on the same requirement. For an institution, participation means engaging the standards and procurement frameworks being written now rather than accepting terms written elsewhere. The alternative is to follow rules made by others, which is the condition Evan Solomon described in Montreal.
The sequence is deliberate. Talent without Enterprise produces analysis and no change. Enterprise without Talent produces contracts nobody can execute. Ecosystem without either produces announcements. What holds them together is the decision threshold: no new consequential AI workload enters production without a documented, tested exit path to a second environment the institution controls.
Sovereignty Test Matrix
The matrix below scores an institution’s position across five domains, each rated from one to five, where five represents genuine retained agency and one represents exposure that has not been examined. The test is applied to the institution’s live AI estate, not to its intentions. A score of three is not a failure; an unmeasured score is.
| Domain | Score 1–2: weak sovereignty signals | Score 4–5: stronger sovereignty signals |
|---|---|---|
| Political | No named owner for AI continuity risk at board level; jurisdiction exposure never documented; no response protocol for a foreign access order | Continuous risk ownership at board level; jurisdiction map covers every layer of the stack; a rehearsed response protocol exists |
| Economic | Pricing, entitlements and model access set unilaterally by the vendor; switching cost never modelled; exit priced at zero | Exit cost quantified and refreshed; multi-year price exposure modelled; second-supplier option maintained at real cost |
| Cultural | Staff knowledge of the platform is proprietary and vendor-specific; no internal evaluation practice; institutional reasoning undocumented | Team skills transferable across platforms; internal evaluation of models against own data is routine; decision reasoning recorded |
| Intellectual | IP, prompts, evaluation sets and retrieved knowledge live inside a vendor estate; no ownership over derived artefacts | The institution owns and holds its prompts, evaluation sets, embeddings and agent definitions in open, exportable formats |
| Technological | Single model, single provider, no routing layer; governance evidence produced only by the vendor | Model chosen at runtime through a portable routing layer; audit logs and compliance records held in institutional custody |
The pattern that emerges from most institutional assessments is consistent. Technological scores are usually higher than boards expect, because teams have already built abstraction layers. Political scores are consistently the lowest, because jurisdiction exposure is a legal question that nobody has been assigned to answer. That gap is where the news in this article becomes actionable.
What Leaders Should Do This Week
The actions below are scoped to be started within five working days and owned by a named function. None require a budget decision to begin, and none require a vendor conversation to complete.
First, chart the stack. Assign one person to produce a single page listing every AI model, platform, cloud region and orchestration tool in production use, with the operating entity and its jurisdiction for each. Most institutions discover between three and eight tools that procurement never formally approved. This page becomes the reference document for everything that follows.
Second, ask the jurisdiction question in writing. For each item on that page, require the vendor to disclose which legal regimes can compel access to data, logs or model internals, and whether an access order served on a parent company could reach the institution’s data. Vague reassurance is not an answer. A written statement of jurisdiction is.
Third, run one substitution test. Choose the two most consequential AI workloads and attempt to run them against a different model in a controlled environment. The objective is not to migrate but to discover what breaks: prompts, retrieval pipelines, evaluation baselines, integrations, output quality. A migration path that has never been executed is an assumption, not a plan.
Fourth, secure the evidence trail. Confirm that audit logs, evaluation records and compliance documentation are held in institutional custody in a portable format, not only inside a vendor console. Tie this to the regulatory reality: under the EU AI Act, downstream providers depend on upstream documentation, and an institution that cannot obtain it cannot demonstrate its own compliance.
Fifth, price the exit. Ask finance to produce a defensible estimate of what leaving each major AI supplier would cost in money, time and disruption, and put that number in the next risk report. The figure is not a commitment to leave. It is the only way a board can weigh continuity risk against vendor pricing power on equal terms.
Sixth, set the decision threshold. Adopt a standing rule that no new consequential AI workload enters production without a named fallback environment, a tested substitution path and a written jurisdiction statement. Apply it to the next procurement, including renewals, and record the exceptions rather than granting them silently.
Seventh, assign ecosystem participation. Nominate an owner for engagement with sector standards bodies, government procurement frameworks and research partnerships so that the institution shapes the requirements it will later have to meet. Sovereignty that is only defensive is temporary. Institutions writing the requirement today are the ones that will not have to comply with someone else’s tomorrow.
The Question Revisited
The question was whether a regulated institution can now buy, at commercial scale, an AI stack in which legal authority over its data, its models and its continuity sits in jurisdictions it can influence. On the evidence of this week, the answer is a qualified yes — and the qualification is where the work sits.
The qualification is that the stack exists and the capability does not, unless the institution builds it. A buyer can now purchase legal sovereignty at the cloud and model layers. That purchase is worthless without the internal capacity to evaluate models against its own data, to operate and leave an orchestration layer, and to produce governance evidence in its own custody. The stack answers a question about suppliers. The TEE Method answers a question about the institution.
Talent supplies the people who can test and refuse. Enterprise supplies the architecture and contracts that make leaving possible. Ecosystem supplies the standards and partnerships that make sovereignty durable rather than defensive. Applied together, they convert a vendor announcement into an institutional capability, and an institutional capability into negotiating position.
That matters because continuity risk does not wait for the assessment to finish. The lever that could have been thrown in another capital has been thrown before, and the institutions least affected were those that had already answered three questions: who can switch this off, what happens if they do, and what does it cost to be ready. Those questions are answerable this quarter. The threshold is straightforward, and it is the same threshold the sovereignty test has always set. No consequential AI workload should run without a tested path that does not depend on someone else’s permission.
Institutions that would rather map their own position against this framework before the next procurement cycle can begin with a structured advisory conversation.
[tt_consultation_booking]Editorial note: This is a news-led Sovereignty Briefing analysis produced with Hermes-assisted research and source checks.
Sources
Brandon Fisher, “Cohere-Aleph Alpha Merger Locks In First Enterprise AI Stack Outside US Cloud Law,” Tech Times, 17 September 2026. https://www.techtimes.com/articles/327652/20260917/cohere-aleph-alpha-merger-locks-first-enterprise-ai-stack-outside-us-cloud-law.htm
The Canadian Press, “Build data centres here or ‘rent’ from neighbours, AI minister says,” BNN Bloomberg, 16 September 2026. https://www.bnnbloomberg.ca/business/artificial-intelligence/2026/09/16/build-out-artificial-intelligence-here-or-rent-from-neighbours-ai-minister-says/
Martin Dippenaar, “South African boards are sleepwalking into AI lock-in,” TechCentral, 17 September 2026. https://techcentral.co.za/south-african-boards-sleepwalking-ai-lock-in/286204/
European Commission, “The enforcement framework of the AI Act,” Shaping Europe’s Digital Future, updated 24 August 2026. https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act
Allegiance Law, “EU AI Act enforcement has started: Commission sends first information requests to AI companies,” September 2026. https://allegiance.law/news/eu-ai-act-enforcement-has-started-commission-sends-first-information-requests-to-ai-companies/
Computerworld, “Big Tech’s AI safety rift signals disruption and disparity for enterprises,” 16 September 2026. https://www.computerworld.com/article/4222898/big-techs-ai-safety-rift-signals-disruption-and-disparity-for-enterprises.html
Featured image: Cohere–Aleph Alpha business combination, Tech Times, 17 September 2026. Source page.
This article draws on the TEE Method™ framework from SOVEREIGN: Who Owns the Future? For the complete framework, see tonishatagoe.com.
Sign in to save