Latvia's new government has committed, in its declaration, to approve a National AI Strategy within 100 days. PPPA is contributing proposals to that strategy — and two of them point in directions that only appear to conflict.
One proposal calls for the technological independence of Latvia's AI capability. Another calls for public–private partnership as the fastest way to build that capability. Independence and partnership with outside providers sound opposed. They are not.
The reality is simple. Latvia needs serious AI compute capacity to deliver proactive public services — and it cannot build that capacity alone, on this timeline, from domestic resources. The compute will come, in large part, from firms headquartered outside the EU. The question is not whether to accept foreign infrastructure. It is whether Latvia governs the relationship or is captured by it.
Sovereignty is not about where the servers sit. It is the ability to understand, audit, and — if needed — exit the systems that make decisions in the state's name. That ability lives in contracts and architecture, not in borders. A locally owned but un-auditable, un-exitable system is less sovereign than foreign infrastructure governed by enforceable rights.
This applies to the tools Latvia's public sector already runs — Microsoft Copilot and the rest — as much as to anything new. Those tools work, and replacing what works for its own sake would be reckless. The point is not which vendor; it is that the same governance test should apply to incumbents and newcomers alike. A level field, where trust is earned by terms rather than by familiarity, strengthens the providers already here and disciplines the ones arriving.
So PPPA proposes a practical test. Any AI-infrastructure partnership in Latvia's public sector — current or future — should meet seven conditions. They are vendor-neutral and practical: each one is something a ministry, a procurement officer, or the AI Centre can verify for itself.
The 7 conditions
-
Condition 1
Data stays in jurisdiction
Public data and the processing of it remain in Latvian or EU jurisdiction. The provider's home-country legal exposures — including extraterritorial access laws — are disclosed and contractually mitigated up front, not buried under "sovereign" branding.
-
Condition 2
Audit is a right, not a courtesy
Latvian authorities and the accountable official can inspect, log, and reconstruct how any decision was reached — enforced technically, guaranteed contractually.
-
Condition 3
Open standards, no lock-in
Open APIs, standardised data structures, documented interfaces. Every proprietary format is a dependency, not a feature.
-
Condition 4
A tested exit path
Migration is specified, costed, and proven before signing. A partnership Latvia cannot leave is not a partnership — it is capture. Exit rights discipline every other term.
-
Condition 5
Proven in the sandbox first
The partnership is validated inside Latvia's regulatory sandbox (AI Sandbox), under the competent authorities, before any sector-wide rollout. Real workloads, real oversight — not slide decks.
-
Condition 6
A genuine public–private partnership, not a vendor contract
The relationship is structured as a PPP in the strategy's own sense: a Latvian partner carries the regulatory, legal, and operational know-how — translating AI Act and GDPR obligations and keeping the public interest in domestic hands — and both sides share responsibility for the result. Procurement buys a product; partnership shares the outcome.
-
Condition 7
Every deployment leaves Latvia more capable
Capability transfer is measurable and contractual: people trained, public data organised into reusable assets, open components Latvia keeps and reuses across institutions. The test is one question, asked every year — is Latvia more able to operate AI on its own, or more dependent on the provider? Dependence must fall over time, not deepen with each renewal.
A provider that meets these seven delivers compute Latvia could not otherwise build, while advancing the strategy's independence goals. A provider that cannot is selling dependence dressed as capability — wherever its servers happen to be.
Strategic opportunity
Why Latvia should be the EU's proving ground
There is a stronger move here than simply protecting Latvia. Latvia should offer to be the place where this standard is set.
Latvia is small, digitally ambitious, and sits on NATO's eastern flank, directly exposed to security pressure from across the Russian border. That combination is usually framed as vulnerability. It is also exactly what makes Latvia the right proving ground. A country that must take sovereignty and resilience seriously — because the stakes are immediate, not theoretical — has both the urgency and the credibility to test what trustworthy foreign AI infrastructure actually looks like under real conditions.
The sandbox principle Latvia already uses for AI systems can be extended one level up, to the infrastructure providers themselves. A foreign provider that can satisfy these seven conditions in Latvia — under genuine security and regulatory pressure — has proven something it can prove nowhere else in the EU. What passes the Latvian test can be trusted across the single market. That is a position of leadership, not dependence: Latvia setting the European benchmark for sovereign foreign-infrastructure partnerships, rather than waiting to inherit someone else's.
Implementation
Latvia is not starting from zero. The AI Sandbox gives a partner a supervised, low-risk first deployment. Process-as-Code, Records-as-Code, and Agreement-as-Code make any third-party system auditable and interoperable by design. The AI Act and GDPR supply the compliance frame. The one missing piece is a governance model for the infrastructure layer itself — which is exactly what these seven conditions provide.
The invitation
PPPA does not sell infrastructure and does not run procurement. Its role is the one a public–private partnership association exists for: to set the terms on which such partnerships can be trusted, and to bring the public and private sides together before commitments are made.
So PPPA invites both sides to engage as the National AI Strategy is written:
Sovereign compute for Latvia's public sector is achievable on this timeline. But only if it is governed from the first conversation.