Malta now needs a national strategy on digital and AI sovereignty.  The case for it has been made in two previous pieces in this series - the first on the infrastructure dimension, the second on artificial intelligence.  The premise that shaped Malta's digital architecture for two decades no longer holds.  The instruments of US state power are being applied to European allies in ways that were not contemplated when the original choices were made.  The European response is underway.  Malta should be part of it.  I want to set out what the framework should look like.

I propose six elements.  They are sequential where sequencing matters and parallel where it does not.  Together, they constitute a national strategy that can be costed, published, and measured.  AI is not simply another category of procurement to which the framework applies.  It is the deeper sovereignty layer set out in the second piece in this series.  The framework should treat it as such throughout.

The first element is an audit of public-sector exposure.  The government, working through the Malta Information Technology Agency as the central operator of the Government's digital estate, should map workload by workload where the public service depends on infrastructure, applications, and AI tools operated under non-European jurisdiction.  The audit should cover the civil service, the tax authority, health records, the courts, the schools, and the platforms used by the regulators.  It should distinguish between data residency, application hosting, platform substrate, and model operation.  Each carries different exposures.  MITA's existing hybrid platform is materially better than a full public cloud on data residency.  A US-incorporated provider supplies the platform substrate itself.  The audit should make that distinction visible.

The second element is a tiered risk approach by sovereignty-criticality.  Not every dependency is equally consequential.  Strategic communications sit at the top tier - the ICC case showed why.  Courts, tax, health, and citizen identity sit at the top tier as well, because their interruption would compromise the state's capacity to function.  AI tools deployed in citizen-facing decisions sit higher than those deployed in internal drafting.  The tiering establishes the order of work and identifies the systems for which alternatives must be sought first.

The third element is a procurement rule.  Above a defined threshold of strategic significance, every public-sector procurement of digital infrastructure or AI tools should be assessed against a jurisdictional test.  Under whose authority does this product operate?  What is the European alternative?  On what timetable can a switch be made if circumstances change?  Where no European alternative yet exists, the procurement should preserve the option to switch through data portability, model-agnostic deployment patterns, and contract terms that allow exit without rebuilding.

The fourth element is a coalition posture.  Malta should not act alone.  It does not need to.  The work of European digital sovereignty is being done in coalitions.  Schleswig-Holstein has done it on the infrastructure side.  Amsterdam is doing it on a longer timetable.  The Mistral-SAP partnership is doing it on the AI side, with French and German governments as anchor customers.  Malta should engage actively.  That engagement should include taking an active position in the EU Member States and the European Commission working groups, expert committees, and standard-setting bodies that are now defining the framework for European AI.  Not as a consumer of the rules that emerge.  As a contributor to them.  Small states gain disproportionately from being in the room when the architecture is being designed.

The fifth element is a costed and published transition horizon.  Decoupling from the European model is the work of a decade.  Schleswig-Holstein's Linux migration is targeted for 2028.  Amsterdam's transition is targeted for 2035.  Malta's horizon will reflect the size of its estate and the sequencing of its priorities.  It must be a horizon - a date by which named systems will sit on a different jurisdictional footing - and it must be public.  Progress can then be measured.  The political decision to begin cannot be quietly reversed.  For AI workloads specifically, the horizon should include a defined transition trigger.  A published threshold of European capability against which migration onto European alternatives will be committed in advance, rather than evaluated contract by contract.

The sixth element is human capability.  The hardest part of decoupling is not the technical migration.  It is the skills and institutional capacity to operate, maintain, and govern the alternative stack.  Schleswig-Holstein's experience, on the public reporting, is that the human transition has been more demanding than the technology change.  Malta will need to invest in the public-sector skills that allow it to assess, procure, and operate non-US digital and AI systems with confidence.  And in the academic and industry partnerships that will sustain that capability over the coming decade.  Strategic capacity does not emerge at the point of crisis.  It is built deliberately, over time.

These six elements are the operational answer to a strategic problem that is now visible at the scale of the EU.  Schleswig-Holstein and Amsterdam are making the infrastructure case.  The AI case is being made by Mistral, by SAP, and by the Franco-German axis at the Berlin summit.  The political decision in each case has preceded the technical work.  What has been required is not a new technology but the willingness to begin.

Malta now faces the same decision.  The US administration's use of hostile instruments against Europe has been both proactive and reactive.  They are deployed against European states that take positions Washington does not accept. Malta also takes positions in EU foreign policy. The same instruments are available.  Size is not exemption.  Malta's exposure is small in global terms.  It is disproportionate to its size.  Public administration in a small state runs on a smaller and more concentrated estate.

The second clock - decoupling - moves at Europe's pace.  Malta does not control it.  The first is Malta's begins now: the audit, the risk tiering, the procurement rule, the transition horizon, and the investment in capability.  And an active seat at the European tables - Commission working groups, Member State coalitions, standard-setting bodies - where the framework for European AI is being written.  The first Malta begins now.

David Spiteri Gingell is a Governance, Institutional, and Digital Transformation Consultant