This week, at EY Malta's Future Realised conference in Valletta, I had the opportunity to join the panel tackling one of the defining questions of the coming decade: sovereign AI, and who controls the data, the models and the decisions. It was a very interesting discussion, because Malta approaches this question with real advantages and every reason to aim high. Small countries have always prospered by choosing their partners wisely and investing in their people, and that is precisely the formula AI sovereignty calls for.

For me, AI sovereignty means effective control, whoever manufactures the chips or builds the models: the capacity to decide how AI is used in our economy and public services, to keep sensitive information secure, and to change course when a provider or system stops serving our interests. The key questions are who can access it, which laws apply to it, whether we hold the encryption keys, and whether we can audit, challenge, replace or walk away from a supplier. Europe is our ally here, giving a small country access to computing power and expertise it could never build alone.

Years ago, while studying transnational crime, I was struck by a lecturer's observation that information had become a strategic resource. AI makes that truer than ever. It can help us defend our systems, yet it also hands criminals and hostile actors new ways to deceive people and exploit weaknesses, from AI-driven impersonation and phishing to state-linked espionage that crosses borders with ease. ENISA's latest Threat Landscape found public administration to be the most targeted sector among the incidents it observed in 2025, at 32%. A threat launched in one country and routed through another can land on a Maltese hospital, bank or public authority.

Resilience therefore has to be practical. Mapping where AI is used in critical sectors, applying strong authentication and encryption, testing suppliers, training staff to spot deepfakes and fraudulent instructions, and rehearsing how essential services keep running when systems fail must be high on the national agenda and taken seriously. Neutrality is no barrier to cooperation, and we should make full use of ENISA, the CSIRTs Network and EU-CyCLONe for intelligence-sharing, joint investigations and common exercises. Cybersecurity means being able to detect an incident, respond to it and keep the country functioning.

The European Commission's 2026 Digital Decade report recognises Malta's strong connectivity and good digital public services, and in this year's EY survey, investors found Malta's telecommunications infrastructure as the most attractive element, topping taxation. That should be a platform for our next investment, but still no reason for declaring victory, because the same Commission report flags cybersecurity incidents, a shortage of ICT specialists, gaps in basic digital skills and SMEs struggling to adopt advanced technology. EY also found that 69% of investors struggled to find specialised skills locally.

21.5% of Maltese businesses used AI in 2025, just above the EU average of 20%, fair enough, but Denmark stands at 42%, and adoption only tells us how widespread use is; it tells us nothing about how much it has contributed to productivity and how much real value it has generated. The real test is whether our firms produce more value, build valuable expertise and compete successfully beyond our shores.

By 2030, the capability that will matter most will be people who can understand, develop, audit, secure and govern AI. Without them, no country, large or small, can exercise meaningful control over the technology it increasingly depends on. Our training programmes must now turn participation into specialist capability, stronger businesses and measurable results.